Merge #255658: staging-next 2023-09-17

2023-09-27 18:00:00 +02:00 · 2023-09-27 18:00:00 +02:00 · 8a86b98f0b
commit 8a86b98f0b
parent bc571a7386 c564a122a6
163 changed files with 795 additions and 1322 deletions
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -10,6 +10,12 @@

 - The `nixos-rebuild` command has been given a `list-generations` subcommand. See `man nixos-rebuild` for more details.

+- [systemd](https://systemd.io) has been updated from v253 to v254, see [the release notes](https://github.com/systemd/systemd/blob/v254/NEWS#L3-L659) for more information on the changes.
+    - `boot.resumeDevice` **must be specified** when hibernating if not in EFI mode.
+    - systemd may warn your system about the permissions of your ESP partition (often `/boot`), this warning can be ignored for now, we are looking
+      into a satisfying solution regarding this problem.
+    - Updating with `nixos-rebuild boot` and rebooting is recommended, since in some rare cases the `nixos-rebuild switch` into the new generation on a live system might fail due to missing mount units.
+
 - [`sudo-rs`], a reimplementation of `sudo` in Rust, is now supported.
  An experimental new module `security.sudo-rs` was added.
  Switching to it (via `security.sudo.enable = false; security.sudo-rs.enable = true;`) introduces
@ -20,7 +26,6 @@

 [`sudo-rs`]: https://github.com/memorysafety/sudo-rs/

-
 ## New Services {#sec-release-23.11-new-services}

 - [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server built for redstone. Available as [services.mchprs](#opt-services.mchprs.enable).
@ -256,6 +261,8 @@

 - New options were added to `services.searx` for better SearXNG support, including options for the built-in rate limiter and bot protection and automatically configuring a local redis server.

+- `jq` was updated to 1.7, its [first release in 5 years](https://github.com/jqlang/jq/releases/tag/jq-1.7).
+
 - A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.

 - DocBook option documentation is no longer supported, all module documentation now uses markdown.
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@ -168,6 +168,9 @@ in
          # ...but only the keymaps if we don't
          "/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) { source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps"; };
        };
+        boot.initrd.systemd.additionalUpstreamUnits = [
+          "systemd-vconsole-setup.service"
+        ];
        boot.initrd.systemd.storePaths = [
          "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
          "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@ -188,6 +188,7 @@ in
          nativeBuildInputs = [
            cfg.package
            pkgs.fakeroot
+            pkgs.util-linux
          ] ++ fileSystemTools;
        } ''
        amendedRepartDefinitions=$(${amendRepartDefinitions} ${partitions} ${definitionsDirectory})
@ -195,7 +196,7 @@ in
        mkdir -p $out
        cd $out

-        fakeroot systemd-repart \
+        unshare --map-root-user fakeroot systemd-repart \
          --dry-run=no \
          --empty=create \
          --size=auto \
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -48,6 +48,7 @@ let
      "rescue.service"

      # Udev.
+      "systemd-tmpfiles-setup-dev-early.service"
      "systemd-udevd-control.socket"
      "systemd-udevd-kernel.socket"
      "systemd-udevd.service"
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -57,7 +57,6 @@ let
    "systemd-ask-password-console.service"
    "systemd-fsck@.service"
    "systemd-halt.service"
-    "systemd-hibernate-resume@.service"
    "systemd-journald-audit.socket"
    "systemd-journald-dev-log.socket"
    "systemd-journald.service"
--- a/pkgs/applications/audio/giada/default.nix
+++ b/pkgs/applications/audio/giada/default.nix
@ -41,7 +41,6 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DCMAKE_INSTALL_BINDIR=bin"
-    "-DCMAKE_BUILD_TYPE=Release"
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/audio/sfizz/default.nix
+++ b/pkgs/applications/audio/sfizz/default.nix
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
      --replace '/usr/bin/zenity' '${gnome.zenity}/bin/zenity'
  '';

-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DSFIZZ_TESTS=ON" ];
+  cmakeFlags = [ "-DSFIZZ_TESTS=ON" ];

  doCheck = true;

--- a/pkgs/applications/audio/spotify-qt/default.nix
+++ b/pkgs/applications/audio/spotify-qt/default.nix
@ -22,7 +22,7 @@ mkDerivation rec {

   nativeBuildInputs = [ cmake ];

-   cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DCMAKE_INSTALL_PREFIX=" ];
+   cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=" ];

   installFlags = [ "DESTDIR=$(out)" ];

--- a/pkgs/applications/blockchains/aeon/default.nix
+++ b/pkgs/applications/blockchains/aeon/default.nix
@ -26,7 +26,6 @@ stdenv.mkDerivation {
  ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DBUILD_GUI_DEPS=ON"
    "-DReadline_ROOT_DIR=${readline.dev}"
  ];
--- a/pkgs/applications/blockchains/haven-cli/default.nix
+++ b/pkgs/applications/blockchains/haven-cli/default.nix
@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
    ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DUSE_DEVICE_TREZOR=ON"
    "-DBUILD_GUI_DEPS=ON"
    "-DReadline_ROOT_DIR=${readline.dev}"
--- a/pkgs/applications/blockchains/monero-cli/default.nix
+++ b/pkgs/applications/blockchains/monero-cli/default.nix
@ -58,7 +58,6 @@ stdenv.mkDerivation rec {
    ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DUSE_DEVICE_TREZOR=ON"
    "-DBUILD_GUI_DEPS=ON"
    "-DReadline_ROOT_DIR=${readline.dev}"
--- a/pkgs/applications/blockchains/oxen/default.nix
+++ b/pkgs/applications/blockchains/oxen/default.nix
@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    # "-DUSE_DEVICE_TREZOR=ON"
    # "-DBUILD_GUI_DEPS=ON"
    "-DReadline_ROOT_DIR=${readline.dev}"
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -115,7 +115,6 @@ in

    cmakeFlags = [
      "-DRSTUDIO_TARGET=${if server then "Server" else "Desktop"}"
-      "-DCMAKE_BUILD_TYPE=Release"
      "-DRSTUDIO_USE_SYSTEM_SOCI=ON"
      "-DRSTUDIO_USE_SYSTEM_BOOST=ON"
      "-DRSTUDIO_USE_SYSTEM_YAML_CPP=ON"
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1811";
+  version = "9.0.1897";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-b/fATWaHcIZIvkmr/UQ4R45ii9N0kWJMb7DerF/JYIA=";
+    hash = "sha256-ywxJ9evXWbqZ6o6EqDIQWK16J05McAdvPl0Y9cW5Zvc=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/emulators/vbam/default.nix
+++ b/pkgs/applications/emulators/vbam/default.nix
@ -44,7 +44,6 @@ stdenv.mkDerivation rec {
  ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE='Release'"
    "-DENABLE_FFMPEG='true'"
    "-DENABLE_LINK='true'"
    "-DSYSCONFDIR=etc"
--- a/pkgs/applications/graphics/brlcad/default.nix
+++ b/pkgs/applications/graphics/brlcad/default.nix
@ -34,7 +34,6 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DBRLCAD_ENABLE_STRICT=OFF"
-    "-DCMAKE_BUILD_TYPE=Release"
  ];

  meta = with lib; {
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@ -47,10 +47,11 @@ mkDerivation rec {
      --replace 'PYTHONPATH=''${_krita_python_path}' 'PYTHONPATH=${pythonPath}'
  '';

+  cmakeBuildType = "RelWithDebInfo";
+
  cmakeFlags = [
    "-DPYQT5_SIP_DIR=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
    "-DPYQT_SIP_DIR_OVERRIDE=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
-    "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
  ];

  preInstall = ''
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@ -45,7 +45,6 @@ in stdenv.mkDerivation rec {
  '';

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DPARAVIEW_ENABLE_FFMPEG=ON"
    "-DPARAVIEW_ENABLE_GDAL=ON"
    "-DPARAVIEW_ENABLE_MOTIONFX=ON"
--- a/pkgs/applications/misc/huggle/default.nix
+++ b/pkgs/applications/misc/huggle/default.nix
@ -40,9 +40,10 @@ stdenv.mkDerivation rec {
    substituteInPlace src/CMakeLists.txt --replace '@libirc_includes@' '${libirc.out}'
  '';

+  cmakeBuildType = "None";
+
  cmakeFlags = [
    "-S" "/build/source/src"
-    "-DCMAKE_BUILD_TYPE=None"
    "-DINSTALL_DATA_DIR=bin"
    "-DQT5_BUILD=ON"
    "-DWEB_ENGINE=ON"
--- a/pkgs/applications/misc/keyleds/default.nix
+++ b/pkgs/applications/misc/keyleds/default.nix
@ -52,9 +52,7 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=MinSizeRel"
-  ];
+  cmakeBuildType = "MinSizeRel";

  meta = {
    homepage = "https://github.com/keyleds/keyleds";
--- a/pkgs/applications/misc/opentrack/default.nix
+++ b/pkgs/applications/misc/opentrack/default.nix
@ -46,7 +46,6 @@ in
    dontWrapQtApps = true;

    cmakeFlags = [
-      "-DCMAKE_BUILD_TYPE=RELEASE"
      "-DSDK_ARUCO_LIBPATH=${aruco}/lib/libaruco.a"
      "-DSDK_XPLANE=${xplaneSdk}"
    ];
--- a/pkgs/applications/networking/qv2ray/default.nix
+++ b/pkgs/applications/networking/qv2ray/default.nix
@ -42,7 +42,6 @@ mkDerivation rec {
  };

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DQV2RAY_DISABLE_AUTO_UPDATE=on"
    "-DQV2RAY_USE_V5_CORE=on"
    "-DQV2RAY_TRANSLATION_PATH=${placeholder "out"}/share/qv2ray/lang"
--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@ -51,9 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
    python.pkgs.numpy
  ];

-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
-  ] ++ lib.optionals usePython [
+  cmakeFlags = lib.optionals usePython [
    "-DUSE_PYTHON_CONFIG=ON"
  ];

--- a/pkgs/applications/science/biology/sortmerna/default.nix
+++ b/pkgs/applications/science/biology/sortmerna/default.nix
@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
  buildInputs = [ zlib rocksdb rapidjson ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DPORTABLE=off"
    "-DRAPIDJSON_HOME=${rapidjson}"
    "-DROCKSDB_HOME=${rocksdb}"
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@ -104,7 +104,6 @@ stdenv.mkDerivation rec {
    "-DKICAD_BUILD_QA_TESTS=OFF"
  ]
  ++ optionals (debug) [
-    "-DCMAKE_BUILD_TYPE=Debug"
    "-DKICAD_STDLIB_DEBUG=ON"
    "-DKICAD_USE_VALGRIND=ON"
  ]
@ -115,6 +114,8 @@ stdenv.mkDerivation rec {
    "-DKICAD_SANITIZE_THREADS=ON"
  ];

+  cmakeBuildType = if debug then "Debug" else "Release";
+
  nativeBuildInputs = [
    cmake
    doxygen
--- a/pkgs/applications/science/electronics/openboardview/default.nix
+++ b/pkgs/applications/science/electronics/openboardview/default.nix
@ -39,7 +39,6 @@ stdenv.mkDerivation rec {
  '';

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DGLAD_REPRODUCIBLE=On"
  ];

--- a/pkgs/applications/science/logic/cvc4/default.nix
+++ b/pkgs/applications/science/logic/cvc4/default.nix
@ -35,9 +35,8 @@ stdenv.mkDerivation rec {
  preConfigure = ''
    patchShebangs ./src/
  '';
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Production"
-  ];
+
+  cmakeBuildType = "Production";

  meta = with lib; {
    description = "A high-performance theorem prover and SMT solver";
--- a/pkgs/applications/science/logic/cvc5/default.nix
+++ b/pkgs/applications/science/logic/cvc5/default.nix
@ -21,8 +21,9 @@ stdenv.mkDerivation rec {
    patchShebangs ./src/
  '';

+  cmakeBuildType = "Production";
+
  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Production"
    "-DBUILD_SHARED_LIBS=1"
    "-DANTLR3_JAR=${antlr3_4}/lib/antlr/antlr-3.4-complete.jar"
  ];
--- a/pkgs/applications/science/logic/klee/default.nix
+++ b/pkgs/applications/science/logic/klee/default.nix
@ -72,10 +72,11 @@ in stdenv.mkDerivation rec {
    (lit.override { python = kleePython; })
  ];

+  cmakeBuildType = if debug then "Debug" else if !debug && includeDebugInfo then "RelWithDebInfo" else "MinSizeRel";
+
  cmakeFlags = let
    onOff = val: if val then "ON" else "OFF";
  in [
-    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else if !debug && includeDebugInfo then "RelWithDebInfo" else "MinSizeRel"}"
    "-DKLEE_RUNTIME_BUILD_TYPE=${if debugRuntime then "Debug" else "Release"}"
    "-DLLVMCC=${clang}/bin/clang"
    "-DLLVMCXX=${clang}/bin/clang++"
--- a/pkgs/applications/video/hyperion-ng/default.nix
+++ b/pkgs/applications/video/hyperion-ng/default.nix
@ -49,7 +49,6 @@ stdenv.mkDerivation rec {
  '' ;

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DENABLE_DEPLOY_DEPENDENCIES=OFF"
    "-DUSE_SYSTEM_FLATBUFFERS_LIBS=ON"
    "-DUSE_SYSTEM_PROTO_LIBS=ON"
--- a/pkgs/applications/video/jellyfin-media-player/default.nix
+++ b/pkgs/applications/video/jellyfin-media-player/default.nix
@ -72,7 +72,6 @@ mkDerivation rec {
  ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DQTROOT=${qtbase}"
    "-GNinja"
  ] ++ lib.optionals (!withDbus) [
--- a/pkgs/applications/video/plex-media-player/default.nix
+++ b/pkgs/applications/video/plex-media-player/default.nix
@ -34,7 +34,9 @@ in mkDerivation rec {
    ln -s ${webClientTv} build/dependencies/web-client-tv-${webClientTvBuildId}.tar.xz
  '';

-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=RelWithDebInfo" "-DQTROOT=${qtbase}" ];
+  cmakeBuildType = "RelWithDebInfo";
+
+  cmakeFlags = [ "-DQTROOT=${qtbase}" ];

  # plexmediaplayer currently segfaults under wayland
  qtWrapperArgs = [ "--set" "QT_QPA_PLATFORM" "xcb" ];
--- a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-k+rG5AZjz47Q6bpVcTK7r4s7Avg3O+1iw+skK+cn0rk=";
  };

-  cmakeFlags = lib.optional debug "-DCMAKE_BUILD_TYPE=Debug";
+  cmakeBuildType = if debug then "Debug" else "Release";

  nativeBuildInputs = [
    cmake
--- a/pkgs/build-support/deterministic-uname/deterministic-uname.sh
+++ b/pkgs/build-support/deterministic-uname/deterministic-uname.sh
@ -38,6 +38,10 @@ processor=0
 hardware_platform=0
 operating_system=0

+# With no OPTION, same as -s.
+if [[ $# -eq 0 ]]; then
+    kernel_name=1
+fi

@getopt@/bin/getopt --test > /dev/null && rc=$? || rc=$?
 if [[ $rc -ne 4 ]]; then
@ -54,11 +58,6 @@ else
  eval set -- "$PARSED"
 fi

-# With no OPTION, same as -s.
-if [[ $# -eq 0 ]]; then
-    kernel_name=1
-fi
-
 # Process each argument, and set the appropriate flag if we recognize it.
 while [[ $# -ge 1 ]]; do
  case "$1" in
@ -132,44 +131,44 @@ fi
 #  Darwin *nodename* 22.1.0 Darwin Kernel Version 22.1.0: Sun Oct  9 20:14:30 PDT 2022; root:xnu-8792.41.9~2/RELEASE_ARM64_T8103 arm64 arm Darwin
 # NixOS:
 #  Linux *nodename* 6.0.13 #1-NixOS SMP PREEMPT_DYNAMIC Wed Dec 14 10:41:06 UTC 2022 x86_64 GNU/Linux
+output=()
 if [[ "$all" = "1" ]]; then
-    echo -n "$KERNEL_NAME_VAL $NODENAME_VAL $KERNEL_RELEASE_VAL $KERNEL_VERSION_VAL $MACHINE_VAL "
+    output+=("$KERNEL_NAME_VAL" "$NODENAME_VAL" "$KERNEL_RELEASE_VAL" "$KERNEL_VERSION_VAL" "$MACHINE_VAL")
    # in help:  except omit -p and -i if unknown.
-    #echo -n "$PROCESSOR_VAL $HARDWARE_PLATFORM_VAL\n"
-    echo -n "$OPERATING_SYSTEM_VAL"
+    # output+=($PROCESSOR_VAL $HARDWARE_PLATFORM_VAL)
+    output+=("$OPERATING_SYSTEM_VAL")
 fi

 if [[ "$kernel_name" = "1" ]]; then
-    echo -n "$KERNEL_NAME_VAL"
+    output+=("$KERNEL_NAME_VAL")
 fi

 if [[ "$nodename" = "1" ]]; then
-    echo -n "$NODENAME_VAL"
+    output+=("$NODENAME_VAL")
 fi

 if [[ "$kernel_release" = "1" ]]; then
-    echo -n "$KERNEL_RELEASE_VAL"
+    output+=("$KERNEL_RELEASE_VAL")
 fi

 if [[ "$kernel_version" = "1" ]]; then
-    echo -n "$KERNEL_VERSION_VAL"
+    output+=("$KERNEL_VERSION_VAL")
 fi

 if [[ "$machine" = "1" ]]; then
-    echo -n "$MACHINE_VAL"
+    output+=("$MACHINE_VAL")
 fi

 if [[ "$processor" = "1" ]]; then
-    echo -n "$PROCESSOR_VAL"
+    output+=("$PROCESSOR_VAL")
 fi

 if [[ "$hardware_platform" = "1" ]]; then
-    echo -n "$HARDWARE_PLATFORM_VAL"
+    output+=("$HARDWARE_PLATFORM_VAL")
 fi

 if [[ "$operating_system" = "1" ]]; then
-    echo -n "$OPERATING_SYSTEM_VAL"
+    output+=("$OPERATING_SYSTEM_VAL")
 fi

-# for newline.
-echo
+echo "${output[@]}"
--- a/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
+++ b/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
@ -23,7 +23,6 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DCMAKE_INSTALL_PREFIX=$out"
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DBUILD_TESTING=OFF"
    "-DKDE_INSTALL_USE_QT_SYS_PATHS=ON"
  ];
--- a/pkgs/development/compilers/ldc/generic.nix
+++ b/pkgs/development/compilers/ldc/generic.nix
@ -68,7 +68,6 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DD_FLAGS=-d-version=TZDatabaseDir;-d-version=LibcurlPath;-J${pathConfig}"
-    "-DCMAKE_BUILD_TYPE=Release"
  ];

  postConfigure = ''
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@ -204,6 +204,8 @@ in stdenv.mkDerivation (rec {
    ln -sv $PWD/lib $out
  '';

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -219,7 +221,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@ -212,6 +212,8 @@ in stdenv.mkDerivation (rec {
  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -227,7 +229,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@ -202,6 +202,8 @@ in stdenv.mkDerivation (rec {
  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -217,7 +219,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@ -164,6 +164,8 @@ in stdenv.mkDerivation (rec {
  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -179,7 +181,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@ -162,6 +162,8 @@ in stdenv.mkDerivation (rec {
  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -177,7 +179,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@ -298,6 +298,8 @@ in stdenv.mkDerivation (rec {
  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -313,7 +315,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@ -286,6 +286,8 @@ in
  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -301,7 +303,6 @@ in
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@ -141,6 +141,8 @@ stdenv.mkDerivation (rec {
    ln -sv $PWD/lib $out
  '';

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -156,7 +158,6 @@ stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@ -161,6 +161,8 @@ stdenv.mkDerivation (rec {
    ln -sv $PWD/lib $out
  '';

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -176,7 +178,6 @@ stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@ -179,6 +179,8 @@ in stdenv.mkDerivation (rec {
    ln -sv $PWD/lib $out
  '';

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -194,7 +196,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@ -178,6 +178,8 @@ in stdenv.mkDerivation (rec {
    ln -sv $PWD/lib $out
  '';

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -193,7 +195,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@ -193,6 +193,8 @@ in stdenv.mkDerivation (rec {
    ln -sv $PWD/lib $out
  '';

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -208,7 +210,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@ -283,6 +283,8 @@ in stdenv.mkDerivation (rec {
  # E.g. mesa.drivers use the build-id as a cache key (see #93946):
  LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";

+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
  cmakeFlags = with stdenv; let
    # These flags influence llvm-config's BuildVariables.inc in addition to the
    # general build. We need to make sure these are also passed via
@ -298,7 +300,6 @@ in stdenv.mkDerivation (rec {
      "-DLLVM_LINK_LLVM_DYLIB=ON"
    ];
  in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
    "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
    "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
    "-DLLVM_ENABLE_FFI=ON"
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@ -57,7 +57,19 @@ in {
  pypaBuildHook = callPackage ({ makePythonHook, build, wheel }:
    makePythonHook {
      name = "pypa-build-hook.sh";
-      propagatedBuildInputs = [ build wheel ];
+      propagatedBuildInputs = [ wheel ];
+      substitutions = {
+        inherit build;
+      };
+      # A test to ensure that this hook never propagates any of its dependencies
+      #   into the build environment.
+      # This prevents false positive alerts raised by catchConflictsHook.
+      # Such conflicts don't happen within the standard nixpkgs python package
+      #   set, but in downstream projects that build packages depending on other
+      #   versions of this hook's dependencies.
+      passthru.tests = import ./pypa-build-hook-tests.nix {
+        inherit pythonForBuild runCommand;
+      };
    } ./pypa-build-hook.sh) {
      inherit (pythonForBuild.pkgs) build;
    };
--- a/pkgs/development/interpreters/python/hooks/pypa-build-hook-test.nix
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook-test.nix
@ -0,0 +1,32 @@
+{ pythonForBuild, runCommand }: {
+  dont-propagate-conflicting-deps = let
+    # customize a package so that its store paths differs
+    mkConflict = pkg: pkg.overrideAttrs { some_modification = true; };
+    # minimal pyproject.toml for the example project
+    pyprojectToml = builtins.toFile "pyproject.toml" ''
+      [project]
+      name = "my-project"
+      version = "1.0.0"
+    '';
+    # the source of the example project
+    projectSource = runCommand "my-project-source" {} ''
+      mkdir -p $out/src
+      cp ${pyprojectToml} $out/pyproject.toml
+      touch $out/src/__init__.py
+    '';
+    in
+    # this build must never triger conflicts
+    pythonForBuild.pkgs.buildPythonPackage {
+      pname = "dont-propagate-conflicting-deps";
+      version = "0.0.0";
+      src = projectSource;
+      format = "pyproject";
+      propagatedBuildInputs = [
+        # At least one dependency of `build` should be included here to
+        # keep the test meaningful
+        (mkConflict pythonForBuild.pkgs.tomli)
+        # setuptools is also needed to build the example project
+        pythonForBuild.pkgs.setuptools
+      ];
+    };
+}
--- a/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
@ -6,7 +6,7 @@ pypaBuildPhase() {
    runHook preBuild

    echo "Creating a wheel..."
-    pyproject-build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
+    @build@/bin/pyproject-build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
    echo "Finished creating a wheel..."

    runHook postBuild
--- a/pkgs/development/libraries/cracklib/default.nix
+++ b/pkgs/development/libraries/cracklib/default.nix
@ -1,8 +1,8 @@
-let version = "2.9.8"; in
+let version = "2.9.11"; in
 { stdenv, lib, buildPackages, fetchurl, zlib, gettext
 , wordlists ? [ (fetchurl {
  url = "https://github.com/cracklib/cracklib/releases/download/v${version}/cracklib-words-${version}.gz";
-  hash = "sha256-WLOCTIDdO6kIsMytUdbhZx4woj/u1gf7jmORR2i8T4U=";
+  hash = "sha256-popxGjE1c517Z+nzYLM/DU7M+b1/rE0XwNXkVqkcUXo=";
 }) ]
 }:

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-H500OF6jqnzXwH+jiNwlgQrqnTwz4mDHE6Olhz1w44Y=";
+    hash = "sha256-yosEmjwtOyIloejRXWE3mOvHSOOVA4jtomlN5Qe6YCA=";
  };

  nativeBuildInputs = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.cracklib;
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@ -7,5 +7,17 @@ import ./generic.nix {
      url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/031f1561cd286596cdb374da32f8aa816ce3b135";
      hash = "sha256-mSnmAkoNikDpxcN+A/hpB7mUbbtcMvm4tG6gZFuroe8=";
    }
+    # The upstream patch isn’t for ffmpeg 4, but it will apply with a few tweaks.
+    # Fixes a crash when built with clang 16 due to UB in ff_seek_frame_binary.
+    {
+      name = "utils-fix_crash_in_ff_seek_frame_binary.patch";
+      url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/ab792634197e364ca1bb194f9abe36836e42f12d";
+      hash = "sha256-UxZ4VneZpw+Q/UwkEUDNdb2nOx1QnMrZ40UagspNTxI=";
+      postFetch = ''
+        substituteInPlace "$out" \
+          --replace libavformat/seek.c libavformat/utils.c \
+          --replace 'const AVInputFormat *const ' 'const AVInputFormat *'
+      '';
+    }
  ];
 }
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -80,7 +80,7 @@
 , withSvtav1 ? withHeadlessDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
 , withTensorflow ? false # Tensorflow dnn backend support
 , withTheora ? withHeadlessDeps # Theora encoder
-, withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
+, withV4l2 ? withHeadlessDeps && !stdenv.isDarwin # Video 4 Linux support
 , withV4l2M2m ? withV4l2
 , withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
 , withVdpau ? withSmallDeps # Vdpau hardware acceleration
@ -545,7 +545,10 @@ stdenv.mkDerivation (finalAttrs: {
  in
    "remove-references-to ${lib.concatStringsSep " " (map (o: "-t ${o}") toStrip)} config.h";

-  nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ]
+  ++ optionals withCudaLLVM [ clang ];

  # TODO This was always in buildInputs before, why?
  buildInputs = optionals withFullDeps [ libdc1394 ]
@ -559,7 +562,6 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optionals withBzlib [ bzip2 ]
  ++ optionals withCaca [ libcaca ]
  ++ optionals withCelt [ celt ]
-  ++ optionals withCudaLLVM [ clang ]
  ++ optionals withDav1d [ dav1d ]
  ++ optionals withDrm [ libdrm ]
  ++ optionals withFdkAac [ fdk_aac ]
--- a/pkgs/development/libraries/flatcc/default.nix
+++ b/pkgs/development/libraries/flatcc/default.nix
@ -18,7 +18,6 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DFLATCC_INSTALL=on"
-    "-DCMAKE_BUILD_TYPE=Release"
  ];

  env.NIX_CFLAGS_COMPILE = toString [
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@ -24,6 +24,7 @@
 , gobject-introspection
 , buildPackages
 , withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , fribidi
 , xorg
 , libepoxy
@ -110,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
    gtk-doc
    # For xmllint
    libxml2
-  ] ++ lib.optionals (withIntrospection && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+  ] ++ lib.optionals ((withIntrospection || compileSchemas) && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
    mesonEmulatorHook
  ] ++ lib.optionals waylandSupport [
    wayland-scanner
@ -183,6 +184,10 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace meson.build \
      --replace "x11_enabled = false" ""

+    # this conditional gates the installation of share/gsettings-schemas/.../glib-2.0/schemas/gschemas.compiled.
+    substituteInPlace meson.build \
+      --replace 'if not meson.is_cross_build()' 'if ${lib.boolToString compileSchemas}'
+
    files=(
      build-aux/meson/post-install.py
      demos/gtk-demo/geninclude.py
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@ -1,5 +1,6 @@
 { lib
 , stdenv
+, buildPackages
 , substituteAll
 , fetchurl
 , pkg-config
@ -7,6 +8,7 @@
 , graphene
 , gi-docgen
 , meson
+, mesonEmulatorHook
 , ninja
 , python3
 , makeWrapper
@ -45,6 +47,7 @@
 , wayland-scanner
 , xineramaSupport ? stdenv.isLinux
 , cupsSupport ? stdenv.isLinux
+, compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , cups
 , AppKit
 , Cocoa
@ -99,6 +102,8 @@ stdenv.mkDerivation rec {
    sassc
    gi-docgen
    libxml2 # for xmllint
+  ] ++ lib.optionals (compileSchemas && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
  ] ++ lib.optionals waylandSupport [
    wayland-scanner
  ] ++ setupHooks;
@ -190,6 +195,10 @@ stdenv.mkDerivation rec {
  };

  postPatch = ''
+    # this conditional gates the installation of share/gsettings-schemas/.../glib-2.0/schemas/gschemas.compiled.
+    substituteInPlace meson.build \
+      --replace 'if not meson.is_cross_build()' 'if ${lib.boolToString compileSchemas}'
+
    files=(
      build-aux/meson/gen-demo-header.py
      demos/gtk-demo/geninclude.py
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "imlib2";
-  version = "1.11.1";
+  version = "1.12.0";

  src = fetchurl {
    url = "mirror://sourceforge/enlightenment/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9xK2u53K1G2Lj0rVJhDcu667TMgLX9EvkxJNOjgPpr8=";
+    hash = "sha256-lf9dTMF92fk0wuetFRw2DzCIgKCnhJpspDt8e5pLshY=";
  };

  buildInputs = [
@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';

    homepage = "https://docs.enlightenment.org/api/imlib2/html";
-    changelog = "https://git.enlightenment.org/legacy/imlib2.git/plain/ChangeLog?h=v${version}";
+    changelog = "https://git.enlightenment.org/old/legacy-imlib2/raw/tag/v${finalAttrs.version}/ChangeLog";
    license = licenses.imlib2;
    pkgConfigModules = [ "imlib2" ];
    platforms = platforms.unix;
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@ -19,13 +19,13 @@ in

 stdenv.mkDerivation rec {
  pname = "libavif";
-  version = "0.11.1";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "AOMediaCodec";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-mUi0DU99XV3FzUZ8/9uJZU+W3fc6Bk6+y6Z78IRZ9Qs=";
+    sha256 = "sha256-3zNhKl8REWsRlblXIFD7zn7qvrc/pa4wHZI0oEc3pKE=";
  };

  # reco: encode libaom slowest but best, decode dav1d fastest
--- a/pkgs/development/libraries/libbsd/darwin-fix-libbsd.sym.patch
+++ b/pkgs/development/libraries/libbsd/darwin-fix-libbsd.sym.patch
@ -0,0 +1,15 @@
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 9d22b00..c6848fc 100644
+--- a/src/Makefile.am
+++ b/src/Makefile.am
+@@ -198,7 +198,9 @@ libbsd_ctor_a_SOURCES = \
+ # Generate a simple libtool symbol export list to be used as a fallback if
+ # there is no version script support.
+ libbsd.sym: libbsd.map
+-	$(AM_V_GEN) $(SED) -ne 's/^[[:space:]]\{1,\}\([A-Za-z0-9_]\{1,\}\);/\1/p' libbsd.map > $@
+	$(AM_V_GEN) $(SED) -ne 's/^[[:space:]]\{1,\}\([A-Za-z0-9_]\{1,\}\);/\1/p' libbsd.map \
+	  | grep -Ev '(group_from_gid|user_from_uid|nlist|__fdnlist|bsd_getopt)' \
+	  > $@
+ 
+ if NEED_TRANSPARENT_LIBMD
+ TRANSPARENT_LIBMD_DEPENDS = format.ld
--- a/pkgs/development/libraries/libbsd/darwin.patch
+++ b/pkgs/development/libraries/libbsd/darwin.patch
@ -1,309 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 5b6d22b..98c449b 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -145,7 +145,7 @@ AS_CASE([$host_os],
- AM_CONDITIONAL([OS_WINDOWS], [test "x$is_windows" = "xyes"])
- 
- # Checks for header files.
-AC_CHECK_HEADERS([sys/ndir.h sys/dir.h ndir.h dirent.h pwd.h grp.h])
-+AC_CHECK_HEADERS([sys/ndir.h sys/dir.h ndir.h dirent.h pwd.h grp.h nlist.h])
- 
- # Checks for typedefs, structures, and compiler characteristics.
- AC_C_INLINE
-@@ -245,7 +245,9 @@ AC_LINK_IFELSE(
- 
- AC_CHECK_FUNCS([clearenv dirfd fopencookie __fpurge \
-                 getauxval getentropy getexecname getline \
-                pstat_getproc sysconf])
-+                pstat_getproc sysconf \
-+		strlcpy strlcat strnstr strmode fpurge \
-+		user_from_uid group_from_gid])
- AM_CONDITIONAL([HAVE_GETENTROPY], [test "x$ac_cv_func_getentropy" = "xtrue"])
- 
- AC_SUBST([MD5_LIBS])
-diff --git a/include/bsd/grp.h b/include/bsd/grp.h
-index b2705e5..c9423a2 100644
--- a/include/bsd/grp.h
-+++ b/include/bsd/grp.h
-@@ -44,8 +44,10 @@
- __BEGIN_DECLS
- int
- gid_from_group(const char *, gid_t *);
-+#if !HAVE_GROUP_FROM_GID
- const char *
- group_from_gid(gid_t, int);
-+#endif
- __END_DECLS
- 
- #endif
-diff --git a/include/bsd/pwd.h b/include/bsd/pwd.h
-index 798af4b..6ae5244 100644
--- a/include/bsd/pwd.h
-+++ b/include/bsd/pwd.h
-@@ -44,8 +44,10 @@
- __BEGIN_DECLS
- int
- uid_from_user(const char *, uid_t *);
-+#if !HAVE_USER_FROM_UID
- const char *
- user_from_uid(uid_t, int);
-+#endif
- __END_DECLS
- 
- #endif
-diff --git a/include/bsd/string.h b/include/bsd/string.h
-index f987fee..a1e17ed 100644
--- a/include/bsd/string.h
-+++ b/include/bsd/string.h
-@@ -41,10 +41,21 @@
- #include <sys/types.h>
- 
- __BEGIN_DECLS
-+#if !HAVE_STRLCPY
- size_t strlcpy(char *dst, const char *src, size_t siz);
-+#endif
-+
-+#if !HAVE_STRLCAT
- size_t strlcat(char *dst, const char *src, size_t siz);
-+#endif
-+
-+#if !HAVE_STRNSTR
- char *strnstr(const char *str, const char *find, size_t str_len);
-+#endif
-+
-+#if !HAVE_STRMODE
- void strmode(mode_t mode, char *str);
-+#endif
- 
- #if !defined(__GLIBC__) || \
-     (defined(__GLIBC__) && (!__GLIBC_PREREQ(2, 25) || !defined(_GNU_SOURCE)))
-diff --git a/src/fpurge.c b/src/fpurge.c
-index 350f364..ff7f01e 100644
--- a/src/fpurge.c
-+++ b/src/fpurge.c
-@@ -26,9 +26,10 @@
- 
- #include <errno.h>
- #include <stdio.h>
-#include <stdio_ext.h>
- 
- #ifdef HAVE___FPURGE
-+#include <stdio_ext.h>
-+
- int
- fpurge(FILE *fp)
- {
-@@ -41,6 +42,36 @@ fpurge(FILE *fp)
- 
- 	return 0;
- }
-+/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin 1.7 */
-+#elif HAVE_FPURGE
-+int
-+fpurge(FILE *fp)
-+{
-+	if (fp == NULL || fileno(fp) < 0) {
-+		errno = EBADF;
-+		return EOF;
-+	}
-+
-+  /* Call the system's fpurge function.  */
-+#undef fpurge
-+#if !HAVE_DECL_FPURGE
-+  extern int fpurge (FILE *);
-+#endif
-+  int result = fpurge (fp);
-+/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin */
-+#if defined(__sferror) || defined(__DragonFly__)
-+  if (result == 0)
-+    /* Correct the invariants that fpurge broke.
-+       <stdio.h> on BSD systems says:
-+         "The following always hold: if _flags & __SRD, _w is 0."
-+       If this invariant is not fulfilled and the stream is read-write but
-+       currently reading, subsequent putc or fputc calls will write directly
-+       into the buffer, although they shouldn't be allowed to.  */
-+    if ((fp->_flags & __SRD) != 0)
-+      fp->_w = 0;
-+#endif
-+  return result;
-+}
- #else
- #error "Function fpurge() needs to be ported."
- #endif
-diff --git a/src/funopen.c b/src/funopen.c
-index 1e6f43a..3a3af6a 100644
--- a/src/funopen.c
-+++ b/src/funopen.c
-@@ -143,6 +143,7 @@ funopen(const void *cookie,
-  * they will not add the needed support to implement it. Just ignore this
-  * interface there, as it has never been provided anyway.
-  */
-+#elif defined(__MACH__)
- #else
- #error "Function funopen() needs to be ported or disabled."
- #endif
-diff --git a/src/local-link.h b/src/local-link.h
-index 6782d9a..fb76098 100644
--- a/src/local-link.h
-+++ b/src/local-link.h
-@@ -29,6 +29,12 @@
- 
- #include <sys/cdefs.h>
- 
-+#ifdef __MACH__
-+#define libbsd_link_warning(symbol, msg)
-+#define libbsd_symver_default(alias, symbol, version)
-+#define libbsd_symver_variant(alias, symbol, version)
-+#define libbsd_symver_weak(alias, symbol, version)
-+#else
- #define libbsd_link_warning(symbol, msg) \
- 	static const char libbsd_emit_link_warning_##symbol[] \
- 		__attribute__((__used__,__section__(".gnu.warning." #symbol))) = msg
-@@ -68,3 +74,4 @@
- #endif
- 
- #endif
-+#endif
-diff --git a/src/nlist.c b/src/nlist.c
-index 1cb9d18..b476f1e 100644
--- a/src/nlist.c
-+++ b/src/nlist.c
-@@ -41,6 +41,7 @@
- #include <unistd.h>
- #include <nlist.h>
- 
-+#if !HAVE_NLIST_H
- #include "local-elf.h"
- 
- /* Note: This function is used by libkvm0, so we need to export it.
-@@ -277,3 +278,4 @@ nlist(const char *name, struct nlist *list)
- 	(void)close(fd);
- 	return (n);
- }
-+#endif
-diff --git a/src/pwcache.c b/src/pwcache.c
-index d54daa0..74fde9f 100644
--- a/src/pwcache.c
-+++ b/src/pwcache.c
-@@ -191,6 +191,7 @@ grptb_start(void)
- 	return 0;
- }
- 
-+#if !HAVE_USER_FROM_UID
- /*
-  * user_from_uid()
-  *	caches the name (if any) for the uid. If noname clear, we always
-@@ -251,7 +252,9 @@ user_from_uid(uid_t uid, int noname)
- 	}
- 	return ptr->name;
- }
-+#endif
- 
-+#if !HAVE_USER_FROM_UID
- /*
-  * group_from_gid()
-  *	caches the name (if any) for the gid. If noname clear, we always
-@@ -312,6 +315,7 @@ group_from_gid(gid_t gid, int noname)
- 	}
- 	return ptr->name;
- }
-+#endif
- 
- /*
-  * uid_from_user()
-diff --git a/src/readpassphrase.c b/src/readpassphrase.c
-index f9f6195..2bc5fb4 100644
--- a/src/readpassphrase.c
-+++ b/src/readpassphrase.c
-@@ -36,6 +36,14 @@
- #define TCSASOFT 0
- #endif
- 
-+#ifndef _SIGMAX
-+#define	_SIGMAX	64
-+#endif
-+
-+#ifndef _NSIG
-+#define _NSIG (_SIGMAX + 1)
-+#endif
-+
- static volatile sig_atomic_t signo[_NSIG];
- 
- static void handler(int);
-diff --git a/src/setproctitle.c b/src/setproctitle.c
-index d3e1087..0e5f64c 100644
--- a/src/setproctitle.c
-+++ b/src/setproctitle.c
-@@ -33,6 +33,10 @@
- #include <string.h>
- #include "local-link.h"
- 
-+#ifdef __MACH__
-+extern char **environ;
-+#endif
-+
- static struct {
- 	/* Original value. */
- 	const char *arg0;
-@@ -291,7 +295,8 @@ libbsd_symver_default(setproctitle, setproctitle_impl, LIBBSD_0.5);
-  * in 0.5, make the implementation available in the old version as an alias
-  * for code linking against that version, and change the default to use the
-  * new version, so that new code depends on the implemented version. */
-#ifdef HAVE_TYPEOF
-+#ifdef __MACH__
-+#elif defined(HAVE_TYPEOF)
- extern __typeof__(setproctitle_impl)
- setproctitle_stub
- 	__attribute__((__alias__("setproctitle_impl")));
-diff --git a/src/strlcat.c b/src/strlcat.c
-index 14c53a1..5961c17 100644
--- a/src/strlcat.c
-+++ b/src/strlcat.c
-@@ -26,6 +26,7 @@
-  * Returns strlen(src) + MIN(dsize, strlen(initial dst)).
-  * If retval >= dsize, truncation occurred.
-  */
-+#if !HAVE_STRLCAT
- size_t
- strlcat(char *dst, const char *src, size_t dsize)
- {
-@@ -53,3 +54,4 @@ strlcat(char *dst, const char *src, size_t dsize)
- 
- 	return(dlen + (src - osrc));	/* count does not include NUL */
- }
-+#endif
-diff --git a/src/strlcpy.c b/src/strlcpy.c
-index e9a7fe4..5137acb 100644
--- a/src/strlcpy.c
-+++ b/src/strlcpy.c
-@@ -24,6 +24,7 @@
-  * chars will be copied.  Always NUL terminates (unless dsize == 0).
-  * Returns strlen(src); if retval >= dsize, truncation occurred.
-  */
-+#if !HAVE_STRLCPY
- size_t
- strlcpy(char *dst, const char *src, size_t dsize)
- {
-@@ -48,3 +49,4 @@ strlcpy(char *dst, const char *src, size_t dsize)
- 
- 	return(src - osrc - 1);	/* count does not include NUL */
- }
-+#endif
-diff --git a/src/strmode.c b/src/strmode.c
-index e6afde5..da680c9 100644
--- a/src/strmode.c
-+++ b/src/strmode.c
-@@ -32,6 +32,7 @@
- #include <sys/stat.h>
- #include <string.h>
- 
-+#if !HAVE_STRMODE
- void
- strmode(mode_t mode, char *p)
- {
-@@ -141,3 +142,4 @@ strmode(mode_t mode, char *p)
- 	*p++ = ' ';		/* will be a '+' if ACL's implemented */
- 	*p = '\0';
- }
-+#endif
--- a/pkgs/development/libraries/libbsd/default.nix
+++ b/pkgs/development/libraries/libbsd/default.nix
@ -1,28 +1,53 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, fetchpatch
 , autoreconfHook
 , libmd
 , gitUpdater
 }:

-stdenv.mkDerivation rec {
-  pname = "libbsd";
-  version = "0.11.7";
+# Run `./get-version` for the new value when bumping the Git revision.
+let gitVersion = "0.11.7-55-g73b2"; in

-  src = fetchurl {
-    url = "https://libbsd.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    hash = "sha256-m6oYYFnrvyXAYwjp+ZH9ox9xg8DySTGCbYOqar2KAmE=";
+stdenv.mkDerivation {
+  pname = "libbsd";
+  version = "unstable-2023-04-29";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "libbsd";
+    repo = "libbsd";
+    rev = "73b25a8f871b3a20f6ff76679358540f95d7dbfd";
+    hash = "sha256-LS28taIMjRCl6xqg75eYOIrTDl8PzSa+OvrdiEOP1+U=";
  };

  outputs = [ "out" "dev" "man" ];

-  # darwin changes configure.ac which means we need to regenerate
-  # the configure scripts
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
  nativeBuildInputs = [ autoreconfHook ];
  propagatedBuildInputs = [ libmd ];

-  patches = [ ./darwin.patch ];
+  patches = [
+    # Fix `{get,set}progname(3bsd)` conditionalization
+    # https://gitlab.freedesktop.org/libbsd/libbsd/-/issues/24
+    (fetchpatch {
+      url = "https://github.com/emilazy/libbsd/commit/0381f8d92873c5a19ced3ff861ee8ffe7825953e.patch";
+      hash = "sha256-+RMg5eHLgC4gyX9zXM0ttNf7rd9E3UzJX/7UVCYGXx4=";
+    })
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Temporary build system hack from upstream maintainer
+    # https://gitlab.freedesktop.org/libbsd/libbsd/-/issues/19#note_2017684
+    ./darwin-fix-libbsd.sym.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace configure.ac \
+      --replace 'm4_esyscmd([./get-version])' '[${gitVersion}]'
+  '';

  passthru.updateScript = gitUpdater {
    # No nicer place to find latest release.
@ -33,7 +58,7 @@ stdenv.mkDerivation rec {
    description = "Common functions found on BSD systems";
    homepage = "https://libbsd.freedesktop.org/";
    license = with licenses; [ beerware bsd2 bsd3 bsdOriginal isc mit ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ matthewbauer ];
  };
 }
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@ -1,23 +1,21 @@
-{ lib, stdenv, cmake, ninja, gtest, fetchFromGitHub, fetchpatch }:
+{ lib
+, stdenv
+, cmake
+, ninja
+, gtest
+, fetchFromGitHub
+}:

 stdenv.mkDerivation rec {
  pname = "libhwy";
-  version = "1.0.5";
+  version = "1.0.7";

  src = fetchFromGitHub {
    owner = "google";
    repo = "highway";
    rev = version;
-    hash = "sha256-Gym2iHq5ws9kuG4HWSQndD8hVugV4USZt6dUFnEkLwY=";
+    hash = "sha256-Z+mAR9nSAbCskUvo6oK79Yd85bu0HtI2aR5THS1EozM=";
  };
-  patches = [
-    # backport for compilation issue on aarch64
-    # https://github.com/google/highway/issues/1613
-    (fetchpatch {
-      url = "https://github.com/google/highway/commit/7ad89efa911cb906ccf3f78fe510db415e921801.diff";
-      hash = "sha256-hTSkeCh2QLMqeIKG/CAqJXaPqD/66Z02gjGXk591f+U=";
-    })
-  ];

  nativeBuildInputs = [ cmake ninja ];

@ -53,7 +51,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Performance-portable, length-agnostic SIMD with runtime dispatch";
    homepage = "https://github.com/google/highway";
-    license = licenses.asl20;
+    license = with licenses; [ asl20 bsd3 ];
    platforms = platforms.unix;
    maintainers = with maintainers; [ zhaofengli ];
  };
--- a/pkgs/development/libraries/libimagequant/Cargo.lock
+++ b/pkgs/development/libraries/libimagequant/Cargo.lock
@ -21,9 +21,9 @@ dependencies = [

 [[package]]
 name = "arrayvec"
-version = "0.7.2"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"

 [[package]]
 name = "autocfg"
@ -33,15 +33,15 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"

 [[package]]
 name = "bitflags"
-version = "1.3.2"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"

 [[package]]
 name = "bytemuck"
-version = "1.13.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17febce684fd15d89027105661fec94afb475cb995fbc59d2865198446ba2eea"
+checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"

 [[package]]
 name = "c_test"
@ -53,9 +53,12 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]

 [[package]]
 name = "cfg-if"
@ -95,9 +98,9 @@ dependencies = [

 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.14"
+version = "0.9.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46bd5f3f85273295a9d14aedfb86f6aadbff6d8f5295c4a9edb08e819dcf5695"
+checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
 dependencies = [
 "autocfg",
 "cfg-if",
@ -108,33 +111,33 @@ dependencies = [

 [[package]]
 name = "crossbeam-utils"
-version = "0.8.15"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c063cd8cc95f5c377ed0d4b49a4b21f632396ff690e8470c29b3359b346984b"
+checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
 dependencies = [
 "cfg-if",
 ]

 [[package]]
 name = "either"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"

 [[package]]
 name = "fallible_collections"
-version = "0.4.7"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9acf77205554f3cfeca94a4b910e159ad9824e8c2d164de02b3f12495cc1074d"
+checksum = "a88c69768c0a15262df21899142bc6df9b9b823546d4b4b9a7bc2d6c448ec6fd"
 dependencies = [
 "hashbrown",
 ]

 [[package]]
 name = "flate2"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
+checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
 dependencies = [
 "crc32fast",
 "miniz_oxide",
@ -151,16 +154,13 @@ dependencies = [

 [[package]]
 name = "hermit-abi"
-version = "0.2.6"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
-dependencies = [
- "libc",
-]
+checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"

 [[package]]
 name = "imagequant"
-version = "4.2.0"
+version = "4.2.1"
 dependencies = [
 "arrayvec",
 "lodepng",
@ -173,7 +173,7 @@ dependencies = [

 [[package]]
 name = "imagequant-sys"
-version = "4.0.1"
+version = "4.0.2"
 dependencies = [
 "bitflags",
 "imagequant",
@ -182,9 +182,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.142"
+version = "0.2.147"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a987beff54b60ffa6d51982e1aa1146bc42f19bd26be28b0586f252fccf5317"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"

 [[package]]
 name = "lodepng"
@ -201,9 +201,9 @@ dependencies = [

 [[package]]
 name = "memoffset"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
 dependencies = [
 "autocfg",
 ]
@ -219,9 +219,9 @@ dependencies = [

 [[package]]
 name = "num_cpus"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
 "hermit-abi",
 "libc",
@ -229,9 +229,9 @@ dependencies = [

 [[package]]
 name = "once_cell"
-version = "1.17.1"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"

 [[package]]
 name = "rayon"
@ -266,9 +266,9 @@ dependencies = [

 [[package]]
 name = "scopeguard"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "thread_local"
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@ -5,13 +5,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "libimagequant";
-  version = "4.2.0";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "ImageOptim";
    repo = pname;
    rev = version;
-    hash = "sha256-51xTCymZKLuw1Xeje6EyKqHdbmqBV1Fdhx+OsO3bZ6Q=";
+    hash = "sha256-a5TztgNFRV9BVERpHI33ZEYwfOR46F9FzmbquzwGq3k=";
  };

  cargoLock = {
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libksba";
-  version = "1.6.3";
+  version = "1.6.4";

  src = fetchurl {
    url = "mirror://gnupg/libksba/libksba-${version}.tar.bz2";
-    hash = "sha256-P3LGjbMJceu/FDZ1J3GUI/Ck1fgQP8n0ocAan6RA3lw=";
+    hash = "sha256-u7Q/AyuRZNhseB/+QiE6g79PL+6RRV7fpGVFIbiwO2s=";
  };

  outputs = [ "out" "dev" "info" ];
--- a/pkgs/development/libraries/libmd/default.nix
+++ b/pkgs/development/libraries/libmd/default.nix
@ -1,35 +1,30 @@
 { lib, stdenv, fetchurl, fetchpatch, autoreconfHook }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libmd";
-  version = "1.0.4";
+  version = "1.1.0";

  src = fetchurl {
    urls = [
-      "https://archive.hadrons.org/software/libmd/libmd-${version}.tar.xz"
-      "https://libbsd.freedesktop.org/releases/libmd-${version}.tar.xz"
+      "https://archive.hadrons.org/software/libmd/libmd-${finalAttrs.version}.tar.xz"
+      "https://libbsd.freedesktop.org/releases/libmd-${finalAttrs.version}.tar.xz"
    ];
-    sha256 = "sha256-9RySEELjS+3e3tS3VVdlZVnPWx8kSAM7TB7sEcB+Uw8=";
+    sha256 = "sha256-G9aqQidTE68xQcfPLluWTosf1IgCXK8vlx9DsAd2szI=";
  };

-  patches = [
-    # Drop aliases for SHA384 functions, because such aliases are not supported on Darwin.
-    (fetchpatch {
-      url = "https://github.com/macports/macports-ports/raw/8332f5dbcaf05a02bc31fbd4ccf735e7d5c9a5b0/devel/libmd/files/patch-symbol-alias.diff";
-      sha256 = "sha256-py5hMpKYKwtBzhWn01lFc2a6+OZN72YCYXyhg1qe6rg=";
-      extraPrefix = "";
-    })
-  ];
+  enableParallelBuilding = true;
+
+  doCheck = true;

  nativeBuildInputs = [ autoreconfHook ];

  meta = with lib; {
-    homepage = "https://www.hadrons.org/software/${pname}/";
-    changelog = "https://archive.hadrons.org/software/libmd/libmd-${version}.announce";
+    homepage = "https://www.hadrons.org/software/libmd/";
+    changelog = "https://archive.hadrons.org/software/libmd/libmd-${finalAttrs.version}.announce";
    # Git: https://git.hadrons.org/cgit/libmd.git
    description = "Message Digest functions from BSD systems";
    license = with licenses; [ bsd3 bsd2 isc beerware publicDomain ];
    maintainers = with maintainers; [ primeos ];
    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/development/libraries/libmodplug/default.nix
+++ b/pkgs/development/libraries/libmodplug/default.nix
@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
    sha256 = "1pnri98a603xk47smnxr551svbmgbzcw018mq1k6srbrq6kaaz25";
  };

+  # Unfortunately, upstream appears inactive and the patches from the fork don’t apply cleanly.
+  # Modify `src/fastmix.cpp` to remove usage of the register storage class, which is
+  # not allowed in C++17 and is an error in clang 16.
+  prePatch = "substituteInPlace src/fastmix.cpp --replace 'register ' ''";
+
  outputs = [ "out" "dev" ];

  preConfigure = ''
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@ -3,20 +3,20 @@
 assert zlib != null;

 let
-  patchVersion = "1.6.39";
+  patchVersion = "1.6.40";
  patch_src = fetchurl {
    url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    hash = "sha256-SsS26roAzeISxI22XLlCkQc/68oixcef2ocJFQLoDP0=";
+    hash = "sha256-CjykZIKTjY1sciZivtLH7gxlobViRESzztIa2NNW2y8=";
  };
  whenPatched = lib.optionalString apngSupport;

 in stdenv.mkDerivation rec {
  pname = "libpng" + whenPatched "-apng";
-  version = "1.6.39";
+  version = "1.6.40";

  src = fetchurl {
    url = "mirror://sourceforge/libpng/libpng-${version}.tar.xz";
-    hash = "sha256-H0aWznC07l+F8eFiPcEimyEAKfpLeu5XPfPiunsDaTc=";
+    hash = "sha256-U1tHmyRn/yMaPsbZKlJZBvuO8nl4vk9m2+BdPzoBs6E=";
  };
  postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1";

@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
  meta = with lib; {
    description = "The official reference implementation for the PNG file format" + whenPatched " with animation patch";
    homepage = "http://www.libpng.org/pub/png/libpng.html";
-    changelog = "https://github.com/glennrp/libpng/blob/v1.6.39/CHANGES";
+    changelog = "https://github.com/glennrp/libpng/blob/v1.6.40/CHANGES";
    license = licenses.libpng2;
    platforms = platforms.all;
    maintainers = with maintainers; [ vcunat ];
--- a/pkgs/development/libraries/libwebp/CVE-2023-4863.patch
+++ b/pkgs/development/libraries/libwebp/CVE-2023-4863.patch
@ -1,361 +0,0 @@
-From 4de93ac70c3292fc944e4587101a52a29f8b0c9c Mon Sep 17 00:00:00 2001
-From: Vincent Rabaud <vrabaud@google.com>
-Date: Thu, 7 Sep 2023 21:16:03 +0200
-Subject: [PATCH] Fix OOB write in BuildHuffmanTable.
-
-First, BuildHuffmanTable is called to check if the data is valid.
-If it is and the table is not big enough, more memory is allocated.
-
-This will make sure that valid (but unoptimized because of unbalanced
-codes) streams are still decodable.
-
-Bug: chromium:1479274
-Change-Id: I31c36dbf3aa78d35ecf38706b50464fd3d375741
-(cherry picked from commit 902bc9190331343b2017211debcec8d2ab87e17a)
---
- src/dec/vp8l_dec.c        | 46 ++++++++++---------
- src/dec/vp8li_dec.h       |  2 +-
- src/utils/huffman_utils.c | 97 +++++++++++++++++++++++++++++++--------
- src/utils/huffman_utils.h | 27 +++++++++--
- 4 files changed, 129 insertions(+), 43 deletions(-)
-
-diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c
-index c0ea0181..7995313f 100644
--- a/src/dec/vp8l_dec.c
-+++ b/src/dec/vp8l_dec.c
-@@ -253,11 +253,11 @@ static int ReadHuffmanCodeLengths(
-   int symbol;
-   int max_symbol;
-   int prev_code_len = DEFAULT_CODE_LENGTH;
-  HuffmanCode table[1 << LENGTHS_TABLE_BITS];
-+  HuffmanTables tables;
- 
-  if (!VP8LBuildHuffmanTable(table, LENGTHS_TABLE_BITS,
-                             code_length_code_lengths,
-                             NUM_CODE_LENGTH_CODES)) {
-+  if (!VP8LHuffmanTablesAllocate(1 << LENGTHS_TABLE_BITS, &tables) ||
-+      !VP8LBuildHuffmanTable(&tables, LENGTHS_TABLE_BITS,
-+                             code_length_code_lengths, NUM_CODE_LENGTH_CODES)) {
-     goto End;
-   }
- 
-@@ -277,7 +277,7 @@ static int ReadHuffmanCodeLengths(
-     int code_len;
-     if (max_symbol-- == 0) break;
-     VP8LFillBitWindow(br);
-    p = &table[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
-+    p = &tables.curr_segment->start[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
-     VP8LSetBitPos(br, br->bit_pos_ + p->bits);
-     code_len = p->value;
-     if (code_len < kCodeLengthLiterals) {
-@@ -300,6 +300,7 @@ static int ReadHuffmanCodeLengths(
-   ok = 1;
- 
-  End:
-+  VP8LHuffmanTablesDeallocate(&tables);
-   if (!ok) dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
-   return ok;
- }
-@@ -307,7 +308,8 @@ static int ReadHuffmanCodeLengths(
- // 'code_lengths' is pre-allocated temporary buffer, used for creating Huffman
- // tree.
- static int ReadHuffmanCode(int alphabet_size, VP8LDecoder* const dec,
-                           int* const code_lengths, HuffmanCode* const table) {
-+                           int* const code_lengths,
-+                           HuffmanTables* const table) {
-   int ok = 0;
-   int size = 0;
-   VP8LBitReader* const br = &dec->br_;
-@@ -362,8 +364,7 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   VP8LMetadata* const hdr = &dec->hdr_;
-   uint32_t* huffman_image = NULL;
-   HTreeGroup* htree_groups = NULL;
-  HuffmanCode* huffman_tables = NULL;
-  HuffmanCode* huffman_table = NULL;
-+  HuffmanTables* huffman_tables = &hdr->huffman_tables_;
-   int num_htree_groups = 1;
-   int num_htree_groups_max = 1;
-   int max_alphabet_size = 0;
-@@ -372,6 +373,10 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   int* mapping = NULL;
-   int ok = 0;
- 
-+  // Check the table has been 0 initialized (through InitMetadata).
-+  assert(huffman_tables->root.start == NULL);
-+  assert(huffman_tables->curr_segment == NULL);
-+
-   if (allow_recursion && VP8LReadBits(br, 1)) {
-     // use meta Huffman codes.
-     const int huffman_precision = VP8LReadBits(br, 3) + 2;
-@@ -434,16 +439,15 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
- 
-   code_lengths = (int*)WebPSafeCalloc((uint64_t)max_alphabet_size,
-                                       sizeof(*code_lengths));
-  huffman_tables = (HuffmanCode*)WebPSafeMalloc(num_htree_groups * table_size,
-                                                sizeof(*huffman_tables));
-   htree_groups = VP8LHtreeGroupsNew(num_htree_groups);
- 
-  if (htree_groups == NULL || code_lengths == NULL || huffman_tables == NULL) {
-+  if (htree_groups == NULL || code_lengths == NULL ||
-+      !VP8LHuffmanTablesAllocate(num_htree_groups * table_size,
-+                                 huffman_tables)) {
-     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
-     goto Error;
-   }
- 
-  huffman_table = huffman_tables;
-   for (i = 0; i < num_htree_groups_max; ++i) {
-     // If the index "i" is unused in the Huffman image, just make sure the
-     // coefficients are valid but do not store them.
-@@ -468,19 +472,20 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-       int max_bits = 0;
-       for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
-         int alphabet_size = kAlphabetSize[j];
-        htrees[j] = huffman_table;
-         if (j == 0 && color_cache_bits > 0) {
-           alphabet_size += (1 << color_cache_bits);
-         }
-        size = ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_table);
-+        size =
-+            ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_tables);
-+        htrees[j] = huffman_tables->curr_segment->curr_table;
-         if (size == 0) {
-           goto Error;
-         }
-         if (is_trivial_literal && kLiteralMap[j] == 1) {
-          is_trivial_literal = (huffman_table->bits == 0);
-+          is_trivial_literal = (htrees[j]->bits == 0);
-         }
-        total_size += huffman_table->bits;
-        huffman_table += size;
-+        total_size += htrees[j]->bits;
-+        huffman_tables->curr_segment->curr_table += size;
-         if (j <= ALPHA) {
-           int local_max_bits = code_lengths[0];
-           int k;
-@@ -515,14 +520,13 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   hdr->huffman_image_ = huffman_image;
-   hdr->num_htree_groups_ = num_htree_groups;
-   hdr->htree_groups_ = htree_groups;
-  hdr->huffman_tables_ = huffman_tables;
- 
-  Error:
-   WebPSafeFree(code_lengths);
-   WebPSafeFree(mapping);
-   if (!ok) {
-     WebPSafeFree(huffman_image);
-    WebPSafeFree(huffman_tables);
-+    VP8LHuffmanTablesDeallocate(huffman_tables);
-     VP8LHtreeGroupsFree(htree_groups);
-   }
-   return ok;
-@@ -1358,7 +1362,7 @@ static void ClearMetadata(VP8LMetadata* const hdr) {
-   assert(hdr != NULL);
- 
-   WebPSafeFree(hdr->huffman_image_);
-  WebPSafeFree(hdr->huffman_tables_);
-+  VP8LHuffmanTablesDeallocate(&hdr->huffman_tables_);
-   VP8LHtreeGroupsFree(hdr->htree_groups_);
-   VP8LColorCacheClear(&hdr->color_cache_);
-   VP8LColorCacheClear(&hdr->saved_color_cache_);
-@@ -1673,7 +1677,7 @@ int VP8LDecodeImage(VP8LDecoder* const dec) {
- 
-   if (dec == NULL) return 0;
- 
-  assert(dec->hdr_.huffman_tables_ != NULL);
-+  assert(dec->hdr_.huffman_tables_.root.start != NULL);
-   assert(dec->hdr_.htree_groups_ != NULL);
-   assert(dec->hdr_.num_htree_groups_ > 0);
- 
-diff --git a/src/dec/vp8li_dec.h b/src/dec/vp8li_dec.h
-index 72b2e861..32540a4b 100644
--- a/src/dec/vp8li_dec.h
-+++ b/src/dec/vp8li_dec.h
-@@ -51,7 +51,7 @@ typedef struct {
-   uint32_t*       huffman_image_;
-   int             num_htree_groups_;
-   HTreeGroup*     htree_groups_;
-  HuffmanCode*    huffman_tables_;
-+  HuffmanTables   huffman_tables_;
- } VP8LMetadata;
- 
- typedef struct VP8LDecoder VP8LDecoder;
-diff --git a/src/utils/huffman_utils.c b/src/utils/huffman_utils.c
-index 90c2fbf7..cf73abd4 100644
--- a/src/utils/huffman_utils.c
-+++ b/src/utils/huffman_utils.c
-@@ -177,21 +177,24 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-       if (num_open < 0) {
-         return 0;
-       }
-      if (root_table == NULL) continue;
-       for (; count[len] > 0; --count[len]) {
-         HuffmanCode code;
-         if ((key & mask) != low) {
-          table += table_size;
-+          if (root_table != NULL) table += table_size;
-           table_bits = NextTableBitSize(count, len, root_bits);
-           table_size = 1 << table_bits;
-           total_size += table_size;
-           low = key & mask;
-          root_table[low].bits = (uint8_t)(table_bits + root_bits);
-          root_table[low].value = (uint16_t)((table - root_table) - low);
-+          if (root_table != NULL) {
-+            root_table[low].bits = (uint8_t)(table_bits + root_bits);
-+            root_table[low].value = (uint16_t)((table - root_table) - low);
-+          }
-+        }
-+        if (root_table != NULL) {
-+          code.bits = (uint8_t)(len - root_bits);
-+          code.value = (uint16_t)sorted[symbol++];
-+          ReplicateValue(&table[key >> root_bits], step, table_size, code);
-         }
-        code.bits = (uint8_t)(len - root_bits);
-        code.value = (uint16_t)sorted[symbol++];
-        ReplicateValue(&table[key >> root_bits], step, table_size, code);
-         key = GetNextKey(key, len);
-       }
-     }
-@@ -211,25 +214,83 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-   ((1 << MAX_CACHE_BITS) + NUM_LITERAL_CODES + NUM_LENGTH_CODES)
- // Cut-off value for switching between heap and stack allocation.
- #define SORTED_SIZE_CUTOFF 512
-int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-+int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
-                           const int code_lengths[], int code_lengths_size) {
-  int total_size;
-+  const int total_size =
-+      BuildHuffmanTable(NULL, root_bits, code_lengths, code_lengths_size, NULL);
-   assert(code_lengths_size <= MAX_CODE_LENGTHS_SIZE);
-  if (root_table == NULL) {
-    total_size = BuildHuffmanTable(NULL, root_bits,
-                                   code_lengths, code_lengths_size, NULL);
-  } else if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
-+  if (total_size == 0 || root_table == NULL) return total_size;
-+
-+  if (root_table->curr_segment->curr_table + total_size >=
-+      root_table->curr_segment->start + root_table->curr_segment->size) {
-+    // If 'root_table' does not have enough memory, allocate a new segment.
-+    // The available part of root_table->curr_segment is left unused because we
-+    // need a contiguous buffer.
-+    const int segment_size = root_table->curr_segment->size;
-+    struct HuffmanTablesSegment* next =
-+        (HuffmanTablesSegment*)WebPSafeMalloc(1, sizeof(*next));
-+    if (next == NULL) return 0;
-+    // Fill the new segment.
-+    // We need at least 'total_size' but if that value is small, it is better to
-+    // allocate a big chunk to prevent more allocations later. 'segment_size' is
-+    // therefore chosen (any other arbitrary value could be chosen).
-+    next->size = total_size > segment_size ? total_size : segment_size;
-+    next->start =
-+        (HuffmanCode*)WebPSafeMalloc(next->size, sizeof(*next->start));
-+    if (next->start == NULL) {
-+      WebPSafeFree(next);
-+      return 0;
-+    }
-+    next->curr_table = next->start;
-+    next->next = NULL;
-+    // Point to the new segment.
-+    root_table->curr_segment->next = next;
-+    root_table->curr_segment = next;
-+  }
-+  if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
-     // use local stack-allocated array.
-     uint16_t sorted[SORTED_SIZE_CUTOFF];
-    total_size = BuildHuffmanTable(root_table, root_bits,
-                                   code_lengths, code_lengths_size, sorted);
-  } else {   // rare case. Use heap allocation.
-+    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
-+                      code_lengths, code_lengths_size, sorted);
-+  } else {  // rare case. Use heap allocation.
-     uint16_t* const sorted =
-         (uint16_t*)WebPSafeMalloc(code_lengths_size, sizeof(*sorted));
-     if (sorted == NULL) return 0;
-    total_size = BuildHuffmanTable(root_table, root_bits,
-                                   code_lengths, code_lengths_size, sorted);
-+    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
-+                      code_lengths, code_lengths_size, sorted);
-     WebPSafeFree(sorted);
-   }
-   return total_size;
- }
-+
-+int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables) {
-+  // Have 'segment' point to the first segment for now, 'root'.
-+  HuffmanTablesSegment* const root = &huffman_tables->root;
-+  huffman_tables->curr_segment = root;
-+  // Allocate root.
-+  root->start = (HuffmanCode*)WebPSafeMalloc(size, sizeof(*root->start));
-+  if (root->start == NULL) return 0;
-+  root->curr_table = root->start;
-+  root->next = NULL;
-+  root->size = size;
-+  return 1;
-+}
-+
-+void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables) {
-+  HuffmanTablesSegment *current, *next;
-+  if (huffman_tables == NULL) return;
-+  // Free the root node.
-+  current = &huffman_tables->root;
-+  next = current->next;
-+  WebPSafeFree(current->start);
-+  current->start = NULL;
-+  current->next = NULL;
-+  current = next;
-+  // Free the following nodes.
-+  while (current != NULL) {
-+    next = current->next;
-+    WebPSafeFree(current->start);
-+    WebPSafeFree(current);
-+    current = next;
-+  }
-+}
-diff --git a/src/utils/huffman_utils.h b/src/utils/huffman_utils.h
-index 13b7ad1a..98415c53 100644
--- a/src/utils/huffman_utils.h
-+++ b/src/utils/huffman_utils.h
-@@ -43,6 +43,29 @@ typedef struct {
-                     // or non-literal symbol otherwise
- } HuffmanCode32;
- 
-+// Contiguous memory segment of HuffmanCodes.
-+typedef struct HuffmanTablesSegment {
-+  HuffmanCode* start;
-+  // Pointer to where we are writing into the segment. Starts at 'start' and
-+  // cannot go beyond 'start' + 'size'.
-+  HuffmanCode* curr_table;
-+  // Pointer to the next segment in the chain.
-+  struct HuffmanTablesSegment* next;
-+  int size;
-+} HuffmanTablesSegment;
-+
-+// Chained memory segments of HuffmanCodes.
-+typedef struct HuffmanTables {
-+  HuffmanTablesSegment root;
-+  // Currently processed segment. At first, this is 'root'.
-+  HuffmanTablesSegment* curr_segment;
-+} HuffmanTables;
-+
-+// Allocates a HuffmanTables with 'size' contiguous HuffmanCodes. Returns 0 on
-+// memory allocation error, 1 otherwise.
-+int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables);
-+void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables);
-+
- #define HUFFMAN_PACKED_BITS 6
- #define HUFFMAN_PACKED_TABLE_SIZE (1u << HUFFMAN_PACKED_BITS)
- 
-@@ -78,9 +101,7 @@ void VP8LHtreeGroupsFree(HTreeGroup* const htree_groups);
- // the huffman table.
- // Returns built table size or 0 in case of error (invalid tree or
- // memory error).
-// If root_table is NULL, it returns 0 if a lookup cannot be built, something
-// > 0 otherwise (but not the table size).
-int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-+int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
-                           const int code_lengths[], int code_lengths_size);
- 
- #ifdef __cplusplus
-- 
-2.41.0
-
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@ -27,23 +27,15 @@

 stdenv.mkDerivation rec {
  pname = "libwebp";
-  version = "1.3.1";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner  = "webmproject";
    repo   = pname;
    rev    = "v${version}";
-    hash   = "sha256-Q94avvKjPdwdGt5ADo30cf2V4T7MCTubDHJxTtbG4xQ=";
+    hash   = "sha256-UYO2Fmm8nzQR8VBC26wEwWd3qZTD+6MHKcmKBoNcpEE=";
  };

-  patches = [
-    # Commit 902bc919 from upstream, mangled slightly to apply onto 1.3.1.
-    # There is currently (2023-09-12) no confirmation that this is the fix for
-    # CVE-2023-4863, but it is linked to the right crbug, and matches the
-    # description of that (critical sev, exploited in the wild) CVE.
-    ./CVE-2023-4863.patch
-  ];
-
  configureFlags = [
    (lib.enableFeature threadingSupport "threading")
    (lib.enableFeature openglSupport "gl")
--- a/pkgs/development/libraries/libyang/default.nix
+++ b/pkgs/development/libraries/libyang/default.nix
@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    "-DCMAKE_INSTALL_LIBDIR=lib"
    "-DCMAKE_INSTALL_INCLUDEDIR=include"
-    "-DCMAKE_BUILD_TYPE:String=Release"
  ];

  passthru.updateScript = gitUpdater {
--- a/pkgs/development/libraries/lmdb/default.nix
+++ b/pkgs/development/libraries/lmdb/default.nix
@ -17,6 +17,11 @@ stdenv.mkDerivation rec {
  patches = [ ./hardcoded-compiler.patch ./bin-ext.patch ];
  patchFlags = [ "-p3" ];

+  # Don't attempt the .so if static, as it would fail.
+  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+    sed 's/^ILIBS\>.*/ILIBS = liblmdb.a/' -i Makefile
+  '';
+
  outputs = [ "bin" "out" "dev" ];

  buildInputs = lib.optional stdenv.hostPlatform.isWindows windows.pthreads;
--- a/pkgs/development/libraries/mesa-glu/default.nix
+++ b/pkgs/development/libraries/mesa-glu/default.nix
@ -1,19 +1,22 @@
-{ lib, stdenv, fetchurl, pkg-config, libGL, ApplicationServices
+{ lib, stdenv, fetchurl
+, meson, ninja
+, pkg-config, libGL, ApplicationServices
 , testers
+, gitUpdater
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "glu";
-  version = "9.0.2";
+  version = "9.0.3";

  src = let
    inherit (finalAttrs) pname version;
  in fetchurl {
    url = "https://mesa.freedesktop.org/archive/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bnKA/1hcah2d/N8vykiSUWNLM3e/wzwp5AAkZqONAtQ=";
+    hash = "sha256-vUP+EvN0sRkusV/iDkX/RWubwmq1fw7ukZ+Wyg+KMw8=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ meson ninja pkg-config ];
  propagatedBuildInputs = [ libGL ]
    ++ lib.optional stdenv.isDarwin ApplicationServices;

@ -21,7 +24,16 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru = {
+    tests = {
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    };
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://gitlab.freedesktop.org/mesa/glu";
+    rev-prefix = "glu-";
+    };
+  };

  meta = {
    description = "OpenGL utility library";
--- a/pkgs/development/libraries/muparserx/default.nix
+++ b/pkgs/development/libraries/muparserx/default.nix
@ -16,10 +16,6 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];

-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
-  ];
-
  doCheck = true;
  checkPhase = ''
    echo "***Muparserx self-test***"
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@ -133,7 +133,6 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DABSL_ENABLE_INSTALL=ON"
-    "-DCMAKE_BUILD_TYPE=RELEASE"
    "-DFETCHCONTENT_FULLY_DISCONNECTED=ON"
    "-DFETCHCONTENT_QUIET=OFF"
    "-DFETCHCONTENT_SOURCE_DIR_ABSEIL_CPP=${abseil-cpp.src}"
--- a/pkgs/development/libraries/phonon/backends/gstreamer.nix
+++ b/pkgs/development/libraries/phonon/backends/gstreamer.nix
@ -58,9 +58,7 @@ stdenv.mkDerivation rec {
    qttools
  ];

-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
-  ];
+  cmakeBuildType = if debug then "Debug" else "Release";

  meta = with lib; {
    homepage = "https://phonon.kde.org/";
--- a/pkgs/development/libraries/phonon/backends/vlc.nix
+++ b/pkgs/development/libraries/phonon/backends/vlc.nix
@ -28,9 +28,7 @@ stdenv.mkDerivation rec {

  dontWrapQtApps = true;

-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
-  ];
+  cmakeBuildType = if debug then "Debug" else "Release";

  meta = with lib; {
    homepage = "https://community.kde.org/Phonon";
--- a/pkgs/development/libraries/phonon/default.nix
+++ b/pkgs/development/libraries/phonon/default.nix
@ -52,9 +52,7 @@ stdenv.mkDerivation rec {

  env.NIX_CFLAGS_COMPILE = "-fPIC";

-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
-  ];
+  cmakeBuildType = if debug then "Debug" else "Release";

  dontWrapQtApps = true;

--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -23,6 +23,7 @@
 , vulkan-headers
 , vulkan-loader
 , webrtc-audio-processing
+, webrtc-audio-processing_1
 , ncurses
 , readline # meson can't find <7 as those versions don't have a .pc file
 , lilv
@ -42,10 +43,11 @@
 , bluez
 , sbc
 , libfreeaptx
-, ldacbt
 , liblc3
 , fdk_aac
 , libopus
+, ldacbtSupport ? bluezSupport && lib.meta.availableOn stdenv.hostPlatform ldacbt
+, ldacbt
 , nativeHspSupport ? true
 , nativeHfpSupport ? true
 , nativeModemManagerSupport ? true
@ -70,12 +72,15 @@
 , ffado
 }:

+# Bluetooth codec only makes sense if general bluetooth enabled
+assert ldacbtSupport -> bluezSupport;
+
 let
  mesonEnableFeature = b: if b then "enabled" else "disabled";

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.79";
+    version = "0.3.80";

    outputs = [
      "out"
@ -93,7 +98,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-pqs991pMqz3IQE+NUk0VNzZS4ExwfoZqBQDWBSGdWcs=";
+      sha256 = "sha256-6Ka83Bqd/nsfp8rv0GTBerpGP226MeZvC5u/j62FzP0=";
    };

    patches = [
@ -111,6 +116,12 @@ let
      ./0090-pipewire-config-template-paths.patch
      # Place SPA data files in lib output to avoid dependency cycles
      ./0095-spa-data-dir.patch
+
+      # backport fix for building with webrtc-audio-processing 0.3 on platforms where we don't have 1.x
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/1f1c308c9766312e684f0b53fc2d1422c7414d31.patch";
+        hash = "sha256-ECM7/84G99yzXsg5A2DkFnXFGJSV9lz3vD0IRSzR8vU=";
+      })
    ];

    strictDeps = true;
@ -138,13 +149,14 @@ let
      udev
      vulkan-headers
      vulkan-loader
-      webrtc-audio-processing
      tinycompress
    ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
+    ++ (if lib.meta.availableOn stdenv.hostPlatform webrtc-audio-processing_1 then [ webrtc-audio-processing_1 ] else [ webrtc-audio-processing ])
    ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
    ++ lib.optionals libcameraSupport [ libcamera libdrm ]
    ++ lib.optional ffmpegSupport ffmpeg
-    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt liblc3 sbc fdk_aac libopus ]
+    ++ lib.optionals bluezSupport [ bluez libfreeaptx liblc3 sbc fdk_aac libopus ]
+    ++ lib.optional ldacbtSupport ldacbt
    ++ lib.optional nativeModemManagerSupport modemmanager
    ++ lib.optional pulseTunnelSupport libpulseaudio
    ++ lib.optional zeroconfSupport avahi
@ -184,6 +196,7 @@ let
      # source code is not easily obtainable
      "-Dbluez5-codec-lc3plus=disabled"
      "-Dbluez5-codec-lc3=${mesonEnableFeature bluezSupport}"
+      "-Dbluez5-codec-ldac=${mesonEnableFeature ldacbtSupport}"
      "-Dsysconfdir=/etc"
      "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
      "-Draop=${mesonEnableFeature raopSupport}"
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@ -39,7 +39,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "polkit";
-  version = "122";
+  version = "123";

  outputs = [ "bin" "dev" "out" ]; # small man pages in $bin

@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
    owner = "polkit";
    repo = "polkit";
    rev = version;
-    sha256 = "fLY8i8h4McAnwVt8dLOqbyHM7v3SkbWqATz69NkUudU=";
+    hash = "sha256-/kjWkh6w2FYgtYWzw3g3GlWJKKpkJ3cqwfE0iDqJctw=";
  };

  patches = [
--- a/pkgs/development/libraries/protobuf/3.24.nix
+++ b/pkgs/development/libraries/protobuf/3.24.nix
@ -1,6 +1,6 @@
 { callPackage, ... } @ args:

 callPackage ./generic-v3-cmake.nix ({
-  version = "3.24.2";
-  sha256 = "sha256-yVLszyVtsz1CCzeOkioL4O3mWTFKKVBUyOhwDbC5UqE=";
+  version = "3.24.3";
+  sha256 = "sha256-wXGQW/o674DeLXX2IlyZskl5OrBcSRptOMoJqLQGm94=";
 } // args)
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@ -13,53 +13,45 @@
 , version
 , sha256

-# downstream dependencies
+  # downstream dependencies
 , python3
+, grpc

 , ...
 }:

-let
-  self = stdenv.mkDerivation {
-    pname = "protobuf";
-    inherit version;
+stdenv.mkDerivation (finalAttrs: {
+  pname = "protobuf";
+  inherit version;

-    src = fetchFromGitHub {
-      owner = "protocolbuffers";
-      repo = "protobuf";
-      rev = "v${version}";
-      inherit sha256;
-    };
+  src = fetchFromGitHub {
+    owner = "protocolbuffers";
+    repo = "protobuf";
+    rev = "v${version}";
+    inherit sha256;
+  };

-    # re-create submodule logic
-    postPatch = ''
-      rm -rf gmock
-      cp -r ${gtest.src}/googlemock third_party/gmock
-      cp -r ${gtest.src}/googletest third_party/
-      chmod -R a+w third_party/
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace src/google/protobuf/testing/googletest.cc \
+      --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
+  '';

-      ln -s ../googletest third_party/gmock/gtest
-      ln -s ../gmock third_party/googletest/googlemock
-      ln -s $(pwd)/third_party/googletest third_party/googletest/googletest
-    '' + lib.optionalString stdenv.isDarwin ''
-      substituteInPlace src/google/protobuf/testing/googletest.cc \
-        --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
-    '';
+  patches = lib.optionals (lib.versionOlder version "3.22") [
+    # fix protobuf-targets.cmake installation paths, and allow for CMAKE_INSTALL_LIBDIR to be absolute
+    # https://github.com/protocolbuffers/protobuf/pull/10090
+    (fetchpatch {
+      url = "https://github.com/protocolbuffers/protobuf/commit/a7324f88e92bc16b57f3683403b6c993bf68070b.patch";
+      sha256 = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
+    })
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    ./static-executables-have-no-rpath.patch
+  ];

-    patches = lib.optionals (lib.versionOlder version "3.22") [
-      # fix protobuf-targets.cmake installation paths, and allow for CMAKE_INSTALL_LIBDIR to be absolute
-      # https://github.com/protocolbuffers/protobuf/pull/10090
-      (fetchpatch {
-        url = "https://github.com/protocolbuffers/protobuf/commit/a7324f88e92bc16b57f3683403b6c993bf68070b.patch";
-        sha256 = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
-      })
-    ] ++ lib.optionals stdenv.hostPlatform.isStatic [
-      ./static-executables-have-no-rpath.patch
-    ];
-
-    nativeBuildInputs = let
+  nativeBuildInputs =
+    let
      protobufVersion = "${lib.versions.major version}_${lib.versions.minor version}";
-    in [
+    in
+    [
      cmake
    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
      # protoc of the same version must be available for build. For non-cross builds, it's able to
@ -67,52 +59,57 @@ let
      buildPackages."protobuf${protobufVersion}"
    ];

-    buildInputs = [
-      zlib
-    ];
+  buildInputs = [
+    gtest
+    zlib
+  ];

-    propagatedBuildInputs = [
-      abseil-cpp
-    ];
+  propagatedBuildInputs = [
+    abseil-cpp
+  ];

-    cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
-    cmakeFlags = [
-      "-Dprotobuf_ABSL_PROVIDER=package"
-    ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
-      "-Dprotobuf_BUILD_SHARED_LIBS=ON"
-    ]
-    # Tests fail to build on 32-bit platforms; fixed in 3.22
-    # https://github.com/protocolbuffers/protobuf/issues/10418
-    ++ lib.optional
-      (stdenv.targetPlatform.is32bit && lib.versionOlder version "3.22")
-      "-Dprotobuf_BUILD_TESTS=OFF";
+  strictDeps = true;

-    # unfortunately the shared libraries have yet to been patched by nix, thus tests will fail
-    doCheck = false;
+  cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
+  cmakeFlags = [
+    "-Dprotobuf_USE_EXTERNAL_GTEST=ON"
+    "-Dprotobuf_ABSL_PROVIDER=package"
+  ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
+    "-Dprotobuf_BUILD_SHARED_LIBS=ON"
+  ]
+  # Tests fail to build on 32-bit platforms; fixed in 3.22
+  # https://github.com/protocolbuffers/protobuf/issues/10418
+  ++ lib.optionals (stdenv.targetPlatform.is32bit && lib.versionOlder version "3.22") [
+    "-Dprotobuf_BUILD_TESTS=OFF"
+  ];

-    passthru = {
-      tests = {
-        pythonProtobuf = python3.pkgs.protobuf.override(_: {
-          protobuf = self;
-        });
-      };
+  # FIXME: investigate.  3.24 and 3.23 have different errors.
+  # At least some of it is not reproduced on some other machine; example:
+  # https://hydra.nixos.org/build/235677717/nixlog/4/tail
+  doCheck = !(stdenv.isDarwin && lib.versionAtLeast version "3.23");

-      inherit abseil-cpp;
+  passthru = {
+    tests = {
+      pythonProtobuf = python3.pkgs.protobuf.override (_: {
+        protobuf = finalAttrs.finalPackage;
+      });
+      inherit grpc;
    };

-    meta = {
-      description = "Google's data interchange format";
-      longDescription = ''
-        Protocol Buffers are a way of encoding structured data in an efficient
-        yet extensible format. Google uses Protocol Buffers for almost all of
-        its internal RPC protocols and file formats.
-      '';
-      license = lib.licenses.bsd3;
-      platforms = lib.platforms.unix;
-      homepage = "https://developers.google.com/protocol-buffers/";
-      maintainers = with lib.maintainers; [ jonringer ];
-      mainProgram = "protoc";
-    };
+    inherit abseil-cpp;
  };
-in
-  self
+
+  meta = {
+    description = "Google's data interchange format";
+    longDescription = ''
+      Protocol Buffers are a way of encoding structured data in an efficient
+      yet extensible format. Google uses Protocol Buffers for almost all of
+      its internal RPC protocols and file formats.
+    '';
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    homepage = "https://protobuf.dev/";
+    maintainers = with lib.maintainers; [ jonringer ];
+    mainProgram = "protoc";
+  };
+})
--- a/pkgs/development/libraries/qpdf/default.nix
+++ b/pkgs/development/libraries/qpdf/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "qpdf";
-  version = "11.5.0";
+  version = "11.6.1";

  src = fetchFromGitHub {
    owner = "qpdf";
    repo = "qpdf";
    rev = "v${version}";
-    hash = "sha256-lojvsCgBsT7wVRLWfkeOduEYUG7ztI/uryM0WueWiL0=";
+    hash = "sha256-QXRzvSMi6gKISJo44KIjTYENNqxh1yDhUUhEZa8uz6Q=";
  };

  nativeBuildInputs = [ cmake perl ];
--- a/pkgs/development/libraries/qt-5/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
@ -1,10 +1,10 @@
-{ qtModule, qtbase, qtquickcontrols, wayland, pkg-config }:
+{ qtModule, qtbase, qtquickcontrols, wayland, wayland-scanner, pkg-config }:

 qtModule {
  pname = "qtwayland";
  qtInputs = [ qtbase qtquickcontrols ];
  buildInputs = [ wayland ];
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config wayland-scanner ];
  outputs = [ "out" "dev" "bin" ];
  patches = [
    # NixOS-specific, ensure that app_id is correctly determined for
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "re2";
-  version = "2023-08-01";
+  version = "2023-09-01";

  src = fetchFromGitHub {
    owner = "google";
    repo = "re2";
    rev = version;
-    hash = "sha256-RexwqNR/Izf2Rzu1cvMw+le6C4EmL4CeWCOc+vXUBZQ=";
+    hash = "sha256-dCEkwjIs8ITVUZ4N0+qeGoShGNqKkdvJ88teyGKN6pg=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/reproc/default.nix
+++ b/pkgs/development/libraries/reproc/default.nix
@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DCMAKE_INSTALL_LIBDIR=lib"
    "-DBUILD_SHARED_LIBS=ON"
    "-DREPROC++=ON"
--- a/pkgs/development/libraries/rnnoise-plugin/default.nix
+++ b/pkgs/development/libraries/rnnoise-plugin/default.nix
@ -49,8 +49,6 @@ stdenv.mkDerivation rec {
      simd
    ];

-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
  meta = with lib; {
    description = "A real-time noise suppression plugin for voice based on Xiph's RNNoise";
    homepage = "https://github.com/werman/noise-suppression-for-voice";
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "s2n-tls";
-  version = "1.3.48";
+  version = "1.3.50";

  src = fetchFromGitHub {
    owner = "aws";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-7C1syZAhMv0N+AuE/SuXqhatKhlzDOix4ZDxLRyuWOs=";
+    sha256 = "sha256-B+znuvQ7TTl2u4rw64ylPywfpr066Yf8Wg0qrdByGRE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@ -28,8 +28,9 @@ stdenv.mkDerivation rec {
    breakpad
  ];

+  cmakeBuildType = "RelWithDebInfo";
+
  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
    "-DSENTRY_BREAKPAD_SYSTEM=On"
  ];

--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@ -7,6 +7,8 @@
 , interactive ? false
 # TODO: can be removed since 3.36 since it is the default now.
 , enableDeserialize ? false
+
+, gitUpdater
 }:

 let
@ -15,13 +17,13 @@ in

 stdenv.mkDerivation rec {
  pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.42.0";
+  version = "3.43.1";

  # nixpkgs-update: no auto update
  # NB! Make sure to update ./tools.nix src (in the same directory).
  src = fetchurl {
    url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-erz9FhxuJ0LKXGwIldH4U8lA8gMwSgtJ2k4eyl0IjKY=";
+    hash = "sha256-ORFslOdmMPItVM2Cw86jCFZfFxX3FtGyUn8cnJabpNk=";
  };

  outputs = [ "bin" "dev" "out" ];
@ -87,9 +89,18 @@ stdenv.mkDerivation rec {

  doCheck = false; # fails to link against tcl

-  passthru.tests = {
-    inherit (python3Packages) sqlalchemy;
-    inherit sqldiff sqlite-analyzer tracker;
+  passthru = {
+    tests = {
+      inherit (python3Packages) sqlalchemy;
+      inherit sqldiff sqlite-analyzer tracker;
+    };
+
+    updateScript = gitUpdater {
+      # No nicer place to look for patest version.
+      url = "https://github.com/sqlite/sqlite.git";
+      # Expect tags like "version-3.43.0".
+      rev-prefix = "version-";
+    };
  };

  meta = with lib; {
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@ -4,12 +4,12 @@ let
  archiveVersion = import ./archive-version.nix lib;
  mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
    inherit pname;
-    version = "3.42.0";
+    version = "3.43.1";

    # nixpkgs-update: no auto update
    src = assert version == sqlite.version; fetchurl {
      url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-OMpWoxe+N/sAvZK8KA2bkgm9QAiyl9SDxB7B9geb+20=";
+      hash = "sha256-IunC70n+b4otvJPE09zgnG1qT1Y95SsKgXGtSajHKRc=";
    };

    nativeBuildInputs = [ unzip ];
--- a/pkgs/development/libraries/taglib/default.nix
+++ b/pkgs/development/libraries/taglib/default.nix
@ -7,20 +7,26 @@

 stdenv.mkDerivation rec {
  pname = "taglib";
-  version = "1.13";
+  version = "1.13.1";

  src = fetchFromGitHub {
    owner = "taglib";
    repo = "taglib";
    rev = "v${version}";
-    sha256 = "sha256-DRALRH+/7c2lBvCpLp8hop3Xxsf76F1q8L7F9qehqQA=";
+    hash = "sha256-QX0EpHGT36UsgIfRf5iALnwxe0jjLpZvCTbk8vSMFF4=";
  };

  nativeBuildInputs = [ cmake ];

  buildInputs = [ zlib ];

-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    # Workaround unconditional ${prefix} until upstream is fixed:
+    #   https://github.com/taglib/taglib/issues/1098
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ];

  meta = with lib; {
    homepage = "https://taglib.org/";
--- a/pkgs/development/libraries/unixODBC/default.nix
+++ b/pkgs/development/libraries/unixODBC/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "unixODBC";
-  version = "2.3.11";
+  version = "2.3.12";

  src = fetchurl {
    urls = [
      "ftp://ftp.unixodbc.org/pub/unixODBC/${pname}-${version}.tar.gz"
      "https://www.unixodbc.org/${pname}-${version}.tar.gz"
    ];
-    sha256 = "sha256-2eVcjnEYNH48ZshzOIVtrRUWtJD7fHVsFWKiwmfHO1w=";
+    sha256 = "sha256-8hBQFEXOIb9ge6Ue+MEl4Q4i3/3/7Dd2RkYt9fAZFew=";
  };

  configureFlags = [ "--disable-gui" "--sysconfdir=/etc" ];
--- a/pkgs/development/libraries/webrtc-audio-processing/default.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/default.nix
@ -1,45 +1,41 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, fetchFromGitLab
 , darwin
 , abseil-cpp
 , meson
 , ninja
+, pkg-config
 }:

 stdenv.mkDerivation rec {
  pname = "webrtc-audio-processing";
-  version = "1.0";
+  version = "1.3";

-  src = fetchurl {
-    url = "https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/archive/v${version}/webrtc-audio-processing-v${version}.tar.gz";
-    sha256 = "sha256-dqRy1OfOG9TX2cgCD8cowU44zVanns/nPYZrilPfuiU=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "pulseaudio";
+    repo = "webrtc-audio-processing";
+    rev = "v${version}";
+    hash = "sha256-8CDt4kMt2Owzyv22dqWIcFuHeg4Y3FxB405cLw3FZ+g=";
  };

  nativeBuildInputs = [
    meson
    ninja
+    pkg-config
  ];

-  buildInputs = [
+  propagatedBuildInputs = [
    abseil-cpp
-  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices ]);
+  ];

-  patchPhase = ''
-    # this is just incorrect upstream
-    # see https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/issues/4
-    substituteInPlace meson.build \
-      --replace "absl_flags_registry" "absl_flags_reflection"
-    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
-    substituteInPlace webrtc/base/checks.cc --replace 'defined(__UCLIBC__)' 1
-  '';
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices ]);

  meta = with lib; {
    homepage = "https://www.freedesktop.org/software/pulseaudio/webrtc-audio-processing";
    description = "A more Linux packaging friendly copy of the AudioProcessing module from the WebRTC project";
    license = licenses.bsd3;
    # https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/blob/master/webrtc/rtc_base/system/arch.h
-    platforms = intersectLists platforms.unix (platforms.aarch64 ++ platforms.mips ++ platforms.riscv ++ platforms.x86);
-    # attempts to inline 256bit AVX instructions on x86
-    # https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/issues/5
-    broken = stdenv.isx86_32;
+    # x86-32 disabled due to https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/issues/5
+    platforms = intersectLists platforms.unix (platforms.aarch64 ++ platforms.mips ++ platforms.riscv ++ platforms.x86_64);
  };
 }
--- a/pkgs/development/python-modules/bootstrap/build/default.nix
+++ b/pkgs/development/python-modules/bootstrap/build/default.nix
@ -7,12 +7,15 @@
 , packaging
 , pyproject-hooks
 , tomli
+, makeWrapper
 }:
 let
  buildBootstrapPythonModule = basePackage: attrs: stdenv.mkDerivation ({
    pname = "${python.libPrefix}-bootstrap-${basePackage.pname}";
    inherit (basePackage) version src meta;

+    nativeBuildInputs = [ makeWrapper ];
+
    buildPhase = ''
      runHook preBuild

@ -38,12 +41,30 @@ let
  bootstrap-pyproject-hooks = buildBootstrapPythonModule pyproject-hooks {};

  bootstrap-tomli = buildBootstrapPythonModule tomli {};
+
+  sitePkgs = python.sitePackages;
 in
 buildBootstrapPythonModule build {
-  propagatedBuildInputs = [
-    bootstrap-packaging
-    bootstrap-pyproject-hooks
-  ] ++ lib.optionals (python.pythonOlder "3.11") [
-    bootstrap-tomli
-  ];
+  # like the installPhase above, but wrapping the pyproject-build command
+  #   to set up PYTHONPATH with the correct dependencies.
+  # This allows using `pyproject-build` without propagating its dependencies
+  #   into the build environment, which is necessary to prevent
+  #   pythonCatchConflicts from raising false positive alerts.
+  # This would happen whenever the package to build has a dependency on
+  #   another version of a package that is also a dependency of pyproject-build.
+  installPhase = ''
+    runHook preInstall
+
+    PYTHONPATH="${installer}/${python.sitePackages}" \
+      ${python.interpreter} -m installer \
+        --destdir "$out" --prefix "" dist/*.whl
+
+    wrapProgram $out/bin/pyproject-build \
+      --prefix PYTHONPATH : "$out/${sitePkgs}" \
+      --prefix PYTHONPATH : "${bootstrap-pyproject-hooks}/${sitePkgs}" \
+      --prefix PYTHONPATH : "${bootstrap-packaging}/${sitePkgs}" \
+      --prefix PYTHONPATH : "${bootstrap-tomli}/${sitePkgs}"
+
+    runHook postInstall
+  '';
 }
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@ -42,14 +42,14 @@

 buildPythonPackage rec {
  pname = "Django";
-  version = "4.2.4";
+  version = "4.2.5";
  format = "pyproject";

  disabled = pythonOlder "3.10";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fkIl7AZeDzVMz3NJoi0gneCcwcB0gyvp64TFHBeZxDI=";
+    hash = "sha256-XlwclUj/t3lrSopHgumi5aPfNhUln8G/0+vHO2RhRsE=";
  };

  patches = [
--- a/pkgs/development/python-modules/gudhi/default.nix
+++ b/pkgs/development/python-modules/gudhi/default.nix
@ -38,7 +38,6 @@ buildPythonPackage rec {
  nativeCheckInputs = [ pytest ];

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
    "-DWITH_GUDHI_PYTHON=ON"
    "-DPython_ADDITIONAL_VERSIONS=3"
  ];
--- a/pkgs/development/python-modules/jq/default.nix
+++ b/pkgs/development/python-modules/jq/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , cython
 , fetchFromGitHub
+, fetchpatch
 , jq
 , pytestCheckHook
 , pythonOlder
@ -9,7 +10,7 @@

 buildPythonPackage rec {
  pname = "jq";
-  version = "1.4.1";
+  version = "1.5.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,12 +19,17 @@ buildPythonPackage rec {
    owner = "mwilliamson";
    repo = "jq.py";
    rev = "refs/tags/${version}";
-    hash = "sha256-prH3yUFh3swXGsxnoax09aYAXaiu8o2M21ZbOp9HDJY=";
+    hash = "sha256-mITk5y2AdUc9kZ/WrsnHxS1GRRmO4FDbPRgTtV2gIXI=";
  };

  patches = [
    # Removes vendoring
    ./jq-py-setup.patch
+    (fetchpatch {
+      url = "https://github.com/mwilliamson/jq.py/commit/805705dde4beb9db9a1743663d415198fb02eb1a.patch";
+      includes = [ "tests/*" ];
+      hash = "sha256-AgdpwmtOTeJ4nSbM6IknKaIVqqtWkpxTTtblXjlbWeA=";
+    })
  ];

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More