Merge master into haskell-updates

maintainers/maintainer-list.nix

@@ -11745,12 +11745,6 @@
     githubId = 1729331;
     name = "Dominique Martinet";
   };
-  martingms = {
-    email = "martin@mg.am";
-    github = "martingms";
-    githubId = 458783;
-    name = "Martin Gammelsæter";
-  };
   martinjlowm = {
     email = "martin@martinjlowm.dk";
     github = "martinjlowm";

nixos/modules/programs/chromium.nix

@@ -23,7 +23,7 @@ in
 
       enablePlasmaBrowserIntegration = mkEnableOption (lib.mdDoc "Native Messaging Host for Plasma Browser Integration");
 
-      plasmaBrowserIntegrationPackage = mkPackageOption pkgs "plasma5Packages.plasma-browser-integration" { };
+      plasmaBrowserIntegrationPackage = mkPackageOption pkgs [ "plasma5Packages" "plasma-browser-integration" ] { };
 
       extensions = mkOption {
         type = with types; nullOr (listOf str);

nixos/modules/services/hardware/brltty.nix

@@ -34,6 +34,7 @@ in {
     users.users.brltty = {
       description = "BRLTTY daemon user";
       group = "brltty";
+      isSystemUser = true;
     };
     users.groups = {
       brltty = { };

nixos/modules/services/hardware/undervolt.nix

@@ -12,6 +12,7 @@ let
     inherit (cfg)
       verbose
       temp
+      turbo
       ;
     # `core` and `cache` are both intentionally set to `cfg.coreOffset` as according to the undervolt docs:
     #
@@ -105,6 +106,14 @@ in
       '';
     };
 
+    turbo = mkOption {
+      type = types.nullOr types.int;
+      default = null;
+      description = lib.mdDoc ''
+        Changes the Intel Turbo feature status (1 is disabled and 0 is enabled).
+      '';
+    };
+
     p1.limit = mkOption {
       type = with types; nullOr int;
       default = null;

nixos/modules/services/mail/stalwart-mail.nix

@@ -32,10 +32,15 @@ in {
       global.tracing.level = mkDefault "info";
       queue.path = mkDefault "${dataDir}/queue";
       report.path = mkDefault "${dataDir}/reports";
+      store.db.type = mkDefault "sqlite";
       store.db.path = mkDefault "${dataDir}/data/index.sqlite3";
-      store.blob.type = mkDefault "local";
+      store.blob.type = mkDefault "fs";
-      store.blob.local.path = mkDefault "${dataDir}/data/blobs";
+      store.blob.path = mkDefault "${dataDir}/data/blobs";
+      storage.data = mkDefault "db";
+      storage.fts = mkDefault "db";
+      storage.blob = mkDefault "blob";
       resolver.type = mkDefault "system";
+      resolver.public-suffix = mkDefault ["https://publicsuffix.org/list/public_suffix_list.dat"];
     };
 
     systemd.services.stalwart-mail = {
@@ -57,8 +62,8 @@ in {
         KillSignal = "SIGINT";
         Restart = "on-failure";
         RestartSec = 5;
-        StandardOutput = "syslog";
+        StandardOutput = "journal";
-        StandardError = "syslog";
+        StandardError = "journal";
         SyslogIdentifier = "stalwart-mail";
 
         DynamicUser = true;

nixos/modules/services/networking/hostapd.nix

@@ -909,7 +909,7 @@ in {
                 in {
                   settings = {
                     ssid = bssCfg.ssid;
-                    utf8_ssid = bssCfg.ssid;
+                    utf8_ssid = bssCfg.utf8Ssid;
 
                     logger_syslog = mkDefault (-1);
                     logger_syslog_level = bssCfg.logLevel;

nixos/modules/services/networking/libreswan.nix

@@ -133,9 +133,6 @@ in
       "ipsec.d/01-nixos.conf".source = configFile;
     } // policyFiles;
 
-    # Create NSS database directory
-    systemd.tmpfiles.rules = [ "d /var/lib/ipsec/nss 755 root root -" ];
-
     systemd.services.ipsec = {
       description = "Internet Key Exchange (IKE) Protocol Daemon for IPsec";
       wantedBy = [ "multi-user.target" ];
@@ -153,6 +150,10 @@ in
         echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects
         echo 0 | tee /proc/sys/net/ipv{4,6}/conf/*/accept_redirects
       '';
+      serviceConfig = {
+        StateDirectory = "ipsec/nss";
+        StateDirectoryMode = 0700;
+      };
     };
 
   };

nixos/modules/services/web-servers/garage.nix

@@ -30,7 +30,7 @@ in
     };
 
     logLevel = mkOption {
-      type = types.enum ([ "info" "debug" "trace" ]);
+      type = types.enum ([ "error" "warn" "info" "debug" "trace" ]);
       default = "info";
       example = "debug";
       description = lib.mdDoc "Garage log level, see <https://garagehq.deuxfleurs.fr/documentation/quick-start/#launching-the-garage-server> for examples.";

nixos/modules/services/x11/window-managers/icewm.nix

@@ -17,7 +17,7 @@ in
       { name = "icewm";
         start =
           ''
-            ${pkgs.icewm}/bin/icewm &
+            ${pkgs.icewm}/bin/icewm-session &
             waitPID=$!
           '';
       };

nixos/modules/system/boot/stage-1.nix

@@ -621,6 +621,11 @@ in
             path the secret should have inside the initrd, the value
             is the path it should be copied from (or null for the same
             path inside and out).
+
+            Note that `nixos-rebuild switch` will generate the initrd
+            also for past generations, so if secrets are moved or deleted
+            you will also have to garbage collect the generations that
+            use those secrets.
           '';
         example = literalExpression
           ''

nixos/tests/docker-tools.nix

@@ -71,14 +71,29 @@ in {
             docker.succeed("${examples.helloOnRoot} | docker load")
             docker.succeed("docker run --rm hello | grep -i hello")
             docker.succeed("docker image rm hello:latest")
+
         with subtest("includeStorePath = false; breaks example"):
             docker.succeed("${examples.helloOnRootNoStore} | docker load")
             docker.fail("docker run --rm hello | grep -i hello")
             docker.succeed("docker image rm hello:latest")
+        with subtest("includeStorePath = false; breaks example (fakechroot)"):
+            docker.succeed("${examples.helloOnRootNoStoreFakechroot} | docker load")
+            docker.fail("docker run --rm hello | grep -i hello")
+            docker.succeed("docker image rm hello:latest")
+
+        with subtest("Ensure ZERO paths are added to the store"):
+            docker.fail("${examples.helloOnRootNoStore} | ${pkgs.crane}/bin/crane export - - | tar t | grep 'nix/store/'")
+        with subtest("Ensure ZERO paths are added to the store (fakechroot)"):
+            docker.fail("${examples.helloOnRootNoStoreFakechroot} | ${pkgs.crane}/bin/crane export - - | tar t | grep 'nix/store/'")
+
         with subtest("includeStorePath = false; works with mounted store"):
             docker.succeed("${examples.helloOnRootNoStore} | docker load")
             docker.succeed("docker run --rm --volume ${builtins.storeDir}:${builtins.storeDir}:ro hello | grep -i hello")
             docker.succeed("docker image rm hello:latest")
+        with subtest("includeStorePath = false; works with mounted store (fakechroot)"):
+            docker.succeed("${examples.helloOnRootNoStoreFakechroot} | docker load")
+            docker.succeed("docker run --rm --volume ${builtins.storeDir}:${builtins.storeDir}:ro hello | grep -i hello")
+            docker.succeed("docker image rm hello:latest")
 
     with subtest("Ensure Docker images use a stable date by default"):
         docker.succeed(

nixos/tests/stalwart-mail.nix

@@ -42,20 +42,22 @@ in import ./make-test-python.nix ({ lib, ... }: {
 
         session.auth.mechanisms = [ "PLAIN" ];
         session.auth.directory = "in-memory";
-        jmap.directory = "in-memory";  # shared with imap
+        storage.directory = "in-memory";  # shared with imap
 
         session.rcpt.directory = "in-memory";
         queue.outbound.next-hop = [ "local" ];
 
         directory."in-memory" = {
           type = "memory";
-          users = [
+          principals = [
             {
+              type = "individual";
               name = "alice";
               secret = "foobar";
               email = [ "alice@${domain}" ];
             }
             {
+              type = "individual";
               name = "bob";
               secret = "foobar";
               email = [ "bob@${domain}" ];
@@ -90,8 +92,9 @@ in import ./make-test-python.nix ({ lib, ... }: {
 
         with IMAP4('localhost') as imap:
             imap.starttls()
-            imap.login('bob', 'foobar')
+            status, [caps] = imap.login('bob', 'foobar')
-            imap.select('"All Mail"')
+            assert status == 'OK'
+            imap.select()
             status, [ref] = imap.search(None, 'ALL')
             assert status == 'OK'
             [msgId] = ref.split()

pkgs/applications/audio/ledfx/default.nix

@@ -5,12 +5,12 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "ledfx";
-  version = "2.0.92";
+  version = "2.0.93";
-  pyproject= true;
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tt2D8pjU/SClweAn9vHYl+H1POdB1u2SQfrnZZvBQ7I=";
+    hash = "sha256-A34GY7uhkHcrofjeFzK3l/Uzr+aoQQ5JERK+HUhoosM=";
   };
 
   pythonRelaxDeps = true;

pkgs/applications/audio/mopidy/spotify.nix

@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "mopidy-spotify";
-  version = "unstable-2024-01-02";
+  version = "unstable-2024-02-11";
 
   src = fetchFromGitHub {
     owner = "mopidy";
     repo = "mopidy-spotify";
-    rev = "ede555c4c6e5f198659a979b85c69294d148c8f3";
+    rev = "fc6ffb3bbbae9224316e2a888db08ef56608966a";
-    hash = "sha256-G2SPzMAfJK3mOUJ+odmaugMoAyIAU1J6OXk25J/oXI0=";
+    hash = "sha256-V1SW8OyuBKLbUoQ4O5iiS4mq3MOXidcVKpiw125vxjQ=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/audio/mympd/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "14.0.1";
+  version = "14.0.2";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-wgrTkUpWx7YG8V9nyr+RHDBOz1TFA0p2OWDXG64BVjs=";
+    sha256 = "sha256-tyNX/bPKg4aWDnSrzymdcz5ZbTlyowuoizm6kQngHj8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/soundux/default.nix

@@ -1,144 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, makeBinaryWrapper
-, pipewire
-, libpulseaudio
-, libappindicator
-, libstartup_notification
-, openssl
-, libwnck
-, pcre
-, util-linux
-, libselinux
-, libsepol
-, libthai
-, libdatrie
-, xorg
-, libxkbcommon
-, libepoxy
-, dbus
-, at-spi2-core
-, nlohmann_json
-, fancypp
-, httplib
-, semver-cpp
-, webkitgtk
-, yt-dlp
-, ffmpeg
-, lsb-release
-}:
-
-stdenv.mkDerivation rec {
-  pname = "soundux";
-  version = "0.2.7";
-
-  src = fetchFromGitHub {
-    owner = "Soundux";
-    repo = "Soundux";
-    rev = version;
-    sha256 = "sha256-aSCsg6nJt6F+6O7UeXnvYva0vllTfsxK/cjaeOhObZY=";
-    fetchSubmodules = true;
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    makeBinaryWrapper
-  ];
-
-  buildInputs = [
-    pipewire
-    libpulseaudio
-    libappindicator
-    openssl
-    libwnck
-    pcre
-    util-linux
-    libselinux
-    libsepol
-    libthai
-    libdatrie
-    xorg.libXdmcp
-    xorg.libXtst
-    xorg.libXres
-    libxkbcommon
-    libepoxy
-    dbus
-    at-spi2-core
-    nlohmann_json
-    fancypp
-    httplib
-    semver-cpp
-    libstartup_notification
-    webkitgtk
-    yt-dlp
-    ffmpeg
-  ];
-
-  postPatch = ''
-    # cannot be overwritten with variables
-    substituteInPlace CMakeLists.txt \
-      --replace "set(CMAKE_INSTALL_PREFIX \"/opt/soundux\" CACHE PATH \"Install path prefix, prepended onto install directories.\" FORCE)" "" \
-      --replace "/usr/share" "$out/usr/share"
-    substituteInPlace src/ui/impl/webview/webview.cpp \
-      --replace "/usr/share/pixmaps/soundux.png" "$out/share/pixmaps/soundux.png"
-  '';
-
-  # We need to append /opt to our CMAKE_INSTALL_PREFIX
-  dontAddPrefix = true;
-
-  preConfigure = ''
-    # This needs to be set in preConfigure to access the $prefix variable
-    export cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix/opt $cmakeFlags"
-
-    # Replace some fetched submodules with symlinks nix packages.
-    rm -rf \
-      lib/json \
-      lib/fancypp \
-      lib/lib-httplib \
-      lib/semver
-
-    ln -s ${nlohmann_json} lib/json
-    ln -s ${fancypp} lib/fancypp
-    ln -s ${httplib} lib/lib-httplib
-    ln -s ${semver-cpp} lib/semver
-  '';
-
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
-
-  # Somehow some of the install destination paths in the build system still
-  # gets transformed to point to /var/empty/share, even though they are at least
-  # relative to the nix output directory with our earlier patching.
-  postInstall = ''
-    mv "$out/var/empty/share" "$out"
-    rm -rf "$out/var"
-    mkdir "$out/bin"
-    ln -s "$out/opt/soundux" "$out/bin"
-    substituteInPlace "$out/share/applications/soundux.desktop" \
-      --replace "/opt/soundux/soundux" "soundux"
-  '';
-
-  postFixup = let
-    rpaths = lib.makeLibraryPath [libwnck pipewire libpulseaudio];
-  in ''
-    # Wnck, PipeWire, and PulseAudio are dlopen-ed by Soundux, so they do
-    # not end up on the RPATH during the build process.
-    patchelf --add-rpath "${rpaths}" "$out/opt/soundux-${version}"
-
-    # Work around upstream bug https://github.com/Soundux/Soundux/issues/435
-    wrapProgram "$out/bin/soundux" \
-      --set WEBKIT_DISABLE_COMPOSITING_MODE 1 \
-      --prefix PATH : ${lib.makeBinPath [ yt-dlp ffmpeg lsb-release ]} \
-  '';
-
-  meta = with lib; {
-    description = "A cross-platform soundboard.";
-    homepage = "https://soundux.rocks/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ aidalgol ];
-  };
-}

pkgs/applications/audio/zrythm/default.nix

@@ -2,6 +2,7 @@
 , lib
 , fetchFromGitHub
 , fetchFromSourcehut
+, fetchpatch
 , SDL2
 , alsa-lib
 , appstream
@@ -170,6 +171,15 @@ stdenv.mkDerivation rec {
     zstd
   ];
 
+  patches = [
+    # Fix gcc-13 build failure
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://gitlab.zrythm.org/zrythm/zrythm/-/commit/cbc2b3715b939718479631841f2d9703fb28e6da.diff";
+      hash = "sha256-2ZTSaCtSO3yynJVFe5B1AEjWhjRa5YyA26ergAfdL5Y=";
+    })
+  ];
+
   # Zrythm uses meson to build, but requires cmake for dependency detection.
   dontUseCmakeConfigure = true;
 

pkgs/applications/editors/texworks/0001-fix-build-with-qt-6.5.patch

@@ -1,26 +0,0 @@
-From b26a91fd0f70e8f0a8f3360a5f371a1eace70002 Mon Sep 17 00:00:00 2001
-From: Nick Cao <nickcao@nichi.co>
-Date: Sun, 16 Apr 2023 22:10:55 +0800
-Subject: [PATCH] fix build with qt 6.5
-
-The fix is borrowed from https://github.com/hluk/CopyQ/pull/2324
----
- src/scripting/Script.cpp | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/scripting/Script.cpp b/src/scripting/Script.cpp
-index 3437f125..906eefde 100644
---- a/src/scripting/Script.cpp
-+++ b/src/scripting/Script.cpp
-@@ -352,7 +352,7 @@ Script::MethodResult Script::doCallMethod(QObject * obj, const QString& name,
- 		}
- 		else if (typeName == QString::fromLatin1("QVariant")) {
- 			// QMetaType can't construct QVariant objects
--			retValArg = Q_RETURN_ARG(QVariant, result);
-+			retValArg = QGenericReturnArgument("QVariant", static_cast<void*>(result.data()));
- 		}
- 		else {
- 			// Note: These two lines are a hack!
--- 
-2.39.2
-

pkgs/applications/editors/texworks/default.nix

@@ -14,17 +14,15 @@
 
 stdenv.mkDerivation rec {
   pname = "texworks";
-  version = "0.6.8";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "TeXworks";
     repo = "texworks";
     rev = "release-${version}";
-    sha256 = "sha256-X0VuXNghHoNsNNDfZJXXJ++nfUa5ofjW8rv3CHOUzxQ=";
+    sha256 = "sha256-G8TVTVQPELyE6H9a6gWSyWHi653TWzUoaRdlfPnngM0=";
   };
 
-  patches = [ ./0001-fix-build-with-qt-6.5.patch ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/applications/editors/vscode/extensions/default.nix

@@ -757,7 +757,7 @@ let
           name = "ruff";
           publisher = "charliermarsh";
           version = "2023.60.0";
-          sha256 = "sha256-zxE4QcWt8M6djTbdIf0YNSpeF1w7vMK4/BW5ArCOYbE=";
+          sha256 = "sha256-qgwud2gzHLHID45VxDlngFMoks5O3pTHQe+Q7bdf8+I=";
         };
         meta = {
           license = lib.licenses.mit;

pkgs/applications/file-managers/browsr/default.nix

@@ -6,20 +6,19 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "browsr";
-  version = "1.17.1";
+  version = "1.18.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "juftin";
     repo = "browsr";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    hash = "sha256-FExDKugFP94C3zMnR1V4QDPWeM2OtRH2ei0LNs3h06c=";
+    hash = "sha256-Ygqoz1rNQwhU1/8NsHwQsSCqQ8gYwHEaAuIaVMCtKKA=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
     hatchling
     pythonRelaxDepsHook
-    pytestCheckHook
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -48,18 +47,31 @@ python3.pkgs.buildPythonApplication rec {
     ];
   };
 
+  nativeCheckInputs = with python3.pkgs; [
+    pytest-textual-snapshot
+    pytestCheckHook
+  ];
+
   pythonRelaxDeps = [
     "art"
     "pandas"
     "pymupdf"
     "rich-click"
+    "rich-pixels"
+    "rich"
     "textual"
   ];
 
-  pythonImportsCheck = [ "browsr" ];
+  pythonImportsCheck = [
+    "browsr"
+  ];
+
+  pytestFlagsArray = [
+    "--snapshot-update"
+  ];
 
-  # requires internet access
   disabledTests = [
+    # Tests require internet access
     "test_github_screenshot"
     "test_github_screenshot_license"
     "test_textual_app_context_path_github"

pkgs/applications/file-managers/clifm/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clifm";
-  version = "1.16";
+  version = "1.17";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tjxsJv5w0Rvk2XYisncytcRdZLRnOSDJmNJN4kkzr7U=";
+    hash = "sha256-plJ2iKloRGtBSa1upSo675bMj6qczR6TQ043UQboxQE=";
   };
 
   buildInputs = [ libcap acl file readline python3];

pkgs/applications/graphics/icon-library/default.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "icon-library";
-  version = "0.0.17";
+  version = "0.0.18";
 
   src = fetchurl {
-    url = "https://gitlab.gnome.org/World/design/icon-library/uploads/8c4cad88809cd4ddc0eeae6f5170c001/icon-library-${version}.tar.xz";
+    url = "https://gitlab.gnome.org/World/design/icon-library/uploads/874b27fcf34662d9686f670d406142c2/icon-library-${version}.tar.xz";
-    hash = "sha256-Gspx3fJl+ZoUN3heGWaeMuxUsjWCrIdg4pJj7DeMTSY=";
+    hash = "sha256-qCGwTePA817mulFjyRZKw+Fw1S77+QTtA7WH+KocL48=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/ipe/default.nix

@@ -13,6 +13,7 @@
 , libspiro
 , lua5
 , qtbase
+, qtsvg
 , texliveSmall
 , wrapQtAppsHook
 , zlib
@@ -41,6 +42,7 @@ stdenv.mkDerivation rec {
     libspiro
     lua5
     qtbase
+    qtsvg
     zlib
   ] ++ (lib.optionals withTeXLive [
     texliveSmall

pkgs/applications/graphics/xpano/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xpano";
-  version = "0.17.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "krupkat";
     repo = pname;
     rev = "v${version}";
-    sha256 = "aKO9NYHFjb69QopseNOJvUvvVT1povP9tyGSOHJFWVo=";
+    sha256 = "iPGvCJz2iywpSePBZ3c8OiccKfwaGAToGaJfRhruUPk=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/nwg-panel/default.nix

@@ -7,7 +7,7 @@
 , systemd          # systemctl
 , wlr-randr        # wlr-randr
 , nwg-menu         # nwg-menu
-, light            # light
+, brightnessctl    # brightnessctl
 , pamixer          # pamixer
 , pulseaudio       # pactl
 , libdbusmenu-gtk3 # tray
@@ -16,13 +16,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.9.20";
+  version = "0.9.22";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     rev = "v${version}";
-    hash = "sha256-Cq/kj61OmnHLd8EQK6QF67ALv3lMXKPGYUvTIeh90zQ=";
+    hash = "sha256-2O3FMPA/QD+ZUmLvot+MMwbUo3zT6ZN5NIbulh2oGYk=";
   };
 
   # No tests
@@ -49,7 +49,7 @@ python3Packages.buildPythonApplication rec {
     makeWrapperArgs+=(
       "''${gappsWrapperArgs[@]}"
       --prefix XDG_DATA_DIRS : "$out/share"
-      --prefix PATH : "${lib.makeBinPath [ hyprland light nwg-menu pamixer pulseaudio sway systemd wlr-randr ]}"
+      --prefix PATH : "${lib.makeBinPath [ brightnessctl hyprland nwg-menu pamixer pulseaudio sway systemd wlr-randr ]}"
     )
   '';
 

pkgs/applications/misc/waybar/default.nix

@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, bash
 , fetchFromGitHub
 , SDL2
 , alsa-lib
@@ -163,6 +164,11 @@ stdenv.mkDerivation (finalAttrs: {
     "wireplumber" = wireplumberSupport;
   }) ++ lib.optional experimentalPatches (lib.mesonBool "experimental" true);
 
+  postPatch = ''
+    substituteInPlace include/util/command.hpp \
+      --replace-fail /bin/sh ${lib.getExe' bash "sh"}
+  '';
+
   preFixup = lib.optionalString withMediaPlayer ''
     cp $src/resources/custom_modules/mediaplayer.py $out/bin/waybar-mediaplayer.py
 

pkgs/applications/misc/waylock/default.nix

@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waylock";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "waylock";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-RSAUSlsBB9IphvdSiFqJIvyhhJoAKKb+KyGhdoTa3vs=";
+    hash = "sha256-wvZrRPZobDh+rB3RSaRrz0xDHuYwT2eoQEu3AbYKn8Y=";
   };
 
   nativeBuildInputs = [
@@ -38,8 +38,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   zigBuildFlags = [ "-Dman-pages" ];
 
+  passthru.updateScript = ./update.nu;
+
   meta = {
-    homepage = "https://github.com/ifreund/waylock";
+    homepage = "https://codeberg.org/ifreund/waylock";
+    changelog = "https://codeberg.org/ifreund/waylock/releases/tag/v${finalAttrs.version}";
     description = "A small screenlocker for Wayland compositors";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ adamcstephens jordanisaacs ];

pkgs/applications/misc/waylock/update.nu

@@ -0,0 +1,5 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell common-updater-scripts
+
+let latest_tag = list-git-tags --url=https://codeberg.org/ifreund/waylock | lines | sort --natural | str replace v '' | last
+update-source-version waylock $latest_tag

pkgs/applications/networking/browsers/chromium/update.py

@@ -201,6 +201,8 @@ def print_updates(channels_old, channels_new):
 channels = {}
 last_channels = load_as_json(PIN_PATH)
 
+src_hash_cache = {}
+
 
 print(f'GET {RELEASES_URL}', file=sys.stderr)
 with urlopen(RELEASES_URL) as resp:
@@ -240,13 +242,27 @@ with urlopen(RELEASES_URL) as resp:
             google_chrome_suffix = channel_name
 
         try:
-            channel['hash'] = prefetch_src_sri_hash(
+            version = release["version"]
-                channel_name_to_attr_name(channel_name),
+            existing_releases = dict(map(lambda channel: (channel[1]['version'], channel[1]['hash']), last_channels.items()))
-                release["version"]
+
-            )
+            if version in src_hash_cache:
+                print(f'Already got hash {src_hash_cache[version]} for {version}, skipping FOD prefetch for {channel_name_to_attr_name(channel_name)}')
+
+                channel["hash"] = src_hash_cache[version]
+            elif version in existing_releases:
+                print(f'Already got hash {existing_releases[version]} for {version} (from upstream-info.nix), skipping FOD prefetch for {channel_name_to_attr_name(channel_name)}')
+
+                channel["hash"] = existing_releases[version]
+            else:
+                channel["hash"] = prefetch_src_sri_hash(
+                    channel_name_to_attr_name(channel_name),
+                    version
+                )
+                src_hash_cache[version] = channel["hash"]
+
             channel['hash_deb_amd64'] = nix_prefetch_url(
                 f'{DEB_URL}/google-chrome-{google_chrome_suffix}/' +
-                f'google-chrome-{google_chrome_suffix}_{release["version"]}-1_amd64.deb')
+                f'google-chrome-{google_chrome_suffix}_{version}-1_amd64.deb')
         except subprocess.CalledProcessError:
             # This release isn't actually available yet.  Continue to
             # the next one.

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -15,9 +15,9 @@
         version = "2023-11-28";
       };
     };
-    hash = "sha256-mncN1Np/70r0oMnJ4oV7PU6Ivi5AiRar5O2G8bNdwY8=";
+    hash = "sha256-mLXBaW4KBieOiz2gRXfgA/KPdmUnNlpUIOqdj7CywcY=";
-    hash_deb_amd64 = "sha256-t/5Mx3P3LaH/6GjwMFP+lVoz7xq7jqAKYxLqlWBnwIE=";
+    hash_deb_amd64 = "sha256-UDgO1sJ7bggFTe7C36CnHYXjG9rM+ZqFCOzNyIDpQ0Y=";
-    version = "121.0.6167.160";
+    version = "121.0.6167.184";
   };
   ungoogled-chromium = {
     deps = {
@@ -28,12 +28,12 @@
         version = "2023-11-28";
       };
       ungoogled-patches = {
-        hash = "sha256-qwMQoJEJxNjDEdqzSMBTozv8+wl+SbBmzIm/VbiGxKw=";
+        hash = "sha256-nJDLCVynuGFRIjLBV0NmC0zHeEDHjzFM16FKAv2QyNY=";
-        rev = "121.0.6167.160-1";
+        rev = "121.0.6167.184-1";
       };
     };
-    hash = "sha256-mncN1Np/70r0oMnJ4oV7PU6Ivi5AiRar5O2G8bNdwY8=";
+    hash = "sha256-mLXBaW4KBieOiz2gRXfgA/KPdmUnNlpUIOqdj7CywcY=";
-    hash_deb_amd64 = "sha256-t/5Mx3P3LaH/6GjwMFP+lVoz7xq7jqAKYxLqlWBnwIE=";
+    hash_deb_amd64 = "sha256-UDgO1sJ7bggFTe7C36CnHYXjG9rM+ZqFCOzNyIDpQ0Y=";
-    version = "121.0.6167.160";
+    version = "121.0.6167.184";
   };
 }

pkgs/applications/networking/browsers/links2/default.nix

@@ -1,23 +1,23 @@
 { lib, stdenv, fetchurl
 , gpm, openssl, pkg-config, libev # Misc.
-, libpng, libjpeg, libtiff, librsvg # graphic formats
+, libpng, libjpeg, libtiff, librsvg, libavif # graphic formats
 , bzip2, zlib, xz # Transfer encodings
-, enableFB ? true
+, enableFB ? (!stdenv.isDarwin)
 , enableDirectFB ? false, directfb
-, enableX11 ? true, libX11, libXt, libXau # GUI support
+, enableX11 ? (!stdenv.isDarwin), libX11, libXt, libXau # GUI support
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "2.29";
   pname = "links2";
 
   src = fetchurl {
-    url = "${meta.homepage}/download/links-${version}.tar.bz2";
+    url = "${finalAttrs.meta.homepage}/download/links-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-IqqWwLOOGm+PftnXpBZ6R/w3JGCXdZ72BZ7Pj56teZg=";
+    hash = "sha256-IqqWwLOOGm+PftnXpBZ6R/w3JGCXdZ72BZ7Pj56teZg=";
   };
 
   buildInputs = with lib;
-    [ libev librsvg libpng libjpeg libtiff openssl xz bzip2 zlib ]
+    [ libev librsvg libpng libjpeg libtiff libavif openssl xz bzip2 zlib ]
     ++ optionals stdenv.isLinux [ gpm ]
     ++ optionals enableX11 [ libX11 libXau libXt ]
     ++ optionals enableDirectFB [ directfb ];
@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
     ++ lib.optional enableFB "--with-fb"
     ++ lib.optional enableDirectFB "--with-directfb";
 
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-int";
+  };
+
   meta = with lib; {
     homepage = "http://links.twibright.com/";
     description = "A small browser with some graphics support";
@@ -38,4 +42,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
-}
+})

pkgs/applications/networking/cluster/tektoncd-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.35.0";
+  version = "0.35.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-4n+20EZvj1cCJTZFSYTpOeArVKvpz4+U1qYxaqWXBSc=";
+    sha256 = "sha256-/o0UzjIUlRP936YG7fgfonPHc86z1WFCBcELor2frqE=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.55.1";
+  version = "0.55.2";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-SYMdn/d13YUlgK1l1pWQsJo31JG4leaCZckKmUWqpUA=";
+    hash = "sha256-6lUBtTG05Bz+M9Jj5HaOqG2yelwbC1trCM33NzUP1U4=";
   };
 
   vendorHash = "sha256-uFSkolmQV11cY+3ZWrlByHDFolpr2E+9/R95bhBn6zo=";

pkgs/applications/networking/cluster/yor/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "yor";
-  version = "0.1.188";
+  version = "0.1.189";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-8bQUZFV5euXki7jz3tZmhJ/vSFnJusYyejfw0s+N6rk=";
+    hash = "sha256-9xZVim5fMKDaeATSpgEGV5ukLv+aw7A99825iBIvvb0=";
   };
 
-  vendorHash = "sha256-VYzMdYwWe2TTIV28kORX6pImSE04aFISDCjlQvqiIp8=";
+  vendorHash = "sha256-RNtWPAAOCGs0aCR0PWnOP4GxaXTXA3uLI3aGLuMNGYI=";
 
   doCheck = false;
 

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -2,22 +2,22 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.42";
+      stable = "0.0.43";
       ptb = "0.0.67";
-      canary = "0.0.267";
+      canary = "0.0.277";
       development = "0.0.13";
     } else {
-      stable = "0.0.292";
+      stable = "0.0.294";
-      ptb = "0.0.96";
+      ptb = "0.0.97";
-      canary = "0.0.401";
+      canary = "0.0.416";
-      development = "0.0.27";
+      development = "0.0.30";
     };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-7can15JhBc6OJAWZMk8uEdt/D1orCKG1MN1WBdTZrI0=";
+        hash = "sha256-DO8bS5luSKhKW6sJZhz4xVeIPexQVoaD4xYugHCN3uk=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
@@ -25,7 +25,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-Hq78SDer7Gb+ju8wk9DrMLisHnoYoSwTzrs8PKhbS3s=";
+        hash = "sha256-AOhwBr/bOKAQtQ41oaYxU/2708Rt5arBzjpGdWUnHZU=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -35,19 +35,19 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-1BKMIWSb7+oQ+B80GUCslKn5VNdM0hPTNyZkI/RsxhM=";
+        hash = "sha256-OzaAHCGusctuQk2uzJhCQCTI6SNRGQZXbQ0FgPZLV8w=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-dG0Wcx8X2+kzrpacFZmMCXfLsuLOLbDK4qVLAMzd4RA=";
+        hash = "sha256-nONU9TZAWtxqh5PpvgsvaEHESOKhMYGTe184EgCNxHQ=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-fz/LDQJ/B8luN6Ffobp82hnycBOLg9Kdi0kXLGltCDc=";
+        hash = "sha256-3Vl5qQihUqyQdHnM/968xaCPIM6P6ImLQAiWKXwYnps=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-MRCBPe98Czm1OG2l3c1GAW4a27fV8XMtQ9pPIJMgqzA=";
+        hash = "sha256-ffTIfurfYprKAJbOOGzzxCfGQofiVy+Q0NmEJ59ENk4=";
       };
     };
     aarch64-darwin = x86_64-darwin;

pkgs/applications/networking/nextcloud-client/default.nix

@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.11.1";
+  version = "3.12.0";
 
   outputs = [ "out" "dev" ];
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    hash = "sha256-gskFI6nxRb5lx6EwWuqghqg7NmCaj0JS7PpV0i4qUqQ=";
+    hash = "sha256-77vsl7BvptNlU/1epn4Eo+3Lnedn5awUgqbkyapW7+A=";
   };
 
   patches = [

pkgs/applications/science/biology/megahit/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, zlib }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, zlib }:
 
 stdenv.mkDerivation rec {
   pname    = "megahit";
@@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "1r5d9nkdmgjsbrpj43q9hy3s8jwsabaz3ji561v18hy47v58923c";
   };
 
+  patches = [
+    # Fix gcc-13 build failure:
+    #   https://github.com/voutcn/megahit/pull/366
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/voutcn/megahit/commit/4cb2f793503087163bda8592222f105f27e33e66.patch";
+      hash = "sha256-b5mhzif+OPcMjmg+BnaUc5CB6Acn/KTBOJEw+WYEhbs=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
 

pkgs/applications/science/biology/svaba/default.nix

@@ -14,6 +14,13 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib bzip2 xz ];
 
+  postPatch = ''
+    # Fix gcc-13 build failure due to missing includes
+    sed -e '1i #include <cstdint>' -i \
+      SeqLib/src/non_api/Histogram.h \
+      src/svaba/Histogram.h
+  '';
+
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: ./libfml.a(rle.o):/build/source/SeqLib/fermi-lite/rle.h:33: multiple definition of

pkgs/applications/science/misc/openmvg/default.nix

@@ -1,34 +1,63 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, cereal, openmp
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake
-, libjpeg ? null
+, cereal
-, zlib ? null
-, libpng ? null
-, eigen ? null
-, libtiff ? null
 , ceres-solver
+, clp
+, coin-utils
+, eigen
+, lemon-graph
+, libjpeg
+, libpng
+, libtiff
+, nix-update-script
+, openmp
+, osi
+, zlib
 , enableShared ? !stdenv.hostPlatform.isStatic
 , enableExamples ? false
 , enableDocs ? false }:
 
 stdenv.mkDerivation rec {
-  version = "unstable-2022-12-30";
+  version = "2.1";
   pname = "openmvg";
 
   src = fetchFromGitHub {
     owner = "openmvg";
     repo = "openmvg";
-    rev = "e1bbfe801986cd7171f36443a1573b0f69f3702d";
+    rev = "v${version}";
-    sha256 = "sha256-DngfmejNFw5pogTo7Ec5aUey2LUQIojvJybLmtCfvVY=";
+    hash = "sha256-vG+tW9Gl/DAUL8DeY+rJVDJH/oMPH3XyZMUgzjtwFv0=";
-    fetchSubmodules = true;
   };
 
-  buildInputs = [ libjpeg zlib libpng eigen libtiff cereal openmp ceres-solver ];
+  # Pretend we checked out the dependency submodules
+  postPatch = ''
+    mkdir src/dependencies/cereal/include
+  '';
+
+  buildInputs = [
+    cereal
+    ceres-solver
+    clp
+    coin-utils
+    eigen
+    lemon-graph
+    libjpeg
+    libpng
+    libtiff
+    openmp
+    osi
+    zlib
+  ];
 
   nativeBuildInputs = [ cmake pkg-config ];
 
+  # flann is missing because the lz4 dependency isn't propagated: https://github.com/openMVG/openMVG/issues/1265
   cmakeFlags = [
     "-DOpenMVG_BUILD_EXAMPLES=${if enableExamples then "ON" else "OFF"}"
     "-DOpenMVG_BUILD_DOC=${if enableDocs then "ON" else "OFF"}"
     "-DTARGET_ARCHITECTURE=generic"
+    "-DCLP_INCLUDE_DIR_HINTS=${lib.getDev clp}/include"
+    "-DCOINUTILS_INCLUDE_DIR_HINTS=${lib.getDev coin-utils}/include"
+    "-DLEMON_INCLUDE_DIR_HINTS=${lib.getDev lemon-graph}/include"
+    "-DOSI_INCLUDE_DIR_HINTS=${lib.getDev osi}/include"
   ] ++ lib.optional enableShared "-DOpenMVG_BUILD_SHARED=ON";
 
   cmakeDir = "./src";
@@ -41,6 +70,8 @@ stdenv.mkDerivation rec {
   # Without hardeningDisable, certain flags are passed to the compile that break the build (primarily string format errors)
   hardeningDisable = [ "all" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     broken = stdenv.isDarwin && stdenv.isx86_64;
     description = "A library for computer-vision scientists and targeted for the Multiple View Geometry community";

pkgs/applications/science/misc/root/default.nix

@@ -2,6 +2,7 @@
 , lib
 , callPackage
 , fetchurl
+, fetchpatch
 , makeWrapper
 , cmake
 , coreutils
@@ -109,6 +110,17 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./sw_vers.patch
+
+    # compatibility with recent XRootD
+    # https://github.com/root-project/root/pull/13752
+    (fetchpatch {
+      url = "https://github.com/root-project/root/commit/3d3cda6c520791282298782189cdb8ca07ace4b9.diff";
+      hash = "sha256-O3aXzrOEQiPjZgbAj9TL6Wt/adN1kKFwjooeaFRyT4I=";
+    })
+    (fetchpatch {
+      url = "https://github.com/root-project/root/commit/6e7798e62dbed1ffa8b91a180fa5a080b7c04ba3.diff";
+      hash = "sha256-47/J631DBnVlvM1Pm9iicKXDKAqN8v9hjAstQuHmH8Q=";
+    })
   ];
 
   preConfigure = ''

pkgs/applications/science/physics/xfitter/default.nix

@@ -47,6 +47,8 @@ stdenv.mkDerivation rec {
   env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.hostPlatform.libc == "glibc") "-I${libtirpc.dev}/include/tirpc";
   NIX_LDFLAGS = lib.optional (stdenv.hostPlatform.libc == "glibc") "-ltirpc";
 
+  hardeningDisable = [ "format" ];
+
   # workaround wrong library IDs
   postInstall = lib.optionalString stdenv.isDarwin ''
     ln -sv "$out/lib/xfitter/"* "$out/lib/"

pkgs/applications/terminal-emulators/alacritty/default.nix

@@ -83,7 +83,7 @@ rustPlatform.buildRustPackage rec {
 
   outputs = [ "out" "terminfo" ];
 
-  postPatch = lib.optionalString (!xdg-utils.meta.broken) ''
+  postPatch = lib.optionalString stdenv.isLinux ''
     substituteInPlace alacritty/src/config/ui_config.rs \
       --replace xdg-open ${xdg-utils}/bin/xdg-open
   '';

pkgs/applications/version-management/gitkraken/default.nix

@@ -11,24 +11,24 @@ with lib;
 
 let
   pname = "gitkraken";
-  version = "9.11.1";
+  version = "9.12.0";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      hash = "sha256-DTnVsVWOPAcG2O87dS6PwAB+VU0ijulELHe9CnOLYPU=";
+      hash = "sha256-g2YcNFKt1/YBmEOH3Z5b0MPMMOWBIvXh+V2fzaGgCgQ=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      hash = "sha256-JkmQYk+t4ACkK3V0IxrrIcheBWJEkxQzf9ZYRWs769c=";
+      hash = "sha256-yy7BbtguQj/LVM7ivNTcG97XIImQUMQPKwTVDWGvvnQ=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      hash = "sha256-jWXvDSyM7A3+cer/yPvom9f0w2nGJmwOJ22qoQzRWGQ=";
+      hash = "sha256-ihnTzQC7B0TdHZzXmrwcVSfxKvGoBBTdRq8ZJicaVDI=";
     };
   };
 

pkgs/applications/version-management/got/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "got";
-  version = "0.95";
+  version = "0.96";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5on9ff76OAFmoaKTwVM0hUCGLiAZGJzt6+jCx2Nygg4=";
+    hash = "sha256-/R7r6IJtgkuNQwoLxys/1HcXW+l3PVkjnPXphFpAFTs=";
   };
 
   nativeBuildInputs = [ pkg-config bison ]

pkgs/applications/video/natron/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , wrapQtAppsHook
@@ -37,6 +38,23 @@ stdenv.mkDerivation {
     hash = "sha256-dgScbfyulZPlrngqSw7xwipldoRd8uFO8VP9mlJyhQ8=";
   };
 
+  patches = [
+    # Fix gcc-13 build:
+    #   https://github.com/NatronGitHub/Natron/pull/929
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/NatronGitHub/Natron/commit/4b44fb18293035873b35c3a2d2aa29da78cb8740.patch";
+      includes = ["Global/GlobalDefines.h"];
+      hash = "sha256-9E1tJCvO7zA1iQAhrlL3GaBFIGpkjxNOr31behQXdhQ=";
+    })
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/NatronGitHub/Natron/commit/f21f58622e32c1684567c82e2ab361f33030bda7.patch";
+      includes = ["Engine/Noise.cpp"];
+      hash = "sha256-t2mzTsRuXVs8d1BB/5uAY1OPxWRa3JTK1iAWLAMsrgs=";
+    })
+  ];
+
   cmakeFlags = [ "-DNATRON_SYSTEM_LIBS=ON" ];
 
   nativeBuildInputs = [

pkgs/applications/virtualization/podman/default.nix

@@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-6E6Qobkvv6y+Jx+X6Z9wJsGIuP7MXoc+cXRiajj0ojw=";
+    hash = "sha256-PdAXcXtc/Jl3ttWWB6TciiOwWescJ51Glhf2ZhOw550=";
   };
 
   patches = [

pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix

@@ -1,13 +1,13 @@
 { lib
 , callPackage
 , pkg-config
-, gcc13Stdenv
+, stdenv
 , hyprland
 }:
 let
   mkHyprlandPlugin =
     args@{ pluginName, ... }:
-    gcc13Stdenv.mkDerivation (args // {
+    stdenv.mkDerivation (args // {
       pname = "${pluginName}";
       nativeBuildInputs = [ pkg-config ] ++ args.nativeBuildInputs or [ ];
       buildInputs = [ hyprland ]

pkgs/build-support/docker/default.nix

@@ -923,6 +923,7 @@ rec {
                   --sort name \
                   --exclude=./proc \
                   --exclude=./sys \
+                  --exclude=.${builtins.storeDir} \
                   --numeric-owner --mtime "@$SOURCE_DATE_EPOCH" \
                   --hard-dereference \
                   -cf $out/layer.tar .

pkgs/build-support/docker/examples.nix

@@ -639,6 +639,20 @@ rec {
     includeStorePaths = false;
   };
 
+  helloOnRootNoStoreFakechroot = pkgs.dockerTools.streamLayeredImage {
+    name = "hello";
+    tag = "latest";
+    contents = [
+      (pkgs.buildEnv {
+        name = "hello-root";
+        paths = [ pkgs.hello ];
+      })
+    ];
+    config.Cmd = [ "hello" ];
+    includeStorePaths = false;
+    enableFakechroot = true;
+  };
+
   etc =
     let
       inherit (pkgs) lib;

pkgs/by-name/ar/arrow-cpp/package.nix

@@ -5,8 +5,19 @@
 , fixDarwinDylibNames
 , autoconf
 , aws-sdk-cpp
+, aws-sdk-cpp-arrow ? aws-sdk-cpp.override {
+    apis = [
+      "cognito-identity"
+      "config"
+      "identity-management"
+      "s3"
+      "sts"
+      "transfer"
+    ];
+  }
 , boost
 , brotli
+, bzip2
 , c-ares
 , cmake
 , crc32c
@@ -36,6 +47,7 @@
 , which
 , zlib
 , zstd
+, testers
 , enableShared ? !stdenv.hostPlatform.isStatic
 , enableFlight ? true
 , enableJemalloc ? !stdenv.isDarwin
@@ -64,17 +76,6 @@ let
     hash = "sha256-CUckfNjfDW05crWigzMP5b9UynviXKGZUlIr754OoGU=";
   };
 
-  aws-sdk-cpp-arrow = aws-sdk-cpp.override {
-    apis = [
-      "cognito-identity"
-      "config"
-      "identity-management"
-      "s3"
-      "sts"
-      "transfer"
-    ];
-  };
-
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "arrow-cpp";
@@ -128,6 +129,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     boost
     brotli
+    bzip2
     flatbuffers
     gflags
     glog
@@ -187,6 +189,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DARROW_USE_GLOG=ON"
     "-DARROW_WITH_BACKTRACE=ON"
     "-DARROW_WITH_BROTLI=ON"
+    "-DARROW_WITH_BZ2=ON"
     "-DARROW_WITH_LZ4=ON"
     "-DARROW_WITH_NLOHMANN_JSON=ON"
     "-DARROW_WITH_SNAPPY=ON"
@@ -247,6 +250,8 @@ stdenv.mkDerivation (finalAttrs: {
   installCheckPhase =
     let
       disabledTests = [
+        # flaky
+        "arrow-flight-test"
         # requires networking
         "arrow-gcsfs-test"
         "arrow-flight-integration-test"
@@ -266,8 +271,24 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = with maintainers; [ tobim veprbl cpcloud ];
+    pkgConfigModules = [
+      "arrow"
+      "arrow-acero"
+      "arrow-compute"
+      "arrow-csv"
+      "arrow-dataset"
+      "arrow-filesystem"
+      "arrow-flight"
+      "arrow-flight-sql"
+      "arrow-flight-testing"
+      "arrow-json"
+      "arrow-substrait"
+      "arrow-testing"
+      "parquet"
+    ];
   };
   passthru = {
     inherit enableFlight enableJemalloc enableS3 enableGcs;
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 })

pkgs/by-name/at/atuin/package.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , installShellFiles
 , rustPlatform
 , libiconv
@@ -11,29 +10,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "atuin";
-  version = "18.0.0";
+  version = "18.0.1";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     rev = "v${version}";
-    hash = "sha256-2nBaGoaTd1TGm8aZnrNA66HkW7+OrD6gOmj+uSFz020=";
+    hash = "sha256-fuVSn1vhKn2+Tw5f6zBYHFW3QSL4eisZ6d5pxsj5hh4=";
   };
 
-  patches = [
-    # https://github.com/atuinsh/atuin/pull/1694
-    (fetchpatch {
-      name = "0001-atuin_src_command_client_search_interactive.rs.patch";
-      url = "https://github.com/atuinsh/atuin/commit/6bc38f4cf3c8d2b6fbd135998a4e64e6abfb2566.patch";
-      hash = "sha256-pUiuECiAmq7nmKO/cOHZ1V5Iy3zDzZyBNNCH7Czo/NA=";
-    })
-  ];
-
   # TODO: unify this to one hash because updater do not support this
   cargoHash =
     if stdenv.isLinux
-    then "sha256-Y+49R/foid+V83tY3bqf644OkMPukJxg2/ZVfJxDaFg="
+    then "sha256-lHWgsVnjSeBmd7O4Fn0pUtTn4XbkBOAouaRHRozil50="
-    else "sha256-gT2JRzBAF4IsXVv1Hvo6kr9qrNE/3bojtULCx6YawhA=";
+    else "sha256-LxfpllzvgUu7ZuD97n3W+el3bdOt5QGXzJbDQ0w8seo=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -60,7 +50,7 @@ rustPlatform.buildRustPackage rec {
     "--skip=registration"
     # No such file or directory (os error 2)
     "--skip=sync"
-    # further failing tests
+    # PermissionDenied (Operation not permitted)
     "--skip=change_password"
     "--skip=multi_user_test"
   ];

pkgs/by-name/co/cockpit/package.nix

@@ -44,13 +44,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cockpit";
-  version = "310.2";
+  version = "311";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     rev = "refs/tags/${version}";
-    hash = "sha256-VaH34UT8kXKZbRPTNvL1afeONb3n6vK0UB1UgWeNRWY=";
+    hash = "sha256-RsOLYvwLu0eNmSZJoCi1dcB2a3JqMbus/gOyL74kCB4=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/fl/flarectl/package.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "flarectl";
-  version = "0.87.0";
+  version = "0.88.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflare-go";
     rev = "v${version}";
-    hash = "sha256-M3Qc9PAcYASOQyEjWdGrLKx9h6uQGPftMJnD0Uc2buc=";
+    hash = "sha256-nFTE6RCVpfF/CPcwKM0wK15/1KMXAuvSdmtrt+Xrp8E=";
   };
 
-  vendorHash = "sha256-Bn2SDvFWmmMYDpOe+KBuzyTZLpdDtYDPc8HixgEgX+M=";
+  vendorHash = "sha256-AxBvmDB3mfgkv7U+BzR0Khdgx1hrDI61CSxr45pRZqg=";
 
   subPackages = [ "cmd/flarectl" ];
 

pkgs/by-name/ga/game-rs/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "game-rs";
-  version = "0.1.3";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "amanse";
     repo = "game-rs";
     rev = "v${version}";
-    hash = "sha256-M9/hFItoCL8fSrc0dFNn43unqkIaD179OGUdbXL6/Rs=";
+    hash = "sha256-FuZl2yNre5jNSfHqF3tjiGwg5mRKbYer2FOPpLy0OrA=";
   };
 
-  cargoHash = "sha256-aq58sFK4/Zd8S4dOWjag+g5PmTeaVAK3FS3fW/YlCLs=";
+  cargoHash = "sha256-fNC8Aff09nTSbtxZg5qEKtvFyKFLRVjaokWiZihZCgM=";
 
   buildFeatures = [ "nixos" ];
 

pkgs/by-name/go/go-judge/package.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "go-judge";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "criyle";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-iKSOD/jh7NgGUNeQxFqlZDcctUXBDC1Tjxsm0Q2iZ3I=";
+    hash = "sha256-yWO4LD8inFOZiyrwFhjl2FCkGePpLfXuLCTwBUUGal4=";
   };
 
-  vendorHash = "sha256-GVsRflqqt+PwVGWaNGMH4prKQ5pWqPRlsTBJZtC+7zo=";
+  vendorHash = "sha256-lMqZGrrMwNER8RKABheUH4GPy0q32FBTY3zmYHtssKo=";
 
   tags = [ "nomsgpack" ];
 

pkgs/by-name/gr/graphite-cli/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.1.2",
+  "version": "1.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.1.2",
+      "version": "1.1.5",
       "license": "None",
       "dependencies": {
         "chalk": "^4.1.2",
@@ -90,9 +90,9 @@
       "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
     },
     "node_modules/escalade": {
-      "version": "3.1.1",
+      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.2.tgz",
-      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+      "integrity": "sha512-ErCHMCae19vR8vQGe50xIsVomy19rg6gFu3+r3jkEO46suLMWBksvVyoGgQV+jOfl84ZSOSlmv6Gxa89PmTGmA==",
       "engines": {
         "node": ">=6"
       }

pkgs/by-name/gr/graphite-cli/package.nix

@@ -7,14 +7,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.1.2";
+  version = "1.1.5";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-NNBI1S33jD6ZKbztZXSRtYwt3w0T4A5Bg2zxMWw74cY=";
+    hash = "sha256-/JnhUjrZq1iiXwqCSXZH250gu3yh6gJt6JjZRJ2OQd8=";
   };
 
-  npmDepsHash = "sha256-Nk0Aoyv4eEXZD4B9B/B6mJd/UDy8Kc/sHtQWXrLukSk=";
+  npmDepsHash = "sha256-oQLombXIZRyjnKA04xuDZoZf2NO/0/xFfuXXmp46OaI=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json

pkgs/by-name/hy/hyprlang/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlang";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlang";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lm1Bq2AduKFYHdl/q0OLYOdYBTHnKyHGewwQa68q/Wc=";
+    hash = "sha256-JZmXxLHYB7t95B5iJdiZml0APJn4nKrGU8M88e8Dkgs=";
   };
 
   nativeBuildInputs = [cmake];

pkgs/by-name/in/invidtui/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "invidtui";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "darkhz";
     repo = "invidtui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3F/JWdYjb3Wtd2eBkEmId3SCVapu2gCgLFowK59RXRc=";
+    hash = "sha256-/HsoV8HdMffD7dzRblSSBMv7kBPRpxUarM5WZoYVxvQ=";
   };
 
-  vendorHash = "sha256-rwKx3h0X7RfIZ9lE/4TJoK0BR6f/lPcLNFbQjUtq/Tk=";
+  vendorHash = "sha256-T/muFaQQp/joOCehNZQc5CWmyGakoRaGAsO2mTOODJA=";
 
   doCheck = true;
 

pkgs/by-name/ke/keep-sorted/package.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "keep-sorted";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "keep-sorted";
     rev = "v${version}";
-    hash = "sha256-qCR1JVDC/+NVz+CAY/2mMP8Sk71WDl2+Ig7QWwXTUrQ=";
+    hash = "sha256-wXR471Iuo+4oZUNa2MN4N5q0n7vEpYtoTaJHvdGIDHw=";
   };
 
   vendorHash = "sha256-tPTWWvr+/8wWUnQcI4Ycco2OEgA2mDQt15OGCk/ZjrQ=";

pkgs/by-name/ko/kokkos/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kokkos";
-  version = "4.2.00";
+  version = "4.2.01";
 
   src = fetchFromGitHub {
     owner = "kokkos";
     repo = "kokkos";
     rev = finalAttrs.version;
-    hash = "sha256-tclPqFxXK5x9P0RD7R/fcab8WPr8Wphq5rzrZbij/ds=";
+    hash = "sha256-d8GB7+hHqpD5KPeYmiXmT5+6W64j3bbTs2hoFYJnfa8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libui-ng/package.nix

@@ -7,17 +7,18 @@
 , meson
 , ninja
 , pkg-config
+, unstableGitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "libui-ng";
-  version = "unstable-2023-12-19";
+  version = "unstable-2024-02-05";
 
   src = fetchFromGitHub {
     owner = "libui-ng";
     repo = "libui-ng";
-    rev = "8de4a5c8336f82310df1c6dad51cb732113ea114";
+    rev = "4d46de31eafad84c88b939356bcd64e6c5ee3821";
-    hash = "sha256-ZMt2pEHwxXxLWtK8Rm7hky9Kxq5ZIB0olBLf1d9wVfc=";
+    hash = "sha256-Yb8VdJe75uBzRnsfTOVxUXstZmu6dJ9nBuOrf86KO5s=";
   };
 
   postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
@@ -46,6 +47,8 @@ stdenv.mkDerivation rec {
     (lib.mesonBool "examples" (!stdenv.isDarwin))
   ];
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with lib; {
     description = "A portable GUI library for C";
     homepage = "https://github.com/libui-ng/libui-ng";

pkgs/by-name/mq/mqttx/package.nix

@@ -7,17 +7,17 @@
 
 let
   pname = "mqttx";
-  version = "1.9.8";
+  version = "1.9.9";
 
   suffixedUrl = suffix: "https://github.com/emqx/MQTTX/releases/download/v${version}/MQTTX-${version}${suffix}.AppImage";
   sources = {
     "aarch64-linux" = fetchurl {
       url = suffixedUrl "-arm64";
-      hash = "sha256-pdR9LwWgFdO0Dtn7ByyYKpLrfoBnl75TzQ31aIAJ/gs=";
+      hash = "sha256-mCCRvLS6diKoKYZNUMsyiWyFWmyYYB0pAxNT0yriJHI=";
     };
     "x86_64-linux" = fetchurl {
       url = suffixedUrl "";
-      hash = "sha256-XHAroiFuUcK0aUleNDskI1bfVX7HfTvIvSup9gKJj1w=";
+      hash = "sha256-InGfGiT3c5M8ueFZl5/hFmYRPeXnwSCUPhAqmz0jsU8=";
     };
   };
 

pkgs/by-name/na/namespace-cli/package.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.334";
+  version = "0.0.338";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-gFh4LF++UB5JIVHVaZNDOhQoowf6xKow3ULrJt8CWTw=";
+    hash = "sha256-pZMqSZuyu7tRMcASWLVB2/Dd7qre35Evz83PLXoMgrs=";
   };
 
-  vendorHash = "sha256-wurZp8cKyayZuTuUwonYZmUHp6OJ5I1RJWtELNyu2pc=";
+  vendorHash = "sha256-8VO+VKd6vsCzWeU1Bh33TvAmpiyCIEJbZ2HebpuwU5g=";
 
   subPackages = ["cmd/nsc" "cmd/ns" "cmd/docker-credential-nsc"];
 

pkgs/by-name/nr/nrr/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nrr";
-  version = "0.5.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "ryanccn";
     repo = "nrr";
     rev = "v${version}";
-    hash = "sha256-jkI5t+1P7Ae6MkSnyy7Ur3Z0Vt8+hWTgf6dgL5tzhY8=";
+    hash = "sha256-WrpyT5h+eoCu7cspf9KGaM0FgLmnBm8tOHIWbj8sYpo=";
   };
 
-  cargoHash = "sha256-9qLeFuaKAGhtyHFHOBS6HA0wAWuk0ZJppVySpMwUGYc=";
+  cargoHash = "sha256-XTKaVHy7FWYgMq5gNCLF8kIjDDyiyZ+GPZYBMKtLrsI=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreFoundation

pkgs/by-name/ph/phpdocumentor/package.nix

@@ -5,16 +5,19 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "phpdocumentor";
-  version = "3.4.1";
+  version = "3.4.3";
 
   src = fetchFromGitHub {
     owner = "phpDocumentor";
     repo = "phpDocumentor";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fNjix3pJDRCTWM3Xtn+AtZe4RJfgQ60kiJB9J9tC5t4=";
+    hash = "sha256-NCBCwQ8im6ttFuQBaG+bzmtinf+rqNnbogcK8r60dCM=";
   };
 
-  vendorHash = "sha256-rsBg2EHbvYLVr6haN1brHZFVjLDaxqdkNWf0HL3Eoy0=";
+  vendorHash = "sha256-/TJ/CahmOWcRBlAsJDzWcfhlDd+ypRapruFT0Dvlb1w=";
+
+  # Needed because of the unbound version constraint on phpdocumentor/json-path
+  composerStrictValidation = false;
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/ro/robo/package.nix

@@ -6,16 +6,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "robo";
-  version = "4.0.4";
+  version = "4.0.6";
 
   src = fetchFromGitHub {
     owner = "consolidation";
     repo = "robo";
     rev = finalAttrs.version;
-    hash = "sha256-4sQc3ec34F5eBy9hquTqmzUgvFCTlml3LJdP39gPim4=";
+    hash = "sha256-rpCs24Q15XM4BdW1+IfysFR/8/ZU4o5b4MyJL48uDaU=";
   };
 
-  vendorHash = "sha256-QX7AFtW6Vm9P0ABOuTs1U++nvWBzpvtxhTbK40zDYqc=";
+  vendorHash = "sha256-Ul8XjH0Nav37UVpNQslOkF2bkiyqUAEZiIbcSW2tGkQ=";
 
   meta = {
     changelog = "https://github.com/consolidation/robo/blob/${finalAttrs.version}/CHANGELOG.md";

pkgs/by-name/sc/scalingo/package.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "scalingo";
-  version = "1.30.0";
+  version = "1.30.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "cli";
     rev = version;
-    hash = "sha256-vgkVxQK18RBIhhL9gyuH9kmCueJFDZByhy0FE4JuVO8=";
+    hash = "sha256-Dzm1f7iNVCzbSogYfjDIHJ2UbPnP1F9nF9QASe/H3TU=";
   };
 
   vendorHash = null;

pkgs/by-name/sc/scitokens-cpp/package.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/scitokens/scitokens-cpp/";
     description =
       "A C++ implementation of the SciTokens library with a C library interface";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     license = licenses.asl20;
     maintainers = with maintainers; [ evey ];
   };

pkgs/by-name/sc/scripthaus/package.nix

@@ -0,0 +1,39 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nix-update-script
+}:
+
+buildGoModule rec {
+  pname = "scripthaus";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "scripthaus-dev";
+    repo = "scripthaus";
+    rev = "v${version}";
+    hash = "sha256-ZWOSLkqjauONa+fKkagpUgWB4k+l1mzEEiC0RAMUmo0=";
+  };
+
+  vendorHash = "sha256-GUZNPLBgqN1zBzCcPl7TB9/4/Yk4e7K6I20nVaM6ank=";
+
+  CGO_ENABLED = 1;
+
+  ldflags = [ "-s" "-w" ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/scripthaus
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex" "^(v[0-9.]+)$" ];
+  };
+
+  meta = with lib; {
+    description = "Run bash, Python, and JS snippets from your Markdown files directly from the command-line";
+    homepage = "https://github.com/scripthaus-dev/scripthaus";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ raspher ];
+    mainProgram = "scripthaus";
+  };
+}

pkgs/by-name/sp/spicetify-cli/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.31.1";
+  version = "2.31.2";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-FmL1AalQzsHIJ1yDtcAt1sjfRdzbpplYK5t0UAdwIyY=";
+    hash = "sha256-kOjWjubYkAUIU18jKa6WMcBgrMFOg9lql59WXusAoa8=";
   };
 
-  vendorHash = "sha256-T7aUjzb69ZAnpLCpHv5C6ZyUktfC8Zt94rIju8QplWI=";
+  vendorHash = "sha256-9rYShpUVI3KSY6UgGmoXo899NkUezkAAkTgFPdq094E=";
 
   ldflags = [
     "-s -w"

pkgs/by-name/sr/srm-cuarzo/package.nix

@@ -14,9 +14,9 @@
 }:
 stdenv.mkDerivation (self: {
   pname = "srm-cuarzo";
-  version = "0.5.1-1";
+  version = "0.5.2-1";
   rev = "v${self.version}";
-  hash = "sha256-+Qn/obgYHWceQN0T3mbGjs/psj+lg43gm/cCBoMnRUk=";
+  hash = "sha256-FMd1v0K+H7DlSD0osmWrnuSKqQZxw3RUZq8JwZFm/f4=";
 
   src = fetchFromGitHub {
     inherit (self) rev hash;

pkgs/by-name/ti/tilix/package.nix

@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , meson
 , ninja
@@ -16,18 +17,17 @@
 , libunwind
 , appstream
 , nixosTests
-, fetchpatch
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tilix";
-  version = "1.9.5";
+  version = "1.9.6";
 
   src = fetchFromGitHub {
     owner = "gnunn1";
     repo = "tilix";
-    rev = version;
+    rev = finalAttrs.version;
-    sha256 = "sha256-sPVL5oYDOmloRVm/nONKkC20vZc907c7ixBF6E2PQ8Y=";
+    hash = "sha256-KP0ojwyZ5FaYKW0nK9mGGAiz1h+gTbfjCUDCgN2LAO8=";
   };
 
   # Default upstream else LDC fails to link
@@ -56,15 +56,6 @@ stdenv.mkDerivation rec {
     libunwind
   ];
 
-  patches = [
-    # https://github.com/gnunn1/tilix/issues/2151
-    (fetchpatch {
-      name = "tilix-replace-std-xml-with-gmarkup.patch";
-      url = "https://github.com/gnunn1/tilix/commit/b02779737997a02b98b690e6f8478d28d5e931a5.patch";
-      hash = "sha256-6p+DomJEZ/hCW8RTjttKsTDsgHZ6eFKj/71TU5O/Ysg=";
-    })
-  ];
-
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py
@@ -81,8 +72,8 @@ stdenv.mkDerivation rec {
     description = "Tiling terminal emulator following the Gnome Human Interface Guidelines";
     homepage = "https://gnunn1.github.io/tilix-web";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ midchildan ];
+    maintainers = with maintainers; [ midchildan jtbx ];
     platforms = platforms.linux;
     mainProgram = "tilix";
   };
-}
+})

pkgs/by-name/ve/vesktop/package.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , stdenvNoCC
-, gcc13Stdenv
 , fetchFromGitHub
 , substituteAll
 , makeWrapper
@@ -123,7 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
         libpulseaudio
         libnotify
         pipewire
-        gcc13Stdenv.cc.cc.lib
+        stdenv.cc.cc.lib
       ] ++ lib.optional withTTS speechd);
     in
     ''

pkgs/data/themes/elegant-sddm/default.nix

@@ -0,0 +1,63 @@
+{ lib
+, formats
+, stdenvNoCC
+, fetchFromGitHub
+, qtgraphicaleffects
+  /* An example of how you can override the background with a NixOS wallpaper
+  *
+  *  environment.systemPackages = [
+  *    (pkgs.elegant-sddm.override {
+  *      themeConfig.General = {
+           background = "${pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom.gnomeFilePath}";
+  *      };
+  *    })
+  *  ];
+  */
+, themeConfig ? null
+}:
+
+let
+  user-cfg = (formats.ini { }).generate "theme.conf.user" themeConfig;
+in
+
+stdenvNoCC.mkDerivation {
+  pname = "elegant-sddm";
+  version = "unstable-2024-02-08";
+
+  src = fetchFromGitHub {
+    owner = "surajmandalcell";
+    repo = "Elegant-sddm";
+    rev = "3102e880f46a1b72c929d13cd0a3fb64f973952a";
+    hash = "sha256-yn0fTYsdZZSOcaYlPCn8BUIWeFIKcTI1oioTWqjYunQ=";
+  };
+
+  propagatedBuildInputs = [
+    qtgraphicaleffects
+  ];
+
+  dontWrapQtApps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/sddm/themes"
+    cp -r Elegant/ "$out/share/sddm/themes/Elegant"
+  '' + (lib.optionalString (lib.isAttrs themeConfig) ''
+    ln -sf ${user-cfg} $out/share/sddm/themes/Elegant/theme.conf.user
+  '') + ''
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    mkdir -p $out/nix-support
+
+    echo ${qtgraphicaleffects} >> $out/nix-support/propagated-user-env-packages
+  '';
+
+  meta = with lib; {
+    description = "Sleek and stylish SDDM theme crafted in QML";
+    homepage = "https://github.com/surajmandalcell/Elegant-sddm";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ GaetanLepage ];
+  };
+}

pkgs/development/compilers/flutter/artifacts/overrides/darwin.nix

@@ -0,0 +1,15 @@
+{ darwin }:
+{
+  buildInputs ? [ ],
+  ...
+}:
+{
+  postPatch = ''
+    if [ "$pname" == "flutter-tools" ]; then
+      # Remove impure references to `arch` and use arm64 instead of arm64e.
+      substituteInPlace lib/src/ios/xcodeproj.dart \
+        --replace-fail /usr/bin/arch '${darwin.adv_cmds}/bin/arch' \
+        --replace-fail arm64e arm64
+    fi
+  '';
+}

pkgs/development/compilers/flutter/flutter-tools.nix

@@ -1,4 +1,6 @@
-{ systemPlatform
+{ lib
+, stdenv
+, systemPlatform
 , buildDartApplication
 , git
 , which
@@ -7,6 +9,7 @@
 , flutterSrc
 , patches ? [ ]
 , pubspecLock
+, darwin
 }:
 
 buildDartApplication.override { inherit dart; } rec {
@@ -21,7 +24,15 @@ buildDartApplication.override { inherit dart; } rec {
   inherit patches;
   # The given patches are made for the entire SDK source tree.
   prePatch = ''pushd "$NIX_BUILD_TOP/source"'';
-  postPatch = ''popd'';
+  postPatch = ''
+    popd
+  ''
+  # Remove impure references to `arch` and use arm64 instead of arm64e.
+  + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace lib/src/ios/xcodeproj.dart \
+      --replace-fail /usr/bin/arch '${darwin.adv_cmds}/bin/arch' \
+      --replace-fail arm64e arm64
+  '';
 
   # When the JIT snapshot is being built, the application needs to run.
   # It attempts to generate configuration files, and relies on a few external

pkgs/development/compilers/flutter/flutter.nix

@@ -136,7 +136,7 @@ let
         '';
         homepage = "https://flutter.dev";
         license = licenses.bsd3;
-        platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+        platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
         maintainers = with maintainers; [ babariviere ericdallo FlafyDev hacker1024 ];
       };
     };

pkgs/development/compilers/flutter/patches/override-host-platform.patch

@@ -13,7 +13,7 @@ index 1ce1951cef..1bd7602318 100644
 +    'x86_64-linux' => HostPlatform.linux_x64,
 +    'aarch64-linux' => HostPlatform.linux_arm64,
 +    'x86_64-darwin' => HostPlatform.darwin_x64,
-+    'arm64-darwin' => HostPlatform.darwin_arm64,
++    'aarch64-darwin' => HostPlatform.darwin_arm64,
 +    String value => throw ArgumentError.value(value, 'NIX_FLUTTER_HOST_PLATFORM', 'Unknown Nix host platform!'),
 +  };
  

pkgs/development/compilers/flutter/update/get-artifact-hashes.nix.in

@@ -22,6 +22,7 @@ let
     "x86_64-linux"
     "aarch64-linux"
     "x86_64-darwin"
+    "aarch64-darwin"
   ];
 
   derivations =

pkgs/development/compilers/flutter/versions/3_13/data.json

@@ -13,42 +13,50 @@
     "android": {
       "x86_64-linux": "sha256-Uc36aBq8wQo2aEvjAPOoixZElWOE/GNRm2GUfhbwT3Y=",
       "aarch64-linux": "sha256-Uc36aBq8wQo2aEvjAPOoixZElWOE/GNRm2GUfhbwT3Y=",
-      "x86_64-darwin": "sha256-v/6/GTj7732fEOIgSaoM00yaw2qNwOMuvbuoCvii7vQ="
+      "x86_64-darwin": "sha256-v/6/GTj7732fEOIgSaoM00yaw2qNwOMuvbuoCvii7vQ=",
+      "aarch64-darwin": "sha256-v/6/GTj7732fEOIgSaoM00yaw2qNwOMuvbuoCvii7vQ="
     },
     "fuchsia": {
       "x86_64-linux": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=",
       "aarch64-linux": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=",
-      "x86_64-darwin": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk="
+      "x86_64-darwin": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=",
+      "aarch64-darwin": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk="
     },
     "ios": {
       "x86_64-linux": "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=",
       "aarch64-linux": "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=",
-      "x86_64-darwin": "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao="
+      "x86_64-darwin": "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=",
+      "aarch64-darwin": "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao="
     },
     "linux": {
       "x86_64-linux": "sha256-0gIOwux3YBdmcXgwICr8dpftj1CauaBUX8Rt5GG0WSs=",
       "aarch64-linux": "sha256-drGHsuJoOCLqrhVrXczqJRCOtpeWVlqdWW0OSMS/l5M=",
-      "x86_64-darwin": "sha256-0gIOwux3YBdmcXgwICr8dpftj1CauaBUX8Rt5GG0WSs="
+      "x86_64-darwin": "sha256-0gIOwux3YBdmcXgwICr8dpftj1CauaBUX8Rt5GG0WSs=",
+      "aarch64-darwin": "sha256-drGHsuJoOCLqrhVrXczqJRCOtpeWVlqdWW0OSMS/l5M="
     },
     "macos": {
       "x86_64-linux": "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=",
       "aarch64-linux": "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=",
-      "x86_64-darwin": "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc="
+      "x86_64-darwin": "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=",
+      "aarch64-darwin": "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc="
     },
     "universal": {
       "x86_64-linux": "sha256-wATt1UPjo/fh7RFO1vvcUAdo0dMAaaOUIuzYodsM0v0=",
       "aarch64-linux": "sha256-Z9bszNaIpCccG7OfvE5WFsw36dITiyCQAZ6p29+Yq68=",
-      "x86_64-darwin": "sha256-qN5bAXRfQ78TWF3FLBIxWzUB5y5OrZVQTEilY5J/+2k="
+      "x86_64-darwin": "sha256-qN5bAXRfQ78TWF3FLBIxWzUB5y5OrZVQTEilY5J/+2k=",
+      "aarch64-darwin": "sha256-mSpAPKyP9v0dbkXqYkzGOnD5OEjRZigiRElXXcHZ5TE="
     },
     "web": {
       "x86_64-linux": "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=",
       "aarch64-linux": "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=",
-      "x86_64-darwin": "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0="
+      "x86_64-darwin": "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=",
+      "aarch64-darwin": "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0="
     },
     "windows": {
       "x86_64-linux": "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=",
       "aarch64-linux": "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=",
-      "x86_64-darwin": "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI="
+      "x86_64-darwin": "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=",
+      "aarch64-darwin": "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI="
     }
   },
   "pubspecLock": {

pkgs/development/compilers/flutter/versions/3_16/data.json

@@ -13,41 +13,49 @@
     "android": {
       "aarch64-linux": "sha256-j8jstEE1RsTVHJbq6f6We0An+CyJz9JH/YClyNA4mwg=",
       "x86_64-darwin": "sha256-0FBI0CGMcxyttkzrdyjJlkGAjFd/yMuAQS3pDrNXZZw=",
+      "aarch64-darwin": "sha256-0FBI0CGMcxyttkzrdyjJlkGAjFd/yMuAQS3pDrNXZZw=",
       "x86_64-linux": "sha256-j8jstEE1RsTVHJbq6f6We0An+CyJz9JH/YClyNA4mwg="
     },
     "fuchsia": {
       "aarch64-linux": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=",
       "x86_64-darwin": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=",
+      "aarch64-darwin": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=",
       "x86_64-linux": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk="
     },
     "ios": {
       "aarch64-linux": "sha256-V3VXRX8hn45J+NhzKli+NAc3TGiSoeVQRlJte8DDbZw=",
       "x86_64-darwin": "sha256-V3VXRX8hn45J+NhzKli+NAc3TGiSoeVQRlJte8DDbZw=",
+      "aarch64-darwin": "sha256-V3VXRX8hn45J+NhzKli+NAc3TGiSoeVQRlJte8DDbZw=",
       "x86_64-linux": "sha256-V3VXRX8hn45J+NhzKli+NAc3TGiSoeVQRlJte8DDbZw="
     },
     "linux": {
       "aarch64-linux": "sha256-LWpou3L7bAWGn8i4nDT/BZez2Uhf/LbqC2C4Z98hCHQ=",
       "x86_64-darwin": "sha256-BzjmO4F8B9GagYPbdvoT55r+YgZcP4BUaKgJPGZDXOU=",
+      "aarch64-darwin": "sha256-LWpou3L7bAWGn8i4nDT/BZez2Uhf/LbqC2C4Z98hCHQ=",
       "x86_64-linux": "sha256-BzjmO4F8B9GagYPbdvoT55r+YgZcP4BUaKgJPGZDXOU="
     },
     "macos": {
       "aarch64-linux": "sha256-BMFqhhy1O1hK33Pj2cxnCAzK9wwHkwT4gNbJ1GaLrnk=",
       "x86_64-darwin": "sha256-BMFqhhy1O1hK33Pj2cxnCAzK9wwHkwT4gNbJ1GaLrnk=",
+      "aarch64-darwin": "sha256-BMFqhhy1O1hK33Pj2cxnCAzK9wwHkwT4gNbJ1GaLrnk=",
       "x86_64-linux": "sha256-BMFqhhy1O1hK33Pj2cxnCAzK9wwHkwT4gNbJ1GaLrnk="
     },
     "universal": {
       "aarch64-linux": "sha256-uB2YZRjioP/koMbPvaBHsezjPO0w5a+BpxZaDuiINIY=",
       "x86_64-darwin": "sha256-Qwf12gMqrW5nDC9Is08oxWTbKMptRQRAIb58JETq3xA=",
+      "aarch64-darwin": "sha256-Emus5J3mqPv47PD6xqNUD1KpXhVkX4JpURWuYG6KC14=",
       "x86_64-linux": "sha256-quSFKx7TZRJpK+4YDt5f9jwr7rZsSsaXMxhJ8vIcczQ="
     },
     "web": {
       "aarch64-linux": "sha256-rQphVm+T4k5B4OYYw0sJwYBOsNvUOC9fu8IuvXN7hVw=",
       "x86_64-darwin": "sha256-rQphVm+T4k5B4OYYw0sJwYBOsNvUOC9fu8IuvXN7hVw=",
+      "aarch64-darwin": "sha256-rQphVm+T4k5B4OYYw0sJwYBOsNvUOC9fu8IuvXN7hVw=",
       "x86_64-linux": "sha256-rQphVm+T4k5B4OYYw0sJwYBOsNvUOC9fu8IuvXN7hVw="
     },
     "windows": {
       "aarch64-linux": "sha256-HL3QLwzze9aO+T/2/xbHqhKV1/ba++MuRnk206hfJdU=",
       "x86_64-darwin": "sha256-HL3QLwzze9aO+T/2/xbHqhKV1/ba++MuRnk206hfJdU=",
+      "aarch64-darwin": "sha256-HL3QLwzze9aO+T/2/xbHqhKV1/ba++MuRnk206hfJdU=",
       "x86_64-linux": "sha256-HL3QLwzze9aO+T/2/xbHqhKV1/ba++MuRnk206hfJdU="
     }
   },

pkgs/development/libraries/fancypp/default.nix

@@ -1,31 +0,0 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-}:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "fancypp";
-  version = "unstable-2021-04-08";
-
-  src = fetchFromGitHub {
-    owner = "Curve";
-    repo = "fancypp";
-    rev = "ede7f712a08f7c66ff4a5590ad94a477c48850a5";
-    sha256 = "sha256-E2JsQnvrqrZFYo+xBJr7xDCoPnRQftqUjjBpZzFvIic=";
-  };
-
-  # Header-only library.
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir "$out"
-    cp -r include "$out"
-  '';
-
-  meta = with lib; {
-    description = "Tiny C++ Library for terminal colors and more!";
-    homepage = "https://github.com/Curve/fancypp";
-    maintainers = with maintainers; [ aidalgol ];
-    license = licenses.mit;
-  };
-}

pkgs/development/libraries/gdal/default.nix

@@ -198,8 +198,9 @@ stdenv.mkDerivation (finalAttrs: {
     ++ darwinDeps
     ++ nonDarwinDeps;
 
+  pythonPath = [ python3.pkgs.numpy ];
   postInstall = ''
-    wrapPythonPrograms
+    wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
   '' + lib.optionalString useJava ''
     cd $out/lib
     ln -s ./jni/libgdalalljni${stdenv.hostPlatform.extensions.sharedLibrary}

pkgs/development/libraries/lemon-graph/default.nix

@@ -18,6 +18,11 @@ stdenv.mkDerivation rec {
   # error: no viable conversion from ...
   doCheck = !stdenv.isDarwin;
 
+  patches = [
+    # error: ISO C++17 does not allow 'register' storage class specifier
+    ./remove-register.patch
+  ];
+
   meta = with lib; {
     homepage = "https://lemon.cs.elte.hu/trac/lemon";
     description = "Efficient library for combinatorial optimization tasks on graphs and networks";

pkgs/development/libraries/lemon-graph/remove-register.patch

@@ -0,0 +1,15 @@
+diff --git a/lemon/random.h b/lemon/random.h
+index 8de74ede8a..f9861f3916 100644
+--- a/lemon/random.h
++++ b/lemon/random.h
+@@ -249,8 +249,8 @@ namespace lemon {
+ 
+         current = state + length;
+ 
+-        register Word *curr = state + length - 1;
+-        register long num;
++        Word *curr = state + length - 1;
++        long num;
+ 
+         num = length - shift;
+         while (num--) {

pkgs/development/libraries/libtheora/default.nix

@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, libogg, libvorbis, pkg-config, autoreconfHook, fetchpatch }:
+{ lib, stdenv, fetchurl, libogg, libvorbis, pkg-config, autoreconfHook, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "libtheora";
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
       url = "https://github.com/xiph/theora/commit/28cc6dbd9b2a141df94f60993256a5fca368fa54.diff";
       sha256 = "16jqrq4h1b3krj609vbpzd5845cvkbh3mwmjrcdg35m490p19x9k";
     })
+  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
+    ./mingw-remove-export.patch
   ];
 
   configureFlags = [ "--disable-examples" ];
@@ -30,6 +32,6 @@ stdenv.mkDerivation rec {
     description = "Library for Theora, a free and open video compression format";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
   };
 }

pkgs/development/libraries/libtheora/mingw-remove-export.patch

@@ -0,0 +1,18 @@
+diff --git a/win32/xmingw32/libtheoradec-all.def b/win32/xmingw32/libtheoradec-all.def
+index 566eeb3..4a2e766 100644
+--- a/win32/xmingw32/libtheoradec-all.def
++++ b/win32/xmingw32/libtheoradec-all.def
+@@ -1,4 +1,3 @@
+-EXPORTS
+ ; Old alpha API
+ 	theora_version_string @ 1
+ 	theora_version_number @ 2
+diff --git a/win32/xmingw32/libtheoraenc-all.def b/win32/xmingw32/libtheoraenc-all.def
+index 36d2dad..d1da2f4 100644
+--- a/win32/xmingw32/libtheoraenc-all.def
++++ b/win32/xmingw32/libtheoraenc-all.def
+@@ -1,4 +1,3 @@
+-EXPORTS
+ ; Old alpha API
+ 	theora_encode_init @ 1
+ 	theora_encode_YUVin @ 2

pkgs/development/libraries/meshoptimizer/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, cmake, nix-update-script }:
 
 let
   basis_universal = fetchFromGitHub {
@@ -7,14 +7,14 @@ let
     rev = "8903f6d69849fd782b72a551a4dd04a264434e20";
     hash = "sha256-o3dCxAAkpMoNkvkM7qD75cPn/obDc/fJ8u7KLPm1G6g=";
   };
-in stdenv.mkDerivation {
+in stdenv.mkDerivation rec {
   pname = "meshoptimizer";
-  version = "unstable-2023-03-22";
+  version = "0.20";
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "meshoptimizer";
-    hash = "sha256-OWeptdnKFvTyfkz0sFCpiTI7323GfVE8vb8bNUBnslA=";
+    rev = "v${version}";
-    rev = "49d9222385daf61a9ce75bb4699472408eb3df3e";
+    hash = "sha256-QCxpM2g8WtYSZHkBzLTJNQ/oHb5j/n9rjaVmZJcCZIA=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -27,6 +27,8 @@ in stdenv.mkDerivation {
   ] ++ lib.optional (!stdenv.hostPlatform.isStatic)
     "-DMESHOPT_BUILD_SHARED_LIBS:BOOL=ON";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Mesh optimization library that makes meshes smaller and faster to render";
     homepage = "https://github.com/zeux/meshoptimizer";

pkgs/development/libraries/nuraft/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, boost, asio, openssl, zlib }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, boost, asio, openssl, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "nuraft";
@@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-puO8E7tSLqB0oq/NlzEZqQgIZKm7ZUb4HhR0XuI9dco=";
   };
 
+  patches = [
+    # Fix gcc-13 build failure:
+    #   https://github.com/eBay/NuRaft/pull/435
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/eBay/NuRaft/commit/fddf33a4d8cd7fcd0306cc838a30893a4df3d58f.patch";
+      hash = "sha256-JOtR3llE4QwQM7PBx+ILR87zsPB0GZ/aIKbSdHIrePA=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ boost asio openssl zlib ];
 

pkgs/development/libraries/poppler/default.nix

@@ -40,19 +40,19 @@ let
     domain = "gitlab.freedesktop.org";
     owner = "poppler";
     repo = "test";
-    rev = "e3cdc82782941a8d7b8112f83b4a81b3d334601a";
+    rev = "400f3ff05b2b1c0ae17797a0bd50e75e35c1f1b1";
-    hash = "sha256-i/NjVWC/PXAXnv88qNaHFBQQNEjRgjdV224NgENaESo=";
+    hash = "sha256-Y4aNOJLqo4g6tTW6TAb60jAWtBhRgT/JXsub12vi3aU=";
   };
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "poppler-${suffix}";
-  version = "23.11.0"; # beware: updates often break cups-filters build, check scribus too!
+  version = "24.01.0"; # beware: updates often break cups-filters build, check scribus too!
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://poppler.freedesktop.org/poppler-${version}.tar.xz";
-    hash = "sha256-+ZzKZ5nLnLbJL8Hg63hUe2EctzN1CrfLBHyw5sJGU5w=";
+    hash = "sha256-x972k6ekkoMPSdSXqAzGuchctXsV6b4tLWFRU7ecrgg=";
   };
 
   nativeBuildInputs = [
@@ -137,6 +137,7 @@ stdenv.mkDerivation (finalAttrs: rec {
 
   meta = with lib; {
     homepage = "https://poppler.freedesktop.org/";
+    changelog = "https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-${version}/NEWS";
     description = "A PDF rendering library";
     longDescription = ''
       Poppler is a PDF rendering library based on the xpdf-3.0 code base. In

pkgs/development/libraries/qt-5/5.15/default.nix

@@ -211,8 +211,14 @@ let
         url = "https://github.com/qtwebkit/qtwebkit/commit/5c272a21e621a66862821d3ae680f27edcc64c19.patch";
         sha256 = "9hjqLyABz372QDgoq7nXXXQ/3OXBGcYN1/92ekcC3WE=";
       })
+      (fetchpatch {
+        name = "qtwebkit-libxml2-api-change.patch";
+        url = "https://github.com/WebKit/WebKit/commit/1bad176b2496579d760852c80cff3ad9fb7c3a4b.patch";
+        sha256 = "WZEj+UuKhgJBM7auhND3uddk1wWdTY728jtiWVe7CSI=";
+      })
       ./qtwebkit.patch
       ./qtwebkit-icu68.patch
+      ./qtwebkit-cstdint.patch
     ] ++ lib.optionals stdenv.isDarwin [
       ./qtwebkit-darwin-no-readline.patch
       ./qtwebkit-darwin-no-qos-classes.patch

pkgs/development/libraries/qt-5/5.15/qtwebkit-cstdint.patch

@@ -0,0 +1,11 @@
+diff -up qtwebkit-5.212.0-alpha4/Source/ThirdParty/ANGLE/src/common/mathutil.h.me qtwebkit-5.212.0-alpha4/Source/ThirdParty/ANGLE/src/common/mathutil.h
+--- qtwebkit-5.212.0-alpha4/Source/ThirdParty/ANGLE/src/common/mathutil.h.me	2023-02-20 15:40:04.045911245 +0100
++++ qtwebkit-5.212.0-alpha4/Source/ThirdParty/ANGLE/src/common/mathutil.h	2023-02-20 15:40:39.038549787 +0100
+@@ -16,6 +16,7 @@
+ #include <algorithm>
+ #include <string.h>
+ #include <stdlib.h>
++#include <cstdint>
+ 
+ namespace gl
+ {

pkgs/development/libraries/raft-canonical/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "raft-canonical";
-  version = "0.18.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "raft";
     rev = "refs/tags/v${version}";
-    hash = "sha256-C3LfrdXNs5AG9B2n2c39fTjv2gri910EYxApGWwtH90=";
+    hash = "sha256-ogTw0+ZFhMRaLAxAAXzHSlLRYFuX8W/zjqglXHfvUv4=";
   };
 
   nativeBuildInputs = [ autoreconfHook file pkg-config ];

pkgs/development/libraries/semver-cpp/default.nix

@@ -1,31 +0,0 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-}:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "semver-cpp";
-  version = "0.3.0";
-
-  src = fetchFromGitHub {
-    owner = "Neargye";
-    repo = "semver";
-    rev = "v${version}";
-    sha256 = "sha256-nRWmY/GJtSkPJIW7i7/eIr/YtfyvYhJVZBRIDXUC7xg=";
-  };
-
-  # Header-only library.
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir "$out"
-    cp -r include "$out"
-  '';
-
-  meta = with lib; {
-    description = "Semantic Versioning for modern C++";
-    homepage = "https://github.com/Neargye/semver";
-    maintainers = with maintainers; [ aidalgol ];
-    license = licenses.mit;
-  };
-}

pkgs/development/ocaml-modules/ocaml-lsp/default.nix

@@ -8,8 +8,9 @@
 , dot-merlin-reader
 , spawn
 , ocamlc-loc
-, odoc-parser
 , merlin-lib
+, astring
+, camlp-streams
 }:
 
 buildDunePackage rec {
@@ -21,7 +22,7 @@ buildDunePackage rec {
   ++ lib.optional (lib.versionAtLeast version "1.9") spawn
   ++ lib.optionals (lib.versionAtLeast version "1.10") [ fiber xdg ]
   ++ lib.optional (lib.versionAtLeast version "1.14.2") ocamlc-loc
-  ++ lib.optional (lib.versionAtLeast version "1.16.2") [ odoc-parser merlin-lib ];
+  ++ lib.optionals (lib.versionAtLeast version "1.17.0") [ astring camlp-streams merlin-lib ];
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix

@@ -9,7 +9,7 @@
 , ocaml
 , version ?
     if lib.versionAtLeast ocaml.version "4.14" then
-      "1.16.2"
+      "1.17.0"
     else if lib.versionAtLeast ocaml.version "4.13" then
       "1.10.5"
     else if lib.versionAtLeast ocaml.version "4.12" then
@@ -19,10 +19,10 @@
 }:
 
 let params = {
-  "1.16.2" = {
+  "1.17.0" = {
     name = "lsp";
     minimalOCamlVersion = "4.14";
-    sha256 = "sha256-FIfVpOLy1PAjNBBYVRvbi6hsIzZ7fFtP3aOqfcAqrsQ=";
+    sha256 = "sha256-j7i71xfu/SYItNg0WBBbZg4N46ETTcj8IWrmWdTRlgA=";
   };
   "1.14.2" = {
     name = "lsp";

pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix

@@ -24,7 +24,7 @@
 , ocaml
 , version ?
     if lib.versionAtLeast ocaml.version "4.14" then
-      "1.16.2"
+      "1.17.0"
     else if lib.versionAtLeast ocaml.version "4.13" then
       "1.10.5"
     else if lib.versionAtLeast ocaml.version "4.12" then

pkgs/development/php-packages/composer/default.nix

@@ -1,4 +1,4 @@
-{ lib, callPackage, fetchFromGitHub, php, unzip, _7zz, xz, git, curl, cacert, makeBinaryWrapper }:
+{ lib, callPackage, fetchFromGitHub, fetchpatch, php, unzip, _7zz, xz, git, curl, cacert, makeBinaryWrapper }:
 
 php.buildComposerProject (finalAttrs: {
   # Hash used by ../../../build-support/php/pkgs/composer-phar.nix to
@@ -22,6 +22,18 @@ php.buildComposerProject (finalAttrs: {
     hash = "sha256-KsTZi7dSlQcAxoen9rpofbptVdLYhK+bZeDSXQY7o5M=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2024-24821.patch";
+      url = "https://github.com/composer/composer/commit/77e3982918bc1d886843dc3d5e575e7e871b27b7.patch";
+      hash = "sha256-Q7gkPLf59+p++DpfJZeOrAOiWePuGkdGYRaS/rK+Nv4=";
+      excludes = [
+        # Skipping test files, they are not included in the source tarball
+        "tests/*"
+      ];
+    })
+  ];
+
   nativeBuildInputs = [ makeBinaryWrapper ];
 
   postInstall = ''