Merge master into haskell-updates

.git-blame-ignore-revs

···
 
 # nixos/*: add trivial defaultText for options with simple defaults
 25124556397ba17bfd70297000270de1e6523b0a
+
+# systemd: rewrite comments
+92dfeb7b3dab820ae307c56c216d175c69ee93cd
+
+# systemd: break too long lines of Nix code
+67643f8ec84bef1482204709073e417c9f07eb87

COPYING

···
-Copyright (c) 2003-2023 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2024 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

lib/attrsets.nix

···
 
 let
   inherit (builtins) head tail length;
-  inherit (lib.trivial) id mergeAttrs;
+  inherit (lib.trivial) id mergeAttrs warn;
   inherit (lib.strings) concatStringsSep concatMapStringsSep escapeNixIdentifier sanitizeDerivationName;
   inherit (lib.lists) foldr foldl' concatMap concatLists elemAt all partition groupBy take foldl;
 in
···
       (x // y) // mask;
 
   # DEPRECATED
-  zipWithNames = zipAttrsWithNames;
+  zipWithNames = warn
+    "lib.zipWithNames is a deprecated alias of lib.zipAttrsWithNames." zipAttrsWithNames;
 
   # DEPRECATED
-  zip = builtins.trace
-    "lib.zip is deprecated, use lib.zipAttrsWith instead" zipAttrsWith;
+  zip = warn
+    "lib.zip is a deprecated alias of lib.zipAttrsWith." zipAttrsWith;
 }

lib/lists.nix

···
 { lib }:
 let
   inherit (lib.strings) toInt;
-  inherit (lib.trivial) compare min id;
+  inherit (lib.trivial) compare min id warn;
   inherit (lib.attrsets) mapAttrs;
   inherit (lib.lists) sort;
 in
···
       crossLists (x:y: "${toString x}${toString y}") [[1 2] [3 4]]
       => [ "13" "14" "23" "24" ]
   */
-  crossLists = builtins.trace
-    "lib.crossLists is deprecated, use lib.cartesianProductOfSets instead"
+  crossLists = warn
+    "lib.crossLists is deprecated, use lib.cartesianProductOfSets instead."
     (f: foldl (fs: args: concatMap (f: map f args) fs) [f]);
 
 

lib/options.nix

···
     if ! isString text then throw "literalExpression expects a string."
     else { _type = "literalExpression"; inherit text; };
 
-  literalExample = lib.warn "literalExample is deprecated, use literalExpression instead, or use literalMD for a non-Nix description." literalExpression;
+  literalExample = lib.warn "lib.literalExample is deprecated, use lib.literalExpression instead, or use lib.literalMD for a non-Nix description." literalExpression;
 
   /* Transition marker for documentation that's already migrated to markdown
      syntax. This is a no-op and no longer needed.

lib/strings.nix

···
     [""" "'" "<" ">" "&"];
 
   # warning added 12-12-2022
-  replaceChars = lib.warn "replaceChars is a deprecated alias of replaceStrings, replace usages of it with replaceStrings." builtins.replaceStrings;
+  replaceChars = lib.warn "lib.replaceChars is a deprecated alias of lib.replaceStrings." builtins.replaceStrings;
 
   # Case conversion utilities.
   lowerChars = stringToCharacters "abcdefghijklmnopqrstuvwxyz";
···
             "/prefix/nix-profiles-library-paths.patch"
             "/prefix/compose-search-path.patch" ]
   */
-  readPathsFromFile = lib.warn "lib.readPathsFromFile is deprecated, use a list instead"
+  readPathsFromFile = lib.warn "lib.readPathsFromFile is deprecated, use a list instead."
     (rootPath: file:
       let
         lines = lib.splitString "\n" (readFile file);

lib/systems/inspect.nix

···
     isRiscV64      = { cpu = { family = "riscv"; bits = 64; }; };
     isRx           = { cpu = { family = "rx"; }; };
     isSparc        = { cpu = { family = "sparc"; }; };
+    isSparc64      = { cpu = { family = "sparc"; bits = 64; }; };
     isWasm         = { cpu = { family = "wasm"; }; };
     isMsp430       = { cpu = { family = "msp430"; }; };
     isVc4          = { cpu = { family = "vc4"; }; };

lib/trivial.nix

···
        else if lib.pathExists revisionFile then lib.fileContents revisionFile
        else default;
 
-  nixpkgsVersion = builtins.trace "`lib.nixpkgsVersion` is deprecated, use `lib.version` instead!" version;
+  nixpkgsVersion = warn "lib.nixpkgsVersion is a deprecated alias of lib.version." version;
 
   /* Determine whether the function is being called from inside a Nix
      shell.

maintainers/maintainer-list.nix

···
     githubId = 49904992;
     name = "Dawid Sowa";
   };
+  daylinmorgan = {
+    email = "[e-mail]";
+    github = "daylinmorgan";
+    githubId = 47667941;
+    name = "Daylin Morgan";
+  };
   dbalan = {
     email = "[e-mail]";
     github = "dbalan";

nixos/doc/manual/configuration/file-systems.chapter.md

···
 ```{=include=} sections
 luks-file-systems.section.md
 sshfs-file-systems.section.md
+overlayfs.section.md
 ```

nixos/doc/manual/configuration/overlayfs.section.md

···
+# Overlayfs {#sec-overlayfs}
+
+NixOS offers a convenient abstraction to create both read-only as well writable
+overlays.
+
+```nix
+fileSystems = {
+  "/writable-overlay" = {
+    overlay = {
+      lowerdir = [ writableOverlayLowerdir ];
+      upperdir = "/.rw-writable-overlay/upper";
+      workdir = "/.rw-writable-overlay/work";
+    };
+    # Mount the writable overlay in the initrd.
+    neededForBoot = true;
+  };
+  "/readonly-overlay".overlay.lowerdir = [
+    writableOverlayLowerdir
+    writableOverlayLowerdir2
+  ];
+};
+```
+
+If `upperdir` and `workdir` are not null, they will be created before the
+overlay is mounted.
+
+To mount an overlay as read-only, you need to provide at least two `lowerdir`s.

nixos/doc/manual/release-notes/rl-2405.section.md

···
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `cryptsetup` has been upgraded from 2.6.1 to 2.7.0. Cryptsetup is a critical component enabling LUKS-based (but not only) full disk encryption.
+  Take the time to review [the release notes](https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.7.0/docs/v2.7.0-ReleaseNotes).
+  One of the highlight is that it is now possible to use hardware OPAL-based encryption of your disk with `cryptsetup`, it has a lot of caveats, see the above notes for the full details.
+
 - `screen`'s module has been cleaned, and will now require you to set `programs.screen.enable` in order to populate `screenrc` and add the program to the environment.
 
 - `linuxPackages_testing_bcachefs` is now fully deprecated by `linuxPackages_latest`, and is therefore no longer available.
···
 - `services.postgresql.extraPlugins` changed its type from just a list of packages to also a function that returns such a list.
   For example a config line like ``services.postgresql.extraPlugins = with pkgs.postgresql_11.pkgs; [ postgis ];`` is recommended to be changed to ``services.postgresql.extraPlugins = ps: with ps; [ postgis ];``;
 
+- The Matrix homeserver [Synapse](https://element-hq.github.io/synapse/) module now supports configuring UNIX domain socket [listeners](#opt-services.matrix-synapse.settings.listeners) through the `path` option.
+  The default replication worker on the main instance has been migrated away from TCP sockets to UNIX domain sockets.
+
 - Programs written in [Nim](https://nim-lang.org/) are built with libraries selected by lockfiles.
   The `nimPackages` and `nim2Packages` sets have been removed.
   See https://nixos.org/manual/nixpkgs/unstable#nim for more information.
···
   This version of Portunus supports strong password hashes, but the legacy hash SHA-256 is also still supported to ensure a smooth migration of existing user accounts.
   After upgrading, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all user accounts to strong password hashes.
   Support for weak password hashes will be removed in NixOS 24.11.
+
+- A stdenv's default set of hardening flags can now be set via its `bintools-wrapper`'s `defaultHardeningFlags` argument. A convenient stdenv adapter, `withDefaultHardeningFlags`, can be used to override an existing stdenv's `defaultHardeningFlags`.
 
 - `libass` now uses the native CoreText backend on Darwin, which may fix subtitle rendering issues with `mpv`, `ffmpeg`, etc.
 
···
 - The option [`services.nextcloud.config.dbport`] of the Nextcloud module was removed to match upstream.
   The port can be specified in [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost).
 
+- A new abstraction to create both read-only as well as writable overlay file
+  systems was added. Available via
+  [fileSystems.overlay](#opt-fileSystems._name_.overlay.lowerdir). See also the
+  [NixOS docs](#sec-overlayfs).
+
 - `stdenv`: The `--replace` flag in `substitute`, `substituteInPlace`, `substituteAll`, `substituteAllStream`, and `substituteStream` is now deprecated if favor of the new `--replace-fail`, `--replace-warn` and `--replace-quiet`. The deprecated `--replace` equates to `--replace-warn`.
+
+- A new hardening flag, `zerocallusedregs` was made available, corresponding to the gcc/clang option `-fzero-call-used-regs=used-gpr`.
 
 - New options were added to the dnsdist module to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
   The module can generate the DNSCrypt provider key pair, certificates and also performs their rotation automatically with no downtime.
···
   `globalRedirect` can now have redirect codes other than 301 through
   `redirectCode`.
 
+- `libjxl` 0.9.0 [dropped support for the butteraugli API](https://github.com/libjxl/libjxl/pull/2576). You will no longer be able to set `enableButteraugli` on `libaom`.
+
 - The source of the `mockgen` package has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
 
 - `security.pam.enableSSHAgentAuth` was renamed to `security.pam.sshAgentAuth.enable` and an `authorizedKeysFiles`
···
   **which is insecure**: see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
 
 - [](#opt-boot.kernel.sysctl._net.core.wmem_max_) changed from a string to an integer because of the addition of a custom merge option (taking the highest value defined to avoid conflicts between 2 services trying to set that value), just as [](#opt-boot.kernel.sysctl._net.core.rmem_max_) since 22.11.
+
+- A new top-level package set, `pkgsExtraHardening` is added. This is a set of packages built with stricter hardening flags - those that have not yet received enough testing to be applied universally, those that are more likely to cause build failures or those that have drawbacks to their use (e.g. performance or required hardware features).
 
 - `services.zfs.zed.enableMail` now uses the global `sendmail` wrapper defined by an email module
   (such as msmtp or Postfix). It no longer requires using a special ZFS build with email support.

nixos/maintainers/scripts/ec2/README.md

···
+# Amazon images
+
+* The `create-amis.sh` script will be replaced by https://github.com/NixOS/amis which will regularly upload AMIs per NixOS channel bump.
+
+* @arianvp is planning to drop zfs support
+* @arianvp is planning to rewrite the image builder to use the repart-based image builder.
+

nixos/maintainers/scripts/ec2/amazon-image.nix

···
       '';
     };
   in if config.ec2.zfs.enable then zfsBuilder else extBuilder;
+
+  meta.maintainers = with maintainers; [ arianvp ];
 }

nixos/modules/module-list.nix

···
   ./tasks/filesystems/jfs.nix
   ./tasks/filesystems/nfs.nix
   ./tasks/filesystems/ntfs.nix
+  ./tasks/filesystems/overlayfs.nix
   ./tasks/filesystems/reiserfs.nix
   ./tasks/filesystems/sshfs.nix
   ./tasks/filesystems/squashfs.nix

nixos/modules/services/hardware/pcscd.nix

···
   config = mkIf config.services.pcscd.enable {
     environment.etc."reader.conf".source = cfgFile;
 
-    environment.systemPackages = [ package.out ];
-    systemd.packages = [ (getBin package) ];
+    environment.systemPackages = [ package ];
+    systemd.packages = [ package ];
 
     services.pcscd.plugins = [ pkgs.ccid ];
 
···
       # around it, we force the path to the cfgFile.
       #
       # https://github.com/NixOS/nixpkgs/issues/121088
-      serviceConfig.ExecStart = [ "" "${getBin package}/bin/pcscd -f -x -c ${cfgFile}" ];
+      serviceConfig.ExecStart = [ "" "${package}/bin/pcscd -f -x -c ${cfgFile}" ];
     };
   };
 }

nixos/modules/services/matrix/synapse.md

···
 Otherwise, or you can generate a registration secret with
 {command}`pwgen -s 64 1` and set it with
 [](#opt-services.matrix-synapse.settings.registration_shared_secret).
-To create a new user or admin, run the following after you have set the secret
-and have rebuilt NixOS:
+To create a new user or admin from the terminal your client listener
+must be configured to use TCP sockets. Then you can run the following
+after you have set the secret and have rebuilt NixOS:
 ```ShellSession
 $ nix-shell -p matrix-synapse
 $ register_new_matrix_user -k your-registration-shared-secret http://localhost:8008

nixos/modules/services/matrix/synapse.nix

···
   cfg = config.services.matrix-synapse;
   format = pkgs.formats.yaml { };
 
+  filterRecursiveNull = o:
+    if isAttrs o then
+      mapAttrs (_: v: filterRecursiveNull v) (filterAttrs (_: v: v != null) o)
+    else if isList o then
+      map filterRecursiveNull (filter (v: v != null) o)
+    else
+      o;
+
   # remove null values from the final configuration
-  finalSettings = lib.filterAttrsRecursive (_: v: v != null) cfg.settings;
+  finalSettings = filterRecursiveNull cfg.settings;
   configFile = format.generate "homeserver.yaml" finalSettings;
 
   usePostgresql = cfg.settings.database.name == "psycopg2";
···
         SYSLOG_IDENTIFIER = logName;
       };
     });
+
+  toIntBase8 = str:
+    lib.pipe str [
+      lib.stringToCharacters
+      (map lib.toInt)
+      (lib.foldl (acc: digit: acc * 8 + digit) 0)
+    ];
+
+  toDecimalFilePermission = value:
+    if value == null then
+      null
+    else
+      toIntBase8 value;
 in {
 
   imports = [
···
   ];
 
   options = let
-    listenerType = workerContext: types.submodule {
+    listenerType = workerContext: types.submodule ({ config, ... }: {
       options = {
         port = mkOption {
-          type = types.port;
+          type = types.nullOr types.port;
+          default = null;
           example = 8448;
           description = lib.mdDoc ''
             The port to listen for HTTP(S) requests on.
···
         };
 
         bind_addresses = mkOption {
-          type = types.listOf types.str;
-          default = [
+          type = types.nullOr (types.listOf types.str);
+          default = if config.path != null then null else [
             "::1"
             "127.0.0.1"
           ];
+          defaultText = literalExpression ''
+            if path != null then
+              null
+            else
+              [
+                "::1"
+                "127.0.0.1"
+              ]
+          '';
           example = literalExpression ''
             [
               "::"
···
           '';
         };
 
+        path = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = ''
+            Unix domain socket path to bind this listener to.
+
+            ::: {.note}
+              This option is incompatible with {option}`bind_addresses`, {option}`port`, {option}`tls`
+              and also does not support the `metrics` and `manhole` listener {option}`type`.
+            :::
+          '';
+        };
+
+        mode = mkOption {
+          type = types.nullOr (types.strMatching "^[0,2-7]{3,4}$");
+          default = if config.path != null then "660" else null;
+          defaultText = literalExpression ''
+            if path != null then
+              "660"
+            else
+              null
+          '';
+          example = "660";
+          description = ''
+            File permissions on the UNIX domain socket.
+          '';
+          apply = toDecimalFilePermission;
+        };
+
         type = mkOption {
           type = types.enum [
             "http"
···
         };
 
         tls = mkOption {
-          type = types.bool;
-          default = !workerContext;
+          type = types.nullOr types.bool;
+          default = if config.path != null then
+            null
+          else
+            !workerContext;
+          defaultText = ''
+            Enabled for the main instance listener, unless it is configured with a UNIX domain socket path.
+          '';
           example = false;
           description = lib.mdDoc ''
             Whether to enable TLS on the listener socket.
+
+            ::: {.note}
+              This option will be ignored for UNIX domain sockets.
+            :::
           '';
         };
 
         x_forwarded = mkOption {
           type = types.bool;
-          default = false;
+          default = config.path != null;
+          defaultText = ''
+            Enabled if the listener is configured with a UNIX domain socket path
+          '';
           example = true;
           description = lib.mdDoc ''
             Use the X-Forwarded-For (XFF) header as the client IP and not the
···
           '';
         };
       };
-    };
+    });
   in {
     services.matrix-synapse = {
       enable = mkEnableOption (lib.mdDoc "matrix.org synapse");
 
+      enableRegistrationScript = mkOption {
+        type = types.bool;
+        default = clientListener.bind_addresses != [];
+        example = false;
+        defaultText = ''
+          Enabled if the client listener uses TCP sockets
+        '';
+        description = ''
+          Whether to install the `register_new_matrix_user` script, that
+          allows account creation on the terminal.
+
+          ::: {.note}
+            This script does not work when the client listener uses UNIX domain sockets
+          :::
+        '';
+      };
+
       serviceUnit = lib.mkOption {
         type = lib.types.str;
         readOnly = true;
···
                   compress = false;
                 }];
               }] ++ lib.optional hasWorkers {
-                port = 9093;
-                bind_addresses = [ "127.0.0.1" ];
+                path = "/run/matrix-synapse/main_replication.sock";
                 type = "http";
-                tls = false;
-                x_forwarded = false;
                 resources = [{
                   names = [ "replication" ];
                   compress = false;
···
                 List of ports that Synapse should listen on, their purpose and their configuration.
 
                 By default, synapse will be configured for client and federation traffic on port 8008, and
-                for worker replication traffic on port 9093. See [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers)
+                use a UNIX domain socket for worker replication. See [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers)
                 for more details.
               '';
             };
···
             listener = lib.findFirst
               (
                 listener:
-                  listener.port == main.port
+                  (
+                    lib.hasAttr "port" main && listener.port or null == main.port
+                    || lib.hasAttr "path" main && listener.path or null == main.path
+                  )
                   && listenerSupportsResource "replication" listener
-                  && (lib.any (bind: bind == main.host || bind == "0.0.0.0" || bind == "::") listener.bind_addresses)
+                  && (
+                    lib.hasAttr "host" main &&  lib.any (bind: bind == main.host || bind == "0.0.0.0" || bind == "::") listener.bind_addresses
+                    || lib.hasAttr "path" main
+                  )
               )
               null
               cfg.settings.listeners;
···
           This is done by default unless you manually configure either of those settings.
         '';
       }
-    ];
+      {
+        assertion = cfg.enableRegistrationScript -> clientListener.path == null;
+        message = ''
+          The client listener on matrix-synapse is configured to use UNIX domain sockets.
+          This configuration is incompatible with the `register_new_matrix_user` script.
+
+          Disable  `services.mastrix-synapse.enableRegistrationScript` to continue.
+        '';
+      }
+    ]
+    ++ (map (listener: {
+      assertion = (listener.path == null) != (listener.bind_addresses == null);
+      message = ''
+        Listeners require either a UNIX domain socket `path` or `bind_addresses` for a TCP socket.
+      '';
+    }) cfg.settings.listeners)
+    ++ (map (listener: {
+      assertion = listener.path != null -> (listener.bind_addresses == null && listener.port == null && listener.tls == null);
+      message = let
+        formatKeyValue = key: value: lib.optionalString (value != null) "  - ${key}=${toString value}\n";
+      in ''
+        Listener configured with UNIX domain socket (${toString listener.path}) ignores the following options:
+        ${formatKeyValue "bind_addresses" listener.bind_addresses}${formatKeyValue "port" listener.port}${formatKeyValue "tls" listener.tls}
+      '';
+    }) cfg.settings.listeners)
+    ++ (map (listener: {
+      assertion = listener.path == null || listener.type == "http";
+      message = ''
+        Listener configured with UNIX domain socket (${toString listener.path}) only supports the "http" listener type.
+      '';
+    }) cfg.settings.listeners);
 
     services.matrix-synapse.settings.redis = lib.mkIf cfg.configureRedisLocally {
       enabled = true;
       path = config.services.redis.servers.matrix-synapse.unixSocket;
     };
     services.matrix-synapse.settings.instance_map.main = lib.mkIf hasWorkers (lib.mkDefault {
-      host = "127.0.0.1";
-      port = 9093;
+      path = "/run/matrix-synapse/main_replication.sock";
     });
 
     services.matrix-synapse.serviceUnit = if hasWorkers then "matrix-synapse.target" else "matrix-synapse.service";
···
             User = "matrix-synapse";
             Group = "matrix-synapse";
             WorkingDirectory = cfg.dataDir;
+            RuntimeDirectory = "matrix-synapse";
+            RuntimeDirectoryPreserve = true;
             ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
             Restart = "on-failure";
             UMask = "0077";
···
       user = "matrix-synapse";
     };
 
-    environment.systemPackages = [ registerNewMatrixUser ];
+    environment.systemPackages = lib.optionals cfg.enableRegistrationScript [
+      registerNewMatrixUser
+    ];
   };
 
   meta = {

nixos/modules/services/misc/nix-gc.nix

···
         example = "--max-freed $((64 * 1024**3))";
         type = lib.types.singleLineStr;
         description = lib.mdDoc ''
-          Options given to {file}`nix-collect-garbage` when the
-          garbage collector is run automatically.
+          Options given to [`nix-collect-garbage`](https://nixos.org/manual/nix/stable/command-ref/nix-collect-garbage) when the garbage collector is run automatically.
         '';
       };
 

nixos/modules/services/networking/dhcpcd.nix

···
       '';
     } ];
 
+    environment.etc."dhcpcd.conf".source = dhcpcdConf;
+
     systemd.services.dhcpcd = let
       cfgN = config.networking;
       hasDefaultGatewaySet = (cfgN.defaultGateway != null && cfgN.defaultGateway.address != "")

nixos/modules/services/networking/nftables.nix

···
     networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));
     systemd.services.nftables = {
       description = "nftables firewall";
-      before = [ "network-pre.target" ];
-      wants = [ "network-pre.target" ];
+      after = [ "sysinit.target" ];
+      before = [ "network-pre.target" "shutdown.target" ];
+      conflicts = [ "shutdown.target" ];
+      wants = [ "network-pre.target" "sysinit.target" ];
       wantedBy = [ "multi-user.target" ];
       reloadIfChanged = true;
       serviceConfig = let
···
         ExecStop = [ deletionsScriptVar cleanupDeletionsScript ];
         StateDirectory = "nftables";
       };
+      unitConfig.DefaultDependencies = false;
     };
   };
 }

nixos/modules/tasks/filesystems/overlayfs.nix

···
+{ config, lib, pkgs, utils, ... }:
+
+let
+  # The scripted initrd contains some magic to add the prefix to the
+  # paths just in time, so we don't add it here.
+  sysrootPrefix = fs:
+    if config.boot.initrd.systemd.enable && (utils.fsNeededForBoot fs) then
+      "/sysroot"
+    else
+      "";
+
+  # Returns a service that creates the required directories before the mount is
+  # created.
+  preMountService = _name: fs:
+    let
+      prefix = sysrootPrefix fs;
+
+      escapedMountpoint = utils.escapeSystemdPath (prefix + fs.mountPoint);
+      mountUnit = "${escapedMountpoint}.mount";
+
+      upperdir = prefix + fs.overlay.upperdir;
+      workdir = prefix + fs.overlay.workdir;
+    in
+    lib.mkIf (fs.overlay.upperdir != null)
+      {
+        "rw-${escapedMountpoint}" = {
+          requiredBy = [ mountUnit ];
+          before = [ mountUnit ];
+          unitConfig = {
+            DefaultDependencies = false;
+            RequiresMountsFor = "${upperdir} ${workdir}";
+          };
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.coreutils}/bin/mkdir -p -m 0755 ${upperdir} ${workdir}";
+          };
+        };
+      };
+
+  overlayOpts = { config, ... }: {
+
+    options.overlay = {
+
+      lowerdir = lib.mkOption {
+        type = with lib.types; nullOr (nonEmptyListOf (either str pathInStore));
+        default = null;
+        description = lib.mdDoc ''
+          The list of path(s) to the lowerdir(s).
+
+          To create a writable overlay, you MUST provide an upperdir and a
+          workdir.
+
+          You can create a read-only overlay when you provide multiple (at
+          least 2!) lowerdirs and neither an upperdir nor a workdir.
+        '';
+      };
+
+      upperdir = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = lib.mdDoc ''
+          The path to the upperdir.
+
+          If this is null, a read-only overlay is created using the lowerdir.
+
+          If you set this to some value you MUST also set `workdir`.
+        '';
+      };
+
+      workdir = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = lib.mdDoc ''
+          The path to the workdir.
+
+          This MUST be set if you set `upperdir`.
+        '';
+      };
+
+    };
+
+    config = lib.mkIf (config.overlay.lowerdir != null) {
+      fsType = "overlay";
+      device = lib.mkDefault "overlay";
+
+      options =
+        let
+          prefix = sysrootPrefix config;
+
+          lowerdir = map (s: prefix + s) config.overlay.lowerdir;
+          upperdir = prefix + config.overlay.upperdir;
+          workdir = prefix + config.overlay.workdir;
+        in
+        [
+          "lowerdir=${lib.concatStringsSep ":" lowerdir}"
+        ] ++ lib.optionals (config.overlay.upperdir != null) [
+          "upperdir=${upperdir}"
+          "workdir=${workdir}"
+        ] ++ (map (s: "x-systemd.requires-mounts-for=${s}") lowerdir);
+    };
+
+  };
+in
+
+{
+
+  options = {
+
+    # Merge the overlay options into the fileSystems option.
+    fileSystems = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule [ overlayOpts ]);
+    };
+
+  };
+
+  config =
+    let
+      overlayFileSystems = lib.filterAttrs (_name: fs: (fs.overlay.lowerdir != null)) config.fileSystems;
+      initrdFileSystems = lib.filterAttrs (_name: utils.fsNeededForBoot) overlayFileSystems;
+      userspaceFileSystems = lib.filterAttrs (_name: fs: (!utils.fsNeededForBoot fs)) overlayFileSystems;
+    in
+    {
+
+      boot.initrd.availableKernelModules = lib.mkIf (initrdFileSystems != { }) [ "overlay" ];
+
+      assertions = lib.concatLists (lib.mapAttrsToList
+        (_name: fs: [
+          {
+            assertion = (fs.overlay.upperdir == null) == (fs.overlay.workdir == null);
+            message = "You cannot define a `lowerdir` without a `workdir` and vice versa for mount point: ${fs.mountPoint}";
+          }
+          {
+            assertion = (fs.overlay.lowerdir != null && fs.overlay.upperdir == null) -> (lib.length fs.overlay.lowerdir) >= 2;
+            message = "A read-only overlay (without an `upperdir`) requires at least 2 `lowerdir`s: ${fs.mountPoint}";
+          }
+        ])
+        config.fileSystems);
+
+      boot.initrd.systemd.services = lib.mkMerge (lib.mapAttrsToList preMountService initrdFileSystems);
+      systemd.services = lib.mkMerge (lib.mapAttrsToList preMountService userspaceFileSystems);
+
+    };
+
+}

nixos/modules/virtualisation/amazon-image.nix

···
     # (e.g. it depends on GTK).
     services.udisks2.enable = false;
   };
+  meta.maintainers = with maintainers; [ arianvp ];
 }

nixos/modules/virtualisation/amazon-init.nix

···
       };
     };
   };
+  meta.maintainers = with maintainers; [ arianvp ];
 }

nixos/modules/virtualisation/qemu-vm.nix

···
           type = types.listOf types.str;
           default = [];
           example = [ "-vga std" ];
-          description = lib.mdDoc "Options passed to QEMU.";
+          description = lib.mdDoc ''
+            Options passed to QEMU.
+            See [QEMU User Documentation](https://www.qemu.org/docs/master/system/qemu-manpage) for a complete list.
+          '';
         };
 
       consoles = mkOption {
···
           description = lib.mdDoc ''
             Networking-related command-line options that should be passed to qemu.
             The default is to use userspace networking (SLiRP).
+            See the [QEMU Wiki on Networking](https://wiki.qemu.org/Documentation/Networking) for details.
 
             If you override this option, be advised to keep
             ''${QEMU_NET_OPTS:+,$QEMU_NET_OPTS} (as seen in the example)
···
         ''}
       '';
 
-    systemd.tmpfiles.rules = lib.mkIf config.boot.initrd.systemd.enable [
-      "f /etc/NIXOS 0644 root root -"
-      "d /boot 0644 root root -"
-    ];
+    systemd.tmpfiles.settings."10-qemu-vm" = lib.mkIf config.boot.initrd.systemd.enable {
+      "/etc/NIXOS".f = {
+        mode = "0644";
+        user = "root";
+        group = "root";
+      };
+      "${config.boot.loader.efi.efiSysMountPoint}".d = {
+        mode = "0644";
+        user = "root";
+        group = "root";
+      };
+    };
 
     # After booting, register the closure of the paths in
     # `virtualisation.additionalPaths' in the Nix database in the VM.  This

nixos/tests/all-tests.nix

···
   fenics = handleTest ./fenics.nix {};
   ferm = handleTest ./ferm.nix {};
   ferretdb = handleTest ./ferretdb.nix {};
+  filesystems-overlayfs = runTest ./filesystems-overlayfs.nix;
   firefox = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox; };
   firefox-beta = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-beta; };
   firefox-devedition = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-devedition; };

nixos/tests/filesystems-overlayfs.nix

···
+{ lib, pkgs, ... }:
+
+let
+  initrdLowerdir = pkgs.runCommand "initrd-lowerdir" { } ''
+    mkdir -p $out
+    echo "initrd" > $out/initrd.txt
+  '';
+  initrdLowerdir2 = pkgs.runCommand "initrd-lowerdir-2" { } ''
+    mkdir -p $out
+    echo "initrd2" > $out/initrd2.txt
+  '';
+  userspaceLowerdir = pkgs.runCommand "userspace-lowerdir" { } ''
+    mkdir -p $out
+    echo "userspace" > $out/userspace.txt
+  '';
+  userspaceLowerdir2 = pkgs.runCommand "userspace-lowerdir-2" { } ''
+    mkdir -p $out
+    echo "userspace2" > $out/userspace2.txt
+  '';
+in
+{
+
+  name = "writable-overlays";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = { config, pkgs, ... }: {
+    boot.initrd.systemd.enable = true;
+    boot.initrd.availableKernelModules = [ "overlay" ];
+
+    virtualisation.fileSystems = {
+      "/initrd-overlay" = {
+        overlay = {
+          lowerdir = [ initrdLowerdir ];
+          upperdir = "/.rw-initrd-overlay/upper";
+          workdir = "/.rw-initrd-overlay/work";
+        };
+        neededForBoot = true;
+      };
+      "/userspace-overlay" = {
+        overlay = {
+          lowerdir = [ userspaceLowerdir ];
+          upperdir = "/.rw-userspace-overlay/upper";
+          workdir = "/.rw-userspace-overlay/work";
+        };
+      };
+      "/ro-initrd-overlay" = {
+        overlay.lowerdir = [
+          initrdLowerdir
+          initrdLowerdir2
+        ];
+        neededForBoot = true;
+      };
+      "/ro-userspace-overlay" = {
+        overlay.lowerdir = [
+          userspaceLowerdir
+          userspaceLowerdir2
+        ];
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("default.target")
+
+    with subtest("Initrd overlay"):
+      machine.wait_for_file("/initrd-overlay/initrd.txt", 5)
+      machine.succeed("touch /initrd-overlay/writable.txt")
+      machine.succeed("findmnt --kernel --types overlay /initrd-overlay")
+
+    with subtest("Userspace overlay"):
+      machine.wait_for_file("/userspace-overlay/userspace.txt", 5)
+      machine.succeed("touch /userspace-overlay/writable.txt")
+      machine.succeed("findmnt --kernel --types overlay /userspace-overlay")
+
+    with subtest("Read only initrd overlay"):
+      machine.wait_for_file("/ro-initrd-overlay/initrd.txt", 5)
+      machine.wait_for_file("/ro-initrd-overlay/initrd2.txt", 5)
+      machine.fail("touch /ro-initrd-overlay/not-writable.txt")
+      machine.succeed("findmnt --kernel --types overlay /ro-initrd-overlay")
+
+    with subtest("Read only userspace overlay"):
+      machine.wait_for_file("/ro-userspace-overlay/userspace.txt", 5)
+      machine.wait_for_file("/ro-userspace-overlay/userspace2.txt", 5)
+      machine.fail("touch /ro-userspace-overlay/not-writable.txt")
+      machine.succeed("findmnt --kernel --types overlay /ro-userspace-overlay")
+  '';
+
+}

nixos/tests/freetube.nix

···
       inherit name;
       nodes = { "${name}" = machine; };
       meta.maintainers = with pkgs.lib.maintainers; [ kirillrdy ];
+      # time-out on ofborg
+      meta.broken = pkgs.stdenv.isAarch64;
       enableOCR = true;
 
       testScript = ''

pkgs/applications/audio/ledfx/default.nix

···
 
 python3.pkgs.buildPythonPackage rec {
   pname = "ledfx";
-  version = "2.0.90";
+  version = "2.0.92";
   pyproject= true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZlZtC0bi9ZUf/1D9hUxxhdix6F8l7Lg5IUOOg+JHGYU=";
+    hash = "sha256-tt2D8pjU/SClweAn9vHYl+H1POdB1u2SQfrnZZvBQ7I=";
   };
 
   pythonRelaxDeps = true;

pkgs/applications/audio/listenbrainz-mpd/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "listenbrainz-mpd";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "elomatreb";
     repo = "listenbrainz-mpd";
     rev = "v${version}";
-    hash = "sha256-DqxE+wEHDmOmh+iJa312uAWQcg/1ApOTZNLrhGq5KmY=";
+    hash = "sha256-4FNFaVi+fxoXo2tl+bynHqh8yRt0Q4z/El/4m0GXZUY=";
   };
 
-  cargoHash = "sha256-/fd3XIBHwJ95bwirUbMldw2cAfdF2Sv8CPxrbM4WWBI=";
+  cargoHash = "sha256-FS7OYzKx/lQh86QQ8Dk9v1JrWUxPHNz3kITiEJ3sNng=";
 
   nativeBuildInputs = [ pkg-config installShellFiles asciidoctor ];
 

pkgs/applications/audio/meters_lv2/default.nix

···
   meta = with lib; {
     description = "Collection of audio level meters with GUI in LV2 plugin format";
     homepage = "https://x42.github.io/meters.lv2/";
-    maintainers = with maintainers; [ ehmry ];
     license = licenses.gpl2;
     platforms = platforms.linux;
   };

pkgs/applications/audio/mympd/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "14.0.0";
+  version = "14.0.1";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-srwLnoQSPex7/PtgF6RWpJM39fpOqN3wze5ABSRTIRA=";
+    sha256 = "sha256-wgrTkUpWx7YG8V9nyr+RHDBOz1TFA0p2OWDXG64BVjs=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/picard/default.nix

···
     homepage = "https://picard.musicbrainz.org";
     changelog = "https://picard.musicbrainz.org/changelog";
     description = "The official MusicBrainz tagger";
-    maintainers = with maintainers; [ ehmry ];
     license = licenses.gpl2Plus;
     platforms = platforms.all;
   };

pkgs/applications/audio/transcribe/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "transcribe";
-  version = "9.30.2";
+  version = "9.40.0";
 
   src =
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchzip
         {
           url = "https://www.seventhstring.com/xscribe/downlo/xscsetup-${version}.tar.gz";
-          sha256 = "sha256-EZyQsO3tSedMaZIhJWc7j3f7ikBf6XqXLUgdAiQdr14=";
+          sha256 = "sha256-GHTr1rk7Kh5M0UYnryUlCk/G6pW3p80GJ6Ai0zXdfNs=";
         }
     else throw "Platform not supported";
 

pkgs/applications/blockchains/taproot-assets/default.nix

···
 
 buildGoModule rec {
   pname = "taproot-assets";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "taproot-assets";
     rev = "v${version}";
-    hash = "sha256-zYS/qLWYzfmLksYLCUWosT287K8La2fuu9TcT4Wytto=";
+    hash = "sha256-KEEecyZA+sVAkg2/i9AcfvPTB26Dk02r77Py87LP758=";
   };
 
   vendorHash = "sha256-jz6q3l2FtkJM3qyaTTqqu3ZG2FeKW9s7WdlW1pHij5k=";

pkgs/applications/editors/ed/sources.nix

···
 {
   ed = let
     pname = "ed";
-    version = "1.19";
+    version = "1.20";
     src = fetchurl {
       url = "mirror://gnu/ed/ed-${version}.tar.lz";
-      hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
+      hash = "sha256-xgMN7+auFy8Wh5Btc1QFTHWmqRMK8xnU5zxQqRlZxaY=";
     };
   in import ./generic.nix {
     inherit pname version src meta;

pkgs/applications/editors/emacs/sources.nix

···
 
   emacs29 = import ./make-emacs.nix (mkArgs {
     pname = "emacs";
-    version = "29.1";
+    version = "29.2";
     variant = "mainline";
-    rev = "29.1";
-    hash = "sha256-3HDCwtOKvkXwSULf3W7YgTz4GV8zvYnh2RrL28qzGKg=";
+    rev = "29.2";
+    hash = "sha256-qSQmQzVyEGSr4GAI6rqnEwBvhl09D2D8MNasHqZQPL8=";
   });
 
   emacs28-macport = import ./make-emacs.nix (mkArgs {

pkgs/applications/editors/lite-xl/default.nix

···
-{ agg
-, fetchFromGitHub
+{ fetchFromGitHub
 , Foundation
 , freetype
 , lib
···
 , ninja
 , pcre2
 , pkg-config
-, reproc
 , SDL2
 , stdenv
 }:
 
 stdenv.mkDerivation rec {
   pname = "lite-xl";
-  version = "2.1.1";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "lite-xl";
     repo = "lite-xl";
     rev = "v${version}";
-    sha256 = "sha256-tZ9bCazs4ygNl5RKFNUtxboaMcG8a7mIz2FuiExX1d4=";
+    hash = "sha256-4ykUdcNwJ4r/4u9H+c8pgupY3BaPi2y69X6yaDjCjac=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [
-    agg
     freetype
     lua5_4
     pcre2
-    reproc
     SDL2
   ] ++ lib.optionals stdenv.isDarwin [
     Foundation
+  ];
+
+  mesonFlags = [
+    "-Duse_system_lua=true"
   ];
 
   meta = with lib; {

pkgs/applications/editors/micro/default.nix

···
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles, callPackage }:
-
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+, callPackage
+, wl-clipboard
+, xclip
+, makeWrapper
+, withXclip ? true
+, withWlclip ? true
+}:
+let
+  clipboardPkgs = if stdenv.isLinux then
+    lib.optional withXclip xclip ++
+    lib.optional withWlclip wl-clipboard
+    else [ ];
+in
 buildGoModule rec {
   pname = "micro";
   version = "2.0.13";
···
 
   vendorHash = "sha256-ePhObvm3m/nT+7IyT0W6K+y+9UNkfd2kYjle2ffAd9Y=";
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
 
   subPackages = [ "cmd/micro" ];
 
···
     installManPage assets/packaging/micro.1
     install -Dm444 -t $out/share/applications assets/packaging/micro.desktop
     install -Dm644 assets/micro-logo-mark.svg $out/share/icons/hicolor/scalable/apps/micro.svg
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/micro" \
+      --prefix PATH : "${lib.makeBinPath clipboardPkgs}"
   '';
 
   passthru.tests.expect = callPackage ./test-with-expect.nix { };

pkgs/applications/editors/vscode/vscode.nix

···
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0qykchhd6cplyip4gp5s1fpv664xw2y5z0z7n6zwhwpfrld8piwb";
-    x86_64-darwin = "0mris80k62yabaz2avh4q2vjpnqcwa77phx3icdif0c19w185pqw";
-    aarch64-linux = "0rbj0l9wdbkxgzy9j9qvx0237g5nx4np0ank4x6jbxhlbs8xdw39";
-    aarch64-darwin = "1j1wd1ssyrd6651k7ias22phcb358k6aigdirfzczam303cxr0hw";
-    armv7l-linux = "1c6bikdhgd6w5njqza5xmhi7iz4kzydcfb2i7jqklb514knqxc8f";
+    x86_64-linux = "0nffz9xqm1iny7sqi1pkmnfcski15qsycw9gxir18j51kfzz50wf";
+    x86_64-darwin = "082m2wwd67ayjadlywqimnmdm8imw6lz0rd8rnwjd2sjksxnrsk8";
+    aarch64-linux = "0wlm8ajm1xw8lpmnbkzkgvaakfa9gacwi7m2fdyc4822rq7fn09b";
+    aarch64-darwin = "1rgcljj97f551yr0q5f0vxdkvbhxrbyqrw85gb6qfxpg5d0l7y4f";
+    armv7l-linux = "1wpslrysi8a6rnx99lq16zx277lnmqjp02q6gxmkpcvrvw27m6yj";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.86.0";
+    version = "1.86.1";
     pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
     # This is used for VS Code - Remote SSH test
-    rev = "05047486b6df5eb8d44b2ecd70ea3bdf775fd937";
+    rev = "31c37ee8f63491495ac49e43b8544550fbae4533";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
···
       src = fetchurl {
         name = "vscode-server-${rev}.tar.gz";
         url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "0d3g6csi2aplsy5j3v84m65mhlg0krpb2sndk0nh7gafyc5gnn28";
+        sha256 = "1hq6i51d1dhpippc8gmhygw3kj9cx021y54ga58l5b80wvg2cf1y";
       };
     };
 

pkgs/applications/emulators/bsnes/higan/default.nix

···
 # Darwin dependencies
 , libicns
 , darwin
+, unstableGitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "higan";
-  version = "115+unstable=2021-08-18";
+  version = "115-unstable-2023-11-13";
 
   src = fetchFromGitHub {
     owner = "higan-emu";
     repo = "higan";
-    rev = "9bf1b3314b2bcc73cbc11d344b369c31562aff10";
-    hash = "sha256-HZItJ97x20OjFKv2OVbMja7g+c1ZXcgcaC/XDe3vMZM=";
+    rev = "993368d917cb750107390effe2cd394ba8710208";
+    hash = "sha256-D21DFLnYl2J4JhwmVmEKHhtglZWxVBrl/kOcvxJYbnA=";
   };
 
   nativeBuildInputs = [
···
 
     runHook postInstall
   '';
+
+  passthru.updateScript = unstableGitUpdater {};
 
   meta = with lib; {
     homepage = "https://github.com/higan-emu/higan";

pkgs/applications/emulators/darling/default.nix

···
   ];
 in stdenv.mkDerivation {
   pname = "darling";
-  version = "unstable-2023-11-07";
+  version = "unstable-2024-02-03";
 
   src = fetchFromGitHub {
     owner = "darlinghq";
     repo = "darling";
-    rev = "34351655a40d2090e70b3033a577b8cdea967633";
+    rev = "25afbc76428c39c3909e9efcf5caef1140425211";
     fetchSubmodules = true;
-    hash = "sha256-Jhr7Do15vms8bJ8AczVSkuWrC7gUR5ZvU9/PfCmGGcg=";
+    hash = "sha256-T0g38loUFv3jHvUu3R3QH9hwP8JVe2al4g4VhXnBDMc=";
   };
 
   outputs = [ "out" "sdk" ];

pkgs/applications/emulators/retroarch/hashes.json

···
     "beetle-pce": {
         "owner": "libretro",
         "repo": "beetle-pce-libretro",
-        "rev": "e8870b170ad4135bf5738c7206d7a27488d388ab",
-        "hash": "sha256-c+LsfuX/3HxJTaIlZeGkGif+D1c7OpIhRUVbWuT8Kc0=",
-        "date": "unstable-2024-02-02"
+        "rev": "753f067738e55a6325d3ca5206151a9acd9127f0",
+        "hash": "sha256-OWvoIi0DS3YhxK1S6PAbCNZwKKXti6brZlWVCJELfKY=",
+        "date": "unstable-2024-02-09"
     },
     "beetle-pce-fast": {
         "owner": "libretro",
         "repo": "beetle-pce-fast-libretro",
-        "rev": "cfb9362fd0de38141d40266725829f25f574162a",
-        "hash": "sha256-D/qAFFKe0mI/W4RnLwcB5lpwI+AlPjTfyo0SH6IZZkU=",
-        "date": "unstable-2024-02-02"
+        "rev": "86a80e1ba551f9a4627b8394901db0ee365c1442",
+        "hash": "sha256-aIDc4jzliVLpI2Xetcd5tG74/xvIlqRdVEb72yHrsCo=",
+        "date": "unstable-2024-02-09"
     },
     "beetle-pcfx": {
         "owner": "libretro",
···
     "beetle-psx": {
         "owner": "libretro",
         "repo": "beetle-psx-libretro",
-        "rev": "fb579de80d7b9ca09940602c14e657f6317dd046",
-        "hash": "sha256-NRnznhvmgOQdNuEYyi0HIeVPzPz7ILEQ3vsYTZY8AbE=",
-        "date": "unstable-2024-02-02"
+        "rev": "3adff889b9b8251526ca7dae963be46bf8401e2e",
+        "hash": "sha256-DaDzoAQJLuer/c+V1bJGbejnyGYB2RYdebZ1YIoVRKw=",
+        "date": "unstable-2024-02-09"
     },
     "beetle-saturn": {
         "owner": "libretro",
···
     "beetle-supergrafx": {
         "owner": "libretro",
         "repo": "beetle-supergrafx-libretro",
-        "rev": "d24d383f88ff892e9f8dce7c1f3ce491f2f7731a",
-        "hash": "sha256-Cbol57jpDpkMnfKCULw6DgJwcnfTNexZ1hSw817z+E8=",
-        "date": "unstable-2024-02-02"
+        "rev": "32070ffd0082fd5127519bb6e92a2daecc359408",
+        "hash": "sha256-ZBZtDMP2inarEuLE76Zw1/qZ2YfyTJy+2eN10hhpn64=",
+        "date": "unstable-2024-02-09"
     },
     "beetle-vb": {
         "owner": "libretro",
···
     "bsnes": {
         "owner": "libretro",
         "repo": "bsnes-libretro",
-        "rev": "dda5b43ed6a552310528509af59bed26af2527f5",
-        "hash": "sha256-7AXHq6ASQ+42yef/jQ74kZtpW9SUuXpmWZbtO84/COg=",
-        "date": "unstable-2024-02-02"
+        "rev": "d230353616ab4c7dc01a2f2a63865011bd5c7ffd",
+        "hash": "sha256-TiOdptWOb13UQ8jKDbIlZQQ3mY3h/lPHr/GskPVAkwA=",
+        "date": "unstable-2024-02-09"
     },
     "bsnes-hd": {
         "owner": "DerKoun",
···
     "fbneo": {
         "owner": "libretro",
         "repo": "fbneo",
-        "rev": "e8cd9f81bc974f7427d9cff9ffc1d2f3a8d15f1f",
-        "hash": "sha256-XR/pLOvQ8L2dLguC1I2C7z8FoBid6oFSudnQNY3ub7c=",
-        "date": "unstable-2024-01-30"
+        "rev": "bb7aa7ea1e3a9a293fcf4e2b15994afde2e52899",
+        "hash": "sha256-XTOZGKq02obnzbtUEAEs99Kxhd8hFqLjI/smwtNAU8Q=",
+        "date": "unstable-2024-02-08"
     },
     "fceumm": {
         "owner": "libretro",
···
     "flycast": {
         "owner": "flyinghead",
         "repo": "flycast",
-        "rev": "c146a92f83ae2cba8df8970e21efc54301b9ade1",
-        "hash": "sha256-+ZED9pLfPr4uNNMNTmsrQWUgbKLW3DnPBdniwQ1fr9U=",
+        "rev": "7029e1615a215bc43e51f8eac605f31dd01ba8cd",
+        "hash": "sha256-JUXKlUNIg+1vvOfUQpysxUMYIRJqIzj9UNIwb+8HRPo=",
         "fetchSubmodules": true,
-        "date": "unstable-2024-02-03"
+        "date": "unstable-2024-02-09"
     },
     "fmsx": {
         "owner": "libretro",
         "repo": "fmsx-libretro",
-        "rev": "1806eed4376fbe2fad82fa19271ea298cfbb7795",
-        "hash": "sha256-nX0H/+iEq7eBN4tm1+dT6/3BYLCpoyiE/L6waDPmUZI=",
-        "date": "unstable-2023-04-17"
+        "rev": "9b5cf868825a629cc4c7086768338165d3bbf706",
+        "hash": "sha256-zDDAMzV+pfu+AwjgXwduPfHyW1rQnvaDpFvz++QBBkA=",
+        "date": "unstable-2024-02-08"
     },
     "freeintv": {
         "owner": "libretro",
···
     "gambatte": {
         "owner": "libretro",
         "repo": "gambatte-libretro",
-        "rev": "c9a07107f121498a158762116d47d7068a247d3c",
-        "hash": "sha256-U4FR794/hB3tHsdbtnC7qL0qr1oi1ZF4PYFTu+sVMVI=",
-        "date": "unstable-2024-02-02"
+        "rev": "05c4e10168aa3070b4ea01f7da7ab1c0d4241103",
+        "hash": "sha256-W/s8FWjFOIcclLkbM5s2+2dcvr+X2My5319SvRo5/lU=",
+        "date": "unstable-2024-02-09"
     },
     "genesis-plus-gx": {
         "owner": "libretro",
         "repo": "Genesis-Plus-GX",
-        "rev": "59cdc560e21eeddfa4d5a5c935413cdaa9d660f3",
-        "hash": "sha256-FB0znNFG6T67V63jm7WprhGRw9rHNJgH4SZ/BtgAyFg=",
-        "date": "unstable-2024-02-02"
+        "rev": "ecb956d914d6bc4e5deb49384bc929939e9a19e5",
+        "hash": "sha256-Fk+Ldjav+yQl6fkYESR6t1JEOKiCZYCW386QL4ozE68=",
+        "date": "unstable-2024-02-06"
     },
     "gpsp": {
         "owner": "libretro",
···
     "mame2003": {
         "owner": "libretro",
         "repo": "mame2003-libretro",
-        "rev": "be247427a8a68f8401ce40c830e2d8767d000f84",
-        "hash": "sha256-ZQ0DWok6EmVEDOhcN7LsK5T4XXHpH9Cyd22KP/UjMok=",
-        "date": "unstable-2023-11-22"
+        "rev": "838f84f14422529c37bbb9803eb649209c8ba4e8",
+        "hash": "sha256-NiqlA4FjHS0GLypEg6QbhEJlhV0YU7VmMquzqnyr7aA=",
+        "date": "unstable-2024-02-08"
     },
     "mame2003-plus": {
         "owner": "libretro",
         "repo": "mame2003-plus-libretro",
-        "rev": "53c6083a2044c3529a436b51c5206cd9a896d12c",
-        "hash": "sha256-k4jl3cN18HQya3F4DXHN/Hoq7UXKVmJg5Lgp08n6M/M=",
-        "date": "unstable-2024-02-03"
+        "rev": "debcb547ea7ae197433142810e99e1313c58cb14",
+        "hash": "sha256-l9YmDiUJ+CQP4i8O8W+E9uTLPZZgLqLR9v7e5hFgJhE=",
+        "date": "unstable-2024-02-09"
     },
     "mame2010": {
         "owner": "libretro",
···
     "mupen64plus": {
         "owner": "libretro",
         "repo": "mupen64plus-libretro-nx",
-        "rev": "0e1dc5abacf91f1640206d32d18735e82071681e",
-        "hash": "sha256-gt9oVJunDCdhHbaqL9xaGlztxdT1D2UvYETqCXogIwU=",
-        "date": "unstable-2024-01-30"
+        "rev": "fa55ddca926d3c3ad2285911646919def4aa6fa3",
+        "hash": "sha256-Fn/qSQDR8FuHG9eLE0I24wUa0sdosrl6+lhnf9cD+yQ=",
+        "date": "unstable-2024-02-06"
     },
     "neocd": {
         "owner": "libretro",
···
     "pcsx_rearmed": {
         "owner": "libretro",
         "repo": "pcsx_rearmed",
-        "rev": "06cdf83a3a30bfb8cafee768dbe83bbaef6c8ddd",
-        "hash": "sha256-E/+dAcJwfaUMjYJUjfAcn98SIh61BiS5YpcZg99lg+Q=",
-        "date": "unstable-2024-02-04"
+        "rev": "016c6e93f6db684211f5c8b05433cb500715ba50",
+        "hash": "sha256-uYzL0uuQbxa4N0uQT8YEBiCgwkIcigvjeNU600WqSDQ=",
+        "date": "unstable-2024-02-07"
     },
     "picodrive": {
         "owner": "libretro",
···
     "ppsspp": {
         "owner": "hrydgard",
         "repo": "ppsspp",
-        "rev": "f65c84f4cb8117b273e7fa2ab578c95aedc6dd56",
-        "hash": "sha256-GgXozubq6ByZDWGkUrzeEgKxUaBaIN3NY5/IIRBNn/o=",
+        "rev": "25689c36d9c2f3f1b7aa612d89b86caf1809e376",
+        "hash": "sha256-hXknMyBNo1vJ49gJsuNef+sccolAovg1I8Wzuw/BnE8=",
         "fetchSubmodules": true,
-        "date": "unstable-2024-02-05"
+        "date": "unstable-2024-02-09"
     },
     "prboom": {
         "owner": "libretro",
···
     "snes9x": {
         "owner": "snes9xgit",
         "repo": "snes9x",
-        "rev": "e76abdc4ef8f961ea0f8e87c160cf59cc6d44e42",
-        "hash": "sha256-JERfp69UB/PC2iIjbepOKpPdmZJbrzWbXhaLMJfOaXY=",
-        "date": "unstable-2024-01-28"
+        "rev": "be6372c0345c82a87b880c791703fb1929ecf72c",
+        "hash": "sha256-JzUXxTJZG3LdWC+FCM/3/ynGclQ11rCj7q5fs45r5Bw=",
+        "date": "unstable-2024-02-08"
     },
     "snes9x2002": {
         "owner": "libretro",

pkgs/applications/finance/denaro/default.nix

···
 
 buildDotnetModule rec {
   pname = "denaro";
-  version = "2024.1.0";
+  version = "2024.2.0";
 
   src = fetchFromGitHub {
     owner = "NickvisionApps";
     repo = "Denaro";
     rev = version;
-    hash = "sha256-1LGcJmNucLmP5JbtZcLGuIE0UTmeUxLl9j31Oe0k93s=";
+    hash = "sha256-fEhwup8SiYvKH2FtzruEFsj8axG5g3YJ917aqc8dn/8=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;

pkgs/applications/graphics/krita/generic.nix

···
       url = "https://invent.kde.org/graphics/krita/-/commit/2d71c47661d43a4e3c1ab0c27803de980bdf2bb2.diff";
       hash = "sha256-U3E44nj4vra++PJV20h4YHjES78kgrJtr4ktNeQfOdA=";
     })
+    # Fixes build with libjxl 0.9.0
+    (fetchpatch {
+      name = "fix-build-with-libjxl-0.9.0.patch";
+      url = "https://invent.kde.org/graphics/krita/-/commit/ace7edcca6ad322581ab39620f21ccf3ffbd3b5a.diff";
+      hash = "sha256-dXk4+HNS0+Ie/8V4+Oj4rBJrJbNHG57gIzPymXLEc9M=";
+    })
   ];
 
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip makeWrapper ];

pkgs/applications/misc/keymapp/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "keymapp";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchurl {
     url = "https://oryx.nyc3.cdn.digitaloceanspaces.com/keymapp/keymapp-${version}.tar.gz";
-    hash = "sha256-BmCLF/4wjBDxToMW0OYqI6PZwqmctgBs7nBygmJ+YOU=";
+    hash = "sha256-adFQCuHkorXixn/dId/vrCcnjQ2VDDQM049UrodjFgA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/lutris/default.nix

···
 in
 buildPythonApplication rec {
   pname = "lutris-unwrapped";
-  version = "0.5.14";
+  version = "0.5.16";
 
   src = fetchFromGitHub {
     owner = "lutris";
     repo = "lutris";
     rev = "v${version}";
-    hash = "sha256-h7oHFVqMJU1HuuUgh5oKXxr9uaIPHz7Q4gf8ONLzric=";
+    hash = "sha256-Ed1bhugBe97XmY050A5jCPcnLj0Fd7qPX2p/Ab+YbOE=";
   };
-
-  # Backport patch to fix a failing test
-  # FIXME: remove in next release
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/lutris/lutris/commit/1f1d554df3b38da64fc65557ad619e55e050641e.patch";
-      hash = "sha256-kVK1RX6T1ijffWVU7VEt2fR62QpvI6VZebiKPgEE/N8=";
-    })
-  ];
 
   nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
   buildInputs = [

pkgs/applications/misc/owmods-cli/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "owmods-cli";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "ow-mods";
     repo = "ow-mod-man";
     rev = "cli_v${version}";
-    hash = "sha256-k9Jn8LiqDyVmtjKnmpoVePNW2x5UyFfcXAPyvEgUaCU=";
+    hash = "sha256-hvzKTJKjO7MafvnrpG9ZkCz1ePr9NCo54zaRRkRCc60=";
   };
 
-  cargoHash = "sha256-RGJ0vefFkjbAL/y5/q1KMJtkO5bloj9SSebaABWSr/I=";
+  cargoHash = "sha256-db6wZs7OVPoESl4RnvOtmaM07FgKmko3nyf1CXzyJHA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/misc/remnote/default.nix

···
 in
 {
   pname = "remnote";
-  version = "1.13.34";
+  version = "1.13.52";
 
   src = fetchurl {
     url = "https://download.remnote.io/remnote-desktop/RemNote-${version}.AppImage";
-    hash = "sha256-QOfU1pZWQfShq8bQPh9ZiGKxzIV6LH8S/sQk3MQVKD0=";
+    hash = "sha256-4wN4lqeA9olo6igr1M1JhecPG/ruVivdOyWiRlDAzQQ=";
   };
   appexec = appimageTools.wrapType2 {
     inherit pname version src;

pkgs/applications/misc/sigi/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "sigi";
-  version = "3.6.1";
+  version = "3.6.3";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-UL4V/5XvqaqO4R2ievw379D/rzHf/ITgvG3BcSbMeTQ=";
+    hash = "sha256-JGQ9UbkS3Q1ohy6vtiUlPijuffH4Gb99cZCKreGqE/U=";
   };
 
-  cargoSha256 = "sha256-wzTUK4AvJmBK7LX7CLCAeAXLDxMJA/3qs/KT1+pMaoI=";
+  cargoHash = "sha256-W/ekk4tsYxG7FXzJW5i0Ii7nLgDHCSCjO3couN+/sMk=";
   nativeBuildInputs = [ installShellFiles ];
 
   # In case anything goes wrong.

pkgs/applications/misc/wofi/default.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "wofi";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromSourcehut {
     repo = pname;
     owner = "~scoopta";
     rev = "v${version}";
-    sha256 = "sha256-GxMjEXBPQniD+Yc9QZjd8TH4ILJAX5dNzrjxDawhy8w=";
+    sha256 = "sha256-zzBD1OPPlOjAUaJOlMf6k1tSai1w1ZvOwy2sSOWI7AM=";
     vc = "hg";
   };
 

pkgs/applications/networking/cluster/cilium/default.nix

···
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.15.21";
+  version = "0.15.22";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jagNtaR7YAOdvy/yJrIRQfr8UQTrEoVrPLaGklt8mUk=";
+    hash = "sha256-tjVrcxWXE/eOeVoXnoBHYXk4rA3QqcWDbK1MRZ+v7uE=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/kubeshark/default.nix

···
 
 buildGoModule rec {
   pname = "kubeshark";
-  version = "52.1.9";
+  version = "52.1.30";
 
   src = fetchFromGitHub {
     owner = "kubeshark";
     repo = "kubeshark";
     rev = "v${version}";
-    hash = "sha256-VtL/fuXMc+vTaP3nSBQm0wfe8m3/yqv5nzjP0BDLVw8=";
+    hash = "sha256-9nlPfWKgx56evxJkW+iRWJCBxqmMaBH0nCJBAAoibJc=";
   };
 
   vendorHash = "sha256-SmvO9DYOXxnmN2dmHPPOguVwEbWSH/xNLBB+idpzopo=";

pkgs/applications/networking/cluster/nomad/default.nix

···
 
   nomad_1_7 = generic {
     buildGoModule = buildGo121Module;
-    version = "1.7.3";
-    sha256 = "sha256-Rl/bDglO87kbtxFCy0eiTQVJCAwPobQI4GJQOflvXhk=";
-    vendorHash = "sha256-M8lGzUvPY8hNhN9ExHasfnLhe+DYBb86RXr1wdrRbgw=";
+    version = "1.7.4";
+    sha256 = "sha256-iyY899W/uwP/wQcarKufSpJdXRAtwDxT6yw5vrB6Xmk=";
+    vendorHash = "sha256-yPf19IRTq+LAaoHsEFVuPJLapFxH3o16y0PbYW0ehiw=";
     license = lib.licenses.bsl11;
     passthru.tests.nomad = nixosTests.nomad;
     preCheck = ''

pkgs/applications/networking/instant-messengers/baresip/default.nix pkgs/by-name/ba/baresip/package.nix

···
 , dbusSupport ? true
 }:
 stdenv.mkDerivation rec {
-  version = "3.8.1";
+  version = "3.9.0";
   pname = "baresip";
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${version}";
-    hash = "sha256-39HRvRTyA0V8NKFUUpj7UGc01KVXULTE3HUd9Kh06bw=";
+    hash = "sha256-AJCm823Fyu1n3gWw6wUfakM6YWwMtzQ84M0OKXZ4ThI=";
   };
   prePatch = lib.optionalString (!dbusSupport) ''
     substituteInPlace cmake/modules.cmake --replace 'list(APPEND MODULES ctrl_dbus)' ""
···
   meta = {
     description = "A modular SIP User-Agent with audio and video support";
     homepage = "https://github.com/baresip/baresip";
-    maintainers = with lib.maintainers; [ elohmeier raskin ];
+    maintainers = with lib.maintainers; [ elohmeier raskin ehmry ];
+    mainProgram = "baresip";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
   };

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240115-3";
+  version = "20240205";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-Ba+9irsOnGcAUJtCwbdes9DYS704dNuKAqNvJGXQKMM=";
+    hash = "sha256-Iwos+WJrCWXbNpuaZTLyc8OEtfMA0EF1DIyLNlsZSx4=";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/slack/default.nix

···
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.36.138";
-  x86_64-darwin-sha256 = "1dj4q98sva25kbniqnwz2l38lg48dhrdmjx31sg8j0ayrs82hha4";
+  x86_64-darwin-version = "4.36.140";
+  x86_64-darwin-sha256 = "0w1fxza3aglh7513znv190gsha12rk7k1ybdp4ml2pffwmm8diad";
 
-  x86_64-linux-version = "4.36.138";
-  x86_64-linux-sha256 = "06h258fvpprx37vjvd5sxl6bxnfcq3shviwx9wv8m9fmg2riwnsg";
+  x86_64-linux-version = "4.36.140";
+  x86_64-linux-sha256 = "0zahhhpcb1dxdhfmam32iqr5w3pspzbmcdv53ciqfnbkmwzkc3xr";
 
-  aarch64-darwin-version = "4.36.138";
-  aarch64-darwin-sha256 = "10xg5aa668iq0n56la1rqgpbzw8jym0y8dgv99f1l7yn03fcwpql";
+  aarch64-darwin-version = "4.36.140";
+  aarch64-darwin-sha256 = "118mzkpk431dcm61gkbj5m4sdxkwnk6fvmxg9f96xiv6n22n7pnx";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;

pkgs/applications/networking/instant-messengers/webcord/default.nix

···
 
 buildNpmPackage rec {
   pname = "webcord";
-  version = "4.7.0";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "SpacingBat3";
     repo = "WebCord";
     rev = "v${version}";
-    hash = "sha256-h0JEIfNoYx0MrHeEg/kwn/10JVxNVXIuvWcTOfellbg=";
+    hash = "sha256-JzKXIdXR/C3HRbpmSUq3qXYpLnVQjIY/uO+wbt1k2jI=";
   };
 
-  npmDepsHash = "sha256-L6ZrPqi4DjTn1P4O+lWDmvzQwqpsWmSOtnFMBHkNQAI=";
+  npmDepsHash = "sha256-KbMoM1zYOjX2Dwu6DJZLyezRx78AC9piPw3xsX3Kb3I=";
 
   nativeBuildInputs = [
     copyDesktopItems

pkgs/applications/networking/irc/hexchat/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "hexchat";
-  version = "2.16.1";
+  version = "2.16.2";
 
   src = fetchFromGitHub {
     owner = "hexchat";
     repo = "hexchat";
     rev = "v${version}";
-    sha256 = "sha256-2IUlNUTL3TOJnDNMds2EWwkfn5NUOQ1ids96Ddo196E=";
+    sha256 = "sha256-rgaXqXbBWlfSyz+CT0jRLyfGOR1cYYnRhEAu7AsaWus=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config makeWrapper ];

pkgs/applications/networking/newsreaders/slrn/default.nix

···
   meta = with lib; {
     description = "The slrn (S-Lang read news) newsreader";
     homepage = "https://slrn.sourceforge.net/index.html";
-    maintainers = with maintainers; [ ehmry ];
     license = licenses.gpl2;
     platforms = with platforms; linux;
   };

pkgs/applications/networking/nym/default.nix

···
     '';
     homepage = "https://nymtech.net";
     license = licenses.asl20;
-    maintainers = [ maintainers.ehmry ];
     platforms = platforms.all;
   };
 }

pkgs/applications/networking/soulseek/nicotine-plus/default.nix

···
     '';
     homepage = "https://www.nicotine-plus.org";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ehmry klntsky ];
+    maintainers = with maintainers; [ klntsky ];
   };
 }

pkgs/applications/office/morgen/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "morgen";
-  version = "3.1.6";
+  version = "3.2.2";
 
   src = fetchurl {
     url = "https://dl.todesktop.com/210203cqcj00tw1/versions/${version}/linux/deb";
-    hash = "sha256-/rMPNIpjkHdLE0lAdWCz71DbcqIW+1Y6RdFrYAfTSKU=";
+    hash = "sha256-+VvQM851uWoMXV3hwuVSlK9IqiNjh57uq8Wlwl/VvPg=";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/qownnotes/default.nix

···
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.1.5";
+  version = "24.2.0";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-iw3MdsS1i7B8RXZk2GXwiOReSUC1IX5z0MTEk9B4nMM=";
+    hash = "sha256-mk7yFlL+NiTZ0JtSY3y/Y1NrN1QYcBxveMImv1zB1l8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/biology/hh-suite/default.nix

···
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , xxd
 , enableMpi ? false
···
     rev = "v${version}";
     hash = "sha256-kjNqJddioCZoh/cZL3YNplweIGopWIGzCYQOnKDqZmw=";
   };
+
+  patches = [
+    # Should be removable as soon as this upstream PR is merged: https://github.com/soedinglab/hh-suite/pull/357
+    (fetchpatch {
+      name = "fix-gcc13-build-issues.patch";
+      url = "https://github.com/soedinglab/hh-suite/commit/cec47cba5dcd580e668b1ee507c9282fbdc8e7d7.patch";
+      hash = "sha256-Msdmj9l8voPYXK0SSwUA6mEbFLBhTjjE/Kjp0VL4Kf4=";
+    })
+  ];
 
   nativeBuildInputs = [ cmake xxd ];
   cmakeFlags = lib.optional stdenv.hostPlatform.isx86 "-DHAVE_SSE2=1"

pkgs/applications/search/recoll/default.nix

···
 
 mkDerivation rec {
   pname = "recoll";
-  version = "1.36.2";
+  version = "1.37.2";
 
   src = fetchurl {
     url = "https://www.lesbonscomptes.com/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-GyQqI3ciRO0TRaAeM4rGu+j/eB4bJlQ7VBTTxUGMNt4=";
+    hash = "sha256-xLdk3pJSV1YaloSV3TuTdJhujXsxUGrDru+mu86YBTU=";
   };
 
   configureFlags = [

pkgs/applications/version-management/jujutsu/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "jujutsu";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    hash = "sha256-UFe4hVzn/jN22KtTuTcyNpseJdgIkmh9/eAJdSObfYU=";
+    hash = "sha256-xnGnervyXPfZyQTYsPu09fj+QvbEZ6rDJ4fYHBeF/RY=";
   };
 
-  cargoHash = "sha256-WY8egnsyCuTLHd2Jnw+RLNd2LUOorHlnHVGLxtR5exQ=";
+  cargoHash = "sha256-wuZ0zthaemzyDn5J2au2L2k0QJnzbrCRjSBIPivEbnQ=";
 
   cargoBuildFlags = [ "--bin" "jj" ]; # don't install the fake editors
   useNextest = true; # nextest is the upstream integration framework
···
     installManPage ./jj.1
 
     installShellCompletion --cmd jj \
-      --bash <($out/bin/jj util completion --bash) \
-      --fish <($out/bin/jj util completion --fish) \
-      --zsh <($out/bin/jj util completion --zsh)
+      --bash <($out/bin/jj util completion bash) \
+      --fish <($out/bin/jj util completion fish) \
+      --zsh <($out/bin/jj util completion zsh)
   '';
 
   passthru = {

pkgs/applications/video/davinci-resolve/default.nix

···
     zlib
   ];
 
+  extraPreBwrapCmds = lib.optionalString studioVariant ''
+    mkdir -p ~/.local/share/DaVinciResolve/license || exit 1
+  '';
+
   extraBwrapArgs = lib.optionals studioVariant [
     "--bind \"$HOME\"/.local/share/DaVinciResolve/license ${davinci}/.license"
   ];

pkgs/applications/video/freetube/default.nix

···
 
   postFixup = ''
     makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar
+      --add-flags $out/share/${pname}/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
   '';
 
   meta = with lib; {

pkgs/applications/virtualization/crun/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.14";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    hash = "sha256-ElmdYJ4X5C+2BKWgUoL7bg/whvAg2CFBDFAGnJXscB4=";
+    hash = "sha256-IEfHww+kAPKcTe5bWM+YuDe6PHlSdZQVEunlBMQ29Ic=";
     fetchSubmodules = true;
   };
 

pkgs/build-support/build-fhsenv-chroot/env.nix

···
 
       # symlink ALSA stuff
       ln -s /host/etc/asound.conf asound.conf
+      ln -s /host/etc/alsa alsa
 
       # symlink SSL certs
       mkdir -p ssl

pkgs/build-support/cc-wrapper/add-hardening.sh

···
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format)
+  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
···
     format)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
       hardeningCFlagsBefore+=('-Wformat' '-Wformat-security' '-Werror=format-security')
+      ;;
+    zerocallusedregs)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling zerocallusedregs >&2; fi
+      hardeningCFlagsBefore+=('-fzero-call-used-regs=used-gpr')
       ;;
     *)
       # Ignore unsupported. Checked in Nix that at least *some*

pkgs/build-support/cc-wrapper/default.nix

···
 
   defaultHardeningFlags = bintools.defaultHardeningFlags or [];
 
+  # if cc.hardeningUnsupportedFlagsByTargetPlatform exists, this is
+  # called with the targetPlatform as an argument and
+  # cc.hardeningUnsupportedFlags is completely ignored - the function
+  # is responsible for including the constant hardeningUnsupportedFlags
+  # list however it sees fit.
+  ccHardeningUnsupportedFlags = if cc ? hardeningUnsupportedFlagsByTargetPlatform
+    then cc.hardeningUnsupportedFlagsByTargetPlatform targetPlatform
+    else (cc.hardeningUnsupportedFlags or []);
+
   darwinPlatformForCC = optionalString stdenv.targetPlatform.isDarwin (
     if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx"
     else targetPlatform.darwinPlatform
···
     ## Hardening support
     ##
     + ''
-      export hardening_unsupported_flags="${builtins.concatStringsSep " " (cc.hardeningUnsupportedFlags or [])}"
+      export hardening_unsupported_flags="${builtins.concatStringsSep " " ccHardeningUnsupportedFlags}"
     ''
 
     # Machine flags. These are necessary to support

pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh

···
 
 for arg; do
     case "$arg" in
-        --sysroot)
+        --sysroot|--sysroot=*)
             defaultSysroot=()
             ;;
         --)

pkgs/by-name/al/alsa-lib/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.9";
+  version = "1.2.11";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-3JxkP9xMz9BXLMaFhY3UHgivtYPzBGCzF+QYgnX2FbI=";
+    hash = "sha256-nz8vabmV+a03NZBy+8aaOoi/uggfyD6b4w4UZieVu00=";
   };
 
   patches = [

pkgs/by-name/al/alsa-ucm-conf/package.nix

···
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "alsa-ucm-conf";
···
     url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
     hash = "sha256-nCHj8B/wC6p1jfF+hnzTbiTrtBpr7ElzfpkQXhbyrpc=";
   };
+
+  patches = [
+    (fetchpatch {
+      # ToDo: Remove this patch in the next package upgrade
+      # Fixes SplitPCM to make some audio devices work with alsa-ucm-conf v1.2.10 again
+      name = "alsa-ucm-conf-splitpcm-device-argument-fix.patch";
+      url = "https://github.com/alsa-project/alsa-ucm-conf/commit/b68aa52acdd2763fedad5eec0f435fbf43e5ccc6.patch";
+      hash = "sha256-8WE4+uhi4W7cCSZYmL7uFpcHJ9muX09UkGXyZIpEd9I=";
+    })
+  ];
 
   dontBuild = true;
 

pkgs/by-name/am/amphetype/package.nix

···
-{ fetchFromGitLab, lib, python3Packages, qt5 }:
+{ copyDesktopItems, fetchFromGitLab, lib, makeDesktopItem, python3Packages, qt5
+}:
 
 let
   pname = "amphetype";
   version = "1.0.0";
+  description = "An advanced typing practice program";
 in python3Packages.buildPythonApplication {
   inherit pname version;
 
···
 
   doCheck = false;
 
-  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+  nativeBuildInputs = [ copyDesktopItems qt5.wrapQtAppsHook ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "Amphetype";
+      genericName = "Typing Practice";
+      categories = [ "Education" "Qt" ];
+      exec = pname;
+      comment = description;
+    })
+  ];
 
   meta = with lib; {
-    description = "An advanced typing practice program";
+    inherit description;
     homepage = "https://gitlab.com/franksh/amphetype";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ rycee ];

pkgs/by-name/ap/approxmc/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "approxmc";
-  version = "4.1.23";
+  version = "4.1.24";
 
   src = fetchFromGitHub {
     owner = "meelgroup";
     repo = "approxmc";
     rev = finalAttrs.version;
-    hash = "sha256-pE2m6Cc2u53H/5CM+2JuQxZOhjhHUZOi0kn23CJmALM=";
+    hash = "sha256-rADPC7SVwzjUN5jb7Wt341oGfr6+LszIaBUe8QgmpRU=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/bi/bitwarden-directory-connector-cli/package.nix

···
-{
-  lib,
-  buildNpmPackage,
-  fetchFromGitHub,
-  buildPackages,
-  python3,
-  pkg-config,
-  libsecret,
-  nodejs_18,
-}:
-buildNpmPackage rec {
-  pname = "bitwarden-directory-connector-cli";
-  version = "2023.10.0";
-  nodejs = nodejs_18;
-
-  src = fetchFromGitHub {
-    owner = "bitwarden";
-    repo = "directory-connector";
-    rev = "v${version}";
-    hash = "sha256-PlOtTh+rpTxAv8ajHBDHZuL7yeeLVpbAfKEDPQlejIg=";
-  };
-
-  postPatch = ''
-    ${lib.getExe buildPackages.jq} 'del(.scripts.preinstall)' package.json > package.json.tmp
-    mv -f package.json{.tmp,}
-  '';
-
-  npmDepsHash = "sha256-jBAWWY12qeX2EDhUvT3TQpnQvYXRsIilRrXGpVzxYvw=";
-
-  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-
-  makeCacheWritable = true;
-  npmBuildScript = "build:cli:prod";
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/libexec/bitwarden-directory-connector
-    cp -R {build-cli,node_modules} $out/libexec/bitwarden-directory-connector
-    runHook postInstall
-  '';
-
-  # needs to be wrapped with nodejs so that it can be executed
-  postInstall = ''
-    chmod +x $out/libexec/bitwarden-directory-connector/build-cli/bwdc.js
-    mkdir -p $out/bin
-    ln -s $out/libexec/bitwarden-directory-connector/build-cli/bwdc.js $out/bin/bitwarden-directory-connector-cli
-  '';
-
-  buildInputs = [
-    libsecret
-  ];
-
-  nativeBuildInputs = [
-    python3
-    pkg-config
-  ];
-
-  meta = with lib; {
-    description = "LDAP connector for Bitwarden";
-    homepage = "https://github.com/bitwarden/directory-connector";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [Silver-Golden];
-    platforms = platforms.linux;
-    mainProgram = "bitwarden-directory-connector-cli";
-  };
-}

pkgs/by-name/bl/bluez/package.nix

···
 , docutils
 , ell
 , enableExperimental ? false
-, fetchpatch
 , fetchurl
 , glib
 , json_c
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez";
-  version = "5.71";
+  version = "5.72";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-uCjUGMk87R9Vthb7VILPAVN0QL+zT72hpWTz7OlHNdg=";
+    hash = "sha256-SZ1/o0WplsG7ZQ9cZ0nh2SkRH6bs4L4OmGh/7mEkU24=";
   };
 
+  patches =
+    # Disable one failing test with musl libc, also seen by alpine
+    # https://github.com/bluez/bluez/issues/726
+    lib.optional (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_64)
+      (fetchurl {
+        url = "https://git.alpinelinux.org/aports/plain/main/bluez/disable_aics_unit_testcases.patch?id=8e96f7faf01a45f0ad8449c1cd825db63a8dfd48";
+        hash = "sha256-1PJkipqBO3qxxOqRFQKfpWlne1kzTCgtnTFYI1cFQt4=";
+      })
+  ;
+
   buildInputs = [
     alsa-lib
     dbus
···
   nativeBuildInputs = [
     docutils
     pkg-config
+    python3.pkgs.pygments
     python3.pkgs.wrapPython
   ];
 

pkgs/by-name/ca/cardboard/package.nix

···
   };
 
   meta = {
+    broken = true; # Upstream is archived, fails to build on gcc-13.
     homepage = "https://gitlab.com/cardboardwm/cardboard";
     description = "A scrollable, tiling Wayland compositor inspired on PaperWM";
     license = lib.licenses.gpl3Only;

pkgs/by-name/cm/cmake/package.nix

···
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.27.8";
+  version = "3.27.9";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/s4kVj9peHD7uYLqi/F0gsnV+FXYyb8LgkY9dsno0Mw=";
+    hash = "sha256-YJqbmFcqal6kd/kSz/uXMQntTQpqaz+eI1PSzcBIcI4=";
   };
 
   patches = [
···
   ++ lib.optional stdenv.isDarwin ./006-darwin-always-set-runtime-c-flag.diff;
 
   outputs = [ "out" ] ++ lib.optionals buildDocs [ "man" "info" ];
+  separateDebugInfo = true;
   setOutputFlags = false;
 
   setupHooks = [

pkgs/by-name/cm/cmd-wrapped/package.nix

···
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cmd-wrapped";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "YiNNx";
+    repo = "cmd-wrapped";
+    rev = version;
+    hash = "sha256-9GyeJFU8wLl2kCnrwZ+j+PwCRS17NvzgSCpulhXHYqQ=";
+  };
+
+  cargoHash = "sha256-i6LgLvLMDF696Tpn4yVA1XNuaTrABLVg3SgclHBq6Go=";
+
+  meta = with lib; {
+    description = "Find out what the past year looks like in commandline";
+    homepage = "https://github.com/YiNNx/cmd-wrapped";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Cryolitia ];
+    mainProgram = "cmd-wrapped";
+  };
+}

pkgs/by-name/co/cosmic-icons/package.nix

···
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "cosmic-icons";
-  version = "unstable-2024-01-23";
+  version = "unstable-2024-02-07";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
-    rev = "49a1762c958196924afcf1eae52ee910c4b4bc9f";
-    sha256 = "sha256-wL4f1rXWuFmeZCAAw0y+JQ3iesZcEC3XxWWrvrJ50oA=";
+    rev = "edd405ed84186ee24307deb7da6f25efc85986e9";
+    sha256 = "sha256-qz39vI9bRac9ZQg8FPrwv3/TW5zGlsvs2me5aE5vvZo=";
   };
 
   nativeBuildInputs = [ just ];

pkgs/by-name/cr/crc/package.nix

···
 }:
 
 let
-  openShiftVersion = "4.14.7";
-  okdVersion = "4.14.0-0.okd-2023-12-01-225814";
-  microshiftVersion = "4.14.7";
+  openShiftVersion = "4.14.8";
+  okdVersion = "4.14.0-0.okd-scos-2024-01-10-151818";
+  microshiftVersion = "4.14.8";
   podmanVersion = "4.4.4";
   writeKey = "$(MODULEPATH)/pkg/crc/segment.WriteKey=cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
-  gitCommit = "6d23b6aa727bdefe4b5d1a77b2f9da7cec477a3e";
-  gitHash = "sha256-NeCARhDmqIukBpnf6fkI0FTE4D9FUaWjBd7eG29eu9A=";
+  gitCommit = "54a6f9a15155edb2bdb70128c7c535fc69841031";
+  gitHash = "sha256-tjrlh31J3fDiYm2+PUnVVRIxxQvJKQVLcYEnMekD4Us=";
 in
 buildGoModule rec {
-  version = "2.31.0";
+  version = "2.32.0";
   pname = "crc";
 
   src = fetchFromGitHub {

pkgs/by-name/ez/eza/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-8n8U8t2hr4CysjXMPRUVKFQlNpTQL8K6Utd1BCtYOfE=";
+    hash = "sha256-gVpgI/I91ounqSrEIM7BWJKR4NyRuEU2iK+g8T9L6YY=";
   };
 
-  cargoHash = "sha256-QNZSF+93JDOt6PknZDy3xOBgeIJbyYHKgM4nM5Xh27c=";
+  cargoHash = "sha256-q2xVSB3lpsur8P8KF7jDVrEj24q6FRVJbh7bL4teOqQ=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]

pkgs/by-name/fi/files-cli/package.nix

···
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.12.28";
+  version = "2.12.30";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-4YW261qQtbfbX08zuGzr3qH470DaWUDIVaex7qYe2tI=";
+    hash = "sha256-V0oQ43ZTgzXjp+jZvF0UxfjU7vhbvKuDG2rBvB1pEOk=";
   };
 
-  vendorHash = "sha256-w5R7eVrnpcKu0/V2gAeZ7RL6VyA57INcOU31Jhwf1so=";
+  vendorHash = "sha256-OKNwYQCiB07cpnmQmJR0OJ3gX4VtXEcCPzsINEHj8Zg=";
 
   ldflags = [
     "-s"

pkgs/by-name/go/gokey/package.nix

···
+{ lib, buildGoModule, fetchFromGitHub }:
+buildGoModule {
+  pname = "gokey";
+  version = "0.1.2-unstable-2023-11-16";
+
+  src = fetchFromGitHub {
+    owner = "cloudflare";
+    repo = "gokey";
+    rev = "26fcef24d123e0eaf7b92224e6880f529f94aa9f";
+    hash = "sha256-nt4fO8NKYfRkpoC1z8zDrEZC7+fo6sU/ZOHCMHIAT58=";
+  };
+
+  vendorHash = "sha256-ZDCoRE2oP8ANsu7jfLm3BMLzXdsq1dhsEigvwWgKk54=";
+
+  meta = with lib; {
+    homepage = "https://github.com/cloudflare/gokey";
+    description = "Vault-less password store";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.confus ];
+    mainProgram = "gokey";
+  };
+}

pkgs/by-name/gp/gpt4all-chat/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpt4all-chat";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
-    hash = "sha256-BQE4UQEOOUAh0uGwQf7Q9D30s+aoGFyyMH6EI/WVIkc=";
+    hash = "sha256-l9Do58Cld9n89J+px8RPjyioIa0Bo3qGSQe7QEGcZr8=";
     owner = "nomic-ai";
     repo = "gpt4all";
     rev = "v${finalAttrs.version}";

pkgs/by-name/ha/hare/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hare";
-  version = "0-unstable-2024-02-01";
+  version = "unstable-2024-02-05";
 
   outputs = [ "out" "man" ];
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "hare";
-    rev = "4d387ed61968f468e43571d15485b498e28acaec";
-    hash = "sha256-vVL8e+P/lnp0/jO+lQ/q0CehwxAvXh+FPOMJ8r+2Ftk=";
+    rev = "d0c057dbbb0f1ee9179769e187c0fbd3b00327d4";
+    hash = "sha256-3zpUqdxoKMwezRfMgnpY3KfMB5/PFfRYtGPZxWfNDtA=";
   };
 
   patches = [

pkgs/by-name/ha/harec/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "harec";
-  version = "0-unstable-2024-01-29";
+  version = "unstable-2024-02-03";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "harec";
-    rev = "f9e17e633845d8d38566b4ea32db0a29ac85d96e";
-    hash = "sha256-Xy9VOcDtbJUz3z6Vk8bqH41VbAFKtJ9fzPGEwVz8KQM=";
+    rev = "09cb18990266eef814917d8211d38b82e0896532";
+    hash = "sha256-cxWRqGipoDATN1+V9s9S2WJ3sLMcTqIJmhP5XTld3AU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/in/invidtui/package.nix

···
 
 buildGoModule rec {
   pname = "invidtui";
-  version = "0.3.8";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "darkhz";
     repo = "invidtui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-m2ygORf6GIJZXYYJKy6i12wDEkxQywtYdCutHeiyNYY=";
+    hash = "sha256-3F/JWdYjb3Wtd2eBkEmId3SCVapu2gCgLFowK59RXRc=";
   };
 
-  vendorHash = "sha256-HQ6JHXiqawDwSV48/Czbao4opnuz1LqIBdcObrkCfNs=";
+  vendorHash = "sha256-rwKx3h0X7RfIZ9lE/4TJoK0BR6f/lPcLNFbQjUtq/Tk=";
 
   doCheck = true;
 

pkgs/by-name/li/libmpdclient/package.nix

···
     homepage = "https://www.musicpd.org/libs/libmpdclient/";
     changelog = "https://raw.githubusercontent.com/MusicPlayerDaemon/libmpdclient/${finalAttrs.src.rev}/NEWS";
     license = with lib.licenses; [ bsd2 ];
-    maintainers = with lib.maintainers; [ AndersonTorres ehmry ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/lz/lzlib/package.nix

···
+{ lib, stdenv, fetchurl, texinfo, lzip }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lzlib";
+  version = "1.14";
+  outputs = [ "out" "info" ];
+
+  nativeBuildInputs = [ texinfo lzip ];
+
+  src = fetchurl {
+    url = "mirror://savannah/lzip/lzlib/lzlib-${finalAttrs.version}.tar.lz";
+    sha256 = "e362ecccd82d4dd297df6a51b952c65d2172f9bf41a5c4590d3604d83aa519d3";
+    # hash from release email
+  };
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile.in --replace '-Wl,--soname=' '-Wl,-install_name,$(out)/lib/'
+  '';
+
+  makeFlags = [ "CC:=$(CC)" "AR:=$(AR)" ];
+  doCheck = true;
+
+  configureFlags = [ "--enable-shared" ];
+
+  meta = {
+    homepage = "https://www.nongnu.org/lzip/lzlib.html";
+    description =
+      "Data compression library providing in-memory LZMA compression and decompression functions, including integrity checking of the decompressed data";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ ehmry ];
+  };
+})

pkgs/by-name/ma/material-black-colors/package.nix

···
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, colorVariants ? [] # default: install all icons
+}:
+
+let
+  pname = "material-black-colors";
+  colorVariantList = [
+    "MB-Blueberry-Suru-GLOW"
+    "MB-Cherry-Suru-GLOW"
+    "MB-Lime-Suru-GLOW"
+    "MB-Mango-Suru-GLOW"
+    "MB-Pistachio-Suru-GLOW"
+    "MB-Plum-Suru-GLOW"
+    "Material-Black-Blueberry-Numix-FLAT"
+    "Material-Black-Blueberry-Numix"
+    "Material-Black-Blueberry-Suru"
+    "Material-Black-Cherry-Numix-FLAT"
+    "Material-Black-Cherry-Numix"
+    "Material-Black-Cherry-Suru"
+    "Material-Black-Lime-Numix-FLAT"
+    "Material-Black-Lime-Numix"
+    "Material-Black-Lime-Suru"
+    "Material-Black-Mango-Numix-FLAT"
+    "Material-Black-Mango-Numix"
+    "Material-Black-Mango-Suru"
+    "Material-Black-Pistachio-Numix-FLAT"
+    "Material-Black-Pistachio-Numix"
+    "Material-Black-Pistachio-Suru"
+    "Material-Black-Plum-Numix-FLAT"
+    "Material-Black-Plum-Numix"
+    "Material-Black-Plum-Suru"
+  ];
+
+in
+lib.checkListOfEnum "${pname}: color variants" colorVariantList colorVariants
+
+stdenvNoCC.mkDerivation {
+  inherit pname;
+  version = "0-unstable-2020-12-17";
+
+  src = fetchFromGitHub {
+    owner = "rtlewis88";
+    repo = "rtl88-Themes";
+    rev = "3864d851aac7f4e76cf23717aee104de234aef74";
+    hash = "sha256-BUJMd6Ltq16/HqqDbB5VDGIRSzLivXxNYZPT9sd6oTI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/icons
+    cp -r ${lib.concatStringsSep " " (if colorVariants != [] then colorVariants else colorVariantList)} $out/share/icons/
+    runHook postInstall
+  '';
+
+  dontFixup = true;
+
+  meta = with lib; {
+    description = "Material Black Colors icons";
+    homepage = "https://github.com/rtlewis88/rtl88-Themes/tree/material-black-COLORS";
+    maintainers = with maintainers; [ d3vil0p3r ];
+    platforms = platforms.all;
+    license = with licenses; [ gpl3Plus mit ];
+  };
+}

pkgs/by-name/md/md4c/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "md4c";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "mity";
     repo = "md4c";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-BWmzNV3iC2g8MHoYtqIcUtLQz3oaQwH+Pyy4fN3N7/k=";
+    hash = "sha256-2/wi7nJugR8X2J9FjXJF1UDnbsozGoO7iR295/KSJng=";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];

pkgs/by-name/ni/nimlangserver/lock.json

···
+{
+  "depends": [
+    {
+      "method": "fetchzip",
+      "packages": [
+        "asynctools"
+      ],
+      "path": "/nix/store/51nf7pb5cwg2n441ka6w6g6c4hdjsdj4-source",
+      "rev": "bb01d965a2ad0f08eaff6a53874f028ddbab4909",
+      "sha256": "0v4n7maskd07qsx8rsr9v0bs7nzbncmvxsn7j9jsk9azcy803v49",
+      "srcDir": "",
+      "url": "https://github.com/nickysn/asynctools/archive/bb01d965a2ad0f08eaff6a53874f028ddbab4909.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "asynctools"
+      ],
+      "path": "/nix/store/86w001hvppm2xfmqzb3733rnd5s1dmc2-source",
+      "rev": "non-blocking",
+      "sha256": "1iyr2k3vrbqfwm70w9bsyhis799lm9rin8j5pkjxgrpshm1znpbd",
+      "srcDir": "",
+      "url": "https://github.com/yyoncho/asynctools/archive/non-blocking.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "bearssl"
+      ],
+      "path": "/nix/store/drj65wylnxdbv4jqhymf7biiyjfb75v8-source",
+      "rev": "9372f27a25d0718d3527afad6cc936f6a853f86e",
+      "sha256": "152zbyqx12fmmjl4wn6kqqk1jzp1ywm4xvjd28ll9037f1pyd5ic",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-bearssl/archive/9372f27a25d0718d3527afad6cc936f6a853f86e.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "chronicles"
+      ],
+      "path": "/nix/store/ffz78k6z9wf8vj2kv1jdj5dq2rxf61j7-source",
+      "rev": "2a2681b60289aaf7895b7056f22616081eb1a882",
+      "sha256": "0n8awgrmn9f6vd7ibv1jlyxk61lrs7hc51fghilrw6g6xq5w9rxq",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-chronicles/archive/2a2681b60289aaf7895b7056f22616081eb1a882.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "chronos"
+      ],
+      "path": "/nix/store/l4zs1l1yw4yhf1f8q7r5x5z2szjygr6d-source",
+      "rev": "ba143e029f35fd9b4cd3d89d007cc834d0d5ba3c",
+      "sha256": "1lv3l9c4ifqzlfgpwpvpq2z3994zz1nirg8f59xrnfb7zgbv8l3i",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-chronos/archive/ba143e029f35fd9b4cd3d89d007cc834d0d5ba3c.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "faststreams"
+      ],
+      "path": "/nix/store/4nj341ypj07hjvxv0462wpnywhkj02b5-source",
+      "rev": "422971502bd641703bf78a27cb20429e77fcfb8b",
+      "sha256": "0snzh904f8f3wn33liy6817q9ccx8mvsl88blhr49qh69mzbgnba",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-faststreams/archive/422971502bd641703bf78a27cb20429e77fcfb8b.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "httputils"
+      ],
+      "path": "/nix/store/jmgpadmdabybhij1srd81xfr873zgfmm-source",
+      "rev": "5065d2cf18dcb9812e25cc0e2c50eb357bde04cf",
+      "sha256": "069fw3h9cjn0hab9vhfri8ibld7yihb8ggyg1nv5vxz6i3x026m5",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-http-utils/archive/5065d2cf18dcb9812e25cc0e2c50eb357bde04cf.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "json_rpc"
+      ],
+      "path": "/nix/store/szg3jxcg0bf6zv224nyisqhnibkd2pxw-source",
+      "rev": "c8a5cbe26917e6716b1597dae2d08166f3ce789a",
+      "sha256": "1l1y4psbcd5w68j1zz172rlwsk7jxbwlr14r2kwnkj7xc7lfwlnx",
+      "srcDir": "",
+      "url": "https://github.com/yyoncho/nim-json-rpc/archive/c8a5cbe26917e6716b1597dae2d08166f3ce789a.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "json_serialization"
+      ],
+      "path": "/nix/store/h0xl7qnw7bh513rb24k1n805x3n1rimw-source",
+      "rev": "d9394dc7286064902d825bbc1203d03d7218633a",
+      "sha256": "102m7jaxjip24a6hrnk0nvfb0vmdx5zq4m9i4xyzq8m782xyqp94",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-json-serialization/archive/d9394dc7286064902d825bbc1203d03d7218633a.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "news"
+      ],
+      "path": "/nix/store/siwfngb840kcdjdviy5rhlpvdpkw14sk-source",
+      "rev": "8bfd753649aa7e870ec45e93f1453d3bfcf66733",
+      "sha256": "0hvs4kfr4aais7ixvh9d7na2r2zjnvaw3m3rpklafn9qld2wpaav",
+      "srcDir": "src",
+      "url": "https://github.com/status-im/news/archive/8bfd753649aa7e870ec45e93f1453d3bfcf66733.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "news"
+      ],
+      "path": "/nix/store/siwfngb840kcdjdviy5rhlpvdpkw14sk-source",
+      "rev": "status",
+      "sha256": "0hvs4kfr4aais7ixvh9d7na2r2zjnvaw3m3rpklafn9qld2wpaav",
+      "srcDir": "src",
+      "url": "https://github.com/status-im/news/archive/status.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "nimcrypto"
+      ],
+      "path": "/nix/store/dnj20qh97ylf57nka9wbxs735wbw7yxv-source",
+      "rev": "4014ef939b51e02053c2e16dd3481d47bc9267dd",
+      "sha256": "1kgqr2lqaffglc1fgbanwcvhkqcbbd20d5b6w4lf0nksfl9c357a",
+      "srcDir": "",
+      "url": "https://github.com/cheatfate/nimcrypto/archive/4014ef939b51e02053c2e16dd3481d47bc9267dd.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "serialization"
+      ],
+      "path": "/nix/store/ss096qz8svm5my0mjhk3imyrc2nm2x0y-source",
+      "rev": "4d541ec43454809904fc4c3c0a7436410ad597d2",
+      "sha256": "1a5x0fsxxkqpambz9q637dz0jrzv9q1jb3cya12k6106vc65lyf8",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-serialization/archive/4d541ec43454809904fc4c3c0a7436410ad597d2.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "stew"
+      ],
+      "path": "/nix/store/90rwcr71bq13cid74v4aazikv2s924r1-source",
+      "rev": "d9400ddea08341a65102cffdb693d3a7131efef4",
+      "sha256": "0gkmh63izhp0bxyfmwfvyp81bxnzwnc3r7nxr5a05xpl8crk85w2",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-stew/archive/d9400ddea08341a65102cffdb693d3a7131efef4.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "stint"
+      ],
+      "path": "/nix/store/q42j4w2f70qfihcrpzgl3fspxihfsadb-source",
+      "rev": "c0ae9e10a9238883d18226fa28a5435c4d305e45",
+      "sha256": "0dxhjg5nf4sc4ga2zrxqcmr1v3ki9irkl603x0y3pz5sd8jdi731",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-stint/archive/c0ae9e10a9238883d18226fa28a5435c4d305e45.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "testutils"
+      ],
+      "path": "/nix/store/hn5r1ywl4qzzjl9zj62w5m6f8bqkjn8q-source",
+      "rev": "dfc4c1b39f9ded9baf6365014de2b4bfb4dafc34",
+      "sha256": "0fi59m8yvayzlh1ajbl98ddy43i3ikjqh3s5px16y0s3cidg4fai",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-testutils/archive/dfc4c1b39f9ded9baf6365014de2b4bfb4dafc34.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "unittest2"
+      ],
+      "path": "/nix/store/wdj38hf9hdyb1skgb6v0z00kxkdmnq04-source",
+      "rev": "b178f47527074964f76c395ad0dfc81cf118f379",
+      "sha256": "1ir20z9m4wmm0bs2dd2qiq75w0x3skv0yj7sqp6bqfh98ni44xdc",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-unittest2/archive/b178f47527074964f76c395ad0dfc81cf118f379.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "websock"
+      ],
+      "path": "/nix/store/yad26q3iv3r2lw9xs655kyx3hvflxi1p-source",
+      "rev": "2c3ae3137f3c9cb48134285bd4a47186fa51f0e8",
+      "sha256": "09pkxzsnahljkqyp540v1wwiqcnbkz5ji5bz9q9cwn3axpmqc3v7",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-websock/archive/2c3ae3137f3c9cb48134285bd4a47186fa51f0e8.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "with"
+      ],
+      "path": "/nix/store/qkwz2w5haw8px691c6gkklvxxp38j9d3-source",
+      "rev": "2f95909c767605e06670dc70f5cffd6b9284f192",
+      "sha256": "1qdq9wpm6xahqczmvdn3a7yvvrw5x42ylvzmbybdwjzd8vmgg0zv",
+      "srcDir": "",
+      "url": "https://github.com/zevv/with/archive/2f95909c767605e06670dc70f5cffd6b9284f192.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "zlib"
+      ],
+      "path": "/nix/store/br78rad2jnl6zka2q89qi6pkfiyn10fv-source",
+      "rev": "f34ca261efd90f118dc1647beefd2f7a69b05d93",
+      "sha256": "1k8y7m1ry1z8jm8hj8pa3vlqprshaa59cdwq2a4acrfw9ks5w482",
+      "srcDir": "",
+      "url": "https://github.com/status-im/nim-zlib/archive/f34ca261efd90f118dc1647beefd2f7a69b05d93.tar.gz"
+    }
+  ]
+}

pkgs/by-name/ni/nimlangserver/package.nix

···
+{
+  lib,
+  buildNimPackage,
+  fetchFromGitHub,
+}:
+buildNimPackage (final: prev: {
+  pname = "nimlangserver";
+  version = "1.2.0";
+
+  # lock.json was generated by converting
+  # nimble.lock into requires "<gitUrl>#revSha" in a dummy.nimble
+  # for all packages and then running nim_lk on said dummy package
+  # default nim_lk output fails because it attempts
+  # to use branches that will not work instead of HEAD for packages
+  lockFile = ./lock.json;
+
+  src = fetchFromGitHub {
+    owner = "nim-lang";
+    repo = "langserver";
+    rev = "71b59bfa77dabf6b8b381f6e18a1d963a1a658fc";
+    hash = "sha256-dznegEhRHvztrNhBcUhW83RYgJpduwdGLWj/tJ//K8c=";
+  };
+
+  doCheck = false;
+
+  meta = with lib;
+    final.src.meta
+    // {
+      description = "The Nim language server implementation (based on nimsuggest)";
+      license = licenses.mit;
+      mainProgram = "nimlangserver";
+      maintainers = with maintainers; [daylinmorgan];
+    };
+})

pkgs/by-name/oc/ocenaudio/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ocenaudio";
-  version = "3.13.3";
+  version = "3.13.4";
 
   src = fetchurl {
-    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    hash = "sha256-B0+NyFZ9c0ljzYMJm3741TpoxFS0Zo6hxzhadYFofSA=";
+    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=v${version}";
+    hash = "sha256-vE+xwwkBXIksy+6oygLDsrT8mFfHYIGcb6+8KMZe0no=";
   };
 
   nativeBuildInputs = [
···
     mv $out/usr/share $out/share
     rm -rf $out/usr
     substituteInPlace $out/share/applications/ocenaudio.desktop \
-      --replace "/opt/ocenaudio/bin/ocenaudio" "ocenaudio"
+      --replace-fail "/opt/ocenaudio/bin/ocenaudio" "ocenaudio"
     mkdir -p $out/share/licenses/ocenaudio
     mv $out/bin/ocenaudio_license.txt $out/share/licenses/ocenaudio/LICENSE
 

pkgs/by-name/pg/pget/package.nix

···
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "pget";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "Code-Hex";
+    repo = "pget";
+    rev = "v${version}";
+    hash = "sha256-SDe9QH1iSRfMBSCfYiOJPXUbDvxH5cCCWvQq9uTWT9Y=";
+  };
+
+  vendorHash = "sha256-p9sgvk5kfim3rApgp++1n05S9XrOWintxJfCeeySuBo=";
+
+  ldflags = [
+    "-w"
+    "-s"
+    "-X=main.version=${version}"
+  ];
+
+  meta = with lib; {
+    description = "The fast, resumable file download client";
+    homepage = "https://github.com/Code-Hex/pget?tab=readme-ov-file";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Ligthiago ];
+    mainProgram = "pget";
+  };
+}

pkgs/by-name/pl/plzip/package.nix

···
+{ lib, stdenv, fetchurl, lzip, lzlib, texinfo }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "plzip";
+  version = "1.11";
+  outputs = [ "out" "man" "info" ];
+
+  src = fetchurl {
+    url = "mirror://savannah/lzip/plzip/plzip-${finalAttrs.version}.tar.lz";
+    sha256 = "51f48d33df659bb3e1e7e418275e922ad752615a5bc984139da08f1e6d7d10fd";
+    # hash from release email
+  };
+
+  nativeBuildInputs = [ lzip texinfo ];
+  buildInputs = [ lzlib ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = {
+    homepage = "https://www.nongnu.org/lzip/plzip.html";
+    description = "A massively parallel lossless data compressor based on the lzlib compression library";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ _360ied ehmry ];
+    mainProgram = "plzip";
+  };
+})

pkgs/by-name/qc/qcm/package.nix

···
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, qt6
+, curl
+, ffmpeg
+, cubeb
+}:
+
+stdenv.mkDerivation rec {
+  pname = "qcm";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner = "hypengw";
+    repo = "Qcm";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-6QivAQqOuWIldx2Rh5nNsj0gia3AOUm6vy9aqyJ1G6k=";
+  };
+
+  patches = [ ./remove_cubeb_vendor.patch ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtwayland
+    curl
+    ffmpeg
+    cubeb
+  ] ++ cubeb.passthru.backendLibs;
+
+  qtWrapperArgs = [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath cubeb.passthru.backendLibs}"
+  ];
+
+  postInstall = ''
+    rm -r $out/{include,lib/cmake}
+  '';
+
+  meta = with lib; {
+    description = "An unofficial Qt client for netease cloud music";
+    homepage = "https://github.com/hypengw/Qcm";
+    license = licenses.gpl2Plus;
+    mainProgram = "Qcm";
+    maintainers = with maintainers; [ aleksana ];
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/qc/qcm/remove_cubeb_vendor.patch

···
+diff --git a/player/CMakeLists.txt b/player/CMakeLists.txt
+index c160e10..62c2611 100644
+--- a/player/CMakeLists.txt
++++ b/player/CMakeLists.txt
+@@ -25,4 +25,4 @@ target_include_directories(
+ target_link_libraries(
+   player
+   PUBLIC core error asio_helper PkgConfig::LIBAV
+-  PRIVATE ctre cubeb::cubeb)
++  PRIVATE ctre cubeb)
+diff --git a/third_party/CMakeLists.txt b/third_party/CMakeLists.txt
+index 45345d3..f797b48 100644
+--- a/third_party/CMakeLists.txt
++++ b/third_party/CMakeLists.txt
+@@ -41,10 +41,7 @@ option(USE_SANITIZERS "" OFF)
+ set(USE_WINMM
+     OFF
+     CACHE BOOL "")
+-add_subdirectory(cubeb EXCLUDE_FROM_ALL)
+-set_property(TARGET cubeb PROPERTY MSVC_RUNTIME_LIBRARY
+-                                   "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+-add_library(cubeb::cubeb ALIAS cubeb)
++find_package(cubeb REQUIRED)
+ 
+ option(KDSingleApplication_QT6 "" ON)
+ option(KDSingleApplication_STATIC "" ON)
+@@ -55,4 +52,4 @@ add_subdirectory(KDSingleApplication)
+ 
+ 
+ add_library(pegtl INTERFACE)
+-target_include_directories(pegtl INTERFACE PEGTL/include)
+\ No newline at end of file
++target_include_directories(pegtl INTERFACE PEGTL/include)

pkgs/by-name/re/renode-unstable/package.nix

···
   inherit buildUnstable;
 }).overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.14.0+20240119git1a0826937";
+  version = "1.14.0+20240130git6e173a1bb";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-bv5+6DVzBFt5XeKcLJFpUHB5T1RKCNi/CuXXpIn6e9k=";
+    hash = "sha256-D4DjZYsvtlJXgoAHkYb7qPqbNfpidXHmEozEj6nPPqA=";
   };
 })

pkgs/by-name/ti/tilda/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tilda";
-  version = "1.5.4";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lanoxx";
     repo = "tilda";
     rev = "tilda-${finalAttrs.version}";
-    hash = "sha256-uDx28jmjNUyzJbgTJiHbjI9U5mYb9bnfl/9AjbxNUWA=";
+    hash = "sha256-Gseti810JwhYQSaGdE2KRRqnwNmthNBiFvXH9DyVpak=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ti/tinycompress/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "tinycompress";
-  version = "1.2.8";
+  version = "1.2.11";
 
   src = fetchurl {
     url = "mirror://alsa/tinycompress/${pname}-${version}.tar.bz2";
-    hash = "sha256-L4l+URLNO8pnkLXOz9puBmLIvF7g+6uXKyR6DMYg1mw=";
+    hash = "sha256-6754jCgyjnzKJFqvkZSlrQ3JHp4NyIPCz5/rbULJ8/w=";
   };
 
   meta = with lib; {

pkgs/by-name/ux/uxn/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "unstable-2024-01-21";
+  version = "unstable-2024-02-07";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "3e1183285a94a0930c9b09fd4fa73ac3a5d24fda";
-    hash = "sha256-hhxcj/jVBOm7E63Z9sS3SnFjexQEXVtw3QU5n/4hkVI=";
+    rev = "300a3d7b3ed399721cef59e9ed9efe8a1d4e0f6f";
+    hash = "sha256-uwHXa4GhXNJHroQG8t3VQggvdCA3G4/1d/XVfsgeI7E=";
   };
 
   outputs = [ "out" "projects" ];

pkgs/by-name/vc/vcpkg-tool/package.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcpkg-tool";
-  version = "2024-01-11";
+  version = "2024-02-05";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg-tool";
     rev = finalAttrs.version;
-    hash = "sha256-PwCJv0O0ysE4CQVOrt+rqp3pjSt/11We+ZI8vdaYpPM=";
+    hash = "sha256-MTlRa7uyJqU98nhADsAwJ3BjlMvijAWIcTJO8GO+6tY=";
   };
 
   nativeBuildInputs = [

pkgs/data/misc/publicsuffix-list/default.nix

···
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "unstable-2023-02-16";
+  version = "0-unstable-2024-01-07";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "8ec4d3049fe139f92937b6137155c33b81dcaf18";
-    hash = "sha256-wA8zk0iADFNP33veIf+Mfx22zdMzHsMNWEizMp1SnuA=";
+    rev = "5db9b65997e3c9230ac4353b01994c2ae9667cb9";
+    hash = "sha256-kIJVS2ETAXQa1MMG8cjRUSFUn+jm9jBWH8go3L+lqHE=";
   };
 
   dontBuild = true;

pkgs/data/misc/tzdata/default.nix

···
 { lib, stdenv, fetchurl, buildPackages }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2023d";
+  version = "2024a";
 
   srcs = [
     (fetchurl {
-      url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-28ohlwsKi4wM7O7B17kfqQO+D27KWucytTKWciMqCPM=";
+      url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
+      hash = "sha256-DQQ0RZrL0gWaeo2h8zBKhKhlkfbtacYkj/+lArbt/+M=";
     })
     (fetchurl {
-      url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-6aX54RiIbS3pK2K7BVEKKMxsBY15HJO9a4TTKSw8Fh4=";
+      url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
+      hash = "sha256-gAcolK3/WkWPHRQ+FuTKHYsqEiycU5naSCy2jLpqH/g=";
     })
   ];
 
···
   propagatedBuildOutputs = [ ];
 
   makeFlags = [
-    "TOPDIR=$(out)"
-    "TZDIR=$(out)/share/zoneinfo"
-    "BINDIR=$(bin)/bin"
-    "ZICDIR=$(bin)/bin"
+    "TOPDIR=${placeholder "out"}"
+    "TZDIR=${placeholder "out"}/share/zoneinfo"
+    "BINDIR=${placeholder "bin"}/bin"
+    "ZICDIR=${placeholder "bin"}/bin"
     "ETCDIR=$(TMPDIR)/etc"
     "TZDEFAULT=tzdefault-to-remove"
-    "LIBDIR=$(dev)/lib"
-    "MANDIR=$(man)/share/man"
+    "LIBDIR=${placeholder "dev"}/lib"
+    "MANDIR=${placeholder "man"}/share/man"
     "AWK=awk"
     "CFLAGS=-DHAVE_LINK=0"
     "CFLAGS+=-DZIC_BLOAT_DEFAULT=\\\"fat\\\""
···
     "CFLAGS+=-DRESERVE_STD_EXT_IDS"
   ];
 
-  doCheck = false; # needs more tools
+  doCheck = true;
+  # everything except for check_web, because that needs curl and wants to talk to https://validator.w3.org
+  checkTarget = "check_back check_character_set check_white_space check_links check_name_lengths check_now check_slashed_abbrs check_sorted check_tables check_ziguard check_zishrink check_tzs";
 
   installFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "zic=${buildPackages.tzdata.bin}/bin/zic"
···
   meta = with lib; {
     homepage = "http://www.iana.org/time-zones";
     description = "Database of current and historical time zones";
-    changelog = "https://github.com/eggert/tz/blob/${version}/NEWS";
+    changelog = "https://github.com/eggert/tz/blob/${finalAttrs.version}/NEWS";
     license = with licenses; [
       bsd3 # tzcode
       publicDomain # tzdata
···
     platforms = platforms.all;
     maintainers = with maintainers; [ ajs124 fpletz ];
   };
-}
+})

pkgs/data/misc/unicode-character-database/default.nix

···
-{ lib, stdenv
+{ lib, stdenvNoCC
 , fetchurl
 , unzip
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "unicode-character-database";
   version = "15.1.0";
 
···
 
     mkdir -p $out/share/unicode
     cp -r * $out/share/unicode
+    rm $out/share/unicode/env-vars
 
     runHook postInstall
   '';

pkgs/data/themes/base16-schemes/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "base16-schemes";
-  version = "unstable-2023-05-02";
+  version = "unstable-2024-01-14";
 
   src = fetchFromGitHub {
     owner = "tinted-theming";
-    repo = "base16-schemes";
-    rev = "9a4002f78dd1094c123169da243680b2fda3fe69";
-    sha256 = "sha256-AngNF++RZQB0l4M8pRgcv66pAcIPY+cCwmUOd+RBJKA=";
+    repo = "schemes";
+    rev = "395074124283df993571f2abb9c713f413b76e6e";
+    sha256 = "sha256-9LmwYbtTxNFiP+osqRUbOXghJXpYvyvAwBwW80JMO7s=";
   };
 
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/share/themes/
-    install *.yaml $out/share/themes/
+    install base16/*.yaml $out/share/themes/
 
     runHook postInstall
   '';

pkgs/desktops/cinnamon/cinnamon-session/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon-session";
-  version = "6.0.3";
+  version = "6.0.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-dNg1e339NWRzyEsRp7I91SwK2H+lU28Ra+7MSgUDk8w=";
+    hash = "sha256-GtaoqzcnpKbiP4OqhnLkNWzZTUqX/KgVE6JImNMkdGo=";
   };
 
   patches = [

pkgs/development/compilers/edk2/default.nix

···
     mkdir -p $out/CryptoPkg/Library/OpensslLib/openssl
     tar --strip-components=1 -xf ${buildPackages.openssl.src} -C $out/CryptoPkg/Library/OpensslLib/openssl
     chmod -R +w $out/
+
+    # Fix missing INT64_MAX include that edk2 explicitly does not provide
+    # via it's own <stdint.h>. Let's pull in openssl's definition instead:
+    sed -i $out/CryptoPkg/Library/OpensslLib/openssl/crypto/property/property_parse.c \
+        -e '1i #include "internal/numbers.h"'
   '';
 
   nativeBuildInputs = [ pythonEnv ];

pkgs/development/compilers/gcc/default.nix

···
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
     isGNU = true;
     hardeningUnsupportedFlags = lib.optional is48 "stackprotector"
+      ++ lib.optional (!atLeast11) "zerocallusedregs"
       ++ lib.optional (!atLeast12) "fortify3"
       ++ lib.optionals (langFortran) [ "fortify" "format" ];
   };

pkgs/development/compilers/llvm/10/clang/default.nix

···
+{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+, buildLlvmTools
+, fixDarwinDylibNames
+, enableManpages ? false
+}:
+
+let
+  self = stdenv.mkDerivation ({
+    pname = "clang";
+    inherit version;
+
+    src = fetch "clang" "091bvcny2lh32zy8f3m9viayyhb2zannrndni7325rl85cwgr6pr";
+
+    unpackPhase = ''
+      unpackFile $src
+      mv clang-${version}* clang
+      sourceRoot=$PWD/clang
+      unpackFile ${clang-tools-extra_src}
+      mv clang-tools-extra-* $sourceRoot/tools/extra
+    '';
+
+    nativeBuildInputs = [ cmake python3 ]
+      ++ lib.optional enableManpages python3.pkgs.sphinx
+      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+    buildInputs = [ libxml2 libllvm ];
+
+    cmakeFlags = [
+      "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ lib.optionals enableManpages [
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DLLVM_ENABLE_SPHINX=ON"
+      "-DSPHINX_OUTPUT_MAN=ON"
+      "-DSPHINX_OUTPUT_HTML=OFF"
+      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
+    ];
+
+    patches = [
+      ./purity.patch
+      # https://reviews.llvm.org/D51899
+      ./compiler-rt-baremetal.patch
+      ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-6-10-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
+    ];
+
+    postPatch = ''
+      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+             lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace tools/extra/clangd/CMakeLists.txt \
+        --replace "NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB" FALSE
+    '';
+
+    outputs = [ "out" "lib" "dev" "python" ];
+
+    postInstall = ''
+      ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+      moveToOutput "lib/libclang-cpp.*" "$lib"
+      substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
+
+      mkdir -p $python/bin $python/share/{clang,scan-view}
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
+      rm $out/bin/c-index-test
+      patchShebangs $python/bin
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
+    '';
+
+    passthru = {
+      inherit libllvm;
+      isClang = true;
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
+    };
+
+    meta = llvm_meta // {
+      homepage = "https://clang.llvm.org/";
+      description = "A C language family frontend for LLVM";
+      longDescription = ''
+        The Clang project provides a language front-end and tooling
+        infrastructure for languages in the C language family (C, C++, Objective
+        C/C++, OpenCL, CUDA, and RenderScript) for the LLVM project.
+        It aims to deliver amazingly fast compiles, extremely useful error and
+        warning messages and to provide a platform for building great source
+        level tools. The Clang Static Analyzer and clang-tidy are tools that
+        automatically find bugs in your code, and are great examples of the sort
+        of tools that can be built using the Clang frontend as a library to
+        parse C/C++ code.
+      '';
+      mainProgram = "clang";
+    };
+  } // lib.optionalAttrs enableManpages {
+    pname = "clang-manpages";
+
+    buildPhase = ''
+      make docs-clang-man
+    '';
+
+    installPhase = ''
+      mkdir -p $out/share/man/man1
+      # Manually install clang manpage
+      cp docs/man/*.1 $out/share/man/man1/
+    '';
+
+    outputs = [ "out" ];
+
+    doCheck = false;
+
+    meta = llvm_meta // {
+      description = "man page for Clang ${version}";
+    };
+  });
+in self

pkgs/development/compilers/llvm/11/clang/default.nix

···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/12/clang/default.nix

···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/13/clang/default.nix

···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/14/clang/default.nix

···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/15/clang/default.nix

···
 }:
 
 let
-  self = stdenv.mkDerivation (rec {
+  self = stdenv.mkDerivation (finalAttrs: rec {
     pname = "clang";
     inherit version;
 
···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [
+        "fortify3"
+      ];
+      hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
+        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/16/clang/default.nix

···
 }:
 
 let
-  self = stdenv.mkDerivation (rec {
+  self = stdenv.mkDerivation (finalAttrs: rec {
     pname = "clang";
     inherit version;
 
···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [
+        "fortify3"
+      ];
+      hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
+        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/17/clang/default.nix

···
 }:
 
 let
-  self = stdenv.mkDerivation (rec {
+  self = stdenv.mkDerivation (finalAttrs: rec {
     pname = "clang";
     inherit version;
 
···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [
+        "fortify3"
+      ];
+      hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
+        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/8/clang/default.nix

···
+{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+, buildLlvmTools
+, fixDarwinDylibNames
+, enableManpages ? false
+, enablePolly ? false # TODO: get this info from llvm (passthru?)
+}:
+
+let
+  self = stdenv.mkDerivation ({
+    pname = "clang";
+    inherit version;
+
+    src = fetch "cfe" "0ihnbdl058gvl2wdy45p5am55bq8ifx8m9mhcsgj9ax8yxlzvvvh";
+
+    unpackPhase = ''
+      unpackFile $src
+      mv cfe-${version}* clang
+      sourceRoot=$PWD/clang
+      unpackFile ${clang-tools-extra_src}
+      mv clang-tools-extra-* $sourceRoot/tools/extra
+    '';
+
+    nativeBuildInputs = [ cmake python3 ]
+      ++ lib.optional enableManpages python3.pkgs.sphinx
+      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+    buildInputs = [ libxml2 libllvm ];
+
+    cmakeFlags = [
+      "-DCMAKE_CXX_FLAGS=-std=c++11"
+      "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ lib.optionals enableManpages [
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DLLVM_ENABLE_SPHINX=ON"
+      "-DSPHINX_OUTPUT_MAN=ON"
+      "-DSPHINX_OUTPUT_HTML=OFF"
+      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
+    ] ++ lib.optionals enablePolly [
+      "-DWITH_POLLY=ON"
+      "-DLINK_POLLY_INTO_TOOLS=ON"
+    ];
+
+    patches = [
+      ../../common/clang/5-8-purity.patch
+      ./xpc.patch
+      # Backport for -static-pie, which the latter touches, and which is nice in
+      # its own right.
+      ./static-pie.patch
+      # Backport for the `--unwindlib=[libgcc|compiler-rt]` flag, which is
+      # needed for our bootstrapping to not interfere with C.
+      ./unwindlib.patch
+      # https://reviews.llvm.org/D51899
+      ./compiler-rt-baremetal.patch
+      # make clang -xhip use $PATH to find executables
+      ./HIP-use-PATH-8.patch
+      ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-6-10-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
+    ];
+
+    postPatch = ''
+      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+             lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace tools/extra/clangd/CMakeLists.txt \
+        --replace "NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB" FALSE
+    '';
+
+    outputs = [ "out" "lib" "dev" "python" ];
+
+    postInstall = ''
+      ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+      substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang."
+
+      mkdir -p $python/bin $python/share/{clang,scan-view}
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
+      rm $out/bin/c-index-test
+      patchShebangs $python/bin
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
+    '';
+
+    passthru = {
+      inherit libllvm;
+      isClang = true;
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
+    };
+
+    meta = llvm_meta // {
+      homepage = "https://clang.llvm.org/";
+      description = "A C language family frontend for LLVM";
+      longDescription = ''
+        The Clang project provides a language front-end and tooling
+        infrastructure for languages in the C language family (C, C++, Objective
+        C/C++, OpenCL, CUDA, and RenderScript) for the LLVM project.
+        It aims to deliver amazingly fast compiles, extremely useful error and
+        warning messages and to provide a platform for building great source
+        level tools. The Clang Static Analyzer and clang-tidy are tools that
+        automatically find bugs in your code, and are great examples of the sort
+        of tools that can be built using the Clang frontend as a library to
+        parse C/C++ code.
+      '';
+      mainProgram = "clang";
+    };
+  } // lib.optionalAttrs enableManpages {
+    pname = "clang-manpages";
+
+    buildPhase = ''
+      make docs-clang-man
+    '';
+
+    installPhase = ''
+      mkdir -p $out/share/man/man1
+      # Manually install clang manpage
+      cp docs/man/*.1 $out/share/man/man1/
+    '';
+
+    outputs = [ "out" ];
+
+    doCheck = false;
+
+    meta = llvm_meta // {
+      description = "man page for Clang ${version}";
+    };
+  });
+in self

pkgs/development/compilers/llvm/9/clang/default.nix

···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/git/clang/default.nix

···
 }:
 
 let
-  self = stdenv.mkDerivation (rec {
+  self = stdenv.mkDerivation (finalAttrs: rec {
     pname = "clang";
     inherit version;
 
···
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [
+        "fortify3"
+      ];
+      hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
+        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/odin/default.nix

···
     cp odin $out/bin/odin
 
     mkdir -p $out/share
+    cp -r base $out/share/base
     cp -r core $out/share/core
     cp -r vendor $out/share/vendor
 

pkgs/development/compilers/zulu/11.nix

···
   # Note that the latest build may differ by platform
   dists = {
     x86_64-linux = {
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
+      zuluVersion = "11.70.15";
+      jdkVersion = "11.0.22";
       hash =
-        if enableJavaFX then "sha256-CjWtqnirEDrpF61WXm/Yi372IzhpTpi+/AfEqirlZnc="
-        else "sha256-o0tAT4egimEUizjhQW2DcYnh33oEDZSedDYz2vRpWjw=";
+        if enableJavaFX then "sha256-FxTHgng7/oDY3n3qy8j1ztbpBQeoGcEBJbEXqaE4Zr4="
+        else "sha256-V41ZRrJtkle3joKhwoID5bvWkN5I4gFjmbEnTD7no8U=";
     };
 
     aarch64-linux = {
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
+      zuluVersion = "11.70.15";
+      jdkVersion = "11.0.22";
       hash =
         if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
-        else "sha256-VBdEOfKz/d0R8QSMOX/nu0XUydZtRS1oibAT0E0hxN4=";
+        else "sha256-u6XWMXAArUhMMb6j3KFOhkIxpVYR1oYLF0Wde7/tI0k=";
     };
 
     x86_64-darwin = {
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
+      zuluVersion = "11.70.15";
+      jdkVersion = "11.0.22";
       hash =
-        if enableJavaFX then "sha256-pVgCJkgYTlFeL7nkkMWLeJ/J8ELhgvWb7gzf3erZP7Y="
-        else "sha256-vKqxHP5Yb651g8bZ0xHGQ4Q1T7JjjrmgEuykw/Gh2f0=";
+        if enableJavaFX then "sha256-JkJZwk+D28wHWqwUoLo7WW5ypwTrT5biSoP+70YI3eQ="
+        else "sha256-ca/ttkPe2tbcm1ruguDgPsxKWbEdKcICsKCDXaup9N4=";
     };
 
     aarch64-darwin = {
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
+      zuluVersion = "11.70.15";
+      jdkVersion = "11.0.22";
       hash =
-        if enableJavaFX then "sha256-VoZo34SCUU+HHnTl6iLe0QBC+4VDkPP14N98oqSg9EQ="
-        else "sha256-djK8Kfikt9SSuT87x1p7YWMIlNuF0TZFYDWrKiTTiIU=";
+        if enableJavaFX then "sha256-bAgH4lCxPvvFOeif5gI2aoLt1aC4EXPzb2YmiS9bQsU="
+        else "sha256-PWQOF+P9djZarjAJaE3I0tuI1E4H/9584VN04BMzmvM=";
     };
   };
 } // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/8.nix

···
   # Note that the latest build may differ by platform
   dists = {
     x86_64-linux = {
-      zuluVersion = "8.72.0.17";
-      jdkVersion = "8.0.382";
+      zuluVersion = "8.76.0.17";
+      jdkVersion = "8.0.402";
       hash =
-        if enableJavaFX then "sha256-mIPCFESU7hy2naYur2jvFBtVn/LZQRcFiyiG61buCYs="
-        else "sha256-exWlbyrgBb7aD4daJps9qtFP+hKWkwbMdFR4OFslupY=";
+        if enableJavaFX then "sha256-29aDAu8WVYQFSpMUFq4gG64BBz/ei/VDMg72xrpB9w4="
+        else "sha256-34DI6O7T8iqDHsX63S3xk+BKDu8IHRRWNvtxpsnUJEk=";
+    };
+
+    aarch64-linux = {
+      zuluVersion = "8.74.0.17";
+      jdkVersion = "8.0.392";
+      hash =
+        if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
+        else "sha256-xESdKEmfkiE657X/xclwsJR5M+P72BpWErtAcYMcK0Y=";
     };
 
     x86_64-darwin = {
-      zuluVersion = "8.72.0.17";
-      jdkVersion = "8.0.382";
+      zuluVersion = "8.76.0.17";
+      jdkVersion = "8.0.402";
       hash =
-        if enableJavaFX then "sha256-/x8FqygivzddXsOwIV8aj/u+LPXMmokgu97vLAVEv80="
-        else "sha256-3dTPIPGUeT6nb3gncNvEa4VTRyQIBJpp8oZadrT2ToE=";
+        if enableJavaFX then "sha256-oqFpKeWwfiXr3oX78LGvAyDGAAS2GON2gAm6fHGH7Ow="
+        else "sha256-edZqDEsydQCDEwC1ZCDF/MjWVTnuQNWcKR2k/RjaIEI=";
     };
 
     aarch64-darwin = {
-      zuluVersion = "8.72.0.17";
-      jdkVersion = "8.0.382";
+      zuluVersion = "8.76.0.17";
+      jdkVersion = "8.0.402";
       hash =
-        if enableJavaFX then "sha256-FkQ+0MzSZWUzc/HmiDVZEHGOrdKAVCdK5pm9wXXzzaU="
-        else "sha256-rN5AI4xAWppE4kJlzMod0JmGyHdHjTXYtx8/wOW6CFk=";
+        if enableJavaFX then "sha256-UCWRXCz4v381IWzWPDYzwJwbhsmZOYxKPLGJBQGjPmc="
+        else "sha256-0VPlOuNB39gDnU+pK0DGTSUjTHTtYoxaRg3YD2LyLXg=";
     };
   };
 } // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/coq-modules/mathcomp-analysis/default.nix

···
   repo  = "analysis";
   owner = "math-comp";
 
+  release."1.0.0".sha256 = "sha256-KiXyaWB4zQ3NuXadq4BSWfoN1cIo1xiLVSN6nW03tC4=";
+  release."0.7.0".sha256 = "sha256-JwkyetXrFsFHqz8KY3QBpHsrkhmEFnrCGuKztcoen60=";
+  release."0.6.7".sha256 = "sha256-3i2PBMEwihwgwUmnS0cmrZ8s+aLPFVq/vo0aXMUaUyA=";
   release."0.6.6".sha256 = "sha256-tWtv6yeB5/vzwpKZINK9OQ0yQsvD8qu9zVSNHvLMX5Y=";
   release."0.6.5".sha256 = "sha256-oJk9/Jl1SWra2aFAXRAVfX7ZUaDfajqdDksYaW8dv8E=";
   release."0.6.1".sha256 = "sha256-1VyNXu11/pDMuH4DmFYSUF/qZ4Bo+/Zl3Y0JkyrH/r0=";
···
   release."0.2.3".sha256 = "0p9mr8g1qma6h10qf7014dv98ln90dfkwn76ynagpww7qap8s966";
 
   defaultVersion = with versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (isGe "8.17") (range "1.15.0" "1.18.0") ];     out = "0.6.6"; }
-      { cases = [ (isGe "8.14") (range "1.15.0" "1.17.0") ];     out = "0.6.5"; }
-      { cases = [ (isGe "8.14") (range "1.13.0" "1.16.0") ];     out = "0.6.1"; }
-      { cases = [ (isGe "8.14") (range "1.13" "1.15") ];         out = "0.5.2"; }
+      { cases = [ (range "8.17" "8.19") (range "2.0.0" "2.2.0") ]; out = "1.0.0"; }
+      { cases = [ (range "8.17" "8.19") (range "1.17.0" "1.19.0") ]; out = "0.7.0"; }
+      { cases = [ (range "8.17" "8.18") (range "1.15.0" "1.18.0") ]; out = "0.6.7"; }
+      { cases = [ (range "8.17" "8.18") (range "1.15.0" "1.18.0") ]; out = "0.6.6"; }
+      { cases = [ (range "8.14" "8.18") (range "1.15.0" "1.17.0") ]; out = "0.6.5"; }
+      { cases = [ (range "8.14" "8.18") (range "1.13.0" "1.16.0") ]; out = "0.6.1"; }
+      { cases = [ (range "8.14" "8.18") (range "1.13" "1.15") ]; out = "0.5.2"; }
       { cases = [ (range "8.13" "8.15") (range "1.13" "1.14") ]; out = "0.5.1"; }
       { cases = [ (range "8.13" "8.15") (range "1.12" "1.14") ]; out = "0.3.13"; }
       { cases = [ (range "8.11" "8.14") (range "1.12" "1.13") ]; out = "0.3.10"; }

pkgs/development/coq-modules/mathcomp-infotheo/default.nix

···
-{ coq, mkCoqDerivation, mathcomp-analysis, lib, version ? null }:
+{ coq, mkCoqDerivation, mathcomp-analysis, mathcomp-algebra-tactics, lib, version ? null }:
 
-mkCoqDerivation {
+(mkCoqDerivation {
   namePrefix = [ "coq" "mathcomp" ];
   pname = "infotheo";
   owner = "affeldt-aist";
   inherit version;
+
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp-analysis.version] [
-    { cases = [ (isGe "8.17") (isGe "0.6.0") ];                  out = "0.5.2"; }
+    { cases = [ (isGe "8.17") (range "0.6.6" "0.7.0") ];         out = "0.6.1"; }
+    { cases = [ (range "8.17" "8.18") (range "0.6.0" "0.6.7") ]; out = "0.5.2"; }
     { cases = [ (range "8.15" "8.16") (range "0.5.4" "0.6.5") ]; out = "0.5.1"; }
   ] null;
+  release."0.6.1".sha256 = "sha256-tFB5lrwRPIlHkP+ebgcJwu03Cc9yVaOINOAo8Bf2LT4=";
   release."0.5.1".sha256 = "sha256-yBBl5l+V+dggsg5KM59Yo9CULKog/xxE8vrW+ZRnX7Y=";
   release."0.5.2".sha256 = "sha256-8WAnAV53c0pMTdwj8XcUDUkLZbpUgIQbEOgOb63uHQA=";
 
···
     description = "A Coq formalization of information theory and linear error-correcting codes";
     license = licenses.lgpl21Plus;
   };
-}
+}).overrideAttrs (o: {
+  propagatedBuildInputs = o.propagatedBuildInputs
+  ++ lib.optional (lib.versions.isGe "0.6.1" o.version || o.version == "dev") mathcomp-algebra-tactics;
+})

pkgs/development/embedded/espflash/default.nix

···
-{ lib
-, rustPlatform
-, fetchCrate
-, pkg-config
-, stdenv
-, udev
-, Security
-, SystemConfiguration
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "espflash";
-  version = "2.1.0";
-
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-Gd+8pA36mO+BCA0EFshboBi0etNjsiQFQU1wBYf/o6I=";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = lib.optionals stdenv.isLinux [
-    udev
-  ] ++ lib.optionals stdenv.isDarwin [
-    Security
-    SystemConfiguration
-  ];
-
-  cargoHash = "sha256-IObAbsyrVBXt5zldirRezU7vS3R3aUihMFy2yIRWIlk=";
-
-  meta = with lib; {
-    description = "Serial flasher utility for Espressif SoCs and modules";
-    homepage = "https://github.com/esp-rs/espflash";
-    changelog = "https://github.com/esp-rs/espflash/blob/v${version}/CHANGELOG.md";
-    mainProgram = "espflash";
-    license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ newam ];
-  };
-}

pkgs/development/interpreters/erlang/26.nix

···
 { mkDerivation }:
 
 mkDerivation {
-  version = "26.2.1";
-  sha256 = "sha256-4aQ4YTeiT32lZ9ZFi7/vV7O4fARYVLbGLtHm5alSDyw=";
+  version = "26.2.2";
+  sha256 = "sha256-7S+mC4pDcbXyhW2r5y8+VcX9JQXq5iEUJZiFmgVMPZ0=";
 }

pkgs/development/interpreters/python/cpython/3.10/asyncio-deprecation.patch

···
-REVERT https://github.com/python/cpython/commit/300d812fd1c4d9244e71de0d228cc72439d312a7
---- b/Doc/library/asyncio-eventloop.rst
-+++ a/Doc/library/asyncio-eventloop.rst
-@@ -43,12 +43,10 @@
- 
-    Get the current event loop.
- 
-+   If there is no current event loop set in the current OS thread,
-+   the OS thread is main, and :func:`set_event_loop` has not yet
-+   been called, asyncio will create a new event loop and set it as the
-+   current one.
--   When called from a coroutine or a callback (e.g. scheduled with
--   call_soon or similar API), this function will always return the
--   running event loop.
--
--   If there is no running event loop set, the function will return
--   the result of ``get_event_loop_policy().get_event_loop()`` call.
- 
-    Because this function has rather complex behavior (especially
-    when custom event loop policies are in use), using the
-@@ -60,14 +58,10 @@
-    event loop.
- 
-    .. deprecated:: 3.10
-+      Emits a deprecation warning if there is no running event loop.
-+      In future Python releases, this function may become an alias of
-+      :func:`get_running_loop` and will accordingly raise a
-+      :exc:`RuntimeError` if there is no running event loop.
--      Deprecation warning is emitted if there is no current event loop.
--      In Python 3.12 it will be an error.
--
--   .. note::
--      In Python versions 3.10.0--3.10.8 this function
--      (and other functions which used it implicitly) emitted a
--      :exc:`DeprecationWarning` if there was no running event loop, even if
--      the current loop was set.
- 
- .. function:: set_event_loop(loop)
- 
-reverted:
---- b/Doc/library/asyncio-llapi-index.rst
-+++ a/Doc/library/asyncio-llapi-index.rst
-@@ -19,7 +19,7 @@
-       - The **preferred** function to get the running event loop.
- 
-     * - :func:`asyncio.get_event_loop`
-+      - Get an event loop instance (current or via the policy).
--      - Get an event loop instance (running or current via the current policy).
- 
-     * - :func:`asyncio.set_event_loop`
-       - Set the event loop as current via the current policy.
-reverted:
---- b/Doc/library/asyncio-policy.rst
-+++ a/Doc/library/asyncio-policy.rst
-@@ -112,11 +112,6 @@
- 
-       On Windows, :class:`ProactorEventLoop` is now used by default.
- 
--   .. deprecated:: 3.10.9
--      :meth:`get_event_loop` now emits a :exc:`DeprecationWarning` if there
--      is no current event loop set and a new event loop has been implicitly
--      created. In Python 3.12 it will be an error.
--
- 
- .. class:: WindowsSelectorEventLoopPolicy
- 
-reverted:
---- b/Lib/asyncio/events.py
-+++ a/Lib/asyncio/events.py
-@@ -650,21 +650,6 @@
-         if (self._local._loop is None and
-                 not self._local._set_called and
-                 threading.current_thread() is threading.main_thread()):
--            stacklevel = 2
--            try:
--                f = sys._getframe(1)
--            except AttributeError:
--                pass
--            else:
--                while f:
--                    module = f.f_globals.get('__name__')
--                    if not (module == 'asyncio' or module.startswith('asyncio.')):
--                        break
--                    f = f.f_back
--                    stacklevel += 1
--            import warnings
--            warnings.warn('There is no current event loop',
--                          DeprecationWarning, stacklevel=stacklevel)
-             self.set_event_loop(self.new_event_loop())
- 
-         if self._local._loop is None:
-@@ -778,13 +763,12 @@
- 
- 
- def _get_event_loop(stacklevel=3):
--    # This internal method is going away in Python 3.12, left here only for
--    # backwards compatibility with 3.10.0 - 3.10.8 and 3.11.0.
--    # Similarly, this method's C equivalent in _asyncio is going away as well.
--    # See GH-99949 for more details.
-     current_loop = _get_running_loop()
-     if current_loop is not None:
-         return current_loop
-+    import warnings
-+    warnings.warn('There is no current event loop',
-+                  DeprecationWarning, stacklevel=stacklevel)
-     return get_event_loop_policy().get_event_loop()
- 
- 
-reverted:
---- b/Lib/test/test_asyncio/test_base_events.py
-+++ a/Lib/test/test_asyncio/test_base_events.py
-@@ -752,7 +752,7 @@
-     def test_env_var_debug(self):
-         code = '\n'.join((
-             'import asyncio',
-+            'loop = asyncio.get_event_loop()',
--            'loop = asyncio.new_event_loop()',
-             'print(loop.get_debug())'))
- 
-         # Test with -E to not fail if the unit test was run with
-reverted:
---- b/Lib/test/test_asyncio/test_events.py
-+++ a/Lib/test/test_asyncio/test_events.py
-@@ -2561,9 +2561,8 @@
-     def test_get_event_loop(self):
-         policy = asyncio.DefaultEventLoopPolicy()
-         self.assertIsNone(policy._local._loop)
-+
-+        loop = policy.get_event_loop()
--        with self.assertWarns(DeprecationWarning) as cm:
--            loop = policy.get_event_loop()
--        self.assertEqual(cm.filename, __file__)
-         self.assertIsInstance(loop, asyncio.AbstractEventLoop)
- 
-         self.assertIs(policy._local._loop, loop)
-@@ -2577,10 +2576,7 @@
-                 policy, "set_event_loop",
-                 wraps=policy.set_event_loop) as m_set_event_loop:
- 
-+            loop = policy.get_event_loop()
--            with self.assertWarns(DeprecationWarning) as cm:
--                loop = policy.get_event_loop()
--            self.addCleanup(loop.close)
--            self.assertEqual(cm.filename, __file__)
- 
-             # policy._local._loop must be set through .set_event_loop()
-             # (the unix DefaultEventLoopPolicy needs this call to attach
-@@ -2614,8 +2610,7 @@
- 
-     def test_set_event_loop(self):
-         policy = asyncio.DefaultEventLoopPolicy()
-+        old_loop = policy.get_event_loop()
--        old_loop = policy.new_event_loop()
--        policy.set_event_loop(old_loop)
- 
-         self.assertRaises(AssertionError, policy.set_event_loop, object())
- 
-@@ -2728,11 +2723,15 @@
-             asyncio.set_event_loop_policy(Policy())
-             loop = asyncio.new_event_loop()
- 
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaises(TestError):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaises(TestError):
--                asyncio.get_event_loop()
-             asyncio.set_event_loop(None)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaises(TestError):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaises(TestError):
--                asyncio.get_event_loop()
- 
-             with self.assertRaisesRegex(RuntimeError, 'no running'):
-                 asyncio.get_running_loop()
-@@ -2746,11 +2745,16 @@
-             loop.run_until_complete(func())
- 
-             asyncio.set_event_loop(loop)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaises(TestError):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
-+
--            with self.assertRaises(TestError):
--                asyncio.get_event_loop()
-             asyncio.set_event_loop(None)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaises(TestError):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaises(TestError):
--                asyncio.get_event_loop()
- 
-         finally:
-             asyncio.set_event_loop_policy(old_policy)
-@@ -2774,8 +2778,10 @@
-             self.addCleanup(loop2.close)
-             self.assertEqual(cm.warnings[0].filename, __file__)
-             asyncio.set_event_loop(None)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaisesRegex(RuntimeError, 'no current'):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaisesRegex(RuntimeError, 'no current'):
--                asyncio.get_event_loop()
- 
-             with self.assertRaisesRegex(RuntimeError, 'no running'):
-                 asyncio.get_running_loop()
-@@ -2789,11 +2795,15 @@
-             loop.run_until_complete(func())
- 
-             asyncio.set_event_loop(loop)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                self.assertIs(asyncio.get_event_loop(), loop)
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            self.assertIs(asyncio.get_event_loop(), loop)
- 
-             asyncio.set_event_loop(None)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaisesRegex(RuntimeError, 'no current'):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaisesRegex(RuntimeError, 'no current'):
--                asyncio.get_event_loop()
- 
-         finally:
-             asyncio.set_event_loop_policy(old_policy)
-reverted:
---- b/Lib/test/test_asyncio/test_futures.py
-+++ a/Lib/test/test_asyncio/test_futures.py
-@@ -145,8 +145,10 @@
-         self.assertTrue(f.cancelled())
- 
-     def test_constructor_without_loop(self):
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                self._new_future()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            self._new_future()
- 
-     def test_constructor_use_running_loop(self):
-         async def test():
-@@ -156,10 +158,12 @@
-         self.assertIs(f.get_loop(), self.loop)
- 
-     def test_constructor_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10, undeprecated in 3.11.1
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            f = self._new_future()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        f = self._new_future()
-         self.assertIs(f._loop, self.loop)
-         self.assertIs(f.get_loop(), self.loop)
- 
-@@ -495,8 +499,10 @@
-             return (arg, threading.get_ident())
-         ex = concurrent.futures.ThreadPoolExecutor(1)
-         f1 = ex.submit(run, 'oi')
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaises(RuntimeError):
-+                asyncio.wrap_future(f1)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.wrap_future(f1)
-         ex.shutdown(wait=True)
- 
-     def test_wrap_future_use_running_loop(self):
-@@ -511,14 +517,16 @@
-         ex.shutdown(wait=True)
- 
-     def test_wrap_future_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10, undeprecated in 3.11.1
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-         def run(arg):
-             return (arg, threading.get_ident())
-         ex = concurrent.futures.ThreadPoolExecutor(1)
-         f1 = ex.submit(run, 'oi')
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            f2 = asyncio.wrap_future(f1)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        f2 = asyncio.wrap_future(f1)
-         self.assertIs(self.loop, f2._loop)
-         ex.shutdown(wait=True)
- 
-reverted:
---- b/Lib/test/test_asyncio/test_streams.py
-+++ a/Lib/test/test_asyncio/test_streams.py
-@@ -747,8 +747,10 @@
-         self.assertEqual(data, b'data')
- 
-     def test_streamreader_constructor_without_loop(self):
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.StreamReader()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.StreamReader()
- 
-     def test_streamreader_constructor_use_running_loop(self):
-         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
-@@ -762,17 +764,21 @@
-     def test_streamreader_constructor_use_global_loop(self):
-         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
-         # retrieves the current loop if the loop parameter is not set
-+        # Deprecated in 3.10
--        # Deprecated in 3.10, undeprecated in 3.11.1
-         self.addCleanup(asyncio.set_event_loop, None)
-         asyncio.set_event_loop(self.loop)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            reader = asyncio.StreamReader()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        reader = asyncio.StreamReader()
-         self.assertIs(reader._loop, self.loop)
- 
- 
-     def test_streamreaderprotocol_constructor_without_loop(self):
-         reader = mock.Mock()
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.StreamReaderProtocol(reader)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.StreamReaderProtocol(reader)
- 
-     def test_streamreaderprotocol_constructor_use_running_loop(self):
-         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
-@@ -786,11 +792,13 @@
-     def test_streamreaderprotocol_constructor_use_global_loop(self):
-         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
-         # retrieves the current loop if the loop parameter is not set
-+        # Deprecated in 3.10
--        # Deprecated in 3.10, undeprecated in 3.11.1
-         self.addCleanup(asyncio.set_event_loop, None)
-         asyncio.set_event_loop(self.loop)
-         reader = mock.Mock()
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            protocol = asyncio.StreamReaderProtocol(reader)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        protocol = asyncio.StreamReaderProtocol(reader)
-         self.assertIs(protocol._loop, self.loop)
- 
-     def test_multiple_drain(self):
-reverted:
---- b/Lib/test/test_asyncio/test_tasks.py
-+++ a/Lib/test/test_asyncio/test_tasks.py
-@@ -210,8 +210,10 @@
- 
-         a = notmuch()
-         self.addCleanup(a.close)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.ensure_future(a)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.ensure_future(a)
- 
-         async def test():
-             return asyncio.ensure_future(notmuch())
-@@ -221,10 +223,12 @@
-         self.assertTrue(t.done())
-         self.assertEqual(t.result(), 'ok')
- 
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            t = asyncio.ensure_future(notmuch())
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        t = asyncio.ensure_future(notmuch())
-         self.assertIs(t._loop, self.loop)
-         self.loop.run_until_complete(t)
-         self.assertTrue(t.done())
-@@ -243,8 +247,10 @@
- 
-         a = notmuch()
-         self.addCleanup(a.close)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.ensure_future(a)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
--            asyncio.ensure_future(a)
- 
-         async def test():
-             return asyncio.ensure_future(notmuch())
-@@ -254,10 +260,12 @@
-         self.assertTrue(t.done())
-         self.assertEqual(t.result(), 'ok')
- 
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            t = asyncio.ensure_future(notmuch())
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        t = asyncio.ensure_future(notmuch())
-         self.assertIs(t._loop, self.loop)
-         self.loop.run_until_complete(t)
-         self.assertTrue(t.done())
-@@ -1480,8 +1488,10 @@
-         self.addCleanup(a.close)
- 
-         futs = asyncio.as_completed([a])
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                list(futs)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            list(futs)
- 
-     def test_as_completed_coroutine_use_running_loop(self):
-         loop = self.new_test_loop()
-@@ -1497,14 +1507,17 @@
-         loop.run_until_complete(test())
- 
-     def test_as_completed_coroutine_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         async def coro():
-             return 42
- 
-         loop = self.new_test_loop()
-         asyncio.set_event_loop(loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        futs = asyncio.as_completed([coro()])
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            futs = list(futs)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        futs = list(asyncio.as_completed([coro()]))
-         self.assertEqual(len(futs), 1)
-         self.assertEqual(loop.run_until_complete(futs[0]), 42)
- 
-@@ -1974,8 +1987,10 @@
- 
-         inner = coro()
-         self.addCleanup(inner.close)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.shield(inner)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.shield(inner)
- 
-     def test_shield_coroutine_use_running_loop(self):
-         async def coro():
-@@ -1989,13 +2004,15 @@
-         self.assertEqual(res, 42)
- 
-     def test_shield_coroutine_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         async def coro():
-             return 42
- 
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            outer = asyncio.shield(coro())
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        outer = asyncio.shield(coro())
-         self.assertEqual(outer._loop, self.loop)
-         res = self.loop.run_until_complete(outer)
-         self.assertEqual(res, 42)
-@@ -2933,7 +2950,7 @@
-         self.assertIsNone(asyncio.current_task(loop=self.loop))
- 
-     def test_current_task_no_running_loop_implicit(self):
-+        with self.assertRaises(RuntimeError):
--        with self.assertRaisesRegex(RuntimeError, 'no running event loop'):
-             asyncio.current_task()
- 
-     def test_current_task_with_implicit_loop(self):
-@@ -3097,8 +3114,10 @@
-         return asyncio.gather(*args, **kwargs)
- 
-     def test_constructor_empty_sequence_without_loop(self):
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaises(RuntimeError):
-+                asyncio.gather()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.gather()
- 
-     def test_constructor_empty_sequence_use_running_loop(self):
-         async def gather():
-@@ -3111,10 +3130,12 @@
-         self.assertEqual(fut.result(), [])
- 
-     def test_constructor_empty_sequence_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         asyncio.set_event_loop(self.one_loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            fut = asyncio.gather()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        fut = asyncio.gather()
-         self.assertIsInstance(fut, asyncio.Future)
-         self.assertIs(fut._loop, self.one_loop)
-         self._run_loop(self.one_loop)
-@@ -3202,8 +3223,10 @@
-         self.addCleanup(gen1.close)
-         gen2 = coro()
-         self.addCleanup(gen2.close)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaises(RuntimeError):
-+                asyncio.gather(gen1, gen2)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.gather(gen1, gen2)
- 
-     def test_constructor_use_running_loop(self):
-         async def coro():
-@@ -3217,14 +3240,16 @@
-         self.one_loop.run_until_complete(fut)
- 
-     def test_constructor_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         async def coro():
-             return 'abc'
-         asyncio.set_event_loop(self.other_loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-         gen1 = coro()
-         gen2 = coro()
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            fut = asyncio.gather(gen1, gen2)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        fut = asyncio.gather(gen1, gen2)
-         self.assertIs(fut._loop, self.other_loop)
-         self.other_loop.run_until_complete(fut)
- 
-reverted:
---- b/Lib/test/test_asyncio/test_unix_events.py
-+++ a/Lib/test/test_asyncio/test_unix_events.py
-@@ -1740,8 +1740,7 @@
- 
-     def test_child_watcher_replace_mainloop_existing(self):
-         policy = self.create_policy()
-+        loop = policy.get_event_loop()
--        loop = policy.new_event_loop()
--        policy.set_event_loop(loop)
- 
-         # Explicitly setup SafeChildWatcher,
-         # default ThreadedChildWatcher has no _loop property
-reverted:
---- b/Lib/test/test_coroutines.py
-+++ a/Lib/test/test_coroutines.py
-@@ -2319,8 +2319,7 @@
-     def test_unawaited_warning_during_shutdown(self):
-         code = ("import asyncio\n"
-                 "async def f(): pass\n"
-+                "asyncio.gather(f())\n")
--                "async def t(): asyncio.gather(f())\n"
--                "asyncio.run(t())\n")
-         assert_python_ok("-c", code)
- 
-         code = ("import sys\n"
-reverted:
---- b/Modules/_asynciomodule.c
-+++ a/Modules/_asynciomodule.c
-@@ -332,6 +332,13 @@
-         return loop;
-     }
- 
-+    if (PyErr_WarnEx(PyExc_DeprecationWarning,
-+                     "There is no current event loop",
-+                     stacklevel))
-+    {
-+        return NULL;
-+    }
-+
-     policy = PyObject_CallNoArgs(asyncio_get_event_loop_policy);
-     if (policy == NULL) {
-         return NULL;
-@@ -3085,11 +3092,6 @@
-     return get_event_loop(1);
- }
- 
--// This internal method is going away in Python 3.12, left here only for
--// backwards compatibility with 3.10.0 - 3.10.8 and 3.11.0.
--// Similarly, this method's Python equivalent in asyncio.events is going
--// away as well.
--// See GH-99949 for more details.
- /*[clinic input]
- _asyncio._get_event_loop
-     stacklevel: int = 3

pkgs/development/interpreters/python/cpython/default.nix

···
-{ lib, stdenv, fetchurl, fetchpatch, fetchgit
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, fetchgit
+
+# build dependencies
+, autoconf-archive
+, autoreconfHook
+, nukeReferences
+, pkg-config
+, python-setup-hook
+
+# runtime dependencies
 , bzip2
 , expat
 , libffi
-, gdbm
-, xz
-, mailcap, mimetypesSupport ? true
+, libxcrypt
+, mpdecimal
 , ncurses
 , openssl
-, openssl_legacy
-, readline
 , sqlite
-, tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
-, bluez ? null, bluezSupport ? false
+, xz
 , zlib
-, tzdata ? null
-, libxcrypt
-, self
+
+# platform-specific dependencies
+, bash
 , configd
 , darwin
 , windows
-, autoreconfHook
-, autoconf-archive
-, pkg-config
-, python-setup-hook
-, nukeReferences
-# For the Python package set
-, packageOverrides ? (self: super: {})
+
+# optional dependencies
+, bluezSupport ? false, bluez
+, mimetypesSupport ? true, mailcap
+, tzdata
+, withGdbm ? !stdenv.hostPlatform.isWindows, gdbm
+, withReadline ? !stdenv.hostPlatform.isWindows, readline
+, x11Support ? false, tcl, tk, tix, libX11, xorgproto
+
+# splicing/cross
+, pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
+, self
 , pkgsBuildBuild
 , pkgsBuildHost
 , pkgsBuildTarget
 , pkgsHostHost
 , pkgsTargetTarget
+
+# build customization
 , sourceVersion
 , hash
 , passthruFun
-, bash
 , stripConfig ? false
 , stripIdlelib ? false
 , stripTests ? false
···
 , includeSiteCustomize ? true
 , static ? stdenv.hostPlatform.isStatic
 , enableFramework ? false
+, noldconfigPatch ? ./. + "/${sourceVersion.major}.${sourceVersion.minor}/no-ldconfig.patch"
+
+# pgo (not reproducible) + -fno-semantic-interposition
+# https://docs.python.org/3/using/configure.html#cmdoption-enable-optimizations
 , enableOptimizations ? false
-# these dont build for windows
-, withGdbm ? !stdenv.hostPlatform.isWindows
-, withReadline ? !stdenv.hostPlatform.isWindows
-# enableNoSemanticInterposition is a subset of the enableOptimizations flag that doesn't harm reproducibility.
-# clang starts supporting `-fno-sematic-interposition` with version 10
-, enableNoSemanticInterposition ? (!stdenv.cc.isClang || (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "10"))
-# enableLTO is a subset of the enableOptimizations flag that doesn't harm reproducibility.
+
+# improves performance, but remains reproducible
+, enableNoSemanticInterposition ? true
+
 # enabling LTO on 32bit arch causes downstream packages to fail when linking
 # enabling LTO on *-darwin causes python3 to fail when linking.
 , enableLTO ? stdenv.is64bit && stdenv.isLinux
+
+# enable asserts to ensure the build remains reproducible
 , reproducibleBuild ? false
-, pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
-, noldconfigPatch ? ./. + "/${sourceVersion.major}.${sourceVersion.minor}/no-ldconfig.patch"
+
+# for the Python package set
+, packageOverrides ? (self: super: {})
+
+# tests
 , testers
+
 } @ inputs:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
···
 
 assert bluezSupport -> bluez != null;
 
-assert enableFramework -> stdenv.isDarwin;
+assert lib.assertMsg (bluezSupport -> stdenv.isLinux)
+  "Bluez support is only available on Linux.";
+
+assert lib.assertMsg (enableFramework -> stdenv.isDarwin)
+  "Framework builds are only supported on Darwin.";
 
 assert lib.assertMsg (reproducibleBuild -> stripBytecode)
   "Deterministic builds require stripping bytecode.";
···
 assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
   "Deterministic builds are not achieved when (default unoptimized) bytecode is created.";
 
-with lib;
-
 let
-  # some python packages need legacy ciphers, so we're using openssl 3, but with that config
-  # null check for Minimal
-  openssl' = if openssl != null then openssl_legacy else null;
+  inherit (lib)
+    concatMapStringsSep
+    concatStringsSep
+    getDev
+    getLib
+    optionals
+    optionalString
+    replaceStrings
+    versionOlder
+  ;
 
   buildPackages = pkgsBuildHost;
   inherit (passthru) pythonOnBuildForHost;
-
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
 
   tzdataSupport = tzdata != null && passthru.pythonAtLeast "3.9";
 
···
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
-  nativeBuildInputs = optionals (!stdenv.isDarwin) [
+  nativeBuildInputs = [
+    nukeReferences
+  ] ++ optionals (!stdenv.isDarwin) [
+    autoconf-archive # needed for AX_CHECK_COMPILE_FLAG
     autoreconfHook
     pkg-config
-    autoconf-archive # needed for AX_CHECK_COMPILE_FLAG
-  ] ++ [
-    nukeReferences
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     buildPackages.stdenv.cc
     pythonOnBuildForHost
···
     stdenv.cc.cc.libllvm.out
   ];
 
-  buildInputs = filter (p: p != null) ([
-    zlib bzip2 expat xz libffi libxcrypt ]
-    ++ optional withGdbm gdbm
-    ++ [ sqlite ]
-    ++ optional withReadline readline
-    ++ [ ncurses openssl' ]
-    ++ optionals x11Support [ tcl tk libX11 xorgproto ]
-    ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
-    ++ optionals stdenv.isDarwin [ configd ])
-
-    ++ optionals enableFramework [ Cocoa ]
-    ++ optionals stdenv.hostPlatform.isMinGW [ windows.mingw_w64_pthreads windows.dlfcn ]
-    ++ optionals tzdataSupport [ tzdata ];  # `zoneinfo` module
+  buildInputs = lib.filter (p: p != null) ([
+    bzip2
+    expat
+    libffi
+    libxcrypt
+    mpdecimal
+    ncurses
+    openssl
+    sqlite
+    xz
+    zlib
+  ] ++ optionals bluezSupport [
+    bluez
+  ] ++ optionals enableFramework [
+    darwin.apple_sdk.frameworks.Cocoa
+  ] ++ optionals stdenv.hostPlatform.isMinGW [
+    windows.dlfcn
+    windows.mingw_w64_pthreads
+  ] ++ optionals stdenv.isDarwin [
+    configd
+  ] ++ optionals tzdataSupport [
+    tzdata
+  ] ++ optionals withGdbm [
+    gdbm
+  ] ++ optionals withReadline [
+    readline
+  ] ++ optionals x11Support [
+    libX11
+    tcl
+    tk
+    xorgproto
+  ]);
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
 
···
       pythonAbi = nixpkgsPythonAbiMappings.${parsed.abi.name} or parsed.abi.name;
     in
       # Python <3.11 doesn't distinguish musl and glibc and always prefixes with "gnu"
-      if lib.versionOlder version "3.11" then
+      if versionOlder version "3.11" then
         replaceStrings [ "musl" ] [ "gnu" ] pythonAbi
       else
         pythonAbi;
···
   inherit src version;
 
   inherit nativeBuildInputs;
-  buildInputs = lib.optionals (!stdenv.hostPlatform.isWindows) [ bash ] ++ buildInputs; # bash is only used for patchShebangs
-
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isWindows) [
+    bash # only required for patchShebangs
+  ] ++ buildInputs;
 
   prePatch = optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace '`/usr/bin/arch`' '"i386"'
+    substituteInPlace configure --replace-fail '`/usr/bin/arch`' '"i386"'
   '' + optionalString (pythonOlder "3.9" && stdenv.isDarwin && x11Support) ''
     # Broken on >= 3.9; replaced with ./3.9/darwin-tcl-tk.patch
-    substituteInPlace setup.py --replace /Library/Frameworks /no-such-path
+    substituteInPlace setup.py --replace-fail /Library/Frameworks /no-such-path
   '';
 
-  patches = optionals (version == "3.10.9") [
-    # https://github.com/python/cpython/issues/100160
-    ./3.10/asyncio-deprecation.patch
-  ] ++ optionals (version == "3.11.1") [
-    # https://github.com/python/cpython/issues/100160
-    (fetchpatch {
-      name = "asyncio-deprecation-3.11.patch";
-      url = "https://github.com/python/cpython/commit/3fae04b10e2655a20a3aadb5e0d63e87206d0c67.diff";
-      revert = true;
-      excludes = [ "Misc/NEWS.d/*" ];
-      hash = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
-    })
-  ] ++ [
+  patches = [
     # Disable the use of ldconfig in ctypes.util.find_library (since
     # ldconfig doesn't work on NixOS), and don't use
     # ctypes.util.find_library during the loading of the uuid module
···
   ] ++ optionals (pythonAtLeast "3.9" && pythonOlder "3.11" && stdenv.isDarwin) [
     # Stop checking for TCL/TK in global macOS locations
     ./3.9/darwin-tcl-tk.patch
-  ] ++ optionals (isPy3k && hasDistutilsCxxPatch && pythonOlder "3.12") [
+  ] ++ optionals (hasDistutilsCxxPatch && pythonOlder "3.12") [
     # Fix for http://bugs.python.org/issue1222585
     # Upstream distutils is calling C compiler to compile C++ code, which
     # only works for GCC and Apple Clang. This makes distutils to call C++
···
 
   postPatch = optionalString (!stdenv.hostPlatform.isWindows) ''
     substituteInPlace Lib/subprocess.py \
-      --replace "'/bin/sh'" "'${bash}/bin/sh'"
+      --replace-fail "'/bin/sh'" "'${bash}/bin/sh'"
   '' + optionalString mimetypesSupport ''
     substituteInPlace Lib/mimetypes.py \
-      --replace "@mime-types@" "${mailcap}"
+      --replace-fail "@mime-types@" "${mailcap}"
   '' + optionalString (pythonOlder "3.13" && x11Support && (tix != null)) ''
-    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+    substituteInPlace "Lib/tkinter/tix.py" --replace-fail \
+      "os.environ.get('TIX_LIBRARY')" \
+      "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
   '';
 
   env = {
···
     PYTHONHASHSEED=0;
   };
 
+  # https://docs.python.org/3/using/configure.html
   configureFlags = [
     "--without-ensurepip"
     "--with-system-expat"
-    "--with-system-ffi"
+  ] ++ optionals (!(stdenv.isDarwin && pythonAtLeast "3.12")) [
+    #  ./Modules/_decimal/_decimal.c:4673:6: error: "No valid combination of CONFIG_64, CONFIG_32 and _PyHASH_BITS"
+    # https://hydra.nixos.org/build/248410479/nixlog/2/tail
+    "--with-system-libmpdec"
+  ] ++ optionals (openssl != null) [
+    "--with-openssl=${openssl.dev}"
+  ] ++ optionals tzdataSupport [
+    "--with-tzpath=${tzdata}/share/zoneinfo"
+  ] ++ optionals (execSuffix != "") [
+    "--with-suffix=${execSuffix}"
+  ] ++ optionals enableLTO [
+    "--with-lto"
   ] ++ optionals (!static && !enableFramework) [
     "--enable-shared"
   ] ++ optionals enableFramework [
     "--enable-framework=${placeholder "out"}/Library/Frameworks"
   ] ++ optionals enableOptimizations [
     "--enable-optimizations"
-  ] ++ optionals enableLTO [
-    "--with-lto"
-  ] ++ optionals (pythonOlder "3.7") [
-    # This is unconditionally true starting in CPython 3.7.
-    "--with-threads"
-  ] ++ optionals (sqlite != null && isPy3k) [
+  ] ++ optionals (sqlite != null) [
     "--enable-loadable-sqlite-extensions"
-  ] ++ optionals (openssl' != null) [
-    "--with-openssl=${openssl'.dev}"
   ] ++ optionals (libxcrypt != null) [
     "CFLAGS=-I${libxcrypt}/include"
     "LIBS=-L${libxcrypt}/lib"
···
     # Never even try to use lchmod on linux,
     # don't rely on detecting glibc-isms.
     "ac_cv_func_lchmod=no"
-  ] ++ optionals tzdataSupport [
-    "--with-tzpath=${tzdata}/share/zoneinfo"
-  ] ++ optional static "LDFLAGS=-static"
-  ++ optional (execSuffix != "") "--with-suffix=${execSuffix}";
+  ] ++ optionals static [
+    "LDFLAGS=-static"
+  ];
 
   preConfigure = optionalString (pythonOlder "3.12") ''
-    for i in /usr /sw /opt /pkg; do	# improve purity
-      substituteInPlace ./setup.py --replace $i /no-such-path
+    # Improve purity
+    for path in /usr /sw /opt /pkg; do
+      substituteInPlace ./setup.py --replace-warn $path /no-such-path
     done
   '' + optionalString stdenv.isDarwin ''
     # Override the auto-detection in setup.py, which assumes a universal build
···
   '' + optionalString (stdenv.isDarwin && x11Support && pythonAtLeast "3.11") ''
     export TCLTK_LIBS="-L${tcl}/lib -L${tk}/lib -l${tcl.libPrefix} -l${tk.libPrefix}"
     export TCLTK_CFLAGS="-I${tcl}/include -I${tk}/include"
-  '' + optionalString (isPy3k && pythonOlder "3.7") ''
-    # Determinism: The interpreter is patched to write null timestamps when compiling Python files
-    #   so Python doesn't try to update the bytecode when seeing frozen timestamps in Nix's store.
-    export DETERMINISTIC_BUILD=1;
   '' + optionalString stdenv.hostPlatform.isMusl ''
     export NIX_CFLAGS_COMPILE+=" -DTHREAD_STACK_SIZE=0x100000"
   '' +
···
     # This allows build Python to import host Python's sysconfigdata
     mkdir -p "$out/${sitePackages}"
     ln -s "$out/lib/${libPrefix}/"_sysconfigdata*.py "$out/${sitePackages}/"
-    '' + lib.optionalString (pythonOlder "3.8") ''
-    # This is gone in Python >= 3.8
-    ln -s "$out/include/${executable}m" "$out/include/${executable}"
     '' + optionalString stripConfig ''
     rm -R $out/bin/python*-config $out/lib/python*/config-*
     '' + optionalString stripIdlelib ''
···
     '' + optionalString includeSiteCustomize ''
     # Include a sitecustomize.py file
     cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
-
     '' + optionalString stripBytecode ''
     # Determinism: deterministic bytecode
     # First we delete all old bytecode.
···
 
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
-  disallowedReferences =
-    lib.optionals (openssl' != null && !static && !enableFramework) [ openssl'.dev ]
-    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  disallowedReferences = lib.optionals (openssl != null && !static && !enableFramework) [
+    openssl.dev
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # Ensure we don't have references to build-time packages.
     # These typically end up in shebangs.
     pythonOnBuildForHost buildPackages.bash
···
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with lib; {
     homepage = "https://www.python.org";
     changelog = let
-      majorMinor = lib.versions.majorMinor version;
-      dashedVersion = lib.replaceStrings [ "." "a" ] [ "-" "-alpha-" ] version;
+      majorMinor = versions.majorMinor version;
+      dashedVersion = replaceStrings [ "." "a" ] [ "-" "-alpha-" ] version;
     in
       if sourceVersion.suffix == "" then
         "https://docs.python.org/release/${version}/whatsnew/changelog.html"

pkgs/development/interpreters/python/default.nix

···
   passthruFun = import ./passthrufun.nix args;
 
   sources = {
-    python310 = {
-      sourceVersion = {
-        major = "3";
-        minor = "10";
-        patch = "13";
-        suffix = "";
-      };
-      hash = "sha256-XIiEhmhkDT4VKzW0U27xwjsspL0slX7x7LsFP1cd0/Y=";
-    };
-
     python311 = {
       sourceVersion = {
         major = "3";
···
     inherit passthruFun;
   };
 
-  python310 = callPackage ./cpython ({
+  python310 = callPackage ./cpython {
     self = __splicedPackages.python310;
+    sourceVersion = {
+      major = "3";
+      minor = "10";
+      patch = "13";
+      suffix = "";
+    };
+    hash = "sha256-XIiEhmhkDT4VKzW0U27xwjsspL0slX7x7LsFP1cd0/Y=";
     inherit (darwin) configd;
     inherit passthruFun;
-  } // sources.python310);
+  };
 
   python311 = callPackage ./cpython ({
     self = __splicedPackages.python311;
···
     readline = null;
     ncurses = null;
     gdbm = null;
-    sqlite = null;
     configd = null;
+    sqlite = null;
     tzdata = null;
     libffi = libffiBoot; # without test suite
     stripConfig = true;

pkgs/development/interpreters/wamr/default.nix

···
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = lib.optionals stdenv.isDarwin [
-    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.targetPlatform.darwinSdkVersion}"
+    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.hostPlatform.darwinSdkVersion}"
   ];
 
   sourceRoot = let

pkgs/development/libraries/acl/LFS64.patch

···
-From 2b42f64737adf6a2ddd491213580d6e9cdd2f5af Mon Sep 17 00:00:00 2001
-From: Khem Raj <[e-mail]>
-Date: Thu, 10 Nov 2022 18:04:15 -0800
-Subject: chacl: Use portable version of dirent and readdir
-
-Using 64bit versions on 32bit architectures should be enabled with
---enable-largefile, this makes it portable across musl and glibc
-
-Signed-off-by: Khem Raj <[e-mail]>
----
- tools/chacl.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/chacl.c b/tools/chacl.c
-index 525a7ff..8fff875 100644
---- a/tools/chacl.c
-+++ b/tools/chacl.c
-@@ -320,7 +320,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
- {
- 	int failed = 0;
- 	DIR *dir;
--	struct dirent64 *d;
-+	struct dirent *d;
- 	char *name;
- 
- 	if ((dir = opendir(fname)) == NULL) {
-@@ -332,7 +332,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
- 		return(0);	/* got a file, not an error */
- 	}
- 
--	while ((d = readdir64(dir)) != NULL) {
-+	while ((d = readdir(dir)) != NULL) {
- 		/* skip "." and ".." entries */
- 		if (strcmp(d->d_name, ".") == 0 || strcmp(d->d_name, "..") == 0)
- 			continue;
--- 
-cgit v1.1
-

pkgs/development/libraries/acl/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "acl";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchurl {
     url = "mirror://savannah/acl/acl-${version}.tar.gz";
-    sha256 = "sha256-dgxhxokBs3/dXu/ur0wMeia9/disdHoe3/HODiQ8Ea8=";
+    hash = "sha256-XyvbrWKXB6p9hcYj+ZSqih0t7FWnPeUgW6wL9gWKL3w=";
   };
-
-  patches = [
-    ./LFS64.patch
-  ];
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ gettext ];
   buildInputs = [ attr ];
 
-  # causes failures in coreutils test suite
-  hardeningDisable = [ "fortify3" ];
-
-  # Upstream use C++-style comments in C code. Remove them.
-  # This comment breaks compilation if too strict gcc flags are used.
   postPatch = ''
-    echo "Removing C++-style comments from include/acl.h"
-    sed -e '/^\/\//d' -i include/acl.h
-
     patchShebangs .
   '';
 

pkgs/development/libraries/armadillo/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "12.6.7";
+  version = "12.8.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-3zIGS99cRxU88YCzwgEsihlKB+6JJlSmkUtIb/8s+mk=";
+    hash = "sha256-qJu2/s5c6f3R0BpLwUXPfMC5OcV3fMpG3mnC9eNBLPA=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/at-spi2-core/default.nix

···
   version = "2.50.0";
 
   outputs = [ "out" "dev" ];
+  separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";

pkgs/development/libraries/attr/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "attr";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchurl {
     url = "mirror://savannah/attr/${pname}-${version}.tar.gz";
-    sha256 = "1y6sibbkrcjygv8naadnsg6xmsqwfh6cwrqk01l0v2i5kfacdqds";
+    sha256 = "sha256-Ob9nRS+kHQlIwhl2AQU/SLPXigKTiXNDMqYwmmgMbIc=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];

pkgs/development/libraries/audio/lilv/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.24.22";
+  version = "0.24.24";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.xz";
-    hash = "sha256-dvlJ0OWfyDNjQJtexeFcEEb7fdZYnTwbkgzsH9Kfn/M=";
+    hash = "sha256-a7a+n4hQQXbQZC8S3oCbK54txVYhporbjH7bma76u08=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config python3 ];

pkgs/development/libraries/boehm-gc/default.nix

···
 { lib
 , stdenv
-, fetchurl
-# doc: https://github.com/ivmai/bdwgc/blob/v8.2.2/doc/README.macros (LARGE_CONFIG)
+, fetchFromGitHub
+, autoreconfHook
+# doc: https://github.com/ivmai/bdwgc/blob/v8.2.4/doc/README.macros (LARGE_CONFIG)
 , enableLargeConfig ? false
 , enableMmap ? true
 , enableStatic ? false
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "boehm-gc";
-  version = "8.2.2";
+  version = "8.2.4";
 
-  src = fetchurl {
-    urls = [
-      # "https://www.hboehm.info/gc/gc_source/gc-${finalAttrs.version}.tar.gz"
-      "https://github.com/ivmai/bdwgc/releases/download/v${finalAttrs.version}/gc-${finalAttrs.version}.tar.gz"
-    ];
-    sha256 = "sha256-8wEHvLBi4JIKeQ//+lbZUSNIVGhZNkwjoUviZLOINqA=";
+  src = fetchFromGitHub {
+    owner = "ivmai";
+    repo = "bdwgc";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-KHijT4BBKfDvTpHpwognN+3ZXoC6JabBTFSYFyOUT9o=";
   };
 
   outputs = [ "out" "dev" "doc" ];
   separateDebugInfo = stdenv.isLinux && stdenv.hostPlatform.libc != "musl";
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
 
   configureFlags = [
     "--enable-cplusplus"
···
   # not fix the problem the test failure will be a reminder to
   # extend the set of versions requiring the workaround).
   makeFlags = lib.optionals (stdenv.hostPlatform.isPower64 &&
-                  finalAttrs.version == "8.2.2")
+                  finalAttrs.version == "8.2.4")
     [
       # do not use /proc primitives to track dirty bits; see:
       # https://github.com/ivmai/bdwgc/issues/479#issuecomment-1279687537

pkgs/development/libraries/chromaprint/default.nix

···
   meta = with lib; {
     homepage = "https://acoustid.org/chromaprint";
     description = "AcoustID audio fingerprinting library";
-    maintainers = with maintainers; [ ehmry ];
     license = licenses.lgpl21Plus;
     platforms = platforms.unix;
   };

pkgs/development/libraries/dav1d/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "dav1d";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "videolan";
     repo = pname;
     rev = version;
-    hash = "sha256-RrEim3HXXjx2RUU7K3wPH3QbhNTRN9ZX/oAcyE9aV8I=";
+    hash = "sha256-c7Dur+0HpteI7KkR9oo3WynoH/FCRaBwZA7bJmPDJp8=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/dbus-cplusplus/default.nix

···
       url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-template-operators.patch";
       hash = "sha256-B8S7z/YH2YEQgaRsBJBBVTx8vHQhHW7z171TZmogpL8=";
     })
-  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
       name = "0001-src-eventloop.cpp-use-portable-method-for-initializi.patch";
       url = "https://github.com/openembedded/meta-openembedded/raw/119e75e48dbf0539b4e440417901458ffff79b38/meta-oe/recipes-core/dbus/libdbus-c++-0.9.0/0001-src-eventloop.cpp-use-portable-method-for-initializi.patch";

pkgs/development/libraries/enchant/2.x.nix

···
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.6.3";
+  version = "2.6.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-wcVxnypZfOPgbJOM+5n7aX2gk96nuFfMAE3B3PG7oYI=";
+    hash = "sha256-no/SjLZae22jVFh4pcL1KhXwPASTOl/0jbif6GhFco4=";
   };
 
   strictDeps = true;

pkgs/development/libraries/exempi/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "exempi";
-  version = "2.6.4";
+  version = "2.6.5";
 
   src = fetchurl {
     url = "https://libopenraw.freedesktop.org/download/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-p1FJyWth45zcsEb9XlbYjP7qtuCPiU4V6//ZlECSv9A=";
+    sha256 = "sha256-6fmj1Cv/c7XrD3fsIs0BY8PiGUnMQUrR8ZoEZd3kH/4=";
   };
 
   configureFlags = [

pkgs/development/libraries/fdk-aac/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "fdk-aac";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/opencore-amr/fdk-aac/${pname}-${version}.tar.gz";
-    sha256 = "sha256-yehjDPnUM/POrXSQahUg0iI/ibzT+pJUhhAXRAuOsi8=";
+    sha256 = "sha256-gptrie7zgkCc2mhX/YKvhPq7Y0F7CO3p6npVP4Ect54=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/ffmpeg/generic.nix

···
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
+, withChromaprint ? withFullDeps # Audio fingerprinting
 , withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch && !hostPlatform.isRiscV))
 , withCudaLLVM ? withFullDeps
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
 , withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
 , withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
 , withFdkAac ? withFullDeps && withUnfree # Fraunhofer FDK AAC de/encoder
+, withFlite ? withFullDeps # Voice Synthesis
 , withFontconfig ? withHeadlessDeps # Needed for drawtext filter
 , withFreetype ? withHeadlessDeps # Needed for drawtext filter
-, withFrei0r ? withFullDeps # frei0r video filtering
+, withFrei0r ? withFullDeps && withGPL # frei0r video filtering
 , withFribidi ? withFullDeps # Needed for drawtext filter
 , withGme ? withFullDeps # Game Music Emulator
 , withGnutls ? withHeadlessDeps
···
 , withIconv ? withHeadlessDeps
 , withJack ? withFullDeps && !stdenv.isDarwin # Jack audio
 , withLadspa ? withFullDeps # LADSPA audio filtering
-, withLibplacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
 , withLzma ? withHeadlessDeps # xz-utils
 , withMfx ? withFullDeps && (with stdenv.hostPlatform; isLinux && !isAarch) # Hardware acceleration via intel-media-sdk/libmfx
 , withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
···
 , withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
 , withOpenal ? withFullDeps # OpenAL 1.1 capture support
 , withOpencl ? withFullDeps
-, withOpencoreAmrnb ? withFullDeps # AMR-NB de/encoder & AMR-WB decoder
+, withOpencoreAmrnb ? withFullDeps && withVersion3 # AMR-NB de/encoder & AMR-WB decoder
 , withOpengl ? false # OpenGL rendering
 , withOpenh264 ? withFullDeps # H.264/AVC encoder
 , withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
 , withOpenmpt ? withFullDeps # Tracked music files decoder
 , withOpus ? withHeadlessDeps # Opus de/encoder
+, withPlacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
 , withPulse ? withSmallDeps && !stdenv.isDarwin # Pulseaudio input support
 , withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
 , withRtmp ? false # RTMP[E] support
-, withSamba ? withFullDeps && !stdenv.isDarwin # Samba protocol
+, withSamba ? withFullDeps && !stdenv.isDarwin && withGPLv3 # Samba protocol
 , withSdl2 ? withSmallDeps
 , withShaderc ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
 , withSoxr ? withHeadlessDeps # Resampling via soxr
···
 , withV4l2M2m ? withV4l2
 , withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
 , withVdpau ? withSmallDeps # Vdpau hardware acceleration
-, withVidStab ? withFullDeps # Video stabilization
-, withVmaf ? withFullDeps && withGPLv3 && !stdenv.isAarch64 && lib.versionAtLeast version "5" # Netflix's VMAF (Video Multi-Method Assessment Fusion)
-, withVoAmrwbenc ? withFullDeps # AMR-WB encoder
+, withVidStab ? withFullDeps && withGPL # Video stabilization
+, withVmaf ? withFullDeps && !stdenv.isAarch64 && lib.versionAtLeast version "5" # Netflix's VMAF (Video Multi-Method Assessment Fusion)
+, withVoAmrwbenc ? withFullDeps && withVersion3 # AMR-WB encoder
 , withVorbis ? withHeadlessDeps # Vorbis de/encoding, native encoder exists
 , withVpx ? withHeadlessDeps && stdenv.buildPlatform == stdenv.hostPlatform # VP8 & VP9 de/encoding
 , withVulkan ? withFullDeps && !stdenv.isDarwin
 , withWebp ? withFullDeps # WebP encoder
-, withX264 ? withHeadlessDeps # H.264/AVC encoder
-, withX265 ? withHeadlessDeps # H.265/HEVC encoder
-, withXavs ? withFullDeps # AVS encoder
+, withX264 ? withHeadlessDeps && withGPL # H.264/AVC encoder
+, withX265 ? withHeadlessDeps && withGPL # H.265/HEVC encoder
+, withXavs ? withFullDeps && withGPL # AVS encoder
 , withXcb ? withXcbShm || withXcbxfixes || withXcbShape # X11 grabbing using XCB
 , withXcbShape ? withFullDeps # X11 grabbing shape rendering
 , withXcbShm ? withFullDeps # X11 grabbing shm communication
 , withXcbxfixes ? withFullDeps # X11 grabbing mouse rendering
 , withXlib ? withFullDeps # Xlib support
 , withXml2 ? withFullDeps # libxml2 support, for IMF and DASH demuxers
-, withXvid ? withHeadlessDeps # Xvid encoder, native encoder exists
+, withXvid ? withHeadlessDeps && withGPL # Xvid encoder, native encoder exists
 , withZimg ? withHeadlessDeps
 , withZlib ? withHeadlessDeps
 , withZmq ? withFullDeps # Message passing
···
  *  Licensing options (yes some are listed twice, filters and such are not listed)
  */
 , withGPL ? true
-, withGPLv3 ? true
+, withVersion3 ? true # When withGPL is set this implies GPLv3 otherwise it is LGPLv3
+, withGPLv3 ? withGPL && withVersion3
 , withUnfree ? false
 
 /*
···
 , withMultithread ? true # Multithreading via pthreads/win32 threads
 , withNetwork ? withHeadlessDeps # Network support
 , withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
+, withStatic ? stdenv.hostPlatform.isStatic
+, withShared ? !stdenv.hostPlatform.isStatic
+, withPic ? true
+, withThumb ? false # On some ARM platforms
+
 /*
  *  Program options
  */
···
 , alsa-lib
 , bzip2
 , celt
+, chromaprint
 , clang
 , dav1d
 , fdk_aac
+, flite
 , fontconfig
 , freetype
 , frei0r
···
 /*
  *  Licensing dependencies
  */
-assert withGPLv3 -> withGPL;
-assert withUnfree -> withGPL && withGPLv3;
+assert withGPLv3 -> withGPL && withVersion3;
+
 /*
  *  Build dependencies
  */
···
      *  Licensing flags
      */
     (enableFeature withGPL "gpl")
-    (enableFeature withGPLv3 "version3")
+    (enableFeature withVersion3 "version3")
     (enableFeature withUnfree "nonfree")
     /*
      *  Build flags
      */
-    # On some ARM platforms --enable-thumb
-    "--enable-shared"
-    "--enable-pic"
+    (enableFeature withStatic "static")
+    (enableFeature withShared "shared")
+    (enableFeature withPic "pic")
+    (enableFeature withThumb "thumb")
 
     (enableFeature withSmallBuild "small")
     (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
···
      *  External libraries
      */
     (enableFeature withAlsa "alsa")
-    # FIXME: see if jellyfin-ffmpeg is already on a version >= 6.1 to use enableFeature
-    (optionalString (withAribcaption && lib.versionAtLeast finalAttrs.version "6.1") "--enable-libaribcaption")
+    (enableFeature withAom "libaom")
+  ] ++ optionals (versionAtLeast finalAttrs.version "6.1") [
+    (enableFeature withAribcaption "libaribcaption")
+  ] ++ [
+    (enableFeature withAss "libass")
+    (enableFeature withBluray "libbluray")
+    (enableFeature withBs2b "libbs2b")
     (enableFeature withBzlib "bzlib")
     (enableFeature withCelt "libcelt")
+    (enableFeature withChromaprint "chromaprint")
     (enableFeature withCuda "cuda")
     (enableFeature withCudaLLVM "cuda-llvm")
     (enableFeature withDav1d "libdav1d")
+    (enableFeature withDc1394 "libdc1394")
+    (enableFeature withDrm "libdrm")
     (enableFeature withFdkAac "libfdk-aac")
-    "--disable-libflite" # Force disable until a solution is found
+    (enableFeature withFlite "libflite")
     (enableFeature withFontconfig "fontconfig")
     (enableFeature withFreetype "libfreetype")
     (enableFeature withFrei0r "frei0r")
···
     (enableFeature withGme "libgme")
     (enableFeature withGnutls "gnutls")
     (enableFeature withGsm "libgsm")
-    (enableFeature withLadspa "ladspa")
-    (enableFeature withMp3lame "libmp3lame")
-    (enableFeature withAom "libaom")
-    (enableFeature withAss "libass")
-    (enableFeature withBluray "libbluray")
-    (enableFeature withBs2b "libbs2b")
-    (enableFeature withDc1394 "libdc1394")
-    (enableFeature withDrm "libdrm")
     (enableFeature withIconv "iconv")
     (enableFeature withJack "libjack")
+    (enableFeature withLadspa "ladspa")
+    (enableFeature withLzma "lzma")
     (enableFeature withMfx "libmfx")
     (enableFeature withModplug "libmodplug")
+    (enableFeature withMp3lame "libmp3lame")
     (enableFeature withMysofa "libmysofa")
-    (enableFeature withOpus "libopus")
-    (optionalString (versionAtLeast finalAttrs.version "5.0" && withLibplacebo) "--enable-libplacebo")
-    (enableFeature withSvg "librsvg")
-    (enableFeature withSrt "libsrt")
-    (enableFeature withSsh "libssh")
-    (enableFeature withTensorflow "libtensorflow")
-    (enableFeature withTheora "libtheora")
-    (enableFeature withV4l2 "libv4l2")
-    (enableFeature withV4l2M2m "v4l2-m2m")
-    (enableFeature withVaapi "vaapi")
-    (enableFeature withVdpau "vdpau")
-    (enableFeature withVorbis "libvorbis")
-    (enableFeature withVmaf "libvmaf")
-    (enableFeature withVpx "libvpx")
-    (enableFeature withWebp "libwebp")
-    (enableFeature withXlib "xlib")
-    (enableFeature withXcb "libxcb")
-    (enableFeature withXcbShm "libxcb-shm")
-    (enableFeature withXcbxfixes "libxcb-xfixes")
-    (enableFeature withXcbShape "libxcb-shape")
-    (enableFeature withXml2 "libxml2")
-    (enableFeature withLzma "lzma")
     (enableFeature withNvdec "cuvid")
     (enableFeature withNvdec "nvdec")
     (enableFeature withNvenc "nvenc")
···
     (enableFeature withOpenh264 "libopenh264")
     (enableFeature withOpenjpeg "libopenjpeg")
     (enableFeature withOpenmpt "libopenmpt")
+    (enableFeature withOpus "libopus")
+  ] ++ optionals (versionAtLeast finalAttrs.version "5.0") [
+    (enableFeature withPlacebo "libplacebo")
+  ] ++ [
     (enableFeature withPulse "libpulse")
     (enableFeature withRav1e "librav1e")
-    (enableFeature withSvtav1 "libsvtav1")
     (enableFeature withRtmp "librtmp")
+    (enableFeature withSamba "libsmbclient")
     (enableFeature withSdl2 "sdl2")
+  ] ++ optionals (versionAtLeast finalAttrs.version "5.0") [
+    (enableFeature withShaderc "libshaderc")
+  ] ++ [
     (enableFeature withSoxr "libsoxr")
     (enableFeature withSpeex "libspeex")
+    (enableFeature withSrt "libsrt")
+    (enableFeature withSsh "libssh")
+    (enableFeature withSvg "librsvg")
+    (enableFeature withSvtav1 "libsvtav1")
+    (enableFeature withTensorflow "libtensorflow")
+    (enableFeature withTheora "libtheora")
+    (enableFeature withV4l2 "libv4l2")
+    (enableFeature withV4l2M2m "v4l2-m2m")
+    (enableFeature withVaapi "vaapi")
+    (enableFeature withVdpau "vdpau")
     (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
+    (enableFeature withVmaf "libvmaf")
     (enableFeature withVoAmrwbenc "libvo-amrwbenc")
+    (enableFeature withVorbis "libvorbis")
+    (enableFeature withVpx "libvpx")
+    (enableFeature withVulkan "vulkan")
+    (enableFeature withWebp "libwebp")
     (enableFeature withX264 "libx264")
     (enableFeature withX265 "libx265")
     (enableFeature withXavs "libxavs")
+    (enableFeature withXcb "libxcb")
+    (enableFeature withXcbShape "libxcb-shape")
+    (enableFeature withXcbShm "libxcb-shm")
+    (enableFeature withXcbxfixes "libxcb-xfixes")
+    (enableFeature withXlib "xlib")
+    (enableFeature withXml2 "libxml2")
     (enableFeature withXvid "libxvid")
-    (enableFeature withZmq "libzmq")
     (enableFeature withZimg "libzimg")
     (enableFeature withZlib "zlib")
-    (enableFeature withVulkan "vulkan")
-    (optionalString (lib.versionAtLeast finalAttrs.version "5") (enableFeature withShaderc "libshaderc"))
-    (enableFeature withSamba "libsmbclient")
+    (enableFeature withZmq "libzmq")
     /*
      * Developer flags
      */
···
   nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ]
   ++ optionals withCudaLLVM [ clang ];
 
-  # TODO This was always in buildInputs before, why?
-  buildInputs = optionals withFullDeps [ libdc1394 ]
-  ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
-  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast finalAttrs.version "6") then nv-codec-headers-12 else nv-codec-headers) ]
+  buildInputs = optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast finalAttrs.version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
   ++ optionals withAribcaption [ libaribcaption ]
···
   ++ optionals withBzlib [ bzip2 ]
   ++ optionals withCaca [ libcaca ]
   ++ optionals withCelt [ celt ]
+  ++ optionals withChromaprint [ chromaprint ]
   ++ optionals withDav1d [ dav1d ]
+  ++ optionals withDc1394 [ libdc1394 libraw1394 ]
   ++ optionals withDrm [ libdrm ]
   ++ optionals withFdkAac [ fdk_aac ]
+  ++ optionals withFlite [ flite ]
   ++ optionals withFontconfig [ fontconfig ]
   ++ optionals withFreetype [ freetype ]
   ++ optionals withFrei0r [ frei0r ]
···
   ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
   ++ optionals withJack [ libjack2 ]
   ++ optionals withLadspa [ ladspaH ]
-  ++ optionals withLibplacebo [ (if (lib.versionAtLeast finalAttrs.version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withLzma [ xz ]
   ++ optionals withMfx [ intel-media-sdk ]
   ++ optionals withModplug [ libmodplug ]
···
   ++ optionals withOpenjpeg [ openjpeg ]
   ++ optionals withOpenmpt [ libopenmpt ]
   ++ optionals withOpus [ libopus ]
+  ++ optionals withPlacebo [ (if (lib.versionAtLeast finalAttrs.version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withPulse [ libpulseaudio ]
   ++ optionals withRav1e [ rav1e ]
   ++ optionals withRtmp [ rtmpdump ]
···
   ++ optionals withSvtav1 [ svt-av1 ]
   ++ optionals withTensorflow [ libtensorflow ]
   ++ optionals withTheora [ libtheora ]
+  ++ optionals withV4l2 [ libv4l ]
   ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
   ++ optionals withVdpau [ libvdpau ]
   ++ optionals withVidStab [ vid-stab ]
···
   ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
   ++ optionals withVorbis [ libvorbis ]
   ++ optionals withVpx [ libvpx ]
-  ++ optionals withV4l2 [ libv4l ]
   ++ optionals withVulkan [ vulkan-headers vulkan-loader ]
   ++ optionals withWebp [ libwebp ]
   ++ optionals withX264 [ x264 ]
···
     '';
     license = with licenses; [ lgpl21Plus ]
       ++ optional withGPL gpl2Plus
+      ++ optional withVersion3 lgpl3Plus
       ++ optional withGPLv3 gpl3Plus
-      ++ optional withUnfree unfreeRedistributable;
+      ++ optional withUnfree unfreeRedistributable
+      ++ optional (withGPL && withUnfree) unfree;
     pkgConfigModules = [ "libavutil" ];
     platforms = platforms.all;
-    maintainers = with maintainers; [ atemu arthsmn ];
+    maintainers = with maintainers; [ atemu arthsmn jopejoe1 ];
     mainProgram = "ffmpeg";
   };
 })

pkgs/development/libraries/gjs/default.nix

···
   ];
 in stdenv.mkDerivation (finalAttrs: {
   pname = "gjs";
-  version = "1.78.1";
+  version = "1.78.3";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fpBRHEKRJ8OerABoxKyaNT335vu8ZG9fGOiWKILBhkE=";
+    hash = "sha256-QtUDZMql15LHZzT+W7zEudu0iBnaIKQGAGHouVJhNKQ=";
   };
 
   patches = [

pkgs/development/libraries/glib/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.78.3";
+  version = "2.78.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "YJgB3Tc3luUVlyv5X8Cy2qRFRUge4vRlxPIE0iSyvCE=";
+    sha256 = "sha256-JLjgZy3KEgzDLTlLzLhYROcy4E/nXRi7BXOy28dUj2M=";
   };
 
   patches = lib.optionals stdenv.isDarwin [

pkgs/development/libraries/glibc/common.nix

···
 
 let
   version = "2.38";
-  patchSuffix = "-27";
+  patchSuffix = "-44";
   sha256 = "sha256-+4KZiZiyspllRnvBtp0VLpwwfSzzAcnq+0VVt3DvP9I=";
 in
 
···
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.38/master && git describe
-          glibc-2.38-27-g750a45a783
+          glibc-2.38-44-gd37c2b20a4
           $ git show --minimal --reverse glibc-2.38.. | gzip -9n --rsyncable - > 2.38-master.patch.gz
 
          To compare the archive contents zdiff can be used.
···
          & https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991
       */
       ./reenable_DT_HASH.patch
+
+      /* Retrieved from https://salsa.debian.org/glibc-team/glibc/-/commit/662dbc4f9287139a0d9c91df328a5ba6cc6abee1#0f3c6d67cb8cf5bb35c421c20f828fea97b68edf
+         Qualys advisory: https://www.qualys.com/2024/01/30/qsort.txt
+       */
+      ./local-qsort-memory-corruption.patch
     ]
     /* NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost
        every HPC piece of software, without this patch CUDA compilation on ARM
···
       # and on aarch64 with binutils 2.30 or later.
       # https://sourceware.org/glibc/wiki/PortStatus
       "--enable-static-pie"
-    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+    ] ++ lib.optionals stdenv.hostPlatform.isx86_64 [
       # Enable Intel Control-flow Enforcement Technology (CET) support
       "--enable-cet"
     ] ++ lib.optionals withLinuxHeaders [

pkgs/development/libraries/glibc/local-qsort-memory-corruption.patch

···
+diff -rup a/stdlib/qsort.c b/stdlib/qsort.c
+--- a/stdlib/qsort.c	2023-07-31 10:54:16.000000000 -0700
++++ b/stdlib/qsort.c	2024-01-15 09:08:25.596167959 -0800
+@@ -224,7 +224,8 @@ _quicksort (void *const pbase, size_t to
+     while ((run_ptr += size) <= end_ptr)
+       {
+ 	tmp_ptr = run_ptr - size;
+-	while ((*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
++	while (tmp_ptr != base_ptr
++	       && (*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
+ 	  tmp_ptr -= size;
+ 
+ 	tmp_ptr += size;
+

pkgs/development/libraries/gperftools/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gperftools";
-  version = "2.10";
+  version = "2.15";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-lUX9T31cYZEi+0DgF52EDSL9yiSHa8ToMxhpQFKHOGk=";
+    sha256 = "sha256-3ibr8AHzo7txX1U+9oOWA60qeeJs/OGeevv+sgBwQa0=";
   };
 
   patches = [

pkgs/development/libraries/graphene/default.nix

···
 , mutest
 , nixosTests
 , glib
+, withDocumentation ? !stdenv.hostPlatform.isStatic
 , gtk-doc
 , docbook_xsl
 , docbook_xml_dtd_43
+, buildPackages
 , gobject-introspection
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , makeWrapper
 }:
 
···
   pname = "graphene";
   version = "1.10.8";
 
-  outputs = [ "out" "dev" "devdoc" ]
+  outputs = [ "out" "dev" ]
+    ++ lib.optionals withDocumentation [ "devdoc" ]
     ++ lib.optionals (stdenv.hostPlatform == stdenv.buildPlatform) [ "installedTests" ];
 
   src = fetchFromGitHub {
···
   ];
 
   nativeBuildInputs = [
-    docbook_xml_dtd_43
-    docbook_xsl
-    gtk-doc
     meson
     ninja
     pkg-config
-    gobject-introspection
     python3
     makeWrapper
+  ] ++ lib.optionals withDocumentation [
+    docbook_xml_dtd_43
+    docbook_xsl
+    gtk-doc
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     mesonEmulatorHook
   ];
···
   ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
-    "-Dintrospection=enabled"
+    (lib.mesonBool "gtk_doc" withDocumentation)
+    (lib.mesonEnable "introspection" withIntrospection)
     "-Dinstalled_test_datadir=${placeholder "installedTests"}/share"
     "-Dinstalled_test_bindir=${placeholder "installedTests"}/libexec"
   ] ++ lib.optionals stdenv.isAarch32 [
···
 
   postPatch = ''
     patchShebangs tests/gen-installed-test.py
+  '' + lib.optionalString withIntrospection ''
     PATH=${python3.withPackages (pp: [ pp.pygobject3 pp.tappy ])}/bin:$PATH patchShebangs tests/introspection.py
   '';
 
   postFixup = let
     introspectionPy = "${placeholder "installedTests"}/libexec/installed-tests/graphene-1.0/introspection.py";
-  in ''
+  in lib.optionalString withIntrospection ''
     if [ -x '${introspectionPy}' ] ; then
       wrapProgram '${introspectionPy}' \
         --prefix GI_TYPELIB_PATH : "$out/lib/girepository-1.0"

pkgs/development/libraries/grpc/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.60.0"; # N.B: if you change this, please update:
+  version = "1.61.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
···
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-0mn+nQAgaurd1WomzcLUAYwp88l26qGkP+cP1SSYxsE=";
+    hash = "sha256-NLxcGFQ1F5RLoSFC0XYMjvGXkSWc/vLzgtk5qsOndEo=";
     fetchSubmodules = true;
   };
 
···
       name = "grpc-link-libatomic.patch";
       url = "https://github.com/lopsided98/grpc/commit/a9b917666234f5665c347123d699055d8c2537b2.patch";
       hash = "sha256-Lm0GQsz/UjBbXXEE14lT0dcRzVmCKycrlrdBJj+KLu8=";
+    })
+    (fetchpatch {
+      # Fix compatibility with Abseil 202401. Remove with the next release.
+      url = "https://github.com/grpc/grpc/commit/bc044174401a0842b36b8682936fc93b5041cf88.patch";
+      hash = "sha256-VKAuPtLqsR2dmrpKuFXq2HIhuDxPJVSH2w1G00N07RI=";
+      excludes = [ "src/core/lib/transport/message.cc" ];
     })
   ];
 

pkgs/development/libraries/httplib/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "httplib";
-  version = "0.15.2";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${version}";
-    hash = "sha256-DNktnRckqiZf0EQ96LfweDvBNgcX8u3Gry1LCs/Qj74=";
+    hash = "sha256-+YAjmsZvBkOk5bsjE07weTNUmevHd1ZXP0bv5QbkZMs=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/iso-codes/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "iso-codes";
-  version = "4.15.0";
+  version = "4.16.0";
 
   src = fetchurl {
     url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz";
-    sha256 = "sha256-uDtUudfdbrh3OAs+xG83CwXa8sv6ExxhLwNZjWVMDvg=";
+    sha256 = "sha256-fJkPw5oFl1vtsBdeP/Cfw4MEiBX2i0Yqu/BVqAMuZsw=";
   };
 
   nativeBuildInputs = [ gettext python3 ];

pkgs/development/libraries/jellyfin-ffmpeg/default.nix

···
 { ffmpeg_6-full
-, chromaprint
 , fetchFromGitHub
 , lib
 }:
···
   # Clobber upstream patches as they don't apply to the Jellyfin fork
   patches = [];
 
-  buildInputs = old.buildInputs ++ [ chromaprint ];
-
   configureFlags = old.configureFlags ++ [
     "--extra-version=Jellyfin"
     "--disable-ptx-compression" # https://github.com/jellyfin/jellyfin/issues/7944#issuecomment-1156880067
-    "--enable-chromaprint"
   ];
 
   postPatch = ''

pkgs/development/libraries/kf5gpgmepp/default.nix

···
 
   meta = with lib; {
     license = [ licenses.lgpl2 ];
-    maintainers = [ maintainers.ehmry ];
     platforms = platforms.linux;
   };
 

pkgs/development/libraries/libaom/default.nix

···
 { lib, stdenv, fetchzip, yasm, perl, cmake, pkg-config, python3
-, enableButteraugli ? true, libjxl
 , enableVmaf ? true, libvmaf
 , gitUpdater
 }:
···
 in
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    hash = "sha256-JxMz+XnjmUvk8TlTqdU2HP1Gq3bXfcLkXp5AEv9+7hM=";
+    hash = "sha256-qng9fEbm71HqPnPzfgqswSium9egIgpB6ZLesOQVg6c=";
     stripRoot = false;
   };
 
···
     yasm perl cmake pkg-config python3
   ];
 
-  propagatedBuildInputs = lib.optional enableButteraugli libjxl
-    ++ lib.optional enableVmaf libvmaf;
+  propagatedBuildInputs = lib.optional enableVmaf libvmaf;
 
   preConfigure = ''
     # build uses `git describe` to set the build version
···
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
     "-DENABLE_TESTS=OFF"
-  ] ++ lib.optionals enableButteraugli [
-    "-DCONFIG_TUNE_BUTTERAUGLI=1"
   ] ++ lib.optionals enableVmaf [
     "-DCONFIG_TUNE_VMAF=1"
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [

pkgs/development/libraries/libcamera/default.nix pkgs/by-name/li/libcamera/package.nix

···
 { stdenv
 , fetchgit
-, fetchpatch
 , lib
+, fetchpatch
 , meson
 , ninja
 , pkg-config
···
 , python3
 , python3Packages
 , systemd # for libudev
+, withQcam ? false
+, qt5 # withQcam
+, libtiff # withQcam
 }:
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-icHZtv25QvJEv0DlELT3cDxho3Oz2BJAMNKr5W4bshk=";
+    hash = "sha256-x0Im9m9MoACJhQKorMI34YQ+/bd62NdAPc2nWwaJAvM=";
   };
 
   outputs = [ "out" "dev" "doc" ];
 
-  patches = [
-    (fetchpatch {
-      # https://git.libcamera.org/libcamera/libcamera.git/commit/?id=6cb92b523bd60bd7718df134cc5b1eff51cf42e5
-      name = "libcamera-sphinx7.0-compat.patch";
-      url = "https://git.libcamera.org/libcamera/libcamera.git/patch/?id=6cb92b523bd60bd7718df134cc5b1eff51cf42e5";
-      hash = "sha256-gs0EiT3gWlmRjDim+o2C0VmnoWqEouP5pNTD4XbNSdE=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs utils/
   '';
···
     libyaml
 
     gtest
-  ];
+  ] ++ lib.optionals withQcam [ libtiff qt5.qtbase qt5.qttools ];
 
   nativeBuildInputs = [
     meson
···
     graphviz
     doxygen
     openssl
-  ];
+  ] ++ lib.optional withQcam qt5.wrapQtAppsHook;
 
   mesonFlags = [
     "-Dv4l2=true"
-    "-Dqcam=disabled"
+    "-Dqcam=${if withQcam then "enabled" else "disabled"}"
     "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
     # Avoid blanket -Werror to evade build failures on less
     # tested compilers.
     "-Dwerror=false"
-    ];
+  ];
 
   # Fixes error on a deprecated declaration
   env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   # Silence fontconfig warnings about missing config
-  FONTCONFIG_FILE = makeFontsConf { fontDirectories = []; };
+  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
 
   # libcamera signs the IPA module libraries at install time, but they are then
   # modified by stripping and RPATH fixup. Therefore, we need to generate the

pkgs/development/libraries/libcbor/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "unstable-2023-01-29"; # Musl fix hasn't been released yet.
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "PJK";
     repo = "libcbor";
-    rev = "cb4162f40d94751141b4d43b07c4add83e738a68";
-    sha256 = "sha256-ZTa+wG1g9KsVoqJG/yqxo2fJ7OhPnaI9QcfOmpOT3pg=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-eE11hYPsOKqfoX8fx/oYfOAichhUe4mMpNQNVZ6vAUI=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libdecor/default.nix

···
 , cairo
 , dbus
 , pango
+, gtk3
 }:
 
 stdenv.mkDerivation rec {
   pname = "libdecor";
-  version = "0.1.1";
+  version = "0.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libdecor";
     repo = "libdecor";
     rev = version;
-    hash = "sha256-8b6qCqOSDDbhYwAeAaUyI71tSopTkGtCJaxZaJw1vQQ=";
+    hash = "sha256-mID19uHXFKJUZtQsSOXjRdz541YVjMxmSHVa+DlkPRc=";
   };
 
   outputs = [ "out" "dev" ];
···
     cairo
     dbus
     pango
+    gtk3
   ];
 
   meta = with lib; {

pkgs/development/libraries/libedit/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libedit";
-  version = "20221030-3.1";
+  version = "20230828-3.1";
 
   src = fetchurl {
     url = "https://thrysoee.dk/editline/${pname}-${version}.tar.gz";
-    sha256 = "sha256-8JJaWt9LG/EW7hl2a32qdmkXrsGYdHlDscTt9npL4rs=";
+    sha256 = "sha256-TugYK25WkpDn0fRPD3jayHFrNfZWt2Uo9pnGnJiBTa0=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libei/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "libei";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";
     repo = "libei";
     rev = version;
-    hash = "sha256-ebZZ2dGXrPBUDPsuu5GZY5kDv9qndnxepQUGFDe9PUg=";
+    hash = "sha256-MHPWEBMtxoEJ8j3LyDPD+m3DsO9u8nE+/pPtRHHXEXA=";
   };
 
   buildInputs = [

pkgs/development/libraries/libgit2/default.nix

···
   version = "1.7.1";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
+  outputs = ["lib" "dev" "out"];
+
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
···
 
   propagatedBuildInputs = lib.optional (!stdenv.isLinux) libiconv;
 
-  doCheck = false; # hangs. or very expensive?
+  doCheck = true;
+  checkPhase = ''
+    testArgs=(-v -xonline)
+
+    # slow
+    testArgs+=(-xclone::nonetwork::bad_urls)
+
+    # failed to set permissions on ...: Operation not permitted
+    testArgs+=(-xrepo::init::extended_1)
+    testArgs+=(-xrepo::template::extended_with_template_and_shared_mode)
+
+    (
+      set -x
+      ./libgit2_tests ''${testArgs[@]}
+    )
+  '';
 
   passthru.tests = {
     inherit libgit2-glib;

pkgs/development/libraries/libgudev/default.nix

···
 , gnome
 , vala
 , gobject-introspection
-, fetchpatch
 , glibcLocales
 , umockdev
 }:
···
     url = "mirror://gnome/sources/libgudev/${lib.versions.majorMinor finalAttrs.version}/libgudev-${finalAttrs.version}.tar.xz";
     hash = "sha256-YSZqsa/J1z28YKiyr3PpnS/f9H2ZVE0IV2Dk+mZ7XdE=";
   };
+
+  patches = [
+    # Conditionally disable one test that requires a locale implementation
+    # https://gitlab.gnome.org/GNOME/libgudev/-/merge_requests/31
+    ./tests-skip-double-test-on-stub-locale-impls.patch
+  ];
+
+  postPatch = ''
+    # The relative location of LD_PRELOAD works for Glibc but not for other loaders (e.g. pkgsMusl)
+    substituteInPlace tests/meson.build \
+      --replace "LD_PRELOAD=libumockdev-preload.so.0" "LD_PRELOAD=${lib.getLib umockdev}/lib/libumockdev-preload.so.0"
+  '';
 
   strictDeps = true;
 

pkgs/development/libraries/libgudev/tests-skip-double-test-on-stub-locale-impls.patch

···
+From ad8b10870ee2092268f87144d8e5ab7db2011139 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <[e-mail]>
+Date: Tue, 30 Jan 2024 20:47:21 +0100
+Subject: [PATCH] tests: Skip double test on stub locale impls
+
+On musl, setlocale() with an unknown locale name will succeed, but
+treat the requested locale as if it were C.UTF-8.  Therefore, to
+properly check whether the locale is supported, we need to actually
+verify whether it works the way we expect when deciding whether to
+skip the test.
+---
+ tests/test-double.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tests/test-double.c b/tests/test-double.c
+index 91e77c9..e9d9232 100644
+--- a/tests/test-double.c
++++ b/tests/test-double.c
+@@ -39,8 +39,6 @@ fixture_teardown (Fixture *f, G_GNUC_UNUSED const void *data)
+ static void
+ test_double (Fixture *f, G_GNUC_UNUSED const void *data)
+ {
+-	g_assert_cmpstr (nl_langinfo(RADIXCHAR), ==, ",");
+-
+ 	umockdev_testbed_add_device (f->testbed, "platform", "dev1", NULL,
+ 				     "in_accel_scale", "0.0000098", NULL,
+ 				     "ID_MODEL", "KoolGadget", "SCALE", "0.0000098", NULL);
+@@ -73,6 +71,10 @@ int main(int argc, char **argv)
+ 	if (setlocale (LC_NUMERIC, "fr_FR.UTF-8") == NULL)
+ 		return GNU_SKIP_RETURNCODE;
+ 
++	/* Skip if locale doesn't work how we expect. */
++	if (strcmp (nl_langinfo(RADIXCHAR), ","))
++		return GNU_SKIP_RETURNCODE;
++
+ 	g_test_init (&argc, &argv, NULL);
+ 
+ 	g_test_add ("/gudev/double", Fixture, NULL,
+-- 
+GitLab
+

pkgs/development/libraries/libidn/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libidn";
-  version = "1.41";
+  version = "1.42";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-iE1wY2S4Gr3Re+6Whtj/KudDHFoUZRBHxorfizH9iUU=";
+    sha256 = "sha256-1sGZ3NgG5P4nk2DLSwg0mg05Vg7VSP/RzK3ajN7LRyM=";
   };
 
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];

pkgs/development/libraries/libidn2/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libidn2";
-  version = "2.3.4";
+  version = "2.3.7";
 
   src = fetchurl {
     url = "https://ftp.gnu.org/gnu/libidn/${pname}-${version}.tar.gz";
-    sha256 = "sha256-k8q6crTgUdH41PWgdqtjyZt3+u4Bm3K5eDsmeYbbtF8=";
+    hash = "sha256-TCGnkbYQuVGbnQ4SuAl78vNZsS+N2SZHYRqSnmv9fWQ=";
   };
 
   strictDeps = true;

pkgs/development/libraries/libimagequant/Cargo.lock

···
 
 [[package]]
 name = "ahash"
-version = "0.8.3"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
+checksum = "77c3a9648d43b9cd48db467b3f87fdd6e146bcc88ab0180006cef2179fe11d01"
 dependencies = [
  "cfg-if",
  "once_cell",
  "version_check",
+ "zerocopy",
 ]
 
 [[package]]
···
 checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
 
 [[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 
 [[package]]
 name = "bytemuck"
···
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
  "crossbeam-utils",
- "memoffset",
- "scopeguard",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "either"
···
 
 [[package]]
 name = "imagequant"
-version = "4.2.2"
+version = "4.3.0"
 dependencies = [
  "arrayvec",
  "lodepng",
···
 
 [[package]]
 name = "imagequant-sys"
-version = "4.0.3"
+version = "4.0.4"
 dependencies = [
  "bitflags",
  "imagequant",
···
 
 [[package]]
 name = "libc"
-version = "0.2.149"
+version = "0.2.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
+checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
 
 [[package]]
 name = "lodepng"
-version = "3.9.1"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3cdccd0cf57a5d456f0656ebcff72c2e19503287e1afbf3b84382812adc0606"
+checksum = "a42d298694b14401847de29abd44adf278b42e989e516deac7b72018400002d8"
 dependencies = [
  "crc32fast",
  "fallible_collections",
···
 ]
 
 [[package]]
-name = "memoffset"
-version = "0.9.0"
+name = "miniz_oxide"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
 dependencies = [
- "autocfg",
+ "adler",
 ]
 
 [[package]]
-name = "miniz_oxide"
-version = "0.7.1"
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
 dependencies = [
- "adler",
+ "unicode-ident",
 ]
 
 [[package]]
-name = "once_cell"
-version = "1.18.0"
+name = "quote"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
 dependencies = [
  "either",
  "rayon-core",
···
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
···
 
 [[package]]
 name = "rgb"
-version = "0.8.36"
+version = "0.8.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20ec2d3e3fc7a92ced357df9cebd5a10b6fb2aa1ee797bf7e9ce2f17dffc8f59"
+checksum = "05aaa8004b64fd573fc9d002f4e632d51ad4f026c2b5ba95fcb6c2f32c2c47d8"
 dependencies = [
  "bytemuck",
 ]
 
 [[package]]
-name = "scopeguard"
-version = "1.2.0"
+name = "syn"
+version = "2.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
 
 [[package]]
 name = "thread_local"
···
 ]
 
 [[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
 name = "version_check"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]

pkgs/development/libraries/libimagequant/default.nix

···
-{ lib, stdenv, fetchFromGitHub, fetchurl, rust, rustPlatform, cargo-c, python3 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchurl
+, rust
+, rustPlatform
+, cargo-c
+, python3
+
+# tests
+, testers
+, vips
+, libimagequant
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "4.2.2";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
-    repo = pname;
+    repo = "libimagequant";
     rev = version;
-    hash = "sha256-cZgnJOmj+xJDcewsxH2Jp5AAnFZKVuYxKPtoGeN03g4=";
+    hash = "sha256-/gHe3LQaBWOQImBesKvHK46T42TtRld988wgxbut4i0=";
   };
 
   cargoLock = {
···
   '';
 
   passthru.tests = {
+    inherit vips;
     inherit (python3.pkgs) pillow;
+
+    pkg-config = testers.hasPkgConfigModules {
+      package = libimagequant;
+      moduleNames = [ "imagequant" ];
+    };
   };
 
   meta = with lib; {

pkgs/development/libraries/libinput/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.24.0";
+  version = "1.25.0";
 
   outputs = [ "bin" "out" "dev" ];
 
···
     owner = "libinput";
     repo = "libinput";
     rev = version;
-    sha256 = "sha256-gTcgEZ7cs4jq8w5Genxtio9nVFy7y3n0nNXJ6SVtYHY=";
+    hash = "sha256-c2FU5OW+CIgtYTQy+bwIbaw3SP1pVxaLokhO+ag5/1s=";
   };
 
   patches = [

pkgs/development/libraries/libipt/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libipt";
-  version = "2.0.6";
+  version = "2.1";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "libipt";
     rev = "v${version}";
-    sha256 = "sha256-RuahOkDLbac9bhXn8QSf7lMRw11PIpXQo3eaQ9N4Rtc=";
+    sha256 = "sha256-SLCuNTFRGFh0mTv1xLCIDg7b6DbWCxgHhrCoPu9xpmw=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/libjpeg-turbo/0001-Compile-transupp.c-as-part-of-the-library.patch

···
-From 4a0584f7c05641143151ebdc1be1163bebf9d35d Mon Sep 17 00:00:00 2001
+From 6442d11617f95d13e2a371bd3e01f5082a9c356d Mon Sep 17 00:00:00 2001
 From: Las <[e-mail]>
 Date: Sun, 3 Jan 2021 18:35:37 +0000
 Subject: [PATCH] Compile transupp.c as part of the library
 
-The exported symbols are made weak to not conflict with users
-of the library that already vendor this functionality.
 ---
  CMakeLists.txt |  4 ++--
- transupp.c     | 14 +++++++-------
- 2 files changed, 9 insertions(+), 9 deletions(-)
+ 1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 0ca6f98..a9a0fae 100644
+index adb0ca45..46fc16dd 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -533,7 +533,7 @@ set(JPEG_SOURCES jcapimin.c jcapistd.c jccoefct.c jccolor.c jcdctmgr.c jchuff.c
-   jdatasrc.c jdcoefct.c jdcolor.c jddctmgr.c jdhuff.c jdicc.c jdinput.c
-   jdmainct.c jdmarker.c jdmaster.c jdmerge.c jdphuff.c jdpostct.c jdsample.c
-   jdtrans.c jerror.c jfdctflt.c jfdctfst.c jfdctint.c jidctflt.c jidctfst.c
--  jidctint.c jidctred.c jquant1.c jquant2.c jutils.c jmemmgr.c jmemnobs.c)
-+  jidctint.c jidctred.c jquant1.c jquant2.c jutils.c jmemmgr.c jmemnobs.c transupp.c)
+@@ -581,7 +581,7 @@ set(JPEG_SOURCES ${JPEG12_SOURCES} jcapimin.c jchuff.c jcicc.c jcinit.c
+   jclhuff.c jcmarker.c jcmaster.c jcomapi.c jcparam.c jcphuff.c jctrans.c
+   jdapimin.c jdatadst.c jdatasrc.c jdhuff.c jdicc.c jdinput.c jdlhuff.c
+   jdmarker.c jdmaster.c jdphuff.c jdtrans.c jerror.c jfdctflt.c jmemmgr.c
+-  jmemnobs.c jpeg_nbits.c)
++  jmemnobs.c jpeg_nbits.c transupp.c)
  
  if(WITH_ARITH_ENC OR WITH_ARITH_DEC)
    set(JPEG_SOURCES ${JPEG_SOURCES} jaricom.c)
-@@ -1489,7 +1489,7 @@ install(EXPORT ${CMAKE_PROJECT_NAME}Targets
+@@ -1803,7 +1803,7 @@ install(EXPORT ${CMAKE_PROJECT_NAME}Targets
  
  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/jconfig.h
    ${CMAKE_CURRENT_SOURCE_DIR}/jerror.h ${CMAKE_CURRENT_SOURCE_DIR}/jmorecfg.h
···
    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
  
  include(cmakescripts/BuildPackages.cmake)
-diff --git a/transupp.c b/transupp.c
-index 6e86077..2da49a7 100644
---- a/transupp.c
-+++ b/transupp.c
-@@ -1386,7 +1386,7 @@ jt_read_integer(const char **strptr, JDIMENSION *result)
-  * This code is loosely based on XParseGeometry from the X11 distribution.
-  */
- 
--GLOBAL(boolean)
-+GLOBAL(boolean) __attribute__((weak))
- jtransform_parse_crop_spec(jpeg_transform_info *info, const char *spec)
- {
-   info->crop = FALSE;
-@@ -1486,7 +1486,7 @@ trim_bottom_edge(jpeg_transform_info *info, JDIMENSION full_height)
-  * and transformation is not perfect.  Otherwise returns TRUE.
-  */
- 
--GLOBAL(boolean)
-+GLOBAL(boolean) __attribute__((weak))
- jtransform_request_workspace(j_decompress_ptr srcinfo,
-                              jpeg_transform_info *info)
- {
-@@ -2033,7 +2033,7 @@ adjust_exif_parameters(JOCTET *data, unsigned int length, JDIMENSION new_width,
-  * to jpeg_write_coefficients().
-  */
- 
--GLOBAL(jvirt_barray_ptr *)
-+GLOBAL(jvirt_barray_ptr *) __attribute__((weak))
- jtransform_adjust_parameters(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-                              jvirt_barray_ptr *src_coef_arrays,
-                              jpeg_transform_info *info)
-@@ -2152,7 +2152,7 @@ jtransform_adjust_parameters(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-  * Note that some transformations will modify the source data arrays!
-  */
- 
--GLOBAL(void)
-+GLOBAL(void) __attribute__((weak))
- jtransform_execute_transform(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-                              jvirt_barray_ptr *src_coef_arrays,
-                              jpeg_transform_info *info)
-@@ -2264,7 +2264,7 @@ jtransform_execute_transform(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-  *           (may use custom action then)
-  */
- 
--GLOBAL(boolean)
-+GLOBAL(boolean) __attribute__((weak))
- jtransform_perfect_transform(JDIMENSION image_width, JDIMENSION image_height,
-                              int MCU_width, int MCU_height,
-                              JXFORM_CODE transform)
-@@ -2303,7 +2303,7 @@ jtransform_perfect_transform(JDIMENSION image_width, JDIMENSION image_height,
-  * This must be called before jpeg_read_header() to have the desired effect.
-  */
- 
--GLOBAL(void)
-+GLOBAL(void) __attribute__((weak))
- jcopy_markers_setup(j_decompress_ptr srcinfo, JCOPY_OPTION option)
- {
- #ifdef SAVE_MARKERS_SUPPORTED
-@@ -2331,7 +2331,7 @@ jcopy_markers_setup(j_decompress_ptr srcinfo, JCOPY_OPTION option)
-  * JFIF APP0 or Adobe APP14 markers if selected.
-  */
- 
--GLOBAL(void)
-+GLOBAL(void) __attribute__((weak))
- jcopy_markers_execute(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-                       JCOPY_OPTION option)
- {
 -- 
-2.29.2
+2.43.0
 

pkgs/development/libraries/libjpeg-turbo/0002-Make-exported-symbols-in-transupp.c-weak.patch

···
+From 6442d11617f95d13e2a371bd3e01f5082a9c356d Mon Sep 17 00:00:00 2001
+From: Las <[e-mail]>
+Date: Sun, 3 Jan 2021 18:35:37 +0000
+Subject: [PATCH] Make exported symbols in transupp.c weak
+
+The exported symbols are made weak to not conflict with users
+of the library that already vendor this functionality.
+---
+ transupp.c     | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/transupp.c b/transupp.c
+index 34fbb371..c0ade5a9 100644
+--- a/transupp.c
++++ b/transupp.c
+@@ -1388,7 +1388,7 @@ jt_read_integer(const char **strptr, JDIMENSION *result)
+  * This code is loosely based on XParseGeometry from the X11 distribution.
+  */
+ 
+-GLOBAL(boolean)
++GLOBAL(boolean) __attribute__((weak))
+ jtransform_parse_crop_spec(jpeg_transform_info *info, const char *spec)
+ {
+   info->crop = FALSE;
+@@ -1488,7 +1488,7 @@ trim_bottom_edge(jpeg_transform_info *info, JDIMENSION full_height)
+  * and transformation is not perfect.  Otherwise returns TRUE.
+  */
+ 
+-GLOBAL(boolean)
++GLOBAL(boolean) __attribute__((weak))
+ jtransform_request_workspace(j_decompress_ptr srcinfo,
+                              jpeg_transform_info *info)
+ {
+@@ -2035,7 +2035,7 @@ adjust_exif_parameters(JOCTET *data, unsigned int length, JDIMENSION new_width,
+  * to jpeg_write_coefficients().
+  */
+ 
+-GLOBAL(jvirt_barray_ptr *)
++GLOBAL(jvirt_barray_ptr *) __attribute__((weak))
+ jtransform_adjust_parameters(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+                              jvirt_barray_ptr *src_coef_arrays,
+                              jpeg_transform_info *info)
+@@ -2154,7 +2154,7 @@ jtransform_adjust_parameters(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+  * Note that some transformations will modify the source data arrays!
+  */
+ 
+-GLOBAL(void)
++GLOBAL(void) __attribute__((weak))
+ jtransform_execute_transform(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+                              jvirt_barray_ptr *src_coef_arrays,
+                              jpeg_transform_info *info)
+@@ -2266,7 +2266,7 @@ jtransform_execute_transform(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+  *           (may use custom action then)
+  */
+ 
+-GLOBAL(boolean)
++GLOBAL(boolean) __attribute__((weak))
+ jtransform_perfect_transform(JDIMENSION image_width, JDIMENSION image_height,
+                              int MCU_width, int MCU_height,
+                              JXFORM_CODE transform)
+@@ -2305,7 +2305,7 @@ jtransform_perfect_transform(JDIMENSION image_width, JDIMENSION image_height,
+  * This must be called before jpeg_read_header() to have the desired effect.
+  */
+ 
+-GLOBAL(void)
++GLOBAL(void) __attribute__((weak))
+ jcopy_markers_setup(j_decompress_ptr srcinfo, JCOPY_OPTION option)
+ {
+ #ifdef SAVE_MARKERS_SUPPORTED
+@@ -2337,7 +2337,7 @@ jcopy_markers_setup(j_decompress_ptr srcinfo, JCOPY_OPTION option)
+  * JFIF APP0 or Adobe APP14 markers if selected.
+  */
+ 
+-GLOBAL(void)
++GLOBAL(void) __attribute__((weak))
+ jcopy_markers_execute(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+                       JCOPY_OPTION option)
+ {
+-- 
+2.43.0
+

pkgs/development/libraries/libjpeg-turbo/default.nix

···
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , nasm
 , openjdk
···
 stdenv.mkDerivation (finalAttrs: {
 
   pname = "libjpeg-turbo";
-  version = "2.1.5.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "libjpeg-turbo";
     repo = "libjpeg-turbo";
     rev = finalAttrs.version;
-    sha256 = "sha256-96SBBZp+/4WkXLvHKSPItNi5WuzdVccI/ZcbJOFjYYk=";
+    hash = "sha256-xHjd0WHN50b75wdWPHUwfmJGsiWKmj+zA59UwakIo74=";
   };
 
-  # This is needed by freeimage
-  patches = [ ./0001-Compile-transupp.c-as-part-of-the-library.patch ]
-    ++ lib.optional stdenv.hostPlatform.isMinGW
-    ./mingw-boolean.patch;
+  patches = [
+    (fetchpatch {
+      name = "CMAKE_CROSSCOMPILING_EMULATOR=env-fix.patch";
+      url = "https://github.com/libjpeg-turbo/libjpeg-turbo/compare/36c51dd3eb60ebde3ca77d3cfa7df3422f1aaaf1..b6ee1016abbc55116304ad396cf88aa19391e10a.patch";
+      hash = "sha256-dNwXicvZEsG02TBaM5nYMlZ+VczT/Dfx6ZM/6huZpwE=";
+    })
+
+    # This is needed by freeimage
+    ./0001-Compile-transupp.c-as-part-of-the-library.patch
+  ] ++ lib.optionals (!stdenv.hostPlatform.isMinGW) [
+    ./0002-Make-exported-symbols-in-transupp.c-weak.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
+    ./mingw-boolean.patch
+  ];
 
   outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
 

pkgs/development/libraries/libjxl/default.nix

···
 { stdenv, lib, fetchFromGitHub
-, fetchpatch
 , brotli
 , cmake
 , giflib
···
 , openexr_3
 , pkg-config
 , zlib
-, buildDocs ? true
 , asciidoc
 , graphviz
 , doxygen
···
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.8.2";
+  version = "0.9.1";
 
   outputs = [ "out" "dev" ];
 
···
     owner = "libjxl";
     repo = "libjxl";
     rev = "v${version}";
-    hash = "sha256-I3PGgh0XqRkCFz7lUZ3Q4eU0+0GwaQcVb6t4Pru1kKo=";
+    hash = "sha256-n5KNbbw6NQRROEM7Cojla/igRCFNawUq7nfhzJlMlPI=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
 
-  patches = [
-    # Add missing <atomic> content to fix gcc compilation for RISCV architecture
-    # https://github.com/libjxl/libjxl/pull/2211
-    (fetchpatch {
-      url = "https://github.com/libjxl/libjxl/commit/22d12d74e7bc56b09cfb1973aa89ec8d714fa3fc.patch";
-      hash = "sha256-X4fbYTMS+kHfZRbeGzSdBW5jQKw8UN44FEyFRUtw0qo=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     gtest
     pkg-config
-  ] ++ lib.optionals buildDocs [
     asciidoc
     doxygen
     python3
   ];
 
-  depsBuildBuild = lib.optionals buildDocs [
+  depsBuildBuild = [
     graphviz
   ];
 

pkgs/development/libraries/libmaxminddb/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libmaxminddb";
-  version = "1.7.1";
+  version = "1.9.1";
 
   src = fetchurl {
     url = meta.homepage + "/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-6EFPDe3Oy8H2wxy2XNgWUJUqsGd6TYxJyrYDs7j7CD4=";
+    sha256 = "sha256-qAaCqJ2RX99gs10xYjL7BOvzb/8n/am9Of6KONPNPxI=";
   };
 
   meta = with lib; {

pkgs/development/libraries/libplacebo/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libplacebo";
-  version = "6.338.1";
+  version = "6.338.2";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NZmwR3+lIC2PF+k+kqCjoMYkMM/PKOJmDwAq7t6YONY=";
+    hash = "sha256-gE6yKnFvsOFh8bFYc7b+bS+zmdDU7jucr0HwhdDeFzU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libpsl/default.nix

···
 , publicsuffix-list
 }:
 
-let
-  enableValgrindTests = !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind
-    # Apparently valgrind doesn't support some new ARM features on (some) Hydra machines:
-    #  VEX: Mismatch detected between RDMA and atomics features.
-    && !stdenv.isAarch64
-    # Valgrind on musl does not hook malloc calls properly, resulting in errors `Invalid free() / delete / delete[] / realloc()`
-    # https://bugs.kde.org/show_bug.cgi?id=435441
-    && !stdenv.hostPlatform.isMusl
-  ;
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "libpsl";
-  version = "0.21.2";
+  version = "0.21.5";
 
   src = fetchurl {
     url = "https://github.com/rockdaboot/libpsl/releases/download/${version}/libpsl-${version}.tar.lz";
-    sha256 = "sha256-qj1wbEUnhtE0XglNriAc022B8Dz4HWNtXPwQ02WQfxc=";
+    hash = "sha256-mp9qjG7bplDPnqVUdc0XLdKEhzFoBOnHMgLZdXLNOi0=";
   };
 
   nativeBuildInputs = [
···
     pkg-config
     python3
     libxslt
-  ] ++ lib.optionals enableValgrindTests [
-    valgrind
   ];
 
   buildInputs = [
···
     "--with-psl-distfile=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
     "--with-psl-file=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
     "--with-psl-testfile=${publicsuffix-list}/share/publicsuffix/test_psl.txt"
-  ] ++ lib.optionals enableValgrindTests [
-    "--enable-valgrind-tests"
   ];
 
   enableParallelBuilding = true;

pkgs/development/libraries/libunwind/default.nix

···
     maintainers = with maintainers; [ orivej ];
     # https://github.com/libunwind/libunwind#libunwind
     platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd13" "i686-linux" "loongarch64-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "s390x-linux" "x86_64-freebsd13" "x86_64-linux" "x86_64-solaris" ];
-    # libunwind relies on getcontext/setcontext,
-    # and only has a musl implementation for some platforms
-    # https://github.com/libunwind/libunwind/issues/33
-    # https://github.com/libunwind/libunwind/issues/69
-    badPlatforms = [ {
-      isAarch64 = false;
-      isRiscV64 = false;
-      isS390x = false;
-      isx86_64 = false;
-      isMusl = true;
-      parsed = {};
-    } ];
     license = licenses.mit;
   };
 }

pkgs/development/libraries/libusb1/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libusb";
-  version = "1.0.26";
+  version = "1.0.27";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "libusb";
     rev = "v${version}";
-    sha256 = "sha256-LEy45YiFbueCCi8d2hguujMsxBezaTUERHUpFsTKGZQ=";
+    sha256 = "sha256-OtzYxWwiba0jRK9X+4deWWDDTeZWlysEt0qMyGUarDo=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libuv/default.nix

···
         "fs_event_watch_dir_recursive" "fs_event_watch_file"
         "fs_event_watch_file_current_dir" "fs_event_watch_file_exact_path"
         "process_priority" "udp_create_early_bad_bind"
+    ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+        # fail on macos < 10.15 (starting in libuv 1.47.0)
+        "fs_write_alotof_bufs_with_offset" "fs_write_multiple_bufs" "fs_read_bufs"
     ] ++ lib.optionals stdenv.isAarch32 [
       # I observe this test failing with some regularity on ARMv7:
       # https://github.com/libuv/libuv/issues/1871

pkgs/development/libraries/libvirt/default.nix

···
       substituteInPlace src/util/virpolkit.h \
         --replace '"/usr/bin/pkttyagent"' '"${if isLinux then polkit.bin else "/usr"}/bin/pkttyagent"'
 
+      substituteInPlace src/util/virpci.c \
+         --replace '/lib/modules' '${if isLinux then "/run/booted-system/kernel-modules" else ""}/lib/modules'
+
       patchShebangs .
     ''
     + (lib.concatStringsSep "\n" (lib.mapAttrsToList patchBuilder overrides));

pkgs/development/libraries/libvpx/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.13.1";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KTbzZ5/qCH+bCvatYZhFiWcT+L2duD40E2w/BUaRorQ=";
+    hash = "sha256-duU1exUg7JiKCtZfNxyb/y40hxsXeTIMShf9YounTWA=";
   };
 
   postPatch = ''

pkgs/development/libraries/libwpe/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libwpe";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchurl {
     url = "https://wpewebkit.org/releases/libwpe-${version}.tar.xz";
-    sha256 = "sha256-sdDNzw+Nu0lOZbD3kT41cQbamg1X9Pu3udEjim2+mt4=";
+    sha256 = "sha256-iuOAIsUMs0DJb9vuEhfx5Gq1f7wci6mBQlZau+2+Iu8=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libxml2/default.nix

···
 { stdenv
 , lib
 , fetchurl
-, fetchFromGitLab
 , zlib
 , pkg-config
 , autoreconfHook
···
 let
 libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.12.3-unstable-2023-12-14";
+  version = "2.12.4";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
   outputMan = "bin";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "GNOME";
-    repo = "libxml2";
-    rev = "f006355eda722cae204606b9f95ba51f5ce9189b";
-    hash = "sha256-3WE90KDZq4Uaawuulc3t2+R8duCqgjEGUDN4HSXxohY=";
+  src = fetchurl {
+    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+    hash = "sha256-SXNg5CPPC9merNt8YhXeqS5tbonulAOTwrrg53y5t9A=";
   };
 
   strictDeps = true;

pkgs/development/libraries/lmdb/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "lmdb";
-  version = "0.9.31";
+  version = "0.9.32";
 
   src = fetchFromGitLab {
     domain = "git.openldap.org";
     owner = "openldap";
     repo = "openldap";
     rev = "LMDB_${version}";
-    sha256 = "sha256-SBbo7MX3NST+OFPDtQshevIYrIsZD9bOkSsH91inMBw=";
+    sha256 = "sha256-29ZrGIiGqrvX+WsPRs2V25hPmAJSHTHaGo19nMldsb8=";
   };
 
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
···
       limited to the size of the virtual address space.
     '';
     homepage = "https://symas.com/lmdb/";
+    changelog = "https://git.openldap.org/openldap/openldap/-/blob/LMDB_${version}/libraries/liblmdb/CHANGES";
     maintainers = with maintainers; [ jb55 vcunat ];
     license = licenses.openldap;
     platforms = platforms.all;

pkgs/development/libraries/lzlib/default.nix

···
-{ lib, stdenv, fetchurl, texinfo, lzip }:
-
-stdenv.mkDerivation rec {
-  pname = "lzlib";
-  version = "1.13";
-  outputs = [ "out" "info" ];
-
-  nativeBuildInputs = [ texinfo lzip ];
-
-  src = fetchurl {
-    url = "mirror://savannah/lzip/${pname}/${pname}-${version}.tar.lz";
-    sha256 = "sha256-3ea9WzJTXxeyjJrCS2ZgfgJQUGrBQypBEso8c/XWYsM=";
-  };
-
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace Makefile.in --replace '-Wl,--soname=' '-Wl,-install_name,$(out)/lib/'
-  '';
-
-  makeFlags = [ "CC:=$(CC)" "AR:=$(AR)" ];
-  doCheck = true;
-
-  configureFlags = [ "--enable-shared" ];
-
-  meta = with lib; {
-    homepage = "https://www.nongnu.org/lzip/${pname}.html";
-    description =
-      "Data compression library providing in-memory LZMA compression and decompression functions, including integrity checking of the decompressed data";
-    license = licenses.bsd2;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ ehmry ];
-  };
-}

pkgs/development/libraries/mdk-sdk/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "mdk-sdk";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchurl {
     url = "https://github.com/wang-bin/mdk-sdk/releases/download/v${version}/mdk-sdk-linux-x64.tar.xz";
-    hash = "sha256-kRihFM2+vPg6OAL4ARz0dLLUvAFvZsbrCu5TBI6b2RI=";
+    hash = "sha256-0m0Rg5Gv7o748iXqHafHvHYX5jHjjnmYE09TbG4PNNY=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook ];

pkgs/development/libraries/mesa/default.nix

···
 */
 
 let
-  version = "23.3.3";
-  hash = "sha256-UYMHwAV/o87otY33i+Qx1N9ar6ftxg0JJ4stegqA87Q=";
+  version = "23.3.5";
+  hash = "sha256-acyxJ4ZB/1utccoPhmGIrrGpKq3E27nTX1CuvsW4tQ8=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
···
     ./musl.patch
 
     ./opencl.patch
-    ./disk_cache-include-dri-driver-path-in-cache-key.patch
 
     # Backports to fix build
     # FIXME: remove when applied upstream
···
     # https://gitlab.freedesktop.org/mesa/mesa/blob/master/docs/meson.html#L327
     "-Db_ndebug=true"
 
-    "-Ddisk-cache-key=${placeholder "drivers"}"
     "-Ddri-search-path=${libglvnd.driverLink}/lib/dri"
 
     "-Dplatforms=${lib.concatStringsSep "," eglPlatforms}"
···
 
   postFixup = lib.optionalString stdenv.isLinux ''
     # set the default search path for DRI drivers; used e.g. by X server
-    substituteInPlace "$dev/lib/pkgconfig/dri.pc" --replace "$drivers" "${libglvnd.driverLink}"
-    [ -f "$dev/lib/pkgconfig/d3d.pc" ] && substituteInPlace "$dev/lib/pkgconfig/d3d.pc" --replace "$drivers" "${libglvnd.driverLink}"
+    for pc in lib/pkgconfig/{dri,d3d}.pc; do
+      [ -f "$dev/$pc" ] && substituteInPlace "$dev/$pc" --replace "$drivers" "${libglvnd.driverLink}"
+    done
 
     # remove pkgconfig files for GL/EGL; they are provided by libGL.
     rm -f $dev/lib/pkgconfig/{gl,egl}.pc

pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch

···
-diff --git a/meson_options.txt b/meson_options.txt
-index 591ed957c85..6cb550593e3 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -519,6 +519,13 @@ option(
-   description : 'Enable direct rendering in GLX and EGL for DRI',
- )
- 
-+option(
-+  'disk-cache-key',
-+  type : 'string',
-+  value : '',
-+  description : 'Mesa cache key.'
-+)
-+
- option('egl-lib-suffix',
-   type : 'string',
-   value : '',
-diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index 1d23b92af7e..fbb4b04f3cf 100644
---- a/src/util/disk_cache.c
-+++ b/src/util/disk_cache.c
-@@ -218,8 +218,10 @@ disk_cache_type_create(const char *gpu_name,
- 
-    /* Create driver id keys */
-    size_t id_size = strlen(driver_id) + 1;
-+   size_t key_size = strlen(DISK_CACHE_KEY) + 1;
-    size_t gpu_name_size = strlen(gpu_name) + 1;
-    cache->driver_keys_blob_size += id_size;
-+   cache->driver_keys_blob_size += key_size;
-    cache->driver_keys_blob_size += gpu_name_size;
- 
-    /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -240,6 +242,7 @@ disk_cache_type_create(const char *gpu_name,
-    uint8_t *drv_key_blob = cache->driver_keys_blob;
-    DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
-    DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
-+   DRV_KEY_CPY(drv_key_blob, DISK_CACHE_KEY, key_size)
-    DRV_KEY_CPY(drv_key_blob, gpu_name, gpu_name_size)
-    DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
-    DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
-diff --git a/src/util/meson.build b/src/util/meson.build
-index eb88f235c47..eae5c54cc10 100644
---- a/src/util/meson.build
-+++ b/src/util/meson.build
-@@ -286,7 +286,12 @@ _libmesa_util = static_library(
-   include_directories : [inc_util, include_directories('format')],
-   dependencies : deps_for_libmesa_util,
-   link_with: [libmesa_util_sse41],
--  c_args : [c_msvc_compat_args],
-+  c_args : [
-+    c_msvc_compat_args,
-+    '-DDISK_CACHE_KEY="@0@"'.format(
-+      get_option('disk-cache-key')
-+    ),
-+  ],
-   gnu_symbol_visibility : 'hidden',
-   build_by_default : false
- )

pkgs/development/libraries/minizip/default.nix

···
   pname = "minizip";
   inherit (zlib) src version;
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-45853.patch";
-      url = "https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c.patch";
-      hash = "sha256-yayfe1g9HsvgMN28WF/MYkH7dGMX4PsK53FcnfL3InM=";
-    })
-  ];
-
   patchFlags = [ "-p3" ];
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/development/libraries/mpdecimal/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "mpdecimal";
-  version = "4.0.0";
+  version = "2.5.1";
   outputs = [ "out" "cxx" "doc" "dev" ];
 
   src = fetchurl {
     url = "https://www.bytereef.org/software/mpdecimal/releases/mpdecimal-${version}.tar.gz";
-    hash = "sha256-lCRFwyRbInMP1Bpnp8XCMdEcsbmTa5wPdjNPt9C0Row=";
+    hash = "sha256-n5zUwEH5m1xJ/7e1nZ8S2VtoPYhYVgiqVqYwdmeysh8=";
   };
 
   configureFlags = [ "LD=${stdenv.cc.targetPrefix}cc" ];

pkgs/development/libraries/nghttp2/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.57.0";
+  version = "1.59.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-xjdnfLrESU6q+LDgOGFzFGhFgw76/+To3JL7O0KOWtI=";
+    sha256 = "sha256-A1P8u6ENKl9304ouSS5eZ3tjexdxI0WkcyXDw1+0d/g=";
   };
 
   outputs = [ "out" "dev" "lib" "doc" "man" ];

pkgs/development/libraries/nng/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "nng";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "nanomsg";
     repo = "nng";
     rev = "v${version}";
-    hash = "sha256-6JFmoCELDkvDvTNy2ET4igFCc/J9wraN6Cl1lq9So1Q=";
+    hash = "sha256-CG6Gw/Qrbi96koF2VxKMYPMPT2Zj9U97vNk2JdrfRro=";
   };
 
   nativeBuildInputs = [ cmake ninja ]

pkgs/development/libraries/opencv/4.x.nix

···
   printEnabled = enabled: if enabled then "ON" else "OFF";
   withOpenblas = (enableBlas && blas.provider.pname == "openblas");
   #multithreaded openblas conflicts with opencv multithreading, which manifest itself in hung tests
-  #https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+  #https://github.com/OpenMathLib/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
   openblas_ = blas.provider.override { singleThreaded = true; };
 
   inherit (cudaPackages) cudaFlags cudaVersion;

pkgs/development/libraries/openldap/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "openldap";
-  version = "2.6.6";
+  version = "2.6.7";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
-    hash = "sha256-CC6ZjPVCmE1DY0RC2+EdqGB1nlEJBxUupXm9xC/jnqA=";
+    hash = "sha256-zXdfYlyUTteKPaGKA7A7CO6nPIqryXtBuzNumhCVSTA=";
   };
 
   # TODO: separate "out" and "bin"
···
 
     # skip flaky tests
     rm -f tests/scripts/test063-delta-multiprovider
+
+    # https://bugs.openldap.org/show_bug.cgi?id=10009
+    # can probably be re-added once https://github.com/cyrusimap/cyrus-sasl/pull/772
+    # has made it to a release
+    rm -f tests/scripts/test076-authid-rewrite
   '';
 
   doCheck = true;

pkgs/development/libraries/openssl/default.nix

···
   };
 
   openssl_3 = common {
-    version = "3.0.12";
-    hash = "sha256-+Tyejt3l6RZhGd4xdV/Ie0qjSGNmL2fd/LoU0La2m2E=";
+    version = "3.0.13";
+    hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
···
   };
 
   openssl_3_2 = common {
-    version = "3.2.0";
-    hash = "sha256-FMgm8Hx+QzcG+1xp+p4l2rlWhIRLTJYqLPG/GD60aQ4=";
+    version = "3.2.1";
+    hash = "sha256-g8cyn+UshQZ3115dCwyiRTCbl+jsvP3B39xKufrDWzk=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch

pkgs/development/libraries/p11-kit/default.nix

···
       --replace 'install_dir: prefix / p11_system_config' "install_dir: '$out/etc/pkcs11'"
   '';
 
+  preCheck = ''
+    # Tests run in fakeroot for non-root users (with Nix single-user install)
+    if [ "$(id -u)" != "0" ]; then
+      export FAKED_MODE=1
+    fi
+  '';
+
   meta = with lib; {
     description = "Library for loading and sharing PKCS#11 modules";
     longDescription = ''

pkgs/development/libraries/pipewire/default.nix

···
 { stdenv
 , lib
-, buildPackages
 , fetchFromGitLab
-, fetchpatch
 , python3
 , meson
 , ninja
···
 , readline # meson can't find <7 as those versions don't have a .pc file
 , lilv
 , makeFontsConf
-, callPackage
 , nixosTests
 , withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind
 , valgrind
···
 # Bluetooth codec only makes sense if general bluetooth enabled
 assert ldacbtSupport -> bluezSupport;
 
-let
-  mesonEnableFeature = b: if b then "enabled" else "disabled";
+stdenv.mkDerivation(finalAttrs: {
+  pname = "pipewire";
+  version = "1.0.3";
 
-  self = stdenv.mkDerivation rec {
-    pname = "pipewire";
-    version = "1.0.1";
+  outputs = [
+    "out"
+    "jack"
+    "dev"
+    "doc"
+    "man"
+    "installedTests"
+  ];
 
-    outputs = [
-      "out"
-      "jack"
-      "dev"
-      "doc"
-      "man"
-      "installedTests"
-    ];
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "pipewire";
+    repo = "pipewire";
+    rev = finalAttrs.version;
+    sha256 = "sha256-QVw7Q+RNo8BBy/uxoZeSQQn/vQcIl1bOiA9fYMR0+oI=";
+  };
 
-    src = fetchFromGitLab {
-      domain = "gitlab.freedesktop.org";
-      owner = "pipewire";
-      repo = "pipewire";
-      rev = version;
-      sha256 = "sha256-rvf0sZRgDDLcqroLg7hcMUqXD/4JT+3lBRX6/m+3Ry8=";
-    };
+  patches = [
+    # Load libjack from a known location
+    ./0060-libjack-path.patch
+    # Move installed tests into their own output.
+    ./0070-installed-tests-path.patch
+  ];
 
-    patches = [
-      # Load libjack from a known location
-      ./0060-libjack-path.patch
-      # Move installed tests into their own output.
-      ./0070-installed-tests-path.patch
-    ];
+  strictDeps = true;
+  nativeBuildInputs = [
+    docutils
+    doxygen
+    graphviz
+    meson
+    ninja
+    pkg-config
+    python3
+    glib
+  ];
 
-    strictDeps = true;
-    nativeBuildInputs = [
-      docutils
-      doxygen
-      graphviz
-      meson
-      ninja
-      pkg-config
-      python3
-      glib
-    ];
+  buildInputs = [
+    alsa-lib
+    dbus
+    glib
+    libjack2
+    libusb1
+    libselinux
+    libsndfile
+    lilv
+    ncurses
+    readline
+    udev
+    vulkan-headers
+    vulkan-loader
+    tinycompress
+  ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
+  ++ (if lib.meta.availableOn stdenv.hostPlatform webrtc-audio-processing_1 then [ webrtc-audio-processing_1 ] else [ webrtc-audio-processing ])
+  ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
+  ++ lib.optionals libcameraSupport [ libcamera libdrm ]
+  ++ lib.optional ffmpegSupport ffmpeg
+  ++ lib.optionals bluezSupport [ bluez libfreeaptx liblc3 sbc fdk_aac libopus ]
+  ++ lib.optional ldacbtSupport ldacbt
+  ++ lib.optional nativeModemManagerSupport modemmanager
+  ++ lib.optional pulseTunnelSupport libpulseaudio
+  ++ lib.optional zeroconfSupport avahi
+  ++ lib.optional raopSupport openssl
+  ++ lib.optional rocSupport roc-toolkit
+  ++ lib.optionals x11Support [ libcanberra xorg.libX11 xorg.libXfixes ]
+  ++ lib.optional mysofaSupport libmysofa
+  ++ lib.optional ffadoSupport ffado;
 
-    buildInputs = [
-      alsa-lib
-      dbus
-      glib
-      libjack2
-      libusb1
-      libselinux
-      libsndfile
-      lilv
-      ncurses
-      readline
-      udev
-      vulkan-headers
-      vulkan-loader
-      tinycompress
-    ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
-    ++ (if lib.meta.availableOn stdenv.hostPlatform webrtc-audio-processing_1 then [ webrtc-audio-processing_1 ] else [ webrtc-audio-processing ])
-    ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
-    ++ lib.optionals libcameraSupport [ libcamera libdrm ]
-    ++ lib.optional ffmpegSupport ffmpeg
-    ++ lib.optionals bluezSupport [ bluez libfreeaptx liblc3 sbc fdk_aac libopus ]
-    ++ lib.optional ldacbtSupport ldacbt
-    ++ lib.optional nativeModemManagerSupport modemmanager
-    ++ lib.optional pulseTunnelSupport libpulseaudio
-    ++ lib.optional zeroconfSupport avahi
-    ++ lib.optional raopSupport openssl
-    ++ lib.optional rocSupport roc-toolkit
-    ++ lib.optionals x11Support [ libcanberra xorg.libX11 xorg.libXfixes ]
-    ++ lib.optional mysofaSupport libmysofa
-    ++ lib.optional ffadoSupport ffado;
+  # Valgrind binary is required for running one optional test.
+  nativeCheckInputs = lib.optional withValgrind valgrind;
 
-    # Valgrind binary is required for running one optional test.
-    nativeCheckInputs = lib.optional withValgrind valgrind;
-
-    mesonFlags = [
-      "-Ddocs=enabled"
-      "-Dudevrulesdir=lib/udev/rules.d"
-      "-Dinstalled_tests=enabled"
-      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-      "-Dlibjack-path=${placeholder "jack"}/lib"
-      "-Dlibcamera=${mesonEnableFeature libcameraSupport}"
-      "-Dlibffado=${mesonEnableFeature ffadoSupport}"
-      "-Droc=${mesonEnableFeature rocSupport}"
-      "-Dlibpulse=${mesonEnableFeature pulseTunnelSupport}"
-      "-Davahi=${mesonEnableFeature zeroconfSupport}"
-      "-Dgstreamer=${mesonEnableFeature gstreamerSupport}"
-      "-Dsystemd-system-service=${mesonEnableFeature enableSystemd}"
-      "-Dudev=${mesonEnableFeature (!enableSystemd)}"
-      "-Dffmpeg=${mesonEnableFeature ffmpegSupport}"
-      "-Dbluez5=${mesonEnableFeature bluezSupport}"
-      "-Dbluez5-backend-hsp-native=${mesonEnableFeature nativeHspSupport}"
-      "-Dbluez5-backend-hfp-native=${mesonEnableFeature nativeHfpSupport}"
-      "-Dbluez5-backend-native-mm=${mesonEnableFeature nativeModemManagerSupport}"
-      "-Dbluez5-backend-ofono=${mesonEnableFeature ofonoSupport}"
-      "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
-      # source code is not easily obtainable
-      "-Dbluez5-codec-lc3plus=disabled"
-      "-Dbluez5-codec-lc3=${mesonEnableFeature bluezSupport}"
-      "-Dbluez5-codec-ldac=${mesonEnableFeature ldacbtSupport}"
-      "-Dsysconfdir=/etc"
-      "-Draop=${mesonEnableFeature raopSupport}"
-      "-Dsession-managers="
-      "-Dvulkan=enabled"
-      "-Dx11=${mesonEnableFeature x11Support}"
-      "-Dx11-xfixes=${mesonEnableFeature x11Support}"
-      "-Dlibcanberra=${mesonEnableFeature x11Support}"
-      "-Dlibmysofa=${mesonEnableFeature mysofaSupport}"
-      "-Dsdl2=disabled" # required only to build examples, causes dependency loop
-      "-Drlimits-install=false" # installs to /etc, we won't use this anyway
-      "-Dcompress-offload=enabled"
-      "-Dman=enabled"
-    ];
+  mesonFlags = [
+    (lib.mesonEnable "docs" true)
+    (lib.mesonOption "udevrulesdir" "lib/udev/rules.d")
+    (lib.mesonEnable "installed_tests" true)
+    (lib.mesonOption "installed_test_prefix" (placeholder "installedTests"))
+    (lib.mesonOption "libjack-path" "${placeholder "jack"}/lib")
+    (lib.mesonEnable "libcamera" libcameraSupport)
+    (lib.mesonEnable "libffado" ffadoSupport)
+    (lib.mesonEnable "roc" rocSupport)
+    (lib.mesonEnable "libpulse" pulseTunnelSupport)
+    (lib.mesonEnable "avahi" zeroconfSupport)
+    (lib.mesonEnable "gstreamer" gstreamerSupport)
+    (lib.mesonEnable "systemd-system-service" enableSystemd)
+    (lib.mesonEnable "udev" (!enableSystemd))
+    (lib.mesonEnable "ffmpeg" ffmpegSupport)
+    (lib.mesonEnable "bluez5" bluezSupport)
+    (lib.mesonEnable "bluez5-backend-hsp-native" nativeHspSupport)
+    (lib.mesonEnable "bluez5-backend-hfp-native" nativeHfpSupport)
+    (lib.mesonEnable "bluez5-backend-native-mm" nativeModemManagerSupport)
+    (lib.mesonEnable "bluez5-backend-ofono" ofonoSupport)
+    (lib.mesonEnable "bluez5-backend-hsphfpd" hsphfpdSupport)
+    # source code is not easily obtainable
+    (lib.mesonEnable "bluez5-codec-lc3plus" false)
+    (lib.mesonEnable "bluez5-codec-lc3" bluezSupport)
+    (lib.mesonEnable "bluez5-codec-ldac" ldacbtSupport)
+    (lib.mesonOption "sysconfdir" "/etc")
+    (lib.mesonEnable "raop" raopSupport)
+    (lib.mesonOption "session-managers" "")
+    (lib.mesonEnable "vulkan" true)
+    (lib.mesonEnable "x11" x11Support)
+    (lib.mesonEnable "x11-xfixes" x11Support)
+    (lib.mesonEnable "libcanberra" x11Support)
+    (lib.mesonEnable "libmysofa" mysofaSupport)
+    (lib.mesonEnable "sdl2" false) # required only to build examples, causes dependency loop
+    (lib.mesonBool "rlimits-install" false) # installs to /etc, we won't use this anyway
+    (lib.mesonEnable "compress-offload" true)
+    (lib.mesonEnable "man" true)
+  ];
 
-    # Fontconfig error: Cannot load default config file
-    FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
+  # Fontconfig error: Cannot load default config file
+  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
 
-    doCheck = true;
+  doCheck = true;
 
-    postUnpack = ''
-      patchShebangs source/doc/*.py
-      patchShebangs source/doc/input-filter-h.sh
-    '';
+  postUnpack = ''
+    patchShebangs source/doc/*.py
+    patchShebangs source/doc/input-filter-h.sh
+  '';
 
-    postInstall = ''
-      moveToOutput "bin/pw-jack" "$jack"
-    '';
+  postInstall = ''
+    moveToOutput "bin/pw-jack" "$jack"
+  '';
 
-    passthru.tests.installed-tests = nixosTests.installed-tests.pipewire;
+  passthru.tests.installed-tests = nixosTests.installed-tests.pipewire;
 
-    meta = with lib; {
-      description = "Server and user space API to deal with multimedia pipelines";
-      changelog = "https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/${version}";
-      homepage = "https://pipewire.org/";
-      license = licenses.mit;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ kranzes k900 ];
-    };
+  meta = with lib; {
+    description = "Server and user space API to deal with multimedia pipelines";
+    changelog = "https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/${version}";
+    homepage = "https://pipewire.org/";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kranzes k900 ];
   };
-
-in
-self
+})

pkgs/development/libraries/pixman/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "pixman";
-  version = "0.43.0";
+  version = "0.43.2";
 
   src = fetchurl {
     urls = [
       "mirror://xorg/individual/lib/${pname}-${version}.tar.gz"
       "https://cairographics.org/releases/${pname}-${version}.tar.gz"
     ];
-    hash = "sha256-plwoIJhY+xa+5Q2AnID5Co5BXA5P2DIQeKGCJ4WlVgo=";
+    hash = "sha256-6nkpflQY+1KNBGbotbkdG+iIV/o3BvSXd7KSWnKumSQ=";
   };
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;

pkgs/development/libraries/qca/default.nix

···
   isQt6 = lib.versions.major qtbase.version == "6";
 in stdenv.mkDerivation rec {
   pname = "qca";
-  version = "2.3.7";
+  version = "2.3.8";
 
   src = fetchurl {
     url = "mirror://kde/stable/qca/${version}/qca-${version}.tar.xz";
-    sha256 = "sha256-/uI0O1RofVvj4w+zPOKW7lCseuXiPXq3JfY//fevP0M=";
+    sha256 = "sha256-SHWcqGoCAkYdkIumYTQ4DMO7fSD+08AxufwCiXlqgmQ=";
   };
 
   buildInputs = [ openssl qtbase qt5compat ];

pkgs/development/libraries/qpdf/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "qpdf";
-  version = "11.6.3";
+  version = "11.8.0";
 
   src = fetchFromGitHub {
     owner = "qpdf";
     repo = "qpdf";
     rev = "v${version}";
-    hash = "sha256-asGNZ/5iEkyIjRO9FECV1bN4k/YHv4/7I125BUr9+fE=";
+    hash = "sha256-EoFCRAWia8LAaLdoBW0ByndzIAjSvQ7bJFh0SZ/FKtY=";
   };
 
   nativeBuildInputs = [ cmake perl ];

pkgs/development/libraries/qt-6/modules/qtwebengine.nix

···
   ] ++ lib.optionals enableProprietaryCodecs [
     "-DQT_FEATURE_webengine_proprietary_codecs=ON"
   ] ++ lib.optionals stdenv.isDarwin [
-    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.targetPlatform.darwinSdkVersion}"
+    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.hostPlatform.darwinSdkVersion}"
   ];
 
   propagatedBuildInputs = [

pkgs/development/libraries/qxmpp/default.nix

···
 
 mkDerivation rec {
   pname = "qxmpp";
-  version = "1.5.5";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "qxmpp-project";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-V24VlfXR1Efk5kzxHWh/OIZzx4L/jLoXyjoNjtDDyTY=";
+    sha256 = "sha256-5NPqNQuVuRz9GfrJULSmTiYHUMe6VxoaQZDHhYCguWQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/s2n-tls/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Kq4jl/ss+Xf5/zv18QWuIyXZDyz8mk3av4mdRoQrvJY=";
+    hash = "sha256-E3Giiu8xiTCSAPkbxOaVL/LXZWjhAS1M/n//Pe5eOKg=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/science/math/openblas/default.nix

···
 # Multi-threaded applications must not call a threaded OpenBLAS
 # (the only exception is when an application uses OpenMP as its
 # *only* form of multi-threading). See
-#     https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
-#     https://github.com/xianyi/OpenBLAS/issues/2543
+#     https://github.com/OpenMathLib/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+#     https://github.com/OpenMathLib/OpenBLAS/issues/2543
 # This flag builds a single-threaded OpenBLAS using the flags
 # stated in thre.
 , singleThreaded ? false
 , buildPackages
 # Select a specific optimization target (other than the default)
-# See https://github.com/xianyi/OpenBLAS/blob/develop/TargetList.txt
+# See https://github.com/OpenMathLib/OpenBLAS/blob/develop/TargetList.txt
 , target ? null
 # Select whether DYNAMIC_ARCH is enabled or not.
 , dynamicArch ? null
···
 , octave
 , opencv
 , python3
+, openmp ? null
 }:
 
 let blas64_ = blas64; in
···
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.25";
+  version = "0.3.26";
 
   outputs = [ "out" "dev" ];
 
   src = fetchFromGitHub {
-    owner = "xianyi";
+    owner = "OpenMathLib";
     repo = "OpenBLAS";
     rev = "v${version}";
-    hash = "sha256-eY/R7gLDOls3csuwZkUS+x+v3GeL3dCsOD+4STxDpCg=";
+    hash = "sha256-AA3+x3SXkcg3g7bROZYLpWAbxnRedmQBZPe+rBJKxJ8=";
   };
 
   postPatch = ''
···
     which
   ];
 
+  buildInputs = lib.optional (stdenv.cc.isClang && config.USE_OPENMP) openmp;
+
   depsBuildBuild = [
     buildPackages.gfortran
     buildPackages.stdenv.cc
···
         else stdenv.hostPlatform != stdenv.buildPlatform;
     # This disables automatic build job count detection (which honours neither enableParallelBuilding nor NIX_BUILD_CORES)
     # and uses the main make invocation's job count, falling back to 1 if no parallelism is used.
-    # https://github.com/xianyi/OpenBLAS/blob/v0.3.20/getarch.c#L1781-L1792
+    # https://github.com/OpenMathLib/OpenBLAS/blob/v0.3.20/getarch.c#L1781-L1792
     MAKE_NB_JOBS = 0;
-  } // (lib.optionalAttrs singleThreaded {
-    # As described on https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+  } // (lib.optionalAttrs stdenv.cc.isClang {
+    LDFLAGS = "-L${lib.getLib buildPackages.gfortran.cc}/lib"; # contains `libgfortran.so`; building with clang needs this, gcc has it implicit
+  }) // (lib.optionalAttrs singleThreaded {
+    # As described on https://github.com/OpenMathLib/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
     USE_THREAD = false;
     USE_LOCKING = true; # available with openblas >= 0.3.7
     USE_OPENMP = false; # openblas will refuse building with both USE_OPENMP=1 and USE_THREAD=0
···
 
   postInstall = ''
     # Write pkgconfig aliases. Upstream report:
-    # https://github.com/xianyi/OpenBLAS/issues/1740
+    # https://github.com/OpenMathLib/OpenBLAS/issues/1740
     for alias in blas cblas lapack; do
       cat <<EOF > $out/lib/pkgconfig/$alias.pc
 Name: $alias
···
   meta = with lib; {
     description = "Basic Linear Algebra Subprograms";
     license = licenses.bsd3;
-    homepage = "https://github.com/xianyi/OpenBLAS";
+    homepage = "https://github.com/OpenMathLib/OpenBLAS";
     platforms = attrNames configs;
     maintainers = with maintainers; [ ttuegel ];
   };

pkgs/development/libraries/science/math/suitesparse/default.nix

···
 , config
 , enableCuda ? config.cudaSupport
 , cudaPackages
+, openmp ? null
 }:
 
 stdenv.mkDerivation rec {
···
     gfortran.cc.lib
     gmp
     mpfr
+  ] ++ lib.optionals stdenv.cc.isClang [
+    openmp
   ] ++ lib.optionals enableCuda [
     cudaPackages.cuda_cudart.dev
     cudaPackages.cuda_cudart.lib

pkgs/development/libraries/speexdsp/default.nix

···
 , autoreconfHook
 , pkg-config
 , fftw
-, withFftw3 ? true
+, withFftw3 ? (!stdenv.hostPlatform.isMinGW)
 }:
 
 stdenv.mkDerivation rec {
···
     homepage = "https://www.speex.org/";
     description = "An Open Source/Free Software patent-free audio compression format designed for speech";
     license = licenses.bsd3;
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
   };
 }

pkgs/development/libraries/sqlite/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.44.2";
+  version = "3.45.1";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
-    url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-HGcZoUi8Qc8PK7vjkm184/XKCdh48SRvzCB2exdbtAc=";
+    url = "https://sqlite.org/2024/sqlite-autoconf-${archiveVersion version}.tar.gz";
+    hash = "sha256-zZwnhBt6WTLJiXZR4guGxwHddAVWmJsByllvz6PUmgo=";
   };
 
   outputs = [ "bin" "dev" "out" ];

pkgs/development/libraries/sqlite/tools.nix

···
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.44.2";
+    version = "3.45.1";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
-      url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-cxh0c/63RQk1fo+my5/WcVOy0BDQCusv3bbO6xirryc=";
+      url = "https://sqlite.org/2024/sqlite-src-${archiveVersion version}.zip";
+      hash = "sha256-f3sUpo7bzUpX3zqMTb1W0tNUam583VDeQM6wOvM9NLo=";
     };
 
     nativeBuildInputs = [ unzip ];

pkgs/development/libraries/umockdev/default.nix

···
 , lib
 , docbook-xsl-nons
 , fetchurl
+, fetchpatch
 , glib
 , gobject-introspection
 , gtk-doc
···
 , ninja
 , pkg-config
 , python3
-, systemd
+, substituteAll
+, systemdMinimal
 , usbutils
 , vala
 , which
···
     # Hardcode absolute paths to libraries so that consumers
     # do not need to set LD_LIBRARY_PATH themselves.
     ./hardcode-paths.patch
+
+    # Replace references to udevadm with an absolute paths, so programs using
+    # umockdev will just work without having to provide it in their test environment
+    # $PATH.
+    (substituteAll {
+      src = ./substitute-udevadm.patch;
+      udevadm = "${systemdMinimal}/bin/udevadm";
+    })
+
+    (fetchpatch {
+      name = "musl.patch";
+      url = "https://github.com/martinpitt/umockdev/commit/d4efe24be59bd859b87473ea3d7efe8100bedc74.patch";
+      hash = "sha256-whf3p2e7FWN1xk5+HF9KsbMW74DPOQ0R0+FxBfCZTX0=";
+    })
   ];
 
   nativeBuildInputs = [
···
 
   buildInputs = [
     glib
-    systemd
+    systemdMinimal
     libpcap
   ];
 
···
 
   nativeCheckInputs = [
     python3
-    which
     usbutils
+    which
   ];
+
+  strictDeps = true;
 
   mesonFlags = [
     "-Dgtk_doc=true"

pkgs/development/libraries/umockdev/substitute-udevadm.patch

···
+From 09efbe8090f501c60975d5467fb587ed633d6a01 Mon Sep 17 00:00:00 2001
+From: Florian Klink <[e-mail]>
+Date: Wed, 24 Jan 2024 14:29:28 +0200
+Subject: [PATCH] substitute udevadm
+
+---
+ src/umockdev-record.vala     | 2 +-
+ tests/test-umockdev-run.vala | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/umockdev-record.vala b/src/umockdev-record.vala
+index 2d49bc8..272f25e 100644
+--- a/src/umockdev-record.vala
++++ b/src/umockdev-record.vala
+@@ -223,7 +223,7 @@ record_device(string dev)
+     int exitcode;
+     try {
+         Process.spawn_sync(null,
+-                           {"udevadm", "info", "--query=all", "--path", dev},
++                           {"@udevadm@", "info", "--query=all", "--path", dev},
+                            null,
+                            SpawnFlags.SEARCH_PATH,
+                            null,
+diff --git a/tests/test-umockdev-run.vala b/tests/test-umockdev-run.vala
+index cd00a08..94616cb 100644
+--- a/tests/test-umockdev-run.vala
++++ b/tests/test-umockdev-run.vala
+@@ -199,8 +199,8 @@ A: size=1048576\n
+ 
+     // unfortunately the udevadm output between distros is not entirely constant
+     assert (get_program_out (
+-            "udevadm",
+-            umockdev_run_command + "-d " + umockdev_file + " -- udevadm info --query=all --name=/dev/loop23",
++            "@udevadm@",
++            umockdev_run_command + "-d " + umockdev_file + " -- @udevadm@ info --query=all --name=/dev/loop23",
+             out sout, out serr, out exit));
+ 
+     assert_cmpstr (serr, CompareOperator.EQ, "");
+-- 
+2.43.0
+

pkgs/development/libraries/vaapi-vdpau/default.nix

···
                   sha256 = "15snqf60ib0xb3cnav5b2r55qv8lv2fa4p6jwxajh8wbvqpw0ibz"; })
     (fetchpatch { url = "https://src.fedoraproject.org/rpms/libva-vdpau-driver/raw/0ad71107e28a60ea453ac70e895cf64342bd58d0/f/implement-vaquerysurfaceattributes.patch";
                   sha256 = "1dapx3bqqblw6l2iqqw1yff6qifam8q4m2rq343kwb3dqhy2ymy5"; })
-    (fetchpatch { url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/x11-libs/libva-vdpau-driver/files/libva-vdpau-driver-0.7.4-include-linux-videodev2.h.patch";
+    (fetchpatch { url = "https://github.com/gentoo/gentoo/raw/34d5cc6fcf1d76c1c2833cb534717246c221214c/x11-libs/libva-vdpau-driver/files/libva-vdpau-driver-0.7.4-include-linux-videodev2.h.patch";
                   sha256 = "1m4is6lk580mppsx2mvdv1xifj6gvx724si4qynsm9qrdfdc9fby"; })
   ];
 

pkgs/development/libraries/wayland/protocols.nix

···
 
 stdenv.mkDerivation rec {
   pname = "wayland-protocols";
-  version = "1.32";
+  version = "1.33";
 
   # https://gitlab.freedesktop.org/wayland/wayland-protocols/-/issues/48
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform && stdenv.hostPlatform.linker == "bfd" && wayland.withLibraries;
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
-    hash = "sha256-dFl5nTQMgpa2le+FfAfd7yTFoJsJq2p097kmQNKxuhE=";
+    hash = "sha256-lPDFCwkNbmGgP2IEhGexmrvoUb5OEa57NvZfi5jDljo=";
   };
 
   postPatch = lib.optionalString doCheck ''

pkgs/development/libraries/webrtc-audio-processing/default.nix

···
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchurl
 , darwin
 , abseil-cpp
 , meson
···
     rev = "v${version}";
     hash = "sha256-8CDt4kMt2Owzyv22dqWIcFuHeg4Y3FxB405cLw3FZ+g=";
   };
+
+  patches = [
+    # Fix an include oppsie that happens to not happen on glibc
+    # https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/merge_requests/38
+    (fetchurl {
+      url = "https://git.alpinelinux.org/aports/plain/community/webrtc-audio-processing-1/0001-rtc_base-Include-stdint.h-to-fix-build-failures.patch?id=625e19c19972e69e034c0870a31b375833d1ab5d";
+      hash = "sha256-9nI22SJoU0H3CzsPSAObtCFTadtvkzdnqIh6mxmUuds=";
+    })
+  ];
 
   outputs = [ "out" "dev" ];
 

pkgs/development/libraries/zlib/default.nix

···
 # If false, and if `{ static = true; }`, the .a stays in the main output.
 , splitStaticOutput ? shared && static
 , testers
+, minizip
 }:
 
 # Without either the build will actually still succeed because the build
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zlib";
-  version = "1.3";
+  version = "1.3.1";
 
   src = let
     inherit (finalAttrs) version;
···
       # Stable archive path, but captcha can be encountered, causing hash mismatch.
       "https://www.zlib.net/fossils/zlib-${version}.tar.gz"
     ];
-    hash = "sha256-/wukwpIBPbwnUws6geH5qBPNOd4Byl4Pi/NVcC76WT4=";
+    hash = "sha256-mpOyt9/ax3zrpaVYpYDnRmfdb+3kWFuR7vtg8Dty3yM=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
···
     "SHARED_MODE=1"
   ];
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru.tests = {
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    # uses `zlib` derivation:
+    inherit minizip;
+  };
 
   meta = with lib; {
     homepage = "https://zlib.net";

pkgs/development/misc/resholve/oildev.nix

···
       rm cpp/stdlib.h # keep modules from finding the wrong stdlib?
       # work around hard parse failure documented in oilshell/oil#1468
       substituteInPlace osh/cmd_parse.py --replace 'elif self.c_id == Id.Op_LParen' 'elif False'
+    '' + lib.optionalString (!stdenv.hostPlatform.isGnu && !stdenv.hostPlatform.isDarwin) ''
+      # disable fragile libc tests
+      substituteInPlace build/py.sh --replace "py-ext-test pyext/libc_test.py" "#py-ext-test pyext/libc_test.py"
     '';
 
     # See earlier note on glibcLocales TODO: verify needed?

pkgs/development/php-packages/phalcon/default.nix

···
 
 buildPecl rec {
   pname = "phalcon";
-  version = "5.6.0";
+  version = "5.6.1";
 
   src = fetchFromGitHub {
     owner = "phalcon";
     repo = "cphalcon";
     rev = "v${version}";
-    hash = "sha256-EtwhWRBqJOMndmsy+Rgc4MVjFZg/Fm97qkSuTGxqHhI=";
+    hash = "sha256-1dCtj3pJGOY7sRe6xx8JgPPLSj/6qMemUnqrt9guPIk=";
   };
 
   internalDeps = [ php.extensions.session php.extensions.pdo ];

pkgs/development/php-packages/swoole/default.nix

···
-{ lib, stdenv, buildPecl, php, valgrind, pcre2, fetchFromGitHub }:
+{ lib
+, stdenv
+, buildPecl
+, php
+, valgrind
+, pcre2
+, fetchFromGitHub
+ }:
 
 let
-  version = "5.0.3";
+  version = "5.1.2";
 in buildPecl {
   inherit version;
   pname = "swoole";
···
     owner = "swoole";
     repo = "swoole-src";
     rev = "v${version}";
-    sha256 = "sha256-xadseYMbA+llzTf9JFIitJK2iR0dN8vAjv3n9/e7FGs=";
+    hash = "sha256-WTsntvauiooj081mOoFcK6CVpnCCR/cEQtJbsOIJ/wo=";
   };
 
   buildInputs = [ pcre2 ] ++ lib.optionals (!stdenv.isDarwin) [ valgrind ];
 
-  doCheck = true;
-  checkTarget = "tests";
+  # tests require internet access
+  doCheck = false;
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/swoole/swoole-src/releases/tag/v${version}";
     description = "Coroutine-based concurrency library for PHP";
-    license = licenses.asl20;
-    homepage = "https://www.swoole.co.uk/";
-    maintainers = teams.php.members;
+    homepage = "https://www.swoole.com";
+    license = lib.licenses.asl20;
+    maintainers = lib.teams.php.members;
   };
 }

pkgs/development/python-modules/aiohttp/default.nix

···
 , aiodns
 , brotli
 # tests_require
+, freezegun
 , gunicorn
 , pytest-mock
 , pytestCheckHook
 , python-on-whales
 , re-assert
-, time-machine
 , trustme
 }:
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.9.1";
+  version = "3.9.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "aio-libs";
     repo = "aiohttp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uiqBUDbmROrhkanfBz4avvTSrnKxgVqw54k4jKhfRGY=";
+    hash = "sha256-dEeMHruFJ1o0J6VUJcpUk7LhEC8sV8hUKXoKcd618lE=";
   };
 
   patches = [
···
 
   # NOTE: pytest-xdist cannot be added because it is flaky. See https://github.com/NixOS/nixpkgs/issues/230597 for more info.
   nativeCheckInputs = [
+    freezegun
     gunicorn
     pytest-mock
     pytestCheckHook
     python-on-whales
     re-assert
-    time-machine
   ] ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) [
     # Optional test dependency. Depends indirectly on pyopenssl, which is
     # broken on aarch64-darwin.

pkgs/development/python-modules/ansible/core.nix

···
 
 buildPythonPackage rec {
   pname = "ansible-core";
-  version = "2.16.2";
+  version = "2.16.3";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5KtVnn5SWxxvmQhPyoc7sBR3XV7L6EW3wHuOnWycBIs=";
+    hash = "sha256-dqh2WoWGBk7wc6KZVi4wj6LBgKdbX3Vpu9D2HUFxzbM=";
   };
 
   # ansible_connection is already wrapped, so don't pass it through

pkgs/development/python-modules/ansible/default.nix

···
 
 let
   pname = "ansible";
-  version = "9.1.0";
+  version = "9.2.0";
 in
 buildPythonPackage {
   inherit pname version;
···
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WtlJkfsODlOncKn/zxtoBH9hsigtlIp9JoLs2PuPob8=";
+    hash = "sha256-ogekoApF5c0Xin+UykKv4m8jydJ75JkB6oxF0YoHt8Y=";
   };
 
   postPatch = ''

pkgs/development/python-modules/boto3-stubs/default.nix

···
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.37";
+  version = "1.34.38";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xmGMcSa6wDN8BeFh6cQo/rxX1qJNf/Yt5G5ndh9ALFc=";
+    hash = "sha256-0eS0vVozFiDs3yXKEParV3EUrTxUoPSLHziz+GJ1eZA=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/botocore-stubs/default.nix

···
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.37";
+  version = "1.34.38";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-1rzqimhyqkbTiQJ9xcAiJB/QogR6i4WKpQBeYVHtMKc=";
+    hash = "sha256-2oA3lMD3BMZuQI/oCaFDzMnH6p4zXpBmKtp9AfweUgg=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix

···
 
 let
   pname = "chacha20poly1305-reuseable";
-  version = "0.12.0";
+  version = "0.12.1";
 in
 
 buildPythonPackage {
···
     owner = "bdraco";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-g1sLmYy5SClkdBSjFFYtikh2nuxfTIoaCyktqoFl+Ho=";
+    hash = "sha256-jgbtDpl2hXmfzmsiIIG6+B3QoekuAjBJGMxQJPX4ynA=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/cryptography/default.nix

···
 , buildPythonPackage
 , callPackage
 , cargo
+, certifi
 , cffi
 , cryptography-vectors ? (callPackage ./vectors.nix { })
 , fetchPypi
-, hypothesis
-, iso8601
+, fetchpatch2
 , isPyPy
 , libiconv
 , libxcrypt
 , openssl
 , pkg-config
 , pretend
-, py
-, pytest-subtests
+, pytest-xdist
 , pytestCheckHook
 , pythonOlder
-, pytz
 , rustc
 , rustPlatform
 , Security
···
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "41.0.7"; # Also update the hash in vectors.nix
+  version = "42.0.2"; # Also update the hash in vectors.nix
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-E/k86b6oAWwlOzSvxr1qdZk+XEBnLtVAWpyDLw1KALw=";
+    hash = "sha256-4OxSujx/G32BPNUmSaWz7x/A1DMhncjJOCfFfqts+Ig=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-VeZhKisCPDRvmSjGNwCgJJeVj65BZ0Ge+yvXbZw86Rw=";
+    hash = "sha256-jw/FC5rQO77h6omtBp0Nc2oitkVbNElbkBUduyprTIc=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # skip overflowing tests on 32 bit; https://github.com/pyca/cryptography/pull/10366
+      url = "https://github.com/pyca/cryptography/commit/d741901dddd731895346636c0d3556c6fa51fbe6.patch";
+      hash = "sha256-eC+MZg5O8Ia5CbjRE4y+JhaFs3Q5c62QtPHr3x9T+zw=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "--benchmark-disable" ""
+      --replace-fail "--benchmark-disable" ""
   '';
 
   cargoRoot = "src/rust";
···
   ];
 
   nativeCheckInputs = [
+    certifi
     cryptography-vectors
-    hypothesis
-    iso8601
     pretend
-    py
     pytestCheckHook
-    pytest-subtests
-    pytz
+    pytest-xdist
   ];
 
   pytestFlagsArray = [

pkgs/development/python-modules/cryptography/vectors.nix

···
 , buildPythonPackage
 , fetchPypi
 , cryptography
-, setuptools
+, flit-core
 }:
 
 buildPythonPackage rec {
···
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-ezb5drbljMGAExDhyTxYTGU503Haf4U47dj8Rj3IDVs=";
+    hash = "sha256-rc3M9dnuZhqWAq0h0lJfZ4ugem52jOeYNZlOIIurDhY=";
   };
 
   nativeBuildInputs = [
-    setuptools
+    flit-core
   ];
 
   # No tests included

pkgs/development/python-modules/deebot-client/default.nix

···
 
 buildPythonPackage rec {
   pname = "deebot-client";
-  version = "5.1.0";
+  version = "5.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
···
     owner = "DeebotUniverse";
     repo = "client.py";
     rev = "refs/tags/${version}";
-    hash = "sha256-XKsS0Ty3n6rQW+f+4lLCc4i9DBqs3b6R5FEIr8L11UE=";
+    hash = "sha256-axz31GboqaWAcBU8DtG700Se6rX7VV7eBrQBDazG+Ig=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/django/4.nix

···
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.2.9";
+  version = "4.2.10";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EkmMw8uLyAOFOf756Q6V9QdQJDbB8MOmc0ETJPpnXRQ=";
+    hash = "sha256-sSYO04GxChF1PHNERAjhmGnzJB/EXJhc1VowF3x4nRM=";
   };
 
   patches = [

pkgs/development/python-modules/evohome-async/default.nix

···
 
 buildPythonPackage rec {
   pname = "evohome-async";
-  version = "0.4.17";
+  version = "0.4.18";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
···
     owner = "zxdavb";
     repo = "evohome-async";
     rev = "refs/tags/${version}";
-    hash = "sha256-8Dl23U0LynNPxDpo79CmA4H8o2knU2rrtNYwDPZBVRQ=";
+    hash = "sha256-EXgq74/RfQ9AHlyZlDLfXtKFgYg37WA1Q3x3g+W9lz0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/faraday-agent-parameters-types/default.nix

···
 , packaging
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "faraday-agent-parameters-types";
-  version = "1.3.1";
-  format = "setuptools";
+  version = "1.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "faraday_agent_parameters_types";
     inherit version;
-    hash = "sha256-yWDZPa9+DZh2Bj9IIeIVFpAt9nhQOk2tTZh02difsCs=";
+    hash = "sha256-pene97VKOX8mZEQgHkOBDu72Dpww2D9nDjA94s5F9rM=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-warn '"pytest-runner",' ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     marshmallow
     packaging
···
   nativeCheckInputs = [
     pytestCheckHook
   ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"pytest-runner",' ""
-  '';
 
   pythonImportsCheck = [
     "faraday_agent_parameters_types"

pkgs/development/python-modules/faraday-plugins/default.nix

···
 , pythonOlder
 , pytz
 , requests
+, setuptools
 , simplejson
 , tabulate
 }:
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.15.1";
-  format = "setuptools";
+  version = "1.16.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
···
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "refs/tags/${version}";
-    hash = "sha256-cJ7gFE8zTN+7fp4EY8ZRwjS8i0r+8WaIH/EdY89nZew=";
+    hash = "sha256-1haWRuWK9WCgdR4geT2w3E95+CapBYDohGowUmnJ2H4=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "version=version," "version='${version}',"
+      --replace-warn "version=version," "version='${version}',"
   '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     beautifulsoup4

pkgs/development/python-modules/fastapi/default.nix

···
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.104.1";
-  format = "pyproject";
+  version = "0.109.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
···
     owner = "tiangolo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-xTTFBc+fswLYUhKRkWP/eiYSbG3j1E7CASkEtHVNTlk=";
+    hash = "sha256-iZBc0tYGmhQuOL/pdthhBYYnZhe+wEttoinePNAIgEs=";
   };
 
   nativeBuildInputs = [
···
     # ignoring deprecation warnings to avoid test failure from
     # tests/test_tutorial/test_testing/test_tutorial001.py
     "-W ignore::DeprecationWarning"
-
-    # http code mismatches
-    "--deselect=tests/test_annotated.py::test_get"
   ];
 
   disabledTestPaths = [
-    # Disabled tests require orjson which requires rust nightly
-    "tests/test_default_response_class.py"
     # Don't test docs and examples
     "docs_src"
     # databases is incompatible with SQLAlchemy 2.0
···
     "tests/test_tutorial/test_sql_databases"
   ];
 
-  disabledTests = [
-    "test_get_custom_response"
-    # Failed: DID NOT RAISE <class 'starlette.websockets.WebSocketDisconnect'>
-    "test_websocket_invalid_data"
-    "test_websocket_no_credentials"
-    # TypeError: __init__() missing 1...starlette-releated
-    "test_head"
-    "test_options"
-    "test_trace"
-    # Unexpected number of warnings caught
-    "test_warn_duplicate_operation_id"
-    # assert state["except"] is True
-    "test_dependency_gets_exception"
-    # Fixtures drift
-    "test_openapi_schema_sub"
-    # 200 != 404
-    "test_flask"
-  ];
-
   pythonImportsCheck = [
     "fastapi"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/tiangolo/fastapi/releases/tag/${version}";
     description = "Web framework for building APIs";
     homepage = "https://github.com/tiangolo/fastapi";
     license = licenses.mit;

pkgs/development/python-modules/findimports/default.nix

···
 , fetchFromGitHub
 , python
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "findimports";
-  version = "2.3.0";
-  format = "setuptools";
+  version = "2.4.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "mgedmin";
-    repo = pname;
+    repo = "findimports";
     rev = "refs/tags/${version}";
-    hash = "sha256-yA1foeGhgOXZArc/nZfS1tbGyONXJZ9lW+Zcx7hCedM=";
+    hash = "sha256-ar05DYSc/raYC1RJyLCxDYnd7Zjx20aczywlb6wc67Y=";
   };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   pythonImportsCheck = [
     "findimports"

pkgs/development/python-modules/flask-api/default.nix

···
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, fetchpatch
+
+# build-system
+, setuptools
+
+# dependencies
 , flask
+
+# tests
 , markdown
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  pname = "Flask-API";
+  pname = "flask-api";
   version = "3.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
···
     hash = "sha256-nHgeI5FLKkDp4uWO+0eaT4YSOMkeQ0wE3ffyJF+WzTM=";
   };
 
+  patches = [
+    (fetchpatch {
+      # werkzeug 3.0 support
+      url = "https://github.com/flask-api/flask-api/commit/9c998897f67d8aa959dc3005d7d22f36568b6938.patch";
+      hash = "sha256-vaCZ4gVlfQXyeksA44ydkjz2FxODHt3gTTP+ukJwEGY=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     flask
+  ];
+
+  nativeCheckInputs = [
     markdown
+    pytestCheckHook
   ];
 
   meta = with lib; {

pkgs/development/python-modules/flask-autoindex/default.nix

···
-{ lib
-, buildPythonPackage
-, fetchPypi
-, flask
-, flask-silk
-, future
-, pythonOlder
-, unittestCheckHook
-}:
-
-buildPythonPackage rec {
-  pname = "flask-autoindex";
-  version = "0.6.6";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    pname = "Flask-AutoIndex";
-    inherit version;
-    sha256 = "ea319f7ccadf68ddf98d940002066278c779323644f9944b300066d50e2effc7";
-  };
-
-  propagatedBuildInputs = [
-    flask
-    flask-silk
-    future
-  ];
-
-  nativeCheckInputs = [
-    unittestCheckHook
-  ];
-
-  pythonImportsCheck = [
-    "flask_autoindex"
-  ];
-
-  meta = with lib; {
-    description = "The mod_autoindex for Flask";
-    longDescription = ''
-      Flask-AutoIndex generates an index page for your Flask application automatically.
-      The result is just like mod_autoindex, but the look is more awesome!
-    '';
-    homepage = "https://flask-autoindex.readthedocs.io/";
-    changelog = "https://github.com/general03/flask-autoindex/blob/v${version}/CHANGELOG.md";
-    license = licenses.bsd2;
-    maintainers = teams.sage.members;
-    # https://github.com/general03/flask-autoindex/issues/67
-    broken = true;
-  };
-}

pkgs/development/python-modules/flask-basicauth/default.nix

···
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, fetchpatch
-, flask
-, python
-}:
-
-buildPythonPackage rec {
-  pname = "flask-basicauth";
-  version = "0.2.0";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "jpvanhal";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-han0OjMI1XmuWKHGVpk+xZB+/+cpV1I+659zOG3hcPY=";
-  };
-
-  patches = [
-    (fetchpatch {
-      # The unit tests fail due to an invalid import:
-      #   from flask.ext.basicauth import BasicAuth
-      #
-      # This patch replaces it with the correct import:
-      #   from flask_basicauth import BasicAuth
-      #
-      # The patch uses the changes from this pull request,
-      # and therefore can be removed once this pull request
-      # has been merged:
-      #   https://github.com/jpvanhal/flask-basicauth/pull/29
-      name = "fix-test-flask-ext-imports.patch";
-      url = "https://github.com/jpvanhal/flask-basicauth/commit/23f57dc1c3d85ea6fc7f468e8d8c6f19348a0a81.patch";
-      hash = "sha256-njUYjO0TRe3vr5D0XjIfCNcsFlShbGxtFV/DJerAKDE=";
-    })
-  ];
-
-  propagatedBuildInputs = [ flask ];
-
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} -m unittest discover
-    runHook postCheck
-  '';
-
-  pythonImportsCheck = [ "flask_basicauth" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/jpvanhal/flask-basicauth";
-    description = "HTTP basic access authentication for Flask";
-    license = licenses.mit;
-    maintainers = with maintainers; [ wesnel ];
-  };
-}

pkgs/development/python-modules/flask-gravatar/default.nix

···
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
+
+# build-system
+, setuptools
+
+# dependencies
 , flask
+
+# tests
 , pytestCheckHook
 , pygments
 }:
···
     sha256 = "YGZfMcLGEokdto/4Aek+06CIHGyOw0arxk0qmSP1YuE=";
   };
 
+  patches = [
+    (fetchpatch {
+      # flask 3.0 compat
+      url = "https://github.com/zzzsochi/Flask-Gravatar/commit/d74d70d9695c464b602c96c2383d391b38ed51ac.patch";
+      hash = "sha256-tCKkA2io/jhvrh6RhTeEw4AKnIZc9hsqTf2qItUsdjo=";
+    })
+  ];
+
   postPatch = ''
     sed -i setup.py \
      -e "s|tests_require=tests_require,||g" \
···
      --replace "--cov=flask_gravatar --cov-report=term-missing" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     flask
   ];
···
     pygments
   ];
 
-  pythonImportsCheck = [ "flask_gravatar" ];
+  pythonImportsCheck = [
+    "flask_gravatar"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/zzzsochi/Flask-Gravatar";

pkgs/development/python-modules/flask-marshmallow/default.nix

···
 
 buildPythonPackage rec {
   pname = "flask-marshmallow";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "marshmallow-code";
     repo = "flask-marshmallow";
     rev = "refs/tags/${version}";
-    hash = "sha256-+5L4OfBRMkS6WRXT7dI/uuqloc/PZgu+DFvOCinByh8=";
+    hash = "sha256-QoktZcyVJXkHr8fCVYt3ZkYq52nxCsZu+AgaDyrZHWs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/flask-restful/default.nix

···
   # conditional so that overrides are easier for web applications
   patches = lib.optionals (lib.versionAtLeast werkzeug.version "2.1.0") [
     ./werkzeug-2.1.0-compat.patch
+  ] ++ lib.optionals (lib.versionAtLeast flask.version "3.0.0") [
+    ./flask-3.0-compat.patch
   ];
 
   propagatedBuildInputs = [

pkgs/development/python-modules/flask-restful/flask-3.0-compat.patch

···
+diff --git a/tests/test_api.py b/tests/test_api.py
+index 582ee5a..20db1f5 100644
+--- a/tests/test_api.py
++++ b/tests/test_api.py
+@@ -1,7 +1,7 @@
+ import unittest
+ import json
+ from flask import Flask, Blueprint, redirect, views, abort as flask_abort
+-from flask.signals import got_request_exception, signals_available
++from flask.signals import got_request_exception
+ try:
+     from mock import Mock
+ except:
+@@ -491,10 +491,6 @@ class APITestCase(unittest.TestCase):
+         self.assertEqual(api.default_mediatype, resp.headers['Content-Type'])
+ 
+     def test_handle_error_signal(self):
+-        if not signals_available:
+-            # This test requires the blinker lib to run.
+-            print("Can't test signals without signal support")
+-            return
+         app = Flask(__name__)
+         api = flask_restful.Api(app)
+ 

pkgs/development/python-modules/flask-session-captcha/default.nix

···
 { lib
 , fetchFromGitHub
+, fetchpatch
 , buildPythonPackage
+
+# build-system
+, setuptools
+
+# dependencies
+, captcha
 , flask
-, flask-sessionstore
+, markupsafe
+
+# tests
 , flask-sqlalchemy
-, captcha
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "flask-session-captcha";
   version = "1.3.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Tethik";
···
     hash = "sha256-V0f3mXCfqwH2l3OtJKOHGdrlKAFxs2ynqXvNve7Amkc=";
   };
 
-  propagatedBuildInputs = [ flask flask-sessionstore captcha ];
+  patches = [
+    (fetchpatch {
+      # https://github.com/Tethik/flask-session-captcha/pull/44
+      url = "https://github.com/Tethik/flask-session-captcha/commit/3f79c22a71c60dd60e9df61b550cce641603dcb6.patch";
+      hash = "sha256-MXsoSytBNbcg3HU6IWlvf2MgNUL78T5ToxKGv4YMtZw=";
+    })
+  ];
 
-  pythonImportsCheck = [ "flask_session_captcha" ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  nativeCheckInputs = [ flask-sqlalchemy pytestCheckHook ];
+  propagatedBuildInputs = [
+    captcha
+    flask
+    markupsafe
+  ];
+
+  pythonImportsCheck = [
+    "flask_session_captcha"
+  ];
 
   # RuntimeError: Working outside of application context.
   doCheck = false;
+
+  nativeCheckInputs = [
+    flask-sqlalchemy
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "A captcha implemention for flask";

pkgs/development/python-modules/flask-sessionstore/default.nix

···
-{ lib
-, fetchPypi
-, buildPythonPackage
-, flask
-, nose
-}:
-
-buildPythonPackage rec {
-  pname = "flask-sessionstore";
-  version = "0.4.5";
-  format = "setuptools";
-
-  src = fetchPypi {
-    pname = "Flask-Sessionstore";
-    inherit version;
-    hash = "sha256-AQ3jWrnw2UI8L3nFEx4AhDwGP4R8Tr7iBMsDS5jLQPQ=";
-  };
-
-  propagatedBuildInputs = [ flask ];
-
-  pythonImportsCheck = [ "flask_sessionstore" ];
-
-  nativeCheckInputs = [ nose ];
-
-  checkPhase = ''
-    nosetests -s
-  '';
-
-  meta = with lib; {
-    description = "Session Storage Backends for Flask";
-    homepage = "https://github.com/mcrowson/flask-sessionstore";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ Flakebi ];
-  };
-}

pkgs/development/python-modules/flask/default.nix

···
 { lib
 , buildPythonPackage
 , fetchPypi
-, asgiref
+, pythonOlder
+
+# build-system
+, flit-core
+
+# dependencies
 , blinker
 , click
-, flit-core
 , importlib-metadata
 , itsdangerous
 , jinja2
+, werkzeug
+
+# optional-dependencies
+, asgiref
 , python-dotenv
-, werkzeug
+
+# tests
+, greenlet
 , pytestCheckHook
-, pythonOlder
-  # used in passthru.tests
+
+# reverse dependencies
 , flask-limiter
 , flask-restful
 , flask-restx
···
 
 buildPythonPackage rec {
   pname = "flask";
-  version = "2.3.3";
+  version = "3.0.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CcNHqSqn/0qOfzIGeV8w2CZlS684uHPQdEzVccpgnvw=";
+    hash = "sha256-ZIn1G7Nmbe9vMU4V8Z1QoYaaGa4OjJo2Qf/mbHfUJAM=";
   };
 
   nativeBuildInputs = [
···
     itsdangerous
     jinja2
     werkzeug
-  ] ++ lib.optional (pythonOlder "3.10") importlib-metadata;
+  ] ++ lib.optionals (pythonOlder "3.10") [
+    importlib-metadata
+  ];
+
+  passthru.optional-dependencies = {
+    async = [
+      asgiref
+    ];
+    dotenv = [
+      python-dotenv
+    ];
+  };
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    greenlet
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   passthru.tests = {
     inherit flask-limiter flask-restful flask-restx moto;
   };
-  passthru.optional-dependencies = {
-    dotenv = [ python-dotenv ];
-    async = [ asgiref ];
-  };
 
   meta = with lib; {
+    changelog = "https://flask.palletsprojects.com/en/${versions.majorMinor version}.x/changes/#version-${replaceStrings [ "." ] [ "-" ] version}";
     homepage = "https://flask.palletsprojects.com/";
     description = "The Python micro framework for building web applications";
     longDescription = ''

pkgs/development/python-modules/fontparts/default.nix

···
-{ lib, buildPythonPackage, fetchPypi, python, pythonOlder
-, fonttools, lxml, fs, unicodedata2
-, defcon, fontpens, fontmath, booleanoperations
-, pytest, setuptools-scm
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch2
+, pythonOlder
+
+# build-system
+, setuptools
+, setuptools-scm
+
+# dependencies
+, fonttools
+, defcon
+, fontmath
+, booleanoperations
+
+# tests
+, python
 }:
 
 buildPythonPackage rec {
-  pname = "fontParts";
+  pname = "fontparts";
   version = "0.12.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "fontParts";
+    inherit version;
     hash = "sha256-eeU13S1IcC+bsiK3YDlT4rVDeXDGcxx1wY/is8t5pCA=";
     extension = "zip";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  patches = [
+    (fetchpatch2 {
+      # replace remaining usage of assertEquals for Python 3.12 support
+      # https://github.com/robotools/fontParts/pull/720
+      url = "https://github.com/robotools/fontParts/commit/d7484cd98051aa1588683136da0bb99eac31523b.patch";
+      hash = "sha256-maoUgbmXY/RC4TUZI4triA9OIfB4T98qjUaQ94uhsbg=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     booleanoperations
-    fonttools
-    unicodedata2  # fonttools[unicode] extra
-    lxml          # fonttools[lxml] extra
-    fs            # fonttools[ufo] extra
     defcon
-    fontpens      # defcon[pens] extra
     fontmath
-  ];
+    fonttools
+  ]
+  ++ defcon.optional-dependencies.pens
+  ++ fonttools.optional-dependencies.ufo
+  ++ fonttools.optional-dependencies.lxml
+  ++ fonttools.optional-dependencies.unicode;
 
   checkPhase = ''
     runHook preCheck
     ${python.interpreter} Lib/fontParts/fontshell/test.py
     runHook postCheck
   '';
-  nativeCheckInputs = [ pytest ];
 
   meta = with lib; {
     description = "An API for interacting with the parts of fonts during the font development process.";

pkgs/development/python-modules/fpdf2/default.nix

···
 , qrcode
 , camelot
 , uharfbuzz
+, lxml
 }:
 
 buildPythonPackage rec {
   pname = "fpdf2";
-  version = "2.7.6";
+  version = "2.7.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "py-pdf";
     repo = "fpdf2";
     rev = version;
-    hash = "sha256-wiCKmS+GlrYV2/6TEdXUbmWIMWU4hyzswFJZR9EOWxc=";
+    hash = "sha256-6B68kwxAW3cHpwMTDhj3C4zEOR6o6USqpSXB7uxcEXs=";
   };
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "--cov=fpdf --cov-report=xml" ""
+      --replace-fail "--cov=fpdf --cov-report=xml" ""
   '';
 
   nativeBuildInputs = [ setuptools ];
···
     qrcode
     camelot
     uharfbuzz
+    lxml
   ];
 
   disabledTestPaths = [

pkgs/development/python-modules/geoalchemy2/default.nix

···
 
 buildPythonPackage rec {
   pname = "geoalchemy2";
-  version = "0.14.3";
+  version = "0.14.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "geoalchemy";
     repo = "geoalchemy2";
     rev = "refs/tags/${version}";
-    hash = "sha256-L3/gLbiEF2VEqyhfVPnREMUPFbf9cD3tqGJ+AbThPkQ=";
+    hash = "sha256-zMd/hHobFBPre0bZA1e2S9gPWnIkeImZhSySlIDxYsg=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/google-cloud-appengine-logging/default.nix

···
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-appengine-logging";
-  version = "1.4.0";
-  format = "setuptools";
+  version = "1.4.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/nT0GNCwHr6+g64hKr8FGtQmkqY2Z345fePUWeANe2Q=";
+    hash = "sha256-mQXHwww8K77dCxMuKycfyCRzM+vJMdLSOvG7vRG0Nf4=";
   };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     google-api-core

pkgs/development/python-modules/google-cloud-datacatalog/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-cloud-datacatalog";
-  version = "3.18.0";
+  version = "3.18.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rqWuOJlyB2EN3+qydRMJHLwK7RAFxUT7eEUZiAfOseE=";
+    hash = "sha256-xjf6yWXgfJFEHw1lYSryfe86UMsM1Y4fGRffDTne20U=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix

···
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-websecurityscanner";
-  version = "1.14.0";
-  format = "setuptools";
+  version = "1.14.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tb8BCpQtEj/0/dGSqTf+c0V0NwGZYx8y0oEHpoJWqhM=";
+    hash = "sha256-+RupyR6W5fYR1n28anASGIXI6J53CU4WG1QC+HIZi/Y=";
   };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     google-api-core

pkgs/development/python-modules/griffe/default.nix

···
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.40.0";
+  version = "0.40.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
···
     owner = "mkdocstrings";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-VUQmyNO2e4SoXzGbd751l7TtRgvaiWOr75gSGwKGPUI=";
+    hash = "sha256-DaLxGEwR2Z9IEkKbLkOy7Q3dvvmwTNBNMzYxNoeZMJE=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/grpcio-status/default.nix

···
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.60.0";
+  version = "1.60.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8Q4LbbOtwP3CRLcZYoFO6YKZbvBhhkRrVpW5+mNaoas=";
+    hash = "sha256-YbWquJiUmOiqFCwguIgp6l2Q0YwYyFO5+ebUB9N7+LQ=";
   };
 
   postPatch = ''

pkgs/development/python-modules/grpcio-testing/default.nix

···
 
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.60.0";
+  version = "1.60.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XF+za8O9x4m/8ewEBQG5reoPiK64vh7VyA1oic0Jq0A=";
+    hash = "sha256-vvrZX0fes/OTTr1VEpl0jqo/Y+44btlq1pemZFNWixc=";
   };
 
   postPatch = ''

pkgs/development/python-modules/grpcio-tools/default.nix

···
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.60.0";
+  version = "1.60.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7TBJk0AijXM/9p/PSmZZDteSH5TrWiv2kiWLEoC52sc=";
+    hash = "sha256-2ggiSrhnXG1GS5iL2MoCzM0r8Cdbzu/o9iGb/UpPXoU=";
   };
 
   postPatch = ''

pkgs/development/python-modules/grpcio/default.nix

···
 buildPythonPackage rec {
   pname = "grpcio";
   format = "setuptools";
-  version = "1.60.0";
+  version = "1.60.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IZkWWhr/tmaqJK3wyXQ2aG0KYbxfwRPAN3Aft8f865Y=";
+    hash = "sha256-3R06jR0uUK2bWeEKp/B8fRvis2fz8tM8X63pbtVGCWI=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/python-modules/hatchling/default.nix

···
 
 buildPythonPackage rec {
   pname = "hatchling";
-  version = "1.21.0";
+  version = "1.21.1";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XAhncjV6UHI7gl/V2lJ4rH42l833eX0HVBpskLb/dUw=";
+    hash = "sha256-u6RARToiTn1EeEV/oujYw2M3Zbr6Apdaa1O5v5F5gLw=";
   };
 
   # listed in backend/pyproject.toml

pkgs/development/python-modules/hdf5plugin/default.nix

···
 
 buildPythonPackage rec {
   pname = "hdf5plugin";
-  version = "4.3.0";
+  version = "4.4.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "silx-kit";
     repo = "hdf5plugin";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xOSGykG6D2Am/gnAPoqLOvIQz6FfxRQe9lPyRHxUoew=";
+    hash = "sha256-MnqY1PyGzo31H696J9CekiA2rJrUYzUMDC3UJMZaFLA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/httpbin/default.nix

···
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pythonRelaxDepsHook
 
 # build-system
···
     inherit pname version;
     hash = "sha256-e4WWvrDnWntlPDnR888mPW1cR20p4d9ve7K3C/nwaj0=";
   };
+
+  patches = [
+    (fetchpatch {
+      # backport flask 3.0 support; drop after 0.10.1
+      url = "https://github.com/psf/httpbin/commit/c1d9e33049263fed3cb27806a97f094acc350905.patch";
+      hash = "sha256-SYJgQN3ERDgLIaBc4eqDfey+EX4z6CSxLoAA7j+16xI=";
+    })
+  ];
 
   nativeBuildInputs = [
     setuptools

pkgs/development/python-modules/httpx/default.nix

···
 
 buildPythonPackage rec {
   pname = "httpx";
-  version = "0.25.2";
+  version = "0.26.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-rGtIrs4dffs7Ndtjb400q7JrZh+HG9k0uwHw9pRlC5s=";
+    hash = "sha256-qMMx1CYu2/yH4NRvZFzJOflAPIbcvMYJqU4r+chuzl0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/iminuit/default.nix

···
 
 buildPythonPackage rec {
   pname = "iminuit";
-  version = "2.25.0";
+  version = "2.25.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e99ZRg05Dy0DznVcAVGy7D0gMwC8UVQb+Ch7Q8EgTGY=";
+    hash = "sha256-uCn/wdte1nHc0aSeBFk3duZXXPOmbMfOdHf8ZkI/hj4=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/ipython/default.nix

···
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "8.18.1";
-  format = "pyproject";
-  disabled = pythonOlder "3.8";
+  version = "8.20.0";
+  pyproject = true;
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ym8Hm7M0V8ZuIz5FgOv8QSiFW0z2Nw3d1zhCqVY+iic=";
+    hash = "sha256-LyG9P8HVFVDInuOUSuBLvHvHnhKeoJN9pubGi/2/EXo=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/jaxlib/bin.nix

···
 }:
 
 let
-  inherit (cudaPackagesGoogle) cudatoolkit cudnn;
+  inherit (cudaPackagesGoogle) cudatoolkit cudnn cudaVersion;
 
   version = "0.4.23";
 
···
       };
     };
 
-  # Find new releases at https://storage.googleapis.com/jax-releases/jax_releases.html.
+  # Note that the prebuilt jaxlib binary requires specific version of CUDA to
+  # work. The cuda12 jaxlib binaries only works with CUDA 12.2, and cuda11
+  # jaxlib binaries only works with CUDA 11.8. This is why we need to find a
+  # binary that matches the provided cudaVersion.
+  gpuSrcVersionString = "cuda${cudaVersion}-${pythonVersion}";
+
+  # Find new releases at https://storage.googleapis.com/jax-releases
   # When upgrading, you can get these hashes from prefetch.sh. See
   # https://github.com/google/jax/issues/12879 as to why this specific URL is the correct index.
   gpuSrcs = {
-    "3.9" = fetchurl {
+    "cuda12.2-3.9" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp39-cp39-manylinux2014_x86_64.whl";
       hash = "sha256-our2mSwHPdjVoDAZP+9aNUkJ+vxv1Tq7G5UqA9HvhNI=";
     };
-    "3.10" = fetchurl {
+    "cuda12.2-3.10" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp310-cp310-manylinux2014_x86_64.whl";
       hash = "sha256-jkIABnJZnn7A6n9VGs/MldzdDiKwWh0fEvl7Vqn85Kg=";
     };
-    "3.11" = fetchurl {
+    "cuda12.2-3.11" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp311-cp311-manylinux2014_x86_64.whl";
       hash = "sha256-dMUcRnHjl8NyUeO3P1x7CNgF0iAHFKIzUtHh+/CNkow=";
     };
-    "3.12" = fetchurl {
+    "cuda12.2-3.12" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp312-cp312-manylinux2014_x86_64.whl";
       hash = "sha256-kXJ6bUwX+QybqYPV9Kpwv+lhdoGEFRr4+1T0vfXoWRo=";
     };
+    "cuda11.8-3.9" = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn86-cp39-cp39-manylinux2014_x86_64.whl";
+      hash = "sha256-m2Y5p12gF3OaADu+aGw5RjcKFrj9RB8xzNWnKNpSz60=";
+    };
+    "cuda11.8-3.10" = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn86-cp310-cp310-manylinux2014_x86_64.whl";
+      hash = "osha256-aQ7iX3o0kQ4liPexv7dkBVWVTUpaty83L083MybGkf0=";
+    };
+    "cuda11.8-3.11" = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn86-cp311-cp311-manylinux2014_x86_64.whl";
+      hash = "sha256-uIEyjEmv0HBaiYVl5PuICTI9XnH4zAfQ1l9tjALRcP4=";
+    };
   };
 
 in
···
       (
         cpuSrcs."${pythonVersion}-${stdenv.hostPlatform.system}"
           or (throw "jaxlib-bin is not supported on ${stdenv.hostPlatform.system}")
-      ) else gpuSrcs."${pythonVersion}";
+      ) else gpuSrcs."${gpuSrcVersionString}";
 
   # Prebuilt wheels are dynamically linked against things that nix can't find.
   # Run `autoPatchelfHook` to automagically fix them.
···
     broken =
       !(cudaSupport -> (cudaPackagesGoogle ? cudatoolkit) && lib.versionAtLeast cudatoolkit.version "11.1")
       || !(cudaSupport -> (cudaPackagesGoogle ? cudnn) && lib.versionAtLeast cudnn.version "8.2")
-      || !(cudaSupport -> stdenv.isLinux);
+      || !(cudaSupport -> stdenv.isLinux)
+      || !(cudaSupport -> (gpuSrcs ? "cuda${cudaVersion}-${pythonVersion}"));
   };
 }

pkgs/development/python-modules/json-logging/default.nix

···
 , httpx
 , pytestCheckHook
 , pythonOlder
+, quart
 , requests
 , sanic
 , uvicorn
···
     flask
     httpx
     pytestCheckHook
-    # quart
+    quart
     requests
     sanic
     uvicorn

pkgs/development/python-modules/meilisearch/default.nix

···
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.29.0";
+  version = "0.30.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "meilisearch";
     repo = "meilisearch-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jquaxJ+4/yaPsPqer+v2UY1N60U71ig4nowqm/KRIeA=";
+    hash = "sha256-gcDJUTg84JugytbUzQzvm3I9YAIboiyvcHe4AcBmpFM=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/molecule/plugins.nix

···
 
 buildPythonPackage rec {
   pname = "molecule-plugins";
-  version = "23.5.0";
+  version = "23.5.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8T6gR7hlDIkmBLgbdjgryAu0riXqULI/MOgf2dWAKv8=";
+    hash = "sha256-orFDfVMtc24/vG23pp7FM+IzSyEV/5JFoLJ3LtlzjSM=";
   };
 
   # reverse the dependency

pkgs/development/python-modules/mplfinance/default.nix

···
     description = "Matplotlib utilities for the visualization, and visual analysis, of financial data";
     homepage = "https://github.com/matplotlib/mplfinance";
     license = [ licenses.bsd3 ];
-    maintainers = [ maintainers.ehmry ];
   };
 }

pkgs/development/python-modules/numpy/default.nix

···
 
   # we default openblas to build with 64 threads
   # if a machine has more than 64 threads, it will segfault
-  # see https://github.com/xianyi/OpenBLAS/issues/2993
+  # see https://github.com/OpenMathLib/OpenBLAS/issues/2993
   preConfigure = ''
     sed -i 's/-faltivec//' numpy/distutils/system_info.py
     export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))

pkgs/development/python-modules/openai/default.nix

···
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "1.10.0";
+  version = "1.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7.1";
···
     owner = "openai";
     repo = "openai-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VffgHJLsfnT3xqELV7Ze1o1rqohKxscC3SDthP8TwzI=";
+    hash = "sha256-PtxKQQfcM4aOlqU0qIJDpB/24Wkt/omx+uDk4mRZU4s=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pcbnew-transition/default.nix

···
 }:
 buildPythonPackage rec {
   pname = "pcbnewTransition";
-  version = "0.3.4";
+  version = "0.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3CJUG1kd63Lg0r9HpJRIvttHS5s2EuZRoxeXrqsJ/kQ=";
+    hash = "sha256-M4r6IeARVZq+KO7Q0tbHFD/BMeLN6vmuxfnstmMPgdg=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pdm-backend/default.nix

···
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.1.7";
+  version = "2.1.8";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     rev = "refs/tags/${version}";
-    hash = "sha256-1YM/vba+8+2wKcWzPKzkpaWVmHqbFsYdhQSY/VBBAfo=";
+    hash = "sha256-d8i+FvxNFPM18W7NmOwh9bqZnMUenF7eCPdcCw4BT7s=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;

pkgs/development/python-modules/pillow/default.nix

···
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "10.1.0";
+  version = "10.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    pname = "Pillow";
+    pname = "pillow";
     inherit version;
-    hash = "sha256-5r+N5sNu2WyG6jtuHVJzxT9G71GKBiRkzX713Sz5Ljg=";
+    hash = "sha256-6H8LLHgVfhLXaGsn1jwHD9ZdmU6N2ubzKODc9KDNAH4=";
   };
 
   passthru.tests = {

pkgs/development/python-modules/pluggy/default.nix

···
 
 buildPythonPackage rec {
   pname = "pluggy";
-  version = "1.3.0";
+  version = "1.4.0";
 
   disabled = pythonOlder "3.8";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = "pluggy";
     rev = "refs/tags/${version}";
-    hash = "sha256-jLasnqmATIOoheGu90Wo1+iTCwslYzNOKckqHIZDJec=";
+    hash = "sha256-1XHJwODmpYQkYZvnZck6RrtT4lOeCf8cr1QFx9DCbzw=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];

pkgs/development/python-modules/psutil/default.nix

···
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.9.6";
+  version = "5.9.8";
   format = "setuptools";
 
   inherit stdenv;
···
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5Lkt3NfdTN0/kAGA6h4QSTLHvOI0+4iXbio7KWRBIlo=";
+    hash = "sha256-a+Em4yJUht/yhqj7mgYkalJT9MfFO0depfWsk05kGUw=";
   };
+
+  postPatch = ''
+    # stick to the old SDK name for now
+    # https://developer.apple.com/documentation/iokit/kiomasterportdefault/
+    # https://developer.apple.com/documentation/iokit/kiomainportdefault/
+    substituteInPlace psutil/arch/osx/cpu.c \
+      --replace-fail kIOMainPortDefault kIOMasterPortDefault
+  '';
 
   buildInputs =
     # workaround for https://github.com/NixOS/nixpkgs/issues/146760

pkgs/development/python-modules/pubnub/default.nix

···
 , pytest-asyncio
 , requests
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pubnub";
-  version = "7.3.2";
-  format = "setuptools";
+  version = "7.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
···
     owner = pname;
     repo = "python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-J6vwdOI/GM/K0TxRwIgkXibNAc+n9wVCpmMkzMhBepw=";
+    hash = "sha256-XYovKAk2GEMi7GE/DVtLjMbww7guGkZzDOHC7Z6ZpJo=";
   };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     aiohttp

pkgs/development/python-modules/py-aosmith/default.nix

···
 , fetchFromGitHub
 , poetry-core
 , aiohttp
+, tenacity
 }:
 
 buildPythonPackage rec {
   pname = "py-aosmith";
-  version = "1.0.6";
+  version = "1.0.8";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
···
     owner = "bdr99";
     repo = "py-aosmith";
     rev = "refs/tags/${version}";
-    hash = "sha256-4KODe+urqYMbN0+tNwQnvO3A9Zc/Xdo4uhJErn3BYS4=";
+    hash = "sha256-TjBjyWxBPrZEY/o1DZ+GiFTHTW37WwFN0oyJSyGru28=";
   };
 
   nativeBuildInputs = [
···
 
   propagatedBuildInputs = [
     aiohttp
+    tenacity
   ];
 
   pythonImportsCheck = [ "py_aosmith" ];

pkgs/development/python-modules/pycaption/default.nix

···
 
 buildPythonPackage rec {
   pname = "pycaption";
-  version = "2.2.3";
+  version = "2.2.4";
 
   disabled = pythonOlder "3.8";
 
···
     owner = "pbs";
     repo = "pycaption";
     rev = "refs/tags/${version}";
-    hash = "sha256-uPzeMuYoNgluXnwSMQE5lSkduBzwi8mP8K5cAKdTZUw=";
+    hash = "sha256-aUhNvqeSNtbnRVp4yxsk4q3szNfR0m1zo0MpkBOCokY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pycfmodel/default.nix

···
 , buildPythonPackage
 , fetchFromGitHub
 , httpx
-, pydantic
+, pydantic_1
 , pytestCheckHook
 , pythonOlder
 , setuptools
···
 
 buildPythonPackage rec {
   pname = "pycfmodel";
-  version = "0.21.2";
+  version = "0.22.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "Skyscanner";
     repo = "pycfmodel";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nQIZ9fwk8CdqJawYsU5qiu9xxhi9X0IxhlPohHUDTL8=";
+    hash = "sha256-NLi94W99LhrBXNFItMfJczV9EZlgvmvkavrfDQJs0YU=";
   };
 
   nativeBuildInputs = [
···
   ];
 
   propagatedBuildInputs = [
-    pydantic
+    pydantic_1
   ];
 
   nativeCheckInputs = [
···
     changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
-    broken = versionAtLeast pydantic.version "2";
   };
 }

pkgs/development/python-modules/pydantic-settings/default.nix

···
 , pytest-mock
 }:
 
-buildPythonPackage rec {
+let self = buildPythonPackage rec {
   pname = "pydantic-settings";
   version = "2.1.0";
   pyproject = true;
···
     export HOME=$TMPDIR
   '';
 
+  # ruff is a dependency of pytest-examples which is required to run the tests.
+  # We do not want all of the downstream packages that depend on pydantic-settings to also depend on ruff.
+  doCheck = false;
+  passthru.tests = {
+    pytest = self.overridePythonAttrs {
+      doCheck = true;
+    };
+  };
+
   meta = with lib; {
     description = "Settings management using pydantic";
     homepage = "https://github.com/pydantic/pydantic-settings";
···
     broken = lib.versionOlder pydantic.version "2.0.0";
     maintainers = with maintainers; [ ];
   };
-}
+}; in self

pkgs/development/python-modules/pymicrobot/default.nix

···
 
 buildPythonPackage rec {
   pname = "pymicrobot";
-  version = "0.0.10";
+  version = "0.0.12";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
   src = fetchPypi {
     pname = "PyMicroBot";
     inherit version;
-    hash = "sha256-A7qfRl958x0vsr/sxvK50M7fGUBFhdGiA+tbHOdk8gE=";
+    hash = "sha256-Ysg97ApwbraRn19Mn5pJsg91dzf/njnNZiBJQKZqIbQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pymodbus/default.nix

···
 
 buildPythonPackage rec {
   pname = "pymodbus";
-  version = "3.5.4";
+  version = "3.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "pymodbus-dev";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-IgGDYNIRS39t8vHkJSGnDGCTKxpeIYZyedLzyS5pOI0=";
+    hash = "sha256-SYdjM3wFZD+bAOd0vRFe6N5UwF+1Wv97ooihJjKV8K0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pyorthanc/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyorthanc";
-  version = "1.16.0";
+  version = "1.16.1";
   disabled = pythonOlder "3.8";
 
   format = "pyproject";
···
     owner = "gacou54";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-qwH3kJzJRHuuGW7tgcaQjT+JwDsAZksQDZciaJLC55Q=";
+    hash = "sha256-6l3L0YUAqedyRjlQ6K3SaAMdGK2C0AeKpJj6MyXi4RA=";
   };
 
   nativeBuildInputs = [ pythonRelaxDepsHook poetry-core ];

pkgs/development/python-modules/pytest/default.nix

···
 
 buildPythonPackage rec {
   pname = "pytest";
-  version = "7.4.3";
+  version = "7.4.4";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2YnRNpgt5OOynavMg4rVgcZOjtUsEfvobd69naCBjNU=";
+    hash = "sha256-LPAAWSLGrOSj4uyLQIDrDZdT/ckxB0FTMvUM6eeZQoA=";
   };
 
   outputs = [

pkgs/development/python-modules/python-memcached/default.nix

···
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
+, memcached
 , mock
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "python-memcached";
-  version = "1.61";
+  version = "1.62";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "linsomniac";
     repo = "python-memcached";
     rev = version;
-    hash = "sha256-7bUCVAmOJ6znVmTZg9AJokOuym07NHL12gZgQ2uhfNo=";
+    hash = "sha256-Qko4Qr9WofeklU0uRRrSPrT8YaBYMCy0GP+TF7YZHLI=";
   };
 
   nativeBuildInputs = [
···
   ];
 
   nativeCheckInputs = [
+    memcached
     mock
     pytestCheckHook
   ];
 
-  # all tests fail
-  doCheck = false;
+  preCheck = ''
+    memcached &
+  '';
+
+  postCheck = ''
+    kill %%
+  '';
+
+  __darwinAllowLocalNetworking = true;
 
   pythonImportsCheck = [ "memcache" ];
 

pkgs/development/python-modules/qdrant-client/default.nix

···
 
 buildPythonPackage rec {
   pname = "qdrant-client";
-  version = "1.7.2";
+  version = "1.7.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "qdrant";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-nGZV8ORThVxH+Q1xfpqUwPGw6LUoTZXj4KgfTLCvUEc=";
+    hash = "sha256-VU2/kK7zpiuHbPtt1Qh8pdgen4KoIIKsyC479LATO84=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/qpsolvers/default.nix

···
 , buildPythonPackage
 , unittestCheckHook
 , flit-core
+, numpy
+, scipy
+
+# optional dependencies
+, clarabel
+, cvxopt
 , daqp
 , ecos
-, numpy
+, gurobipy
 , osqp
-, scipy
+, quadprog
 , scs
-, quadprog
 }:
 buildPythonPackage rec {
   pname = "qpsolvers";
···
     hash = "sha256-/HLc9dFf9F/6W7ux2Fj2yJuV/xCVeGyO6MblddwIGdM=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   pythonImportsCheck = [ "qpsolvers" ];
 
   propagatedBuildInputs = [
-    daqp
-    ecos
     numpy
-    osqp
     scipy
-    scs
   ];
 
+  passthru.optional-dependencies = {
+    # FIXME commented out solvers have not been packaged yet
+    clarabel = [ clarabel ];
+    cvxopt = [ cvxopt ];
+    daqp = [ daqp ];
+    ecos = [ ecos ];
+    gurobi = [ gurobipy ];
+    # highs = [ highspy ];
+    # mosek = [ cvxopt mosek ];
+    osqp = [ osqp ];
+    # piqp = [ piqp ];
+    # proxqp = [ proxsuite ];
+    # qpalm = [ qpalm ];
+    quadprog = [ quadprog ];
+    scs = [ scs ];
+    open_source_solvers = with passthru.optional-dependencies; lib.flatten [
+      clarabel cvxopt daqp ecos /* highs */ osqp /* piqp proxqp qpalm */ quadprog scs
+    ];
+  };
+
   nativeCheckInputs = [
-    flit-core
-    quadprog
     unittestCheckHook
-  ];
+  ] ++ passthru.optional-dependencies.open_source_solvers;
 
   meta = with lib; {
     changelog = "https://github.com/qpsolvers/qpsolvers/blob/${src.rev}/CHANGELOG.md";

pkgs/development/python-modules/quart/default.nix

···
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 
 # build-system
 , poetry-core
···
 , aiofiles
 , blinker
 , click
+, flask
 , hypercorn
 , importlib-metadata
 , itsdangerous
···
 
 buildPythonPackage rec {
   pname = "quart";
-  version = "0.18.4";
+  version = "0.19.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pallets";
     repo = "quart";
     rev = "refs/tags/${version}";
-    hash = "sha256-iT/pePUtH1hwNIOG8Y/YbqCVseNXVOKC0nrXfB2RTlQ=";
+    hash = "sha256-EgCZ0AXK2vGxo55BWAcDVv6zNUrWNbAYNnEXEBJk+84=";
   };
 
   nativeBuildInputs = [
···
     aiofiles
     blinker
     click
+    flask
     hypercorn
-    importlib-metadata
     itsdangerous
     jinja2
     markupsafe
     pydata-sphinx-theme
     python-dotenv
+    werkzeug
+  ] ++ lib.optionals (pythonOlder "3.10") [
+    importlib-metadata
     typing-extensions
-    werkzeug
   ];
 
   pythonImportsCheck = [
···
     py
     pytest-asyncio
     pytestCheckHook
-  ];
-
-  disabledTestPaths = [
-    # remove after 0.18.4
-    "tests/test_signals.py"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/rflink/default.nix

···
 
 buildPythonPackage rec {
   pname = "rflink";
-  version = "0.0.65";
+  version = "0.0.66";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "aequitas";
     repo = "python-rflink";
     rev = "refs/tags/${version}";
-    hash = "sha256-DUnhuA84nkmYkREa7vUiyLg7JUdEEeLewg3vFFlcar8=";
+    hash = "sha256-n6VLa0xX1qewMS7Kv+kiitezWRbRvDJRNuOmA7IV6u0=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/scipy/default.nix

···
         "doc/source/dev/contributor/meson_advanced.rst"
       ];
     })
+    (fetchpatch {
+      name = "openblas-0.3.26-compat.patch";
+      url = "https://github.com/scipy/scipy/commit/8c96a1f742335bca283aae418763aaba62c03378.patch";
+      hash = "sha256-SGoYDxwSAkr6D5/XEqHLerF4e4nmmI+PX+z+3taWAps=";
+    })
   ];
 
   # Upstream complicated numpy version pinning is causing issues in the

pkgs/development/python-modules/sentry-sdk/default.nix

···
 , pytest-watch
 , pytestCheckHook
 , pythonOlder
+, quart
 , rq
 , sanic
 , setuptools
···
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.39.2";
+  version = "1.40.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "getsentry";
     repo = "sentry-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-MC+9w53fsC5XB7CR9SS+z4bu2GgxkqdeYWERhk8lhcA=";
+    hash = "sha256-cVBqSFMBSRoIIv2RmkSLhlQ+jrofJVT9QoAPyjyX0ms=";
   };
 
   nativeBuildInputs = [
···
       pure-eval
     ];
     quart = [
-      # quart missing
+      quart
       blinker
     ];
     rq = [

pkgs/development/python-modules/setuptools/default.nix

···
 
 buildPythonPackage rec {
   pname = "setuptools";
-  version = "69.0.2";
+  version = "69.0.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "setuptools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7xOZC85glpXPKdPTYOpwjQHRpkKL1hgbMFgJF3q5EW0=";
+    hash = "sha256-38csULki+SBcg7StScj0/09A+JZesm8iwOBjSgXyXMA=";
   };
 
   patches = [

pkgs/development/python-modules/sip/default.nix

···
 , ply
 , toml
 , tomli
+
+# tests
 , poppler-qt5
+, qgis
+, qgis-ltr
 }:
 
 buildPythonPackage rec {
···
   pythonImportsCheck = [ "sipbuild" ];
 
   passthru.tests = {
-    inherit poppler-qt5;
+    # test depending packages
+    inherit poppler-qt5 qgis qgis-ltr;
   };
 
   meta = with lib; {

pkgs/development/python-modules/sqlalchemy-utils/default.nix

···
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pythonOlder
 
 # runtime
···
 
   patches = [
     ./skip-database-tests.patch
+
+    (fetchpatch {
+      # sqlalchemy 2.0.22+ compat; https://github.com/kvesteri/sqlalchemy-utils/pull/725
+      url = "https://github.com/kvesteri/sqlalchemy-utils/commit/712aabaefc5c8ca3680751c705cf5a5984c74af1.patch";
+      hash = "sha256-xBdiUtFWjlUhBzHgGFbaKBt3at6NDo+mv9sd8WwiPOA=";
+    })
   ];
 
   propagatedBuildInputs = [

pkgs/development/python-modules/sqlalchemy/default.nix

···
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "2.0.21";
+  version = "2.0.25";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-ldBn+pdZfqnBKdYkOcG47ScH/hBgeJBeIvn1hCIBw/A=";
+    hash = "sha256-nfkYzLpWyNXDuRUJl5pzaedw5v7jHpG7kpmr6VTGUaw=";
   };
 
   postPatch = ''

pkgs/development/python-modules/starlette/default.nix

···
 { lib
-, stdenv
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
 , hatchling
 
-# runtime
-, ApplicationServices
+# dependencies
 , anyio
+, typing-extensions
+
+# optional dependencies
 , itsdangerous
 , jinja2
 , python-multipart
 , pyyaml
 , httpx
-, typing-extensions
 
 # tests
 , pytestCheckHook
 , pythonOlder
 , trio
+
+# reverse dependencies
+, fastapi
 }:
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.32.0.post1";
-  format = "pyproject";
+  version = "0.35.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-1twyN3fSlxwfDtyqaFFuCAVehLZ8vCV4voCT7CVSEbk=";
+    hash = "sha256-ynT1KowVJ1QdKLSOXYWVe5Q/PrYEWQDUbj395ebfk6Y=";
   };
 
   nativeBuildInputs = [
···
 
   propagatedBuildInputs = [
     anyio
+  ] ++ lib.optionals (pythonOlder "3.10") [
+    typing-extensions
+  ];
+
+  passthru.optional-dependencies.full = [
     itsdangerous
     jinja2
     python-multipart
     pyyaml
     httpx
-  ] ++ lib.optionals (pythonOlder "3.10") [
-    typing-extensions
-  ] ++ lib.optionals stdenv.isDarwin [
-    ApplicationServices
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
     trio
     typing-extensions
-  ];
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pytestFlagsArray = [
     "-W" "ignore::DeprecationWarning"
     "-W" "ignore::trio.TrioDeprecationWarning"
   ];
 
-  disabledTests = [
-    # asserts fail due to inclusion of br in Accept-Encoding
-    "test_websocket_headers"
-    "test_request_headers"
-  ];
-
   pythonImportsCheck = [
     "starlette"
   ];
+
+  passthru.tests = {
+    inherit fastapi;
+  };
 
   meta = with lib; {
     changelog = "https://github.com/encode/starlette/releases/tag/${version}";

pkgs/development/python-modules/tqdm/default.nix

···
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, pythonAtLeast
+, pythonOlder
 , setuptools
 , setuptools-scm
 , wheel
···
   version = "4.66.1";
   format = "pyproject";
 
-  # https://github.com/tqdm/tqdm/issues/1537
-  disabled = pythonAtLeast "3.12";
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-2I5lH5242FUaYlVtPP+eMDQnTKXWbpMZfPJJDi3Lacc=";
···
     setuptools-scm
     wheel
   ];
+
+  # https://github.com/tqdm/tqdm/issues/1537
+  doCheck = pythonOlder "3.12";
 
   nativeCheckInputs = [
     pytestCheckHook

pkgs/development/python-modules/trove-classifiers/default.nix

···
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2023.11.29";
+    version = "2024.1.8";
     pyproject = true;
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-/49/2Cx5MhE7RufvZ0LHAJHMY2QMjGXbANkfLpQLlRQ=";
+      hash = "sha256-bjbK9DD/ZIXEtXpMazZKE/aomNFrlBfGw3Rn5ZwUsFo=";
     };
 
     postPatch = ''

pkgs/development/python-modules/werkzeug/default.nix

···
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+
+# build-system
 , flit-core
+
+# dependencies
+, markupsafe
+
+# optional-dependencies
 , watchdog
+
+# tests
+, cryptography
 , ephemeral-port-reserve
+, greenlet
 , pytest-timeout
 , pytest-xprocess
 , pytestCheckHook
-, markupsafe
-# for passthru.tests
-, moto, sentry-sdk
+
+# reverse dependencies
+, moto
+, sentry-sdk
 }:
 
 buildPythonPackage rec {
   pname = "werkzeug";
-  version = "2.3.8";
+  version = "3.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VUslfHS763oNJUFgpPj/4YUkP1KlIDUGC3Ycpi2XfwM=";
+    hash = "sha256-UH6BHs6nKxikBJR63tSzOQ4duPgmtJTXZVDvRbs7Hcw=";
   };
 
   nativeBuildInputs = [
···
 
   passthru.optional-dependencies = {
     watchdog = lib.optionals (!stdenv.isDarwin) [
-      # watchdog requires macos-sdk 10.13[
+      # watchdog requires macos-sdk 10.13
       watchdog
     ];
   };
 
   nativeCheckInputs = [
+    cryptography
     ephemeral-port-reserve
     pytest-timeout
     pytest-xprocess
     pytestCheckHook
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    greenlet
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   disabledTests = lib.optionals stdenv.isDarwin [
···
   };
 
   meta = with lib; {
+    changelog = "https://werkzeug.palletsprojects.com/en/${versions.majorMinor version}.x/changes/#version-${replaceStrings [ "." ] [ "-" ] version}";
     homepage = "https://palletsprojects.com/p/werkzeug/";
     description = "The comprehensive WSGI web application library";
     longDescription = ''

pkgs/development/tools/azure-static-sites-client/versions.json

···
 [
   {
     "version": "latest",
-    "buildId": "1.0.025241",
-    "publishDate": "2023-11-30T02:51:40.8356813Z",
+    "buildId": "1.0.025891",
+    "publishDate": "2024-02-02T19:23:37.1915908Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/linux/StaticSitesClient",
-        "sha": "e4ccb44c516e03e6dcc2a26a35ffd4c84a61dfea581990dd5c0edb7c12662db0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/linux/StaticSitesClient",
+        "sha": "798b4032d1b6cd3f7057a6b7510c502dd69fa8cb4d27d47433542e8e80e9f87c"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/windows/StaticSitesClient.exe",
-        "sha": "4146ac01a488910d6ea066e1c46505048b0c9af2e74ef273c4236b387796712d"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/windows/StaticSitesClient.exe",
+        "sha": "097f9633c12b55e85e4ea9c053576a94b4f5847ce3a5a7671112c881878cfc4b"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/macOS/StaticSitesClient",
-        "sha": "05b213d7861454368d2c9801b0ccc75cfd13cb48f8e121fffaa2ab7e9b5671cd"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/macOS/StaticSitesClient",
+        "sha": "142310370774f91526c5d08ebde2f0b224b4f7f88bb6e514d25c1ef6f04fd8c8"
       }
     }
   },
   {
     "version": "stable",
-    "buildId": "1.0.025241",
-    "publishDate": "2023-11-30T02:51:40.8356813Z",
+    "buildId": "1.0.025891",
+    "publishDate": "2024-02-02T19:23:37.1915908Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/linux/StaticSitesClient",
-        "sha": "e4ccb44c516e03e6dcc2a26a35ffd4c84a61dfea581990dd5c0edb7c12662db0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/linux/StaticSitesClient",
+        "sha": "798b4032d1b6cd3f7057a6b7510c502dd69fa8cb4d27d47433542e8e80e9f87c"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/windows/StaticSitesClient.exe",
-        "sha": "4146ac01a488910d6ea066e1c46505048b0c9af2e74ef273c4236b387796712d"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/windows/StaticSitesClient.exe",
+        "sha": "097f9633c12b55e85e4ea9c053576a94b4f5847ce3a5a7671112c881878cfc4b"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/macOS/StaticSitesClient",
-        "sha": "05b213d7861454368d2c9801b0ccc75cfd13cb48f8e121fffaa2ab7e9b5671cd"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/macOS/StaticSitesClient",
+        "sha": "142310370774f91526c5d08ebde2f0b224b4f7f88bb6e514d25c1ef6f04fd8c8"
       }
     }
   },
   {
     "version": "backup",
-    "buildId": "1.0.025142",
-    "publishDate": "2023-11-20T09:32:48.489649Z",
+    "buildId": "1.0.025241",
+    "publishDate": "2023-11-30T02:51:40.8356813Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/linux/StaticSitesClient",
-        "sha": "f36cce34f04b045e3ea5de5c201ce6663925d9680e3b5986b417534898b995b2"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/linux/StaticSitesClient",
+        "sha": "e4ccb44c516e03e6dcc2a26a35ffd4c84a61dfea581990dd5c0edb7c12662db0"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/windows/StaticSitesClient.exe",
-        "sha": "1e8932e2c4189d40657db888f82dfb030c2d41951421dd9a68712960e7c7fa7b"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/windows/StaticSitesClient.exe",
+        "sha": "4146ac01a488910d6ea066e1c46505048b0c9af2e74ef273c4236b387796712d"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025142/macOS/StaticSitesClient",
-        "sha": "891faef16ae06fc609f787ffce7d6a1816e24fddfcaef9bc10e3b50208fe29aa"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/macOS/StaticSitesClient",
+        "sha": "05b213d7861454368d2c9801b0ccc75cfd13cb48f8e121fffaa2ab7e9b5671cd"
       }
     }
   }

pkgs/development/tools/cocoapods/Gemfile-beta.lock

···
   specs:
     CFPropertyList (3.0.6)
       rexml
-    activesupport (7.1.2)
+    activesupport (7.1.3)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
···
       minitest (>= 5.1)
       mutex_m
       tzinfo (~> 2.0)
-    addressable (2.8.5)
+    addressable (2.8.6)
       public_suffix (>= 2.0.2, < 6.0)
     algoliasearch (1.27.5)
       httpclient (~> 2.8, >= 2.8.3)
       json (>= 1.5.1)
     atomos (0.1.3)
     base64 (0.2.0)
-    bigdecimal (3.1.4)
+    bigdecimal (3.1.6)
     claide (1.1.0)
-    cocoapods (1.14.3)
+    cocoapods (1.15.1)
       addressable (~> 2.8)
       claide (>= 1.0.2, < 2.0)
-      cocoapods-core (= 1.14.3)
+      cocoapods-core (= 1.15.1)
       cocoapods-deintegrate (>= 1.0.3, < 2.0)
       cocoapods-downloader (>= 2.1, < 3.0)
       cocoapods-plugins (>= 1.0.0, < 2.0)
···
       nap (~> 1.0)
       ruby-macho (>= 2.3.0, < 3.0)
       xcodeproj (>= 1.23.0, < 2.0)
-    cocoapods-core (1.14.3)
+    cocoapods-core (1.15.1)
       activesupport (>= 5.0, < 8)
       addressable (~> 2.8)
       algoliasearch (~> 1.0)
···
       netrc (~> 0.11)
     cocoapods-try (1.2.0)
     colored2 (3.1.2)
-    concurrent-ruby (1.2.2)
+    concurrent-ruby (1.2.3)
     connection_pool (2.4.1)
     drb (2.2.0)
       ruby2_keywords
···
     httpclient (2.8.3)
     i18n (1.14.1)
       concurrent-ruby (~> 1.0)
-    json (2.6.3)
-    minitest (5.20.0)
+    json (2.7.1)
+    minitest (5.22.0)
     molinillo (0.8.0)
     mutex_m (0.2.0)
     nanaimo (0.3.0)
···
       ethon (>= 0.9.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    xcodeproj (1.23.0)
+    xcodeproj (1.24.0)
       CFPropertyList (>= 2.3.3, < 4.0)
       atomos (~> 0.1.3)
       claide (>= 1.0.2, < 2.0)

pkgs/development/tools/cocoapods/Gemfile.lock

···
   specs:
     CFPropertyList (3.0.6)
       rexml
-    activesupport (7.1.2)
+    activesupport (7.1.3)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
···
       minitest (>= 5.1)
       mutex_m
       tzinfo (~> 2.0)
-    addressable (2.8.5)
+    addressable (2.8.6)
       public_suffix (>= 2.0.2, < 6.0)
     algoliasearch (1.27.5)
       httpclient (~> 2.8, >= 2.8.3)
       json (>= 1.5.1)
     atomos (0.1.3)
     base64 (0.2.0)
-    bigdecimal (3.1.4)
+    bigdecimal (3.1.6)
     claide (1.1.0)
-    cocoapods (1.14.3)
+    cocoapods (1.15.1)
       addressable (~> 2.8)
       claide (>= 1.0.2, < 2.0)
-      cocoapods-core (= 1.14.3)
+      cocoapods-core (= 1.15.1)
       cocoapods-deintegrate (>= 1.0.3, < 2.0)
       cocoapods-downloader (>= 2.1, < 3.0)
       cocoapods-plugins (>= 1.0.0, < 2.0)
···
       nap (~> 1.0)
       ruby-macho (>= 2.3.0, < 3.0)
       xcodeproj (>= 1.23.0, < 2.0)
-    cocoapods-core (1.14.3)
+    cocoapods-core (1.15.1)
       activesupport (>= 5.0, < 8)
       addressable (~> 2.8)
       algoliasearch (~> 1.0)
···
       netrc (~> 0.11)
     cocoapods-try (1.2.0)
     colored2 (3.1.2)
-    concurrent-ruby (1.2.2)
+    concurrent-ruby (1.2.3)
     connection_pool (2.4.1)
     drb (2.2.0)
       ruby2_keywords
···
     httpclient (2.8.3)
     i18n (1.14.1)
       concurrent-ruby (~> 1.0)
-    json (2.6.3)
-    minitest (5.20.0)
+    json (2.7.1)
+    minitest (5.22.0)
     molinillo (0.8.0)
     mutex_m (0.2.0)
     nanaimo (0.3.0)
···
       ethon (>= 0.9.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    xcodeproj (1.23.0)
+    xcodeproj (1.24.0)
       CFPropertyList (>= 2.3.3, < 4.0)
       atomos (~> 0.1.3)
       claide (>= 1.0.2, < 2.0)

pkgs/development/tools/cocoapods/gemset-beta.nix

···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1l6hmf99zgckpn812qfxfz60rbh0zixv1hxnxhjlg8942pvixn2v";
+      sha256 = "09zrw3sydkk6lwzjhzia38wg1as5aab2lgnysfdr1qxh39zi7z7v";
       type = "gem";
     };
-    version = "7.1.2";
+    version = "7.1.3";
   };
   addressable = {
     dependencies = ["public_suffix"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05r1fwy487klqkya7vzia8hnklcxy4vr92m9dmni3prfwk6zpw33";
+      sha256 = "0irbdwkkjwzajq1ip6ba46q49sxnrl2cw7ddkdhsfhb6aprnm3vr";
       type = "gem";
     };
-    version = "2.8.5";
+    version = "2.8.6";
   };
   algoliasearch = {
     dependencies = ["httpclient" "json"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07y615s8yldk3k13lmkhpk1k190lcqvmxmnjwgh4bzjan9xrc36y";
+      sha256 = "00db5v09k1z3539g1zrk7vkjrln9967k08adh6qx33ng97a2gg5w";
       type = "gem";
     };
-    version = "3.1.4";
+    version = "3.1.6";
   };
   CFPropertyList = {
     dependencies = ["rexml"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1r2w719d5zfzl3wnc5npnjv4194b7gdh4vib09vifdm8yab14br3";
+      sha256 = "19rmw9518zlcalr7vy6f10rbiya7ch86z3nfk2d6klw41ihc5hrq";
       type = "gem";
     };
-    version = "1.14.3";
+    version = "1.15.1";
   };
   cocoapods-core = {
     dependencies = ["activesupport" "addressable" "algoliasearch" "concurrent-ruby" "fuzzy_match" "nap" "netrc" "public_suffix" "typhoeus"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04qyzcwkwbm7l4kjp6m8g2pvsryfvsllwpqf0mxfnzwbdid40zwn";
+      sha256 = "03dh7vfr9r248c8vbkssa6q0y9imvv1ms6mx28w06ysmdvn4vbgv";
       type = "gem";
     };
-    version = "1.14.3";
+    version = "1.15.1";
   };
   cocoapods-deintegrate = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
+      sha256 = "1qh1b14jwbbj242klkyz5fc7npd4j0mvndz62gajhvl1l3wd7zc2";
       type = "gem";
     };
-    version = "1.2.2";
+    version = "1.2.3";
   };
   connection_pool = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nalhin1gda4v8ybk6lq8f407cgfrj6qzn234yra4ipkmlbfmal6";
+      sha256 = "0r9jmjhg2ly3l736flk7r2al47b5c8cayh0gqkq0yhjqzc9a6zhq";
       type = "gem";
     };
-    version = "2.6.3";
+    version = "2.7.1";
   };
   minitest = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bkmfi9mb49m0fkdhl2g38i3xxa02d411gg0m8x0gvbwfmmg5ym3";
+      sha256 = "0hv03j1ac349pjymis7jxmbqr5jalc60cg27529bbb3zymswhdjz";
       type = "gem";
     };
-    version = "5.20.0";
+    version = "5.22.0";
   };
   molinillo = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "176ndahc5fssyx04q176vy6wngs1av4vrsdrkdpjij700hqll8hn";
+      sha256 = "1wpg4n7b8571j2h8h7v2kk8pr141rgf6m8mhk221k990fissrq56";
       type = "gem";
     };
-    version = "1.23.0";
+    version = "1.24.0";
   };
 }

pkgs/development/tools/cocoapods/gemset.nix

···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1l6hmf99zgckpn812qfxfz60rbh0zixv1hxnxhjlg8942pvixn2v";
+      sha256 = "09zrw3sydkk6lwzjhzia38wg1as5aab2lgnysfdr1qxh39zi7z7v";
       type = "gem";
     };
-    version = "7.1.2";
+    version = "7.1.3";
   };
   addressable = {
     dependencies = ["public_suffix"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05r1fwy487klqkya7vzia8hnklcxy4vr92m9dmni3prfwk6zpw33";
+      sha256 = "0irbdwkkjwzajq1ip6ba46q49sxnrl2cw7ddkdhsfhb6aprnm3vr";
       type = "gem";
     };
-    version = "2.8.5";
+    version = "2.8.6";
   };
   algoliasearch = {
     dependencies = ["httpclient" "json"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07y615s8yldk3k13lmkhpk1k190lcqvmxmnjwgh4bzjan9xrc36y";
+      sha256 = "00db5v09k1z3539g1zrk7vkjrln9967k08adh6qx33ng97a2gg5w";
       type = "gem";
     };
-    version = "3.1.4";
+    version = "3.1.6";
   };
   CFPropertyList = {
     dependencies = ["rexml"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1r2w719d5zfzl3wnc5npnjv4194b7gdh4vib09vifdm8yab14br3";
+      sha256 = "19rmw9518zlcalr7vy6f10rbiya7ch86z3nfk2d6klw41ihc5hrq";
       type = "gem";
     };
-    version = "1.14.3";
+    version = "1.15.1";
   };
   cocoapods-core = {
     dependencies = ["activesupport" "addressable" "algoliasearch" "concurrent-ruby" "fuzzy_match" "nap" "netrc" "public_suffix" "typhoeus"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04qyzcwkwbm7l4kjp6m8g2pvsryfvsllwpqf0mxfnzwbdid40zwn";
+      sha256 = "03dh7vfr9r248c8vbkssa6q0y9imvv1ms6mx28w06ysmdvn4vbgv";
       type = "gem";
     };
-    version = "1.14.3";
+    version = "1.15.1";
   };
   cocoapods-deintegrate = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
+      sha256 = "1qh1b14jwbbj242klkyz5fc7npd4j0mvndz62gajhvl1l3wd7zc2";
       type = "gem";
     };
-    version = "1.2.2";
+    version = "1.2.3";
   };
   connection_pool = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nalhin1gda4v8ybk6lq8f407cgfrj6qzn234yra4ipkmlbfmal6";
+      sha256 = "0r9jmjhg2ly3l736flk7r2al47b5c8cayh0gqkq0yhjqzc9a6zhq";
       type = "gem";
     };
-    version = "2.6.3";
+    version = "2.7.1";
   };
   minitest = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bkmfi9mb49m0fkdhl2g38i3xxa02d411gg0m8x0gvbwfmmg5ym3";
+      sha256 = "0hv03j1ac349pjymis7jxmbqr5jalc60cg27529bbb3zymswhdjz";
       type = "gem";
     };
-    version = "5.20.0";
+    version = "5.22.0";
   };
   molinillo = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "176ndahc5fssyx04q176vy6wngs1av4vrsdrkdpjij700hqll8hn";
+      sha256 = "1wpg4n7b8571j2h8h7v2kk8pr141rgf6m8mhk221k990fissrq56";
       type = "gem";
     };
-    version = "1.23.0";
+    version = "1.24.0";
   };
 }

pkgs/development/tools/continuous-integration/cirrus-cli/default.nix

···
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.110.0";
+  version = "0.110.3";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5BMaOuiXz8SMfaB7qFvCyboGFKxzenkEVwj25Qh4MKw=";
+    sha256 = "sha256-+OzBWooLpI4WnyBPRlwLGZVFrckXGeoDJilsEE00slk=";
   };
 
   vendorHash = "sha256-xJnBMSfYwx6uHuMjyR9IWGHwt3fNajDr6DW8o+J+lj8=";

pkgs/development/tools/devbox/default.nix

···
 }:
 buildGoModule rec {
   pname = "devbox";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "jetpack-io";
     repo = pname;
     rev = version;
-    hash = "sha256-cM4PiNbfE2sEQHzklBgsJdN/iVK0nT9iZ1F/Cb5tLtM=";
+    hash = "sha256-3KZWXVwvzy3mZkh6pGZpeQQp2aU4V9TyBcJXU4Au4Rs=";
   };
 
   ldflags = [

pkgs/development/tools/fermyon-spin/default.nix

···
   }.${system} or (throw "Unsupported system: ${system}");
 
   packageHash = {
-    x86_64-linux = "sha256-i06Zp176zl7y8P32Hss64QkMc/+vXtkQy/tkOPSX3dc=";
+    x86_64-linux = "sha256-Y0Inew0PncpnEpdLWtl/85t93eGSRewKh5mvGnn+yck=";
     aarch64-linux = "sha256-HEm3TaLeaws8G73CU9BmxeplQdeF9nQbBSnbctaVhqI=";
     x86_64-darwin = "sha256-mlshpN/4Od4qrXiqIEYo7G84Dtb+tp2nK2VnrRG2rto=";
     aarch64-darwin = "sha256-aJH/vOidj0vbkttGDgelaAC/dMYguQPLjxl+V3pOVzI=";
···
 
 in stdenv.mkDerivation rec {
   pname = "fermyon-spin";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchzip {
     url = "https://github.com/fermyon/spin/releases/download/v${version}/spin-v${version}-${platform}.tar.gz";

pkgs/development/tools/global-platform-pro/default.nix

···
     cp tool/target/gp.jar "$out/share/java"
     makeWrapper "${jre8_headless}/bin/java" "$out/bin/gp" \
       --add-flags "-jar '$out/share/java/gp.jar'" \
-      --prefix LD_LIBRARY_PATH : "${pcsclite.out}/lib"
+      --prefix LD_LIBRARY_PATH : "${lib.getLib pcsclite}/lib"
   '';
 
   meta = with lib; {

pkgs/development/tools/misc/lsof/default.nix

···
-{ lib, stdenv, fetchFromGitHub, buildPackages, perl, which, ncurses }:
+{ lib, stdenv, fetchFromGitHub, buildPackages, perl, which, ncurses, nukeReferences }:
 
 let
   dialect = with lib; last (splitString "-" stdenv.hostPlatform.system);
···
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.98.0";
+  version = "4.99.3";
 
   src = fetchFromGitHub {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    sha256 = "sha256-DQLY0a0sOCZFEJA4Y4b18OcWZw47RyqKZ0mVG0CDVTI=";
+    hash = "sha256-XW3l+E9D8hgI9jGJGKkIAKa8O9m0JHgZhEASqg4gYuw=";
   };
 
-  patches = [
-    ./no-build-info.patch
-  ];
-
-  postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
+  postPatch = ''
+    patchShebangs --build lib/dialects/*/Mksrc
+    # Do not re-build version.h in every 'make' to allow nuke-refs below.
+    # We remove phony 'FRC' target that forces rebuilds:
+    #   'version.h: FRC ...' is translated to 'version.h: ...'.
+    sed -i lib/dialects/*/Makefile -e 's/version.h:\s*FRC/version.h:/'
+  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     substituteInPlace dialects/linux/dlsof.h --replace "defined(__UCLIBC__)" 1
   '' + lib.optionalString stdenv.isDarwin ''
     sed -i 's|lcurses|lncurses|g' Configure
   '';
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl which ];
+  nativeBuildInputs = [ nukeReferences perl which ];
   buildInputs = [ ncurses ];
 
   # Stop build scripts from searching global include paths
···
     for filepath in $(find dialects/${dialect} -type f); do
       sed -i "s,/usr/include,$LSOF_INCLUDE,g" $filepath
     done
+
+    # Wipe out development-only flags from CFLAGS embedding
+    make version.h
+    nuke-refs version.h
   '';
 
   installPhase = ''

pkgs/development/tools/misc/lsof/no-build-info.patch

···
---- a/usage.c
-+++ b/usage.c
-@@ -931,24 +931,6 @@ usage(err, fh, version)
- 		(void) fprintf(stderr, "    configuration info: %s\n", cp);
- #endif	/* defined(LSOF_CINFO) */
- 
--	    cp = isnullstr(LSOF_HOST);
--	    if (!(cp1 = isnullstr(LSOF_LOGNAME)))
--		cp1 = isnullstr(LSOF_USER);
--	    if (cp || cp1) {
--		if (cp && cp1)
--		    cp2 = "by and on";
--		else if (cp)
--		    cp2 = "on";
--		else
--		    cp2 = "by";
--		(void) fprintf(stderr, "    constructed %s: %s%s%s\n",
--		    cp2,
--		    cp1 ? cp1 : "",
--		    (cp && cp1) ? "@" : "",
--		    cp  ? cp  : ""
--		    );
--	    }
--
- #if	defined(LSOF_BLDCMT)
- 	    if ((cp = isnullstr(LSOF_BLDCMT)))
- 		(void) fprintf(stderr, "    builder's comment: %s\n", cp);
-@@ -958,12 +940,6 @@ usage(err, fh, version)
- 		(void) fprintf(stderr, "    compiler: %s\n", cp);
- 	    if ((cp = isnullstr(LSOF_CCV)))
- 		(void) fprintf(stderr, "    compiler version: %s\n", cp);
--	    if ((cp = isnullstr(LSOF_CCFLAGS)))
--		(void) fprintf(stderr, "    compiler flags: %s\n", cp);
--	    if ((cp = isnullstr(LSOF_LDFLAGS)))
--		(void) fprintf(stderr, "    loader flags: %s\n", cp);
--	    if ((cp = isnullstr(LSOF_SYSINFO)))
--		(void) fprintf(stderr, "    system info: %s\n", cp);
- 	    // display configurations that might affect output
- 	    char *features[] = {
- #if	defined(HASEFFNLINK)

pkgs/development/tools/ruff/default.nix

···
 , stdenv
 , darwin
 , rust-jemalloc-sys
-  # tests
 , ruff-lsp
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.1.13";
+  version = "0.1.15";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cH/Vw04QQ3U7E1ZCwozjhPcn0KVljP976/p3okrBpEU=";
+    hash = "sha256-DzdzMO9PEwf4HmpG8SxRJTmdrmkXuQ8RsIchvsKstH8=";
   };
 
-  cargoHash = "sha256-tmoFnghHQEsyv0vO9fnWyTsxiIhmovhi/zHXOCi5u10=";
+  # The following specific substitution is not working as the current directory is `/build/source` and thus has no mention of `ruff` in it.
+  # https://github.com/astral-sh/ruff/blob/866bea60a5de3c59d2537b0f3a634ae0ac9afd94/crates/ruff/tests/show_settings.rs#L12
+  # -> Just patch it so that it expects the actual current directory and not `"[BASEPATH]"`.
+  postPatch = ''
+    substituteInPlace crates/ruff/tests/snapshots/show_settings__display_default_settings.snap \
+      --replace '"[BASEPATH]"' '"'$PWD'"'
+  '';
+
+  cargoHash = "sha256-MpiWdNUs66OGYfOJo1kJQTCqjrk/DAYecaLf6GUUKew=";
 
   nativeBuildInputs = [
     installShellFiles
···
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
   ];
-
-  cargoBuildFlags = [ "--package=ruff_cli" ];
-  cargoTestFlags = cargoBuildFlags;
 
   # tests expect no colors
   preCheck = ''

pkgs/development/tools/rust/bindgen/unwrapped.nix

···
   rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.69.1";
+  version = "0.69.2";
 
   src = fetchCrate {
     pname = "bindgen-cli";
     inherit version;
-    sha256 = "sha256-zqyIc07RLti2xb23bWzL7zFjreEZuUstnYSp+jUX8Lw=";
+    sha256 = "sha256-ytbaXCVNXXBtJet5CBkCNUoISxdFXt/kgb4VVZisUXE=";
   };
 
-  cargoHash = "sha256-o1B8jq7Ze97pBLE9gvNsmCaD/tsW4f6DL0upzQkxbA4=";
+  cargoHash = "sha256-pnoCq25CrZIAQNkDsokIVVyUYLlg7WY6th17IgeW9x8=";
 
   buildInputs = [ clang.cc.lib ];
 

pkgs/development/tools/rust/cargo-espflash/default.nix pkgs/by-name/es/espflash/package.nix

···
 }:
 
 rustPlatform.buildRustPackage rec {
-  pname = "cargo-espflash";
+  pname = "espflash";
   version = "2.1.0";
 
   src = fetchFromGitHub {
···
     SystemConfiguration
   ];
 
-  cargoHash = "sha256-FpBc92a2JQHRLe5S6yh3l0FpRI8LpkGGEma/4v5X4xs=";
+  cargoHash = "sha256-Xj5FVTssC3e+mMhDHmKqV6lUQgaIv3aVc1yewbQSy9E=";
 
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Serial flasher utility for Espressif SoCs and modules based on esptool.py";
-    homepage = "https://github.com/esp-rs/cargo-espflash";
+    homepage = "https://github.com/esp-rs/espflash";
+    changelog = "https://github.com/esp-rs/espflash/blob/v${version}/CHANGELOG.md";
+    mainProgram = "espflash";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ matthiasbeyer ];
   };

pkgs/development/tools/rust/cargo-flamegraph/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-flamegraph";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "flamegraph-rs";
     repo = "flamegraph";
     rev = "v${version}";
-    sha256 = "sha256-yeNA6HkhWEUqarBDRbyD3RBIlBZZVrbAMng7d5beBB4=";
+    sha256 = "sha256-VrC3c3a1G8mn9U6txeynsaWOL4HQQk2IOiQqS52iPGo=";
   };
 
-  cargoSha256 = "sha256-IHOVaRfjopaSRY8HF8ATdNNLfhTVrIKvYsAuocqRdWI=";
+  cargoSha256 = "sha256-KwpveTiViY+C4A+fE5yeGuT9PXbDyi+YsOc75mX2KdU=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
   buildInputs = lib.optionals stdenv.isDarwin [

pkgs/development/tools/yq-go/default.nix

···
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.40.5";
+  version = "4.40.7";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-CCgertXgnA6q259Ngmy4EBD6GDuvSb0bREDddR2ht8E=";
+    hash = "sha256-VvA6PYJYRejGlYDb/gyHDQSNOwDWSE7vXPqYGrVLtko=";
   };
 
-  vendorHash = "sha256-SQGJj5syay4LllqmK/cRoZbprgDQhLGdQM3T1m/dZsI=";
+  vendorHash = "sha256-5jc9AQ1T4818kvAF6SU6JEdCQWt1gRJnESXRMGvqrB0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/games/crossfire/add-cstdint-include-to-crossfire-server.patch

···
+diff --git a/include/Treasures.h b/include/Treasures.h
+index 614078f..a00b4f6 100644
+--- a/include/Treasures.h
++++ b/include/Treasures.h
+@@ -13,6 +13,8 @@
+ #ifndef TREASURES_H
+ #define TREASURES_H
+ 
++#include <cstdint>
++
+ #include "AssetsCollection.h"
+ 
+ extern "C" {

pkgs/games/crossfire/crossfire-server.nix

···
     rev = "r${rev}";
   };
 
+  patches = [
+    ./add-cstdint-include-to-crossfire-server.patch
+  ];
+
   nativeBuildInputs = [ autoconf automake libtool flex perl check pkg-config python39 ];
   hardeningDisable = [ "format" ];
 

pkgs/games/dxx-rebirth/default.nix

···
 , libGL
 , libpng
 , physfs
+, unstableGitUpdater
 }:
 
 let
···
 in
 stdenv.mkDerivation rec {
   pname = "dxx-rebirth";
-  version = "unstable-2023-03-23";
+  version = "0-unstable-2024-01-13";
 
   src = fetchFromGitHub {
     owner = "dxx-rebirth";
     repo = "dxx-rebirth";
-    rev = "841ebcc11d249febe48911bc239606ade3bd78b3";
-    hash = "sha256-cr5QdkKO/HNvtc2w4ynJixuLauhPCwtsSC3UEV7+C1A=";
+    rev = "5c710857a9312e1b2f3249c51c12b55f9390a2b1";
+    hash = "sha256-nEPMJiTeePAmourAksUNqyy5whs+8+qy/qrycfNw2lo=";
   };
 
   nativeBuildInputs = [ pkg-config scons ];
···
     install -Dm644 ${music} $out/share/games/dxx-rebirth/${music.name}
     install -Dm644 -t $out/share/doc/dxx-rebirth *.txt
   '';
+
+  passthru.updateScript = unstableGitUpdater {};
 
   meta = with lib; {
     description = "Source Port of the Descent 1 and 2 engines";

pkgs/games/fheroes2/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    hash = "sha256-R7hl5VzzdRcU9TF6WfiLYgUFpVixuppLobMsan0jKsQ=";
+    hash = "sha256-FqtxTRgjFqFu4zml6xePXtK8yn/dkHP+5aU2/9S7gSQ=";
   };
 
   nativeBuildInputs = [ imagemagick ];

pkgs/misc/uboot/default.nix

···
 , openssl
 , swig
 , which
+, python3
 , armTrustedFirmwareAllwinner
 , armTrustedFirmwareAllwinnerH6
 , armTrustedFirmwareAllwinnerH616
···
     version ? null
   , src ? null
   , filesToInstall
+  , pythonScriptsToInstall ? { }
   , installDir ? "$out"
   , defconfig
   , extraConfig ? ""
···
     ] ++ extraPatches;
 
     postPatch = ''
+      ${lib.concatMapStrings (script: ''
+        substituteInPlace ${script} \
+        --replace "#!/usr/bin/env python3" "#!${pythonScriptsToInstall.${script}}/bin/python3"
+      '') (builtins.attrNames pythonScriptsToInstall)}
       patchShebangs tools
       patchShebangs scripts
     '';
···
       runHook preInstall
 
       mkdir -p ${installDir}
-      cp ${lib.concatStringsSep " " filesToInstall} ${installDir}
+      cp ${lib.concatStringsSep " " (filesToInstall ++ builtins.attrNames pythonScriptsToInstall)} ${installDir}
 
       mkdir -p "$out/nix-support"
       ${lib.concatMapStrings (file: ''
         echo "file binary-dist ${installDir}/${builtins.baseNameOf file}" >> "$out/nix-support/hydra-build-products"
-      '') filesToInstall}
+      '') (filesToInstall ++ builtins.attrNames pythonScriptsToInstall)}
 
       runHook postInstall
     '';
···
       license = licenses.gpl2;
       maintainers = with maintainers; [ bartsch dezgeg samueldr lopsided98 ];
     } // extraMeta;
-  } // removeAttrs args [ "extraMeta" ]));
+  } // removeAttrs args [ "extraMeta" "pythonScriptsToInstall" ]));
 in {
   inherit buildUBoot;
 
···
       "tools/mkenvimage"
       "tools/mkimage"
     ];
+
+    pythonScriptsToInstall = {
+      "tools/efivar.py" = (python3.withPackages (ps: [ ps.pyopenssl ]));
+    };
   };
 
   ubootA20OlinuxinoLime = buildUBoot {

pkgs/os-specific/darwin/apple-sdk-11.0/default.nix

···
   mkStdenv = stdenv:
     if stdenv.isAarch64 then stdenv
     else
+      let
+        darwinMinVersion = "10.12";
+        darwinSdkVersion = "11.0";
+      in
       (overrideCC stdenv (mkCc stdenv.cc)).override {
         extraBuildInputs = [ pkgs.darwin.apple_sdk_11_0.frameworks.CoreFoundation ];
-        targetPlatform = stdenv.targetPlatform // {
-          darwinMinVersion = "10.12";
-          darwinSdkVersion = "11.0";
-        };
+        buildPlatform = stdenv.buildPlatform // { inherit darwinMinVersion darwinSdkVersion; };
+        hostPlatform = stdenv.hostPlatform // { inherit darwinMinVersion darwinSdkVersion; };
+        targetPlatform = stdenv.targetPlatform // { inherit darwinMinVersion darwinSdkVersion; };
       };
 
   stdenvs = {

pkgs/os-specific/linux/cryptsetup/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.6.1";
+  version = "2.7.0";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-QQ3tZaEHKrnI5Brd7Te5cpwIf+9NLbArtO9SmtbaRpM=";
+    hash = "sha256-lAA6AM1agZRPRejcUp4M/Spv9im9LNIc9eV05GXa95U=";
   };
 
   patches = [

pkgs/os-specific/linux/ffado/default.nix

···
 in
 mkDerivation rec {
   pname = "ffado";
-  version = "2.4.7";
+  version = "2.4.8";
 
   src = fetchurl {
     url = "http://www.ffado.org/files/libffado-${version}.tgz";
-    sha256 = "0vsn3y52g6f77lqh9qfkd7dslmb7bbgy46cv5idynx4frqscc23s";
+    hash = "sha256-f0x561ehKw6uMSri0RZip+v1JHZuhixtywl0PVU/N44=";
   };
+
+  sourceRoot = "libffado-${version}/libffado";
 
   prePatch = ''
     substituteInPlace ./support/tools/ffado-diag.in \

pkgs/os-specific/linux/iotop-c/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "iotop-c";
-  version = "1.25";
+  version = "1.26";
 
   src = fetchFromGitHub {
     owner = "Tomas-M";
     repo = "iotop";
     rev = "v${version}";
-    sha256 = "sha256-ZIvWdNxGSUmQtMKB/MVHEZ0fJ8b//zSXz+1r/P9ZDkE=";
+    sha256 = "sha256-m75BHvKMk9ckZ6TgT1QDfHYcEfvfEwWu0bQacnVgSmU=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/os-specific/linux/iproute/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.6.0";
+  version = "6.7.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-hzjIBK/Qnwv3VpN/DD3iMReDKpjYy79QOGz1AFzWE84=";
+    hash = "sha256-/5Qt2YKNfR+Gf2H+cs5DMHjDHl2OSnjiDwLLWJLohB0=";
   };
 
   postPatch = ''

pkgs/os-specific/linux/iputils/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "iputils";
-  version = "20231222";
+  version = "20240117";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-/blxT6k79fgbxX8qCQuJMf7zDPwMjJUt7FCscaMXx6U=";
+    hash = "sha256-sERY8ZKuXiY85cXdNWOm4byiNU7mOVIeA55dgQJHdoE=";
   };
 
   outputs = [ "out" "apparmor" ];

pkgs/os-specific/linux/kbd/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "kbd";
-  version = "2.6.3";
+  version = "2.6.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/kbd/${pname}-${version}.tar.xz";
-    sha256 = "sha256-BJlsCNfRxGCWb7JEo9OIM1LCZ0t61SIAPZ9Oy4q0jes=";
+    sha256 = "sha256-UZ+NCHrsyn4KM80IS++SwGbrGXMWZmU9zHDJ1xqkCSY=";
   };
 
   # vlock is moved into its own output, since it depends on pam. This

pkgs/os-specific/linux/kernel-headers/default.nix

···
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "6.6"; in
+  linuxHeaders = let version = "6.7"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-        hash = "sha256-2SagbGPdisffP4buH/ws4qO4Gi0WhITna1s4mrqOVtA=";
+        hash = "sha256-7zEUSiV20IDYwxaY6D7J9mv5fGd/oqrw1bu58zRbEGk=";
       };
       patches = [
         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

···
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.1.74";
-    hash = "sha256-PqCojvh7JwTcavtQHB8l/WxCTg94ndOy9KGVXsmGO/Y=";
+    version = "6.1.76";
+    hash = "sha256-0nBdUFRGMWM3IL/q8CYiDEUA/sIrYPMkzsBQen30o2E=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.6.13";
-    hash = "sha256-RTfa9eIGYDqnffFnOFNaghKoGcHVy4rGYQkYumcw6Tk=";
+    version = "6.6.15";
+    hash = "sha256-KHn4Ntm1QStgJRWzwmPYXEbEcuZcF4pWJ964wc6J2Wk=";
     variant = "main";
   };
 

pkgs/os-specific/linux/libsepol/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "3.5";
+  version = "3.6";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
     url = "${se_url}/${version}/libsepol-${version}.tar.gz";
-    sha256 = "sha256-eP2vaZJNt4C6x4VG5D2cRAdLrXmMLEFdC5u5bQZe6KI=";
+    sha256 = "sha256-ydxYXqlJA9eE1ZfIYc1dzmRZFo+V4isxoOqxzdgAl1o=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''

pkgs/os-specific/linux/openvswitch/default.nix

···
 import ./generic.nix {
-  version = "3.2.1";
-  hash = "sha256-nXdyDJIU60Lx9cvpLuUp3E7MUnaZvvGDm+UKbXJRH0o=";
+  version = "3.2.2";
+  hash = "sha256-BCesNAYE3RyxfBAzK2/6+PcV1W+1ZEZQKVSLSq/pWC8=";
 }

pkgs/os-specific/linux/openvswitch/lts.nix

···
 import ./generic.nix {
-  version = "2.17.8";
-  hash = "sha256-DWAwepAxl90ay7MXPCz++BicaeSHYuZ06O8VeFZac+U=";
+  version = "2.17.9";
+  hash = "sha256-4bP6RyZ2YmhT8i1j+VnlrQYeG/V+G71ETQ7Yj5R++LE=";
   updateScriptArgs = "--lts=true --regex '2\.17.*'";
 }

pkgs/os-specific/linux/pam/default.nix

···
-{ lib, stdenv, buildPackages, fetchurl
-, fetchpatch
+{ lib, stdenv, buildPackages, fetchurl, fetchpatch
 , flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
 , autoreconfHook269, pkg-config-unwrapped
···
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.5.3";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    hash = "sha256-esS1D+7gBKn6iPHf0tL6c4qCiWdjBQzXc7PFSwqBgoM=";
+    hash = "sha256-//SjTlu+534ujxmS8nYx4jKby/igVj3etcM4m04xaa0=";
   };
 
   patches = [
     ./suid-wrapper-path.patch
-    # Pull support for localization on non-default --prefix:
-    #   https://github.com/NixOS/nixpkgs/issues/249010
-    #   https://github.com/linux-pam/linux-pam/pull/604
+
+    # Backport fix for missing include breaking musl builds.
     (fetchpatch {
-      name = "bind-locales.patch";
-      url = "https://github.com/linux-pam/linux-pam/commit/77bd338125cde583ecdfb9fd69619bcd2baf15c2.patch";
-      hash = "sha256-tlc9RcLZpEH315NFD4sdN9yOco8qhC6+bszl4OHm+AI=";
+      name = "pam_namespace-stdint.h.patch";
+      url = "https://github.com/linux-pam/linux-pam/commit/cc9d40b7cdbd3e15ccaa324a0dda1680ef9dea13.patch";
+      hash = "sha256-tCnH2yPO4dBbJOZA0fP2gm1EavHRMEJyfzB5Vy7YjAA=";
     })
-  ]
-  ++ lib.optional stdenv.hostPlatform.isMusl (fetchpatch {
-      name = "missing-termio.patch";
-      url = "https://github.com/linux-pam/linux-pam/commit/5374f677e4cae669eb9accf2449178b602e8a40a.patch";
-      hash = "sha256-b6n8f16ETSNj5h+5/Yhn32XMfVO8xEnZRRhw+nuLP/8=";
-    })
-  ;
+  ];
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
   postPatch = if stdenv.buildPlatform.isDarwin && stdenv.buildPlatform != stdenv.hostPlatform then ''
···
   outputs = [ "out" "doc" "man" /* "modules" */ ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  # autoreconfHook269 is needed for `suid-wrapper-path.patch` and
-  # `bind-locales.patch` above.
+  # autoreconfHook269 is needed for `suid-wrapper-path.patch` above.
   # pkg-config-unwrapped is needed for `AC_CHECK_LIB` and `AC_SEARCH_LIBS`
   nativeBuildInputs = [ flex autoreconfHook269 pkg-config-unwrapped ]
     ++ lib.optional stdenv.buildPlatform.isDarwin gettext;

pkgs/os-specific/linux/shadow/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.14.2";
+  version = "4.14.3";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = pname;
     rev = version;
-    hash = "sha256-8sFXxP4MPFzKfBHzlKlsibj0lVQKJbC/Z7pWCy3WEuc=";
+    hash = "sha256-Y5wyvmTh66Bjb1/UPdDF78lgvH7HFTCFowhQQ+Fo9ak=";
   };
 
   outputs = [ "out" "su" "dev" "man" ];

pkgs/os-specific/linux/systemd/default.nix

···
 , libpwquality
 , qrencode
 
-  # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to be available during build time.
+  # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to
+  # be available during build time.
   # Only libbpf should be a runtime dependency.
   # Note: llvmPackages is explicitly taken from buildPackages instead of relying
   # on splicing. Splicing will evaluate the adjacent (pkgsHostTarget) llvmPackages
   # which is sometimes problematic: llvmPackages.clang looks at targetPackages.stdenv.cc
-  # which, in the unfortunate case of pkgsCross.ghcjs, `throw`s. If we explicitly
-  # take buildPackages.llvmPackages, this is no problem because
-  # `buildPackages.targetPackages.stdenv.cc == stdenv.cc` relative to us. Working
-  # around this is important, because systemd is in the dependency closure of
-  # GHC via emscripten and jdk.
+  # which, in the unfortunate case of pkgsCross.ghcjs, `throw`s. If we
+  # explicitly take buildPackages.llvmPackages, this is no problem because
+  # `buildPackages.targetPackages.stdenv.cc == stdenv.cc` relative to
+  # us. Working around this is important, because systemd is in the dependency
+  # closure of GHC via emscripten and jdk.
 , bpftools
 , libbpf
 
···
     && !stdenv.hostPlatform.isMusl
     # "Unknown 64-bit data model"
     && !stdenv.hostPlatform.isRiscV32
-, withCompression ? true  # adds bzip2, lz4, xz and zstd
+  # adds bzip2, lz4, xz and zstd
+, withCompression ? true
 , withCoredump ? true
 , withCryptsetup ? true
 , withRepart ? true
 , withDocumentation ? true
 , withEfi ? stdenv.hostPlatform.isEfi
 , withFido2 ? true
-, withFirstboot ? false # conflicts with the NixOS /etc management
+  # conflicts with the NixOS /etc management
+, withFirstboot ? false
 , withHomed ? !stdenv.hostPlatform.isMusl
 , withHostnamed ? true
 , withHwdb ? true
···
 , withIptables ? true
 , withKmod ? true
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
-    && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
-    && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
+    # assumes hard floats
+    && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6")
+    # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
+    && !stdenv.hostPlatform.isMips64
     # can't find gnu/stubs-32.h
     && (stdenv.hostPlatform.isPower64 -> stdenv.hostPlatform.isBigEndian)
     # https://reviews.llvm.org/D43106#1019077
···
 , withTimedated ? true
 , withTimesyncd ? true
 , withTpm2Tss ? true
-, withUkify ? false  # adds python to closure which is too much by default
+  # adds python to closure which is too much by default
+, withUkify ? false
 , withUserDb ? true
 , withUtmp ? !stdenv.hostPlatform.isMusl
 , withVmspawn ? true
···
   # build only libudev and libsystemd
 , buildLibsOnly ? false
 
-  # name argument
+  # yes, pname is an argument here
 , pname ? "systemd"
 
 , libxslt
···
   wantGcrypt = withResolved || withImportd;
   version = "255.2";
 
-  # Bump this variable on every (major) version change. See below (in the meson options list) for why.
+  # Use the command below to update `releaseTimestamp` on every (major) version
+  # change. More details in the commentary at mesonFlags.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
···
     hash = "sha256-8SfJY/pcH4yrDeJi0GfIUpetTbpMwyswvSu+RSfgqfY=";
   };
 
-  # On major changes, or when otherwise required, you *must* reformat the patches,
-  # `git am path/to/00*.patch` them into a systemd worktree, rebase to the more recent
-  # systemd version, and export the patches again via
-  # `git -c format.signoff=false format-patch v${version} --no-numbered --zero-commit --no-signature`.
-  # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all patches
+  # On major changes, or when otherwise required, you *must* :
+  # 1. reformat the patches,
+  # 2. `git am path/to/00*.patch` them into a systemd worktree,
+  # 3. rebase to the more recent systemd version,
+  # 4. and export the patches again via
+  #   `git -c format.signoff=false format-patch v${version} --no-numbered --zero-commit --no-signature`.
+  # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all
+  # patches
   patches = [
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
···
       "$out/lib/systemd/boot/efi"
   '' + (
     let
-      # The following patches references to dynamic libraries to ensure that
-      # all the features that are implemented via dlopen(3) are available (or
+      # The following patches references to dynamic libraries to ensure that all
+      # the features that are implemented via dlopen(3) are available (or
       # explicitly deactivated) by pointing dlopen to the absolute store path
       # instead of relying on the linkers runtime lookup code.
       #
···
       # found` when using e.g. --grep with journalctl. Those errors should
       # become less unexpected now.
       #
-      # There are generally two classes of dlopen(3) calls. Those that we want to
-      # support and those that should be deactivated / unsupported. This change
-      # enforces that we handle all dlopen calls explicitly. Meaning: There is
-      # not a single dlopen call in the source code tree that we did not
-      # explicitly handle.
+      # There are generally two classes of dlopen(3) calls. Those that we want
+      # to support and those that should be deactivated / unsupported. This
+      # change enforces that we handle all dlopen calls explicitly. Meaning:
+      # There is not a single dlopen call in the source code tree that we did
+      # not explicitly handle.
       #
       # In order to do this we introduced a list of attributes that maps from
       # shared object name to the package that contains them. The package can be
···
       # path location).
       #
       # To get a list of dynamically loaded libraries issue something like
-      # `grep -ri '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"'' $src` and update the below list.
+      #   `grep -ri '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"'' $src`
+      # and update the list below.
       dlopenLibs =
         let
           opt = condition: pkg: if condition then pkg else null;
···
     # patch all the dlopen calls to contain absolute paths to the libraries
     lib.concatMapStringsSep "\n" patchDlOpen dlopenLibs
   )
-  # finally ensure that there are no left-over dlopen calls (or rather strings pointing to shared libraries) that we didn't handle
+  # finally ensure that there are no left-over dlopen calls (or rather strings
+  # pointing to shared libraries) that we didn't handle
   + ''
     if grep -qr '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"' src; then
       echo "Found unhandled dynamic library calls: "
···
   mesonFlags = [
     # Options
 
-    # We bump this variable on every (major) version change to ensure
-    # that we have known-good value for a timestamp that is in the (not so distant) past.
-    # This serves as a lower bound for valid system timestamps during startup. Systemd will
-    # reset the system timestamp if this date is +- 15 years from the system time.
+    # We bump this attribute on every (major) version change to ensure that we
+    # have known-good value for a timestamp that is in the (not so distant)
+    # past. This serves as a lower bound for valid system timestamps during
+    # startup. Systemd will reset the system timestamp if this date is +- 15
+    # years from the system time.
     # See the systemd v250 release notes for further details:
-    # https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
+    #   https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
     (lib.mesonOption "time-epoch" releaseTimestamp)
 
     (lib.mesonOption "version-tag" version)
···
   ];
   preConfigure =
     let
-      # A list of all the runtime binaries that the systemd executables, tests and libraries are referencing in their source code, scripts and unit files.
-      # As soon as a dependency isn't required anymore we should remove it from the list. The `where` attribute for each of the replacement patterns must be exhaustive. If another (unhandled) case is found in the source code the build fails with an error message.
+      # A list of all the runtime binaries referenced by the source code (plus
+      # scripts and unit files) of systemd executables, tests and libraries.
+      # As soon as a dependency is lo longer required we should remove it from
+      # the list.
+      # The `where` attribute for each of the replacement patterns must be
+      # exhaustive. If another (unhandled) case is found in the source code the
+      # build fails with an error message.
       binaryReplacements = [
-        { search = "/usr/bin/getent"; replacement = "${getent}/bin/getent"; where = [ "src/nspawn/nspawn-setuid.c" ]; }
-
+        {
+          search = "/usr/bin/getent";
+          replacement = "${getent}/bin/getent";
+          where = [ "src/nspawn/nspawn-setuid.c" ];
+        }
         {
           search = "/sbin/mkswap";
           replacement = "${lib.getBin util-linux}/sbin/mkswap";
···
             "man/systemd-makefs@.service.xml"
           ];
         }
-        { search = "/sbin/swapon"; replacement = "${lib.getOutput "swap" util-linux}/sbin/swapon"; where = [ "src/core/swap.c" "src/basic/unit-def.h" ]; }
-        { search = "/sbin/swapoff"; replacement = "${lib.getOutput "swap" util-linux}/sbin/swapoff"; where = [ "src/core/swap.c" ]; }
+        {
+          search = "/sbin/swapon";
+          replacement = "${lib.getOutput "swap" util-linux}/sbin/swapon";
+          where = [
+            "src/core/swap.c"
+            "src/basic/unit-def.h"
+          ];
+        }
+        {
+          search = "/sbin/swapoff";
+          replacement = "${lib.getOutput "swap" util-linux}/sbin/swapoff";
+          where = [ "src/core/swap.c" ];
+        }
         {
           search = "/bin/echo";
           replacement = "${coreutils}/bin/echo";
···
         {
           search = "/bin/cat";
           replacement = "${coreutils}/bin/cat";
-          where = [ "test/test-execute/exec-noexecpaths-simple.service" "src/journal/cat.c" ];
+          where = [
+            "test/test-execute/exec-noexecpaths-simple.service"
+            "src/journal/cat.c"
+          ];
         }
         {
           search = "/usr/lib/systemd/systemd-fsck";
           replacement = "$out/lib/systemd/systemd-fsck";
-          where = [
-            "man/systemd-fsck@.service.xml"
-          ];
+          where = [ "man/systemd-fsck@.service.xml" ];
         }
       ] ++ lib.optionals withImportd [
         {
···
           ];
         }
       ] ++ lib.optionals withKmod [
-        { search = "/sbin/modprobe"; replacement = "${lib.getBin kmod}/sbin/modprobe"; where = [ "units/modprobe@.service" ]; }
+        {
+          search = "/sbin/modprobe";
+          replacement = "${lib.getBin kmod}/sbin/modprobe";
+          where = [ "units/modprobe@.service" ];
+        }
       ];
 
-      # { replacement, search, where } -> List[str]
+      # { replacement, search, where, ignore } -> List[str]
       mkSubstitute = { replacement, search, where, ignore ? [ ] }:
         map (path: "substituteInPlace ${path} --replace '${search}' \"${replacement}\"") where;
       mkEnsureSubstituted = { replacement, search, where, ignore ? [ ] }:
···
     mv $out/lib/sysusers.d $out/example
   '';
 
-  # Avoid *.EFI binary stripping. At least on aarch64-linux strip
-  # removes too much from PE32+ files:
+  # Avoid *.EFI binary stripping.
+  # At least on aarch64-linux strip removes too much from PE32+ files:
   #   https://github.com/NixOS/nixpkgs/issues/169693
-  # The hack is to move EFI file out of lib/ before doStrip
-  # run and return it after doStrip run.
+  # The hack is to move EFI file out of lib/ before doStrip run and return it
+  # after doStrip run.
   preFixup = lib.optionalString withBootloader ''
     mv $out/lib/systemd/boot/efi $out/dont-strip-me
   '';
···
     (builtins.map (p: p.__spliced.buildHost or p) finalAttrs.nativeBuildInputs);
 
   passthru = {
-    # The interface version prevents NixOS from switching to an
-    # incompatible systemd at runtime.  (Switching across reboots is
-    # fine, of course.)  It should be increased whenever systemd changes
-    # in a backwards-incompatible way.  If the interface version of two
-    # systemd builds is the same, then we can switch between them at
-    # runtime; otherwise we can't and we need to reboot.
+    # The `interfaceVersion` attribute below points out the incompatibilities
+    # between systemd versions. When the new systemd build is
+    # backwards-compatible with the previous one, then they can be switched at
+    # runtime (the reboot being optional in this case); otherwise, a reboot is
+    # needed - and therefore `interfaceVersion` should be incremented.
     interfaceVersion = 2;
 
-    inherit withCryptsetup withHostnamed withImportd withKmod withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
+    inherit withCryptsetup withHostnamed withImportd withKmod withLocaled
+      withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests)
···
         systemd-journal
         systemd-journal-gateway
         systemd-journal-upload;
-      cross = pkgsCross.${if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform"}.systemd;
+      cross =
+        let
+          systemString =
+            if stdenv.buildPlatform.isAarch64
+            then "gnu64"
+            else "aarch64-multiplatform";
+        in
+        pkgsCross.${systemString}.systemd;
     };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.freedesktop.org/wiki/Software/systemd/";
     description = "A system and service manager for Linux";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
+    longDescription = ''
+      systemd is a suite of basic building blocks for a Linux system. It
+      provides a system and service manager that runs as PID 1 and starts the
+      rest of the system. systemd provides aggressive parallelization
+      capabilities, uses socket and D-Bus activation for starting services,
+      offers on-demand starting of daemons, keeps track of processes using Linux
+      control groups, maintains mount and automount points, and implements an
+      elaborate transactional dependency-based service control logic. systemd
+      supports SysV and LSB init scripts and works as a replacement for
+      sysvinit. Other parts include a logging daemon, utilities to control basic
+      system configuration like the hostname, date, locale, maintain a list of
+      logged-in users and running containers and virtual machines, system
+      accounts, runtime directories and settings, and daemons to manage simple
+      network configuration, network time synchronization, log forwarding, and
+      name resolution.
+    '';
+    license = with lib.licenses; [
+      # Taken from https://raw.githubusercontent.com/systemd/systemd-stable/${finalAttrs.src.rev}/LICENSES/README.md
+      bsd2
+      bsd3
+      cc0
+      lgpl21Plus
+      lgpl2Plus
+      mit
+      mit0
+      ofl
+      publicDomain
+    ];
+    maintainers = with lib.maintainers; [ flokli kloenk ];
+    platforms = lib.platforms.linux;
+    priority = 10;
     badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
     # https://github.com/systemd/systemd/issues/20600#issuecomment-912338965
     broken = stdenv.hostPlatform.isStatic;
-    priority = 10;
-    maintainers = with maintainers; [ flokli kloenk ];
   };
 })

pkgs/servers/mpd/default.nix

···
         description = "A flexible, powerful daemon for playing music";
         homepage    = "https://www.musicpd.org/";
         license     = licenses.gpl2Only;
-        maintainers = with maintainers; [ astsmtl ehmry tobim ];
+        maintainers = with maintainers; [ astsmtl tobim ];
         platforms   = platforms.unix;
         mainProgram = "mpd";
 

pkgs/servers/redpanda/default.nix

···
 , stdenv
 }:
 let
-  version = "23.3.4";
+  version = "23.3.5";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-Bcr+bMqurwpd7IFTBR73RcgekkiuQQ3JPjvrp03fpJ0=";
+    sha256 = "sha256-rERKoaSZ/lscMW9IcHU00+l4BzvFCz3RMDCQyiEam0E=";
   };
   server = callPackage ./server.nix { inherit src version; };
 in

pkgs/servers/slimserver/default.nix

···
 in
 perlPackages.buildPerlPackage rec {
   pname = "slimserver";
-  version = "8.3.1";
+  version = "8.4.0";
 
   src = fetchFromGitHub {
     owner = "Logitech";
     repo = "slimserver";
     rev = version;
-    hash = "sha256-yMFOwh/oPiJnUsKWBGvd/GZLjkWocMAUK0r+Hx/SUPo=";
+    hash = "sha256-92mKchgAWRIrNOeK/zXUYRqIAk6THdtz1zQe3fg2kE0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
···
 
   meta = with lib; {
     homepage = "https://github.com/Logitech/slimserver";
+    changelog = "https://github.com/Logitech/slimserver/blob/${version}/Changelog${lib.versions.major version}.html";
     description = "Server for Logitech Squeezebox players. This server is also called Logitech Media Server";
-    # the firmware is not under a free license, but not included in the default package
+    # the firmware is not under a free license, so we do not include firmware in the default package
     # https://github.com/Logitech/slimserver/blob/public/8.3/License.txt
     license = if enableUnfreeFirmware then licenses.unfree else licenses.gpl2Only;
     mainProgram = "slimserver";

pkgs/servers/sql/postgresql/ext/postgis.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "postgis";
-  version = "3.4.1";
+  version = "3.4.2";
 
   outputs = [ "out" "doc" ];
 
   src = fetchurl {
     url = "https://download.osgeo.org/postgis/source/postgis-${version}.tar.gz";
-    sha256 = "sha256-/vahQSE9D/J79FszuEnMOWwi3bH/xv7UNUacnokfyB0=";
+    sha256 = "sha256-yMh0wAukqYSocDCva/lUSCFQIGCtRz1clvHU0INcWJI=";
   };
 
   buildInputs = [ libxml2 postgresql geos proj gdal json_c protobufc pcre2.dev ]

pkgs/servers/sql/postgresql/ext/timescaledb.nix

···
 
 stdenv.mkDerivation rec {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.13.1";
+  version = "2.14.0";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl libkrb5 ];
···
     owner = "timescale";
     repo = "timescaledb";
     rev = version;
-    hash = "sha256-7OMeH818f/wu55jQS/6pP+hl7ph2Ul5LiLrSDA47SeM=";
+    hash = "sha256-CtuJSLhrgvUAyJDnPvCNH2Rizl0W6SuMjWA6wpDqRtE=";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" "-DTAP_CHECKS=OFF" ]

pkgs/servers/web-apps/rss-bridge/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "rss-bridge";
-  version = "2023-09-24";
+  version = "2024-02-02";
 
   src = fetchFromGitHub {
     owner = "RSS-Bridge";
     repo = "rss-bridge";
     rev = version;
-    sha256 = "sha256-N1pbveOgJrB1M+WelKD07Jmv9Vz5NqT+IJf//L8UEnU=";
+    sha256 = "sha256-VycEgu7uHYwDnNE1eoVxgaWZAnC6mZLBxT8Le3PI4Rs=";
   };
 
   patches = [

pkgs/servers/web-apps/rss-bridge/paths.patch

···
 diff --git a/lib/Configuration.php b/lib/Configuration.php
-index c38d7cc9..d95e5174 100644
+index 63f67a3c..f0a53a24 100644
 --- a/lib/Configuration.php
 +++ b/lib/Configuration.php
-@@ -104,8 +104,8 @@ final class Configuration
+@@ -81,8 +81,8 @@ public static function loadConfiguration(array $customConfig = [], array $env =
              }
          }
  
···
              if ($enabledBridges === '*') {
                  self::setConfig('system', 'enabled_bridges', ['*']);
              } else {
-diff --git a/lib/RssBridge.php b/lib/RssBridge.php
-index 6ba952eb..a0bbaf03 100644
---- a/lib/RssBridge.php
-+++ b/lib/RssBridge.php
-@@ -11,8 +11,8 @@ final class RssBridge
-         Configuration::verifyInstallation();
- 
-         $customConfig = [];
--        if (file_exists(__DIR__ . '/../config.ini.php')) {
--            $customConfig = parse_ini_file(__DIR__ . '/../config.ini.php', true, INI_SCANNER_TYPED);
-+        if (file_exists(getenv('RSSBRIDGE_DATA') . '/config.ini.php')) {
-+            $customConfig = parse_ini_file(getenv('RSSBRIDGE_DATA') . '/config.ini.php', true, INI_SCANNER_TYPED);
-         }
-         Configuration::loadConfiguration($customConfig, getenv());
- 
 diff --git a/lib/bootstrap.php b/lib/bootstrap.php
-index dc1c0f04..194a3f8f 100644
+index 6465f5f9..4605596f 100644
 --- a/lib/bootstrap.php
 +++ b/lib/bootstrap.php
-@@ -27,7 +27,7 @@ const PATH_LIB_CACHES = __DIR__ . '/../caches/';
- const PATH_LIB_ACTIONS = __DIR__ . '/../actions/';
+@@ -1,7 +1,7 @@
+ <?php
  
- /** Path to the cache folder */
+ const PATH_LIB_CACHES = __DIR__ . '/../caches/';
 -const PATH_CACHE = __DIR__ . '/../cache/';
 +define('PATH_CACHE', getenv('RSSBRIDGE_DATA') . '/cache/');
  
- /** URL to the RSS-Bridge repository */
- const REPOSITORY = 'https://github.com/RSS-Bridge/rss-bridge/';
+ // Allow larger files for simple_html_dom
+ // todo: extract to config (if possible)
+@@ -43,7 +43,7 @@
+ });
+ 
+ $customConfig = [];
+-if (file_exists(__DIR__ . '/../config.ini.php')) {
+-    $customConfig = parse_ini_file(__DIR__ . '/../config.ini.php', true, INI_SCANNER_TYPED);
++if (file_exists(getenv('RSSBRIDGE_DATA') . '/config.ini.php')) {
++    $customConfig = parse_ini_file(getenv('RSSBRIDGE_DATA') . '/config.ini.php', true, INI_SCANNER_TYPED);
+ }
+ Configuration::loadConfiguration($customConfig, getenv());

pkgs/servers/x11/xorg/default.nix

···
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   imake = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "imake";
-    version = "1.0.9";
+    version = "1.0.10";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/util/imake-1.0.9.tar.xz";
-      sha256 = "10wgw3l0rsnvc2191awyg5j24n3g552xgc671qr5vnbliwkrvpkj";
+      url = "mirror://xorg/individual/util/imake-1.0.10.tar.xz";
+      sha256 = "1xgcsamfij22ggc4p8anvvihwyf4adg6gjdd6v7m9cypm37cppkm";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;

pkgs/servers/x11/xorg/tarballs.list

···
 mirror://xorg/individual/proto/xorgproto-2023.2.tar.xz
 mirror://xorg/individual/util/bdftopcf-1.1.1.tar.xz
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
-mirror://xorg/individual/util/imake-1.0.9.tar.xz
+mirror://xorg/individual/util/imake-1.0.10.tar.xz
 mirror://xorg/individual/util/lndir-1.0.4.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.8.tar.xz
 mirror://xorg/individual/util/util-macros-1.20.0.tar.xz

pkgs/shells/bash/5.nix

···
   });
 in
 stdenv.mkDerivation rec {
-  name = "bash-${lib.optionalString interactive "interactive-"}${version}-p${toString (builtins.length upstreamPatches)}";
-  version = "5.2";
+  pname = "bash${lib.optionalString interactive "-interactive"}";
+  version = "5.2${patch_suffix}";
+  patch_suffix = "p${toString (builtins.length upstreamPatches)}";
 
   src = fetchurl {
-    url = "mirror://gnu/bash/bash-${version}.tar.gz";
+    url = "mirror://gnu/bash/bash-${lib.removeSuffix patch_suffix version}.tar.gz";
     sha256 = "sha256-oTnBZt9/9EccXgczBRZC7lVWwcyKSnjxRVg8XIGrMvs=";
   };
 

pkgs/shells/bash/bash-5.2-patches.nix

···
 (patch "019" "10njgv5mrc5rhsp5lvxcbm0pnzn59a8spi2nhdasifyl1a32cp1j")
 (patch "020" "07f0wlmqjdfarp44w3gj9gdqbqm5x20rvlhpn34ngklmxcm2bz5n")
 (patch "021" "1kahfqqalcwi4m73pg3ssz6lh0kcqsqax09myac7a15d2y0vhd43")
+(patch "022" "0w74aym0g1fh48864a3qxh89f26iaq7wsbg7244c6kjr94527dbq")
+(patch "023" "1lywjqbc36j5pdzfcvnz1zy30j76aqmsm190p888av0hw815b45g")
+(patch "024" "1hq23djqbr7s9y2324jq9mxr5bwdkmgizn3zgpchbsqp054k85cp")
+(patch "025" "0x9hc4silzl4d3zw4p43i5dm7w86k50j47f87lracwfgwy3z8f2i")
+(patch "026" "1b1fhm1dsi67r8ip17s0xvx2qq31fsxc1g9n3r931dd0k9a1zvln")
 ]

pkgs/stdenv/darwin/default.nix

···
                 ln -s ${bootstrapTools}/lib/clang $out/lib
                 ln -s ${bootstrapTools}/include   $out
               '';
-              passthru.isFromBootstrapFiles = true;
+              passthru = {
+                isFromBootstrapFiles = true;
+                hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
+              };
             };
             clang-unwrapped = selfTools.libclang;
             libllvm = self.stdenv.mkDerivation {

pkgs/stdenv/generic/make-derivation.nix

···
     "relro"
     "stackprotector"
     "strictoverflow"
+    "zerocallusedregs"
   ];
   defaultHardeningFlags =
     (if stdenv.hasCC then stdenv.cc else {}).defaultHardeningFlags or

pkgs/stdenv/linux/bootstrap-files/i686-unknown-linux-gnu.nix

···
+# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
+# $ ./refresh-tarballs.bash --targets=i686-unknown-linux-gnu
+#
+# Metadata:
+# - nixpkgs revision: 125cefd4cf8f857e5ff1aceaef9230ba578a033d
+# - hydra build: https://hydra.nixos.org/job/nixpkgs/trunk/stdenvBootstrapTools.i686-unknown-linux-gnu.build/latest
+# - resolved hydra build: https://hydra.nixos.org/build/247889988
+# - instantiated derivation: /nix/store/chcf0brhdyn7ihmb14n0w4rm2a59gqrw-stdenv-bootstrap-tools.drv
+# - output directory: /nix/store/5x6dldhza7if5s6wsicaxa8fbndyixps-stdenv-bootstrap-tools
+# - build time: Fri, 26 Jan 2024 22:04:03 +0000
 {
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/i686-unknown-linux-gnu/125cefd4cf8f857e5ff1aceaef9230ba578a033d/bootstrap-tools.tar.xz";
+    hash = "sha256-KTAh3t91aJMiMO/7NFOjUz6fXI9Iu+H7cuODreWz9N8=";
+  };
   busybox = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-linux/i686/4907fc9e8d0d82b28b3c56e3a478a2882f1d700f/busybox";
-    sha256 = "ef4c1be6c7ae57e4f654efd90ae2d2e204d6769364c46469fa9ff3761195cba1";
+    url = "http://tarballs.nixos.org/stdenv/i686-unknown-linux-gnu/125cefd4cf8f857e5ff1aceaef9230ba578a033d/busybox";
+    hash = "sha256-omz+ZT0bhMkAZcDs9evA2PNpO6VHUozdtjMgdui6fxw=";
     executable = true;
-  };
-
-  bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv-linux/i686/c5aabb0d603e2c1ea05f5a93b3be82437f5ebf31/bootstrap-tools.tar.xz";
-    sha256 = "b9bf20315f8c5c0411679c5326084420b522046057a0850367c67d9514794f1c";
   };
 }

pkgs/stdenv/linux/bootstrap-tools-musl/default.nix

···
   langC = true;
   langCC = true;
   isGNU = true;
-  hardeningUnsupportedFlags = [ "fortify3" ];
+  hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
 } // extraAttrs)

pkgs/stdenv/linux/bootstrap-tools/default.nix

···
   langC = true;
   langCC = true;
   isGNU = true;
-  hardeningUnsupportedFlags = [ "fortify3" ];
+  hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
 } // extraAttrs)

pkgs/test/nixpkgs-check-by-name/scripts/pinned-tool.json

···
 {
-  "rev": "ae5c332cbb5827f6b1f02572496b141021de335f",
-  "ci-path": "/nix/store/ghfxriicygwcrxvm45r0cm9g0vshpw01-nixpkgs-check-by-name"
+  "rev": "f8e2ebd66d097614d51a56a755450d4ae1632df1",
+  "ci-path": "/nix/store/4kv4fyb6x5ivn0qncg7d9i5zhqhzy7bi-nixpkgs-check-by-name"
 }

pkgs/tools/X11/xdg-utils/default.nix

···
-{ lib, stdenv, fetchFromGitLab, fetchFromGitHub, fetchpatch
-, file, libxslt, docbook_xml_dtd_412, docbook_xsl, xmlto
-, w3m, gnugrep, gnused, coreutils, xset, perlPackages
-, mimiSupport ? false, gawk
-, bash
-, glib
+{ lib, stdenv, fetchFromGitLab, fetchFromGitHub, fetchpatch, writeText
+# docs deps
+, libxslt, docbook_xml_dtd_412, docbook_xml_dtd_43, docbook_xsl, xmlto
+# runtime deps
+, resholve, bash, coreutils, dbus, file, gawk, glib, gnugrep, gnused, jq, lockfileProgs, nettools, procmail, procps, xdg-user-dirs
+, perl, perlPackages
+, mimiSupport ? false
 , withXdgOpenUsePortalPatch ? true }:
 
 let
···
     sha256 = "15gw2nyrqmdsdin8gzxihpn77grhk9l97jp7s7pr7sl4n9ya2rpj";
   };
 
-  perlPath = with perlPackages; makePerlPath [
-    NetDBus XMLTwig XMLParser X11Protocol
+  # Required by the common desktop detection code
+  commonDeps = [ dbus coreutils gnugrep gnused ];
+  # These are all faked because the current desktop is detected
+  # based on their presence, so we want them to be missing by default.
+  commonFakes = [
+    "explorer.exe"
+    "gnome-default-applications-properties"
+    "kde-config"
+    "xprop"
   ];
 
+  # This is still required to work around the eval trickery some scripts do
+  commonPrologue = "${writeText "xdg-utils-prologue" ''
+    export PATH=$PATH:${coreutils}/bin
+  ''}";
+
+  solutions = [
+    {
+      scripts = [ "bin/xdg-desktop-icon" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = commonDeps ++ [ xdg-user-dirs ];
+      execer = [
+        "cannot:${xdg-user-dirs}/bin/xdg-user-dir"
+      ];
+      # These are desktop-specific, so we don't want xdg-utils to be able to
+      # call them when in a different setup.
+      fake.external = commonFakes ++ [
+        "gconftool-2"   # GNOME2
+      ];
+      keep."$KDE_SESSION_VERSION" = true;
+      prologue = commonPrologue;
+    }
+
+    {
+      scripts = [ "bin/xdg-desktop-menu" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = commonDeps ++ [ gawk ];
+      fake.external = commonFakes;
+      keep."$KDE_SESSION_VERSION" = true;
+      prologue = commonPrologue;
+    }
+
+    {
+      scripts = [ "bin/xdg-email" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = commonDeps ++ [ gawk glib.bin "${placeholder "out"}/bin" ];
+      execer = [
+        "cannot:${placeholder "out"}/bin/xdg-mime"
+        "cannot:${placeholder "out"}/bin/xdg-open"
+      ];
+      # These are desktop-specific, so we don't want xdg-utils to be able to
+      # call them when in a different setup.
+      fake.external = commonFakes ++ [
+        "exo-open"           # XFCE
+        "gconftool-2"        # GNOME
+        "gio"                # GNOME (new)
+        "gnome-open"         # GNOME (very old)
+        "gvfs-open"          # GNOME (old)
+        "qtxdg-mat"          # LXQT
+        "xdg-email-hook.sh"  # user-defined hook that may be available ambiently
+      ];
+      fix."/bin/echo" = true;
+      keep = {
+        "$command" = true;
+        "$kreadconfig" = true;
+        "$THUNDERBIRD" = true;
+        "$utf8" = true;
+      };
+    }
+
+    {
+      scripts = [ "bin/xdg-icon-resource" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = commonDeps;
+      fake.external = commonFakes;
+      keep."$KDE_SESSION_VERSION" = true;
+      prologue = commonPrologue;
+    }
+
+    {
+      scripts = [ "bin/xdg-mime" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = commonDeps ++ [ file gawk ];
+      # These are desktop-specific, so we don't want xdg-utils to be able to
+      # call them when in a different setup.
+      fake.external = commonFakes ++ [
+        "gio"                # GNOME (new)
+        "gnomevfs-info"      # GNOME (very old)
+        "gvfs-info"          # GNOME (old)
+        "kde4-config"        # Plasma 4
+        "kfile"              # KDE 3
+        "kmimetypefinder"    # Plasma (generic)
+        "kmimetypefinder5"   # Plasma 5
+        "ktraderclient"      # KDE 3
+        "ktradertest"        # KDE 3
+        "mimetype"           # alternative tool for file, pulls in perl, avoid
+        "qtpaths"            # Plasma
+        "qtxdg-mat"          # LXQT
+      ];
+      fix."/usr/bin/file" = true;
+      keep = {
+        "$KDE_SESSION_VERSION" = true;
+        "$KTRADER" = true;
+      };
+      prologue = commonPrologue;
+    }
+
+    {
+      scripts = [ "bin/xdg-open" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = commonDeps ++ [ nettools glib.bin "${placeholder "out"}/bin" ];
+      execer = [
+        "cannot:${placeholder "out"}/bin/xdg-mime"
+      ];
+      # These are desktop-specific, so we don't want xdg-utils to be able to
+      # call them when in a different setup.
+      fake.external = commonFakes ++ [
+        "cygstart"            # Cygwin
+        "dde-open"            # Deepin
+        "enlightenment_open"  # Enlightenment
+        "exo-open"            # XFCE
+        "gio"                 # GNOME (new)
+        "gnome-open"          # GNOME (very old)
+        "gvfs-open"           # GNOME (old)
+        "kde-open"            # Plasma
+        "kfmclient"           # KDE3
+        "mate-open"           # MATE
+        "mimeopen"            # alternative tool for file, pulls in perl, avoid
+        "open"                # macOS
+        "pcmanfm"             # LXDE
+        "qtxdg-mat"           # LXQT
+        "run-mailcap"         # generic
+        "rundll32.exe"        # WSL
+        "wslpath"             # WSL
+      ];
+      fix."$printf" = [ "printf" ];
+      keep = {
+        "env:$command" = true;
+        "$browser" = true;
+        "$KDE_SESSION_VERSION" = true;
+      };
+    }
+
+    {
+      scripts = [ "bin/xdg-screensaver" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = commonDeps ++ [ lockfileProgs nettools perl procmail procps ];
+      # These are desktop-specific, so we don't want xdg-utils to be able to
+      # call them when in a different setup.
+      fake.external = commonFakes ++ [
+        "dcop"                      # KDE3
+        "mate-screensaver-command"  # MATE
+        "xautolock"                 # Xautolock
+        "xscreensaver-command"      # Xscreensaver
+        "xset"                      # generic-ish X
+      ];
+      fix."$lockfile_command" = [ "lockfile" ];
+      keep = {
+        "$MV" = true;
+        "$XPROP" = true;
+      };
+      prologue = "${writeText "xdg-screensaver-prologue" ''
+        export PERL5LIB=${with perlPackages; makePerlPath [ NetDBus XMLTwig XMLParser X11Protocol ]}
+        export PATH=$PATH:${coreutils}/bin
+      ''}";
+    }
+
+    {
+      scripts = [ "bin/xdg-settings" ];
+      interpreter = "${bash}/bin/bash";
+      inputs = commonDeps ++ [ jq "${placeholder "out"}/bin" ];
+      execer = [
+        "cannot:${placeholder "out"}/bin/xdg-mime"
+      ];
+      # These are desktop-specific, so we don't want xdg-utils to be able to
+      # call them when in a different setup.
+      fake.external = commonFakes ++ [
+        "gconftool-2"    # GNOME
+        "kreadconfig"    # Plasma (generic)
+        "kreadconfig5"   # Plasma 5
+        "kreadconfig6"   # Plasma 6
+        "ktradertest"    # KDE3
+        "kwriteconfig"   # Plasma (generic)
+        "kwriteconfig5"  # Plasma 5
+        "kwriteconfig6"  # Plasma 6
+        "qtxdg-mat"      # LXQT
+      ];
+      keep = {
+        "$KDE_SESSION_VERSION" = true;
+        # get_browser_$handler
+        "$handler" = true;
+      };
+    }
+  ];
 in
 
 stdenv.mkDerivation rec {
   pname = "xdg-utils";
-  version = "unstable-2022-11-06";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "xdg";
     repo = "xdg-utils";
-    rev = "8ae02631a9806da11b34cd6b274af02d28aee5da";
-    sha256 = "sha256-WdnnAiPYbREny633FnBi5tD9hDuF8NCVVbUaAVIKTxM=";
+    rev = "v${version}";
+    hash = "sha256-rjNIO4B9jHsBmPaugWTMqTGNpjiw0MTEmf9/ds2Mud4=";
   };
 
-  patches = lib.optionals withXdgOpenUsePortalPatch [
+  patches = [
+    # Backport typo fix
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/xdg/xdg-utils/-/commit/af2fe0d1dcbcd982d84ddf2bbd174afe90976ed9.patch";
+      hash = "sha256-HhQk06wWkyWjSxjXet+sADKf1irswKxDA8WuOknZKRs=";
+    })
+    # Backport docs rendering fixes
+    # See: https://gitlab.freedesktop.org/xdg/xdg-utils/-/merge_requests/106
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/xdg/xdg-utils/-/commit/403a720ad18920030418a7c3d1f2caba9ce3892d.patch";
+      hash = "sha256-XxFUeyXENHCy+wplIJ5OzoU5oyA4v1bz/9qMXp1ZwsE=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/xdg/xdg-utils/-/commit/a137f2ba87620402aca21b14fb1d79517782dd29.patch";
+      hash = "sha256-XFUAWn4uOyzgLdvupBxsO7wm6VDSzYj1SGZEM+9ouec=";
+    })
+  ] ++ lib.optionals withXdgOpenUsePortalPatch [
     # Allow forcing the use of XDG portals using NIXOS_XDG_OPEN_USE_PORTAL environment variable.
     # Upstream PR: https://github.com/freedesktop/xdg-utils/pull/12
     ./allow-forcing-portal-use.patch
-    # Allow opening files when using portal with xdg-open.
-    # Upstream PR: https://gitlab.freedesktop.org/xdg/xdg-utils/-/merge_requests/65
-    (fetchpatch {
-      name = "support-openfile-with-portal.patch";
-      url = "https://gitlab.freedesktop.org/xdg/xdg-utils/-/commit/5cd8c38f58d9db03240f4bc67267fe3853b66ec7.diff";
-      hash = "sha256-snkhxwGF9hpqEh5NGG8xixTi/ydAk5apXRtgYrVgNY8=";
-    })
   ];
 
   # just needed when built from git
-  nativeBuildInputs = [ libxslt docbook_xml_dtd_412 docbook_xsl xmlto w3m ];
+  nativeBuildInputs = [ libxslt docbook_xml_dtd_412 docbook_xml_dtd_43 docbook_xsl xmlto ];
 
   # explicitly provide a runtime shell so patchShebangs is consistent across build platforms
   buildInputs = [ bash ];
 
   postInstall = lib.optionalString mimiSupport ''
     cp ${mimisrc}/xdg-open $out/bin/xdg-open
-  '' + ''
-    sed  '2s#.#\
-    sed()   { ${gnused}/bin/sed     "$@"; }\
-    grep()  { ${gnugrep}/bin/grep   "$@"; }\
-    egrep() { ${gnugrep}/bin/egrep  "$@"; }\
-    file()  { ${file}/bin/file      "$@"; }\
-    awk()   { ${gawk}/bin/awk       "$@"; }\
-    xset()  { ${xset}/bin/xset      "$@"; }\
-    perl()  { PERL5LIB=${perlPath} ${perlPackages.perl}/bin/perl "$@"; }\
-    mimetype() { ${perlPackages.FileMimeInfo}/bin/mimetype "$@"; }\
-    PATH=$PATH:'$out'/bin:${coreutils}/bin\
-    &#' -i "$out"/bin/*
+  '';
 
-    substituteInPlace $out/bin/xdg-open \
-      --replace "/usr/bin/printf" "${coreutils}/bin/printf" \
-      --replace "gdbus" "${glib}/bin/gdbus" \
-      --replace "mimeopen" "${perlPackages.FileMimeInfo}/bin/mimeopen"
-
-    substituteInPlace $out/bin/xdg-mime \
-      --replace "/usr/bin/file" "${file}/bin/file"
-
-    substituteInPlace $out/bin/xdg-email \
-      --replace "/bin/echo" "${coreutils}/bin/echo" \
-      --replace "gdbus" "${glib}/bin/gdbus"
-
-    sed 's|\bwhich\b|type -P|g' -i "$out"/bin/*
-  '';
+  preFixup = lib.concatStringsSep "\n" (map (resholve.phraseSolution "xdg-utils-resholved") solutions);
 
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/xdg-utils/";

pkgs/tools/admin/ansible/lint.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ansible-lint";
-  version = "6.22.2";
+  version = "24.2.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-L0Cf6Y762mHan4q3zfNKW2feQ+EzjO4GGfXVH0+LFd0=";
+    hash = "sha256-a8XWJz8zcR7G03Df5f2+l6ZLTDbCp6GaJJQBMm6wNhY=";
   };
 
   postPatch = ''

pkgs/tools/archivers/cpio/default.nix

···
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , autoreconfHook
 
 # for passthru.tests
···
 
 stdenv.mkDerivation rec {
   pname = "cpio";
-  version = "2.14";
+  version = "2.15";
 
   src = fetchurl {
     url = "mirror://gnu/cpio/cpio-${version}.tar.bz2";
-    sha256 = "/NwV1g9yZ6b8fvzWudt7bIlmxPL7u5ZMJNQTNv0/LBI=";
+    hash = "sha256-k3YQuXwymh7JJoVT+3gAN7z/8Nz/6XJevE/ZwaqQdds=";
   };
-
-  patches = [
-    # Pull upstream fix for clang-16 and gcc-14.
-    (fetchpatch {
-      name = "major-decl.patch";
-      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=8179be21e664cedb2e9d238cc2f6d04965e97275";
-      hash = "sha256-k5Xiv3xuPU8kPT6D9B6p+V8SK55ybFgrIIPDgHuorpM=";
-    })
-  ];
 
   nativeBuildInputs = [ autoreconfHook ];
 

pkgs/tools/archivers/unrar/default.nix

···
     homepage = "https://www.rarlab.com/";
     license = licenses.unfreeRedistributable;
     mainProgram = "unrar";
-    maintainers = with maintainers; [ ehmry wegank ];
+    maintainers = with maintainers; [ wegank ];
     platforms = platforms.all;
   };
 })

pkgs/tools/archivers/zip/buffer-overflow-on-utf8-rh-bug-2165653.patch

···
+diff -urp zip30/fileio.c zip30/fileio.c
+--- zip30/fileio.c	2008-05-29 03:13:24.000000000 +0300
++++ zip30/fileio.c	2023-05-02 12:19:50.488314853 +0300
+@@ -3502,7 +3502,7 @@ zwchar *local_to_wide_string(local_strin
+   if ((wc_string = (wchar_t *)malloc((wsize + 1) * sizeof(wchar_t))) == NULL) {
+     ZIPERR(ZE_MEM, "local_to_wide_string");
+   }
+-  wsize = mbstowcs(wc_string, local_string, strlen(local_string) + 1);
++  wsize = mbstowcs(wc_string, local_string, wsize + 1);
+   wc_string[wsize] = (wchar_t) 0;
+ 
+   /* in case wchar_t is not zwchar */

pkgs/tools/archivers/zip/default.nix

···
     ./fix-memset-detection.patch
     # Implicit declaration of `closedir` and `opendir` cause dirent detection to fail with clang 16.
     ./fix-implicit-declarations.patch
+    # Buffer overflow on Unicode characters in path names
+    # https://bugzilla.redhat.com/show_bug.cgi?id=2165653
+    ./buffer-overflow-on-utf8-rh-bug-2165653.patch
   ] ++ lib.optionals (enableNLS && !stdenv.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
 
   buildInputs = lib.optional enableNLS libnatspec

pkgs/tools/backup/sigtop/default.nix

···
 
 buildGoModule rec {
   name = "sigtop";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "tbvdm";
     repo = "sigtop";
     rev = "v${version}";
-    sha256 = "sha256-vFs6/b2ypwMXDgmkZDgfKPqW0GRh9A2t4QQvkUdhYQw=";
+    sha256 = "sha256-+TV3mlFW3SxgLyXyOPWKhMdkPf/ZTK2/EMWaZHC82YM=";
   };
 
-  vendorHash = "sha256-H43XOupVicLpYfkWNjArpSxQWcFqh9h2Zb6zGZ5xtfs=";
+  vendorHash = "sha256-kkRmyWYrWDq96fECe2YMsDjRZPX2K0jKFitMJycaVVA=";
 
   makeFlags = [
     "PREFIX=\${out}"

pkgs/tools/compression/plzip/default.nix

···
-{ lib, stdenv, fetchurl, lzip, lzlib, texinfo }:
-
-stdenv.mkDerivation rec {
-  pname = "plzip";
-  version = "1.10";
-  outputs = [ "out" "man" "info" ];
-
-  src = fetchurl {
-    url = "mirror://savannah/lzip/plzip/plzip-${version}.tar.lz";
-    sha256 = "62f16a67be0dabf0da7fd1cb7889fe5bfae3140cea6cafa1c39e7e35a5b3c661";
-  };
-
-  nativeBuildInputs = [ lzip texinfo ];
-  buildInputs = [ lzlib ];
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    homepage = "https://www.nongnu.org/lzip/plzip.html";
-    description = "A massively parallel lossless data compressor based on the lzlib compression library";
-    license = licenses.gpl2Plus;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ _360ied ];
-    mainProgram = "plzip";
-  };
-}

pkgs/tools/compression/xz/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.4.5";
+  version = "5.4.6";
 
   src = fetchurl {
-    url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "sha256-jM9f/4aMAG8pUi44b7TGobZkY/vKZaTPw8S9WW6JXnk=";
+    url = "https://github.com/tukaani-project/xz/releases/download/v${version}/xz-${version}.tar.bz2";
+    sha256 = "sha256-kThRsnTo4dMXgeyUnxwj6NvPDs9uc6JDbcIXad0+b0k=";
   };
 
   strictDeps = true;

pkgs/tools/filesystems/juicefs/default.nix

···
 
 buildGoModule rec {
   pname = "juicefs";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "juicedata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dMzBgwd5tVxE6OFHf6QTZfoqgL/t2pX+OgI6Pki6PG8=";
+    sha256 = "sha256-Sf68N5ZKveKM6xZEqF7Ah0KGgOx1cGZpJ2lYkUlgpI0=";
   };
 
-  vendorHash = "sha256-orq03bwN1cbwHoZFXz92tcA2F0oivGR/C5EJDAPA+pk=";
+  vendorHash = "sha256-ofUo/3EQPhXPNeD/3to5oFir/3eAaf9WBHR4DOzcxBQ=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/tools/graphics/amber/default.nix

···
 , cmake
 , pkg-config
 , cctools
+, makeWrapper
 , python3
 , vulkan-headers
 , vulkan-loader
+, vulkan-validation-layers
 }:
 let
   glslang = fetchFromGitHub {
···
   spirv-headers = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
-    rev = "b42ba6d92faf6b4938e6f22ddd186dbdacc98d78";
-    hash = "sha256-ks9JCj5rj+Xu++7z5RiHDkU3/sFXhcScw8dATfB/ot0=";
+    rev = "d13b52222c39a7e9a401b44646f0ca3a640fbd47";
+    hash = "sha256-bjiWGSmpEbydXtCLP8fRZfPBvdCzBoJxKXTx3BroQbg=";
   };
 
   spirv-tools = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    rev = "a73e724359a274d7cf4f4248eba5be1e7764fbfd";
-    hash = "sha256-vooJHtgVRlBNkQG4hulYOxIgHH4GMhXw7N4OEbkKJvU=";
+    rev = "d87f61605b3647fbceae9aaa922fce0031afdc63";
+    hash = "sha256-lB2i6wjehIFDOQdIPUvCy3zzcnJSsR5vNawPhGmb0es=";
   };
 
 in
 stdenv.mkDerivation rec {
   pname = "amber";
-  version = "unstable-2022-04-21";
+  version = "unstable-2023-09-02";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
-    rev = "8b145a6c89dcdb4ec28173339dd176fb7b6f43ed";
-    hash = "sha256-+xFYlUs13khT6r475eJJ+XS875h2sb+YbJ8ZN4MOSAA=";
+    rev = "8e90b2d2f532bcd4a80069e3f37a9698209a21bc";
+    hash = "sha256-LuNCND/NXoNbbTWv7RYQUkq2QXL1qXR27uHwFIz0DXg=";
   };
 
   buildInputs = [
···
 
   nativeBuildInputs = [
     cmake
+    makeWrapper
     pkg-config
     python3
   ] ++ lib.optionals stdenv.isDarwin [
···
   ];
 
   # Tests are disabled so we do not have to pull in googletest and more dependencies
-  cmakeFlags = [ "-DAMBER_SKIP_TESTS=ON" ];
+  cmakeFlags = [ "-DAMBER_SKIP_TESTS=ON" "-DAMBER_DISABLE_WERROR=ON" ];
 
   prePatch = ''
     cp -r ${glslang}/ third_party/glslang
···
     cp -r ${spirv-headers}/ third_party/spirv-headers
     chmod u+w -R third_party
 
-    substituteInPlace CMakeLists.txt \
-      --replace "-Werror" ""
     substituteInPlace tools/update_build_version.py \
       --replace "not os.path.exists(directory)" "True"
   '';
 
   installPhase = ''
     install -Dm755 -t $out/bin amber image_diff
+    wrapProgram $out/bin/amber \
+      --suffix VK_LAYER_PATH : ${vulkan-validation-layers}/share/vulkan/explicit_layer.d
   '';
 
   meta = with lib; {

pkgs/tools/misc/cyberchef/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "cyberchef";
-  version = "10.6.0";
+  version = "10.7.0";
 
   src = fetchzip {
     url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_v${version}.zip";
-    sha256 = "sha256-vJ2NbD0SqUd5HKkjaZXPxn48xC1vMS95dnmp+u2W1SM=";
+    sha256 = "sha256-/miIdPP00vIh3Em8BFDoxkYFpgU4Vty4V5RiCgqOKPo=";
     stripRoot = false;
   };
 

pkgs/tools/misc/dust/default.nix pkgs/by-name/du/dust/package.nix

···
 { stdenv, lib, fetchFromGitHub, rustPlatform, AppKit, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
+  # Originally, this package was under the attribute `du-dust`, since `dust` was taken.
+  # Since then, `dust` has been freed up, allowing this package to take that attribute.
+  # However in order for tools like `nix-env` to detect package updates, keep `du-dust` for pname.
   pname = "du-dust";
   version = "0.9.0";
 
···
     owner = "bootandy";
     repo = "dust";
     rev = "v${version}";
-    sha256 = "sha256-5X7gRMTUrG6ecZnwExBTadOJo/HByohTMDsgxFmp1HM=";
+    hash = "sha256-5X7gRMTUrG6ecZnwExBTadOJo/HByohTMDsgxFmp1HM=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''

pkgs/tools/misc/gotify-desktop/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "gotify-desktop";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "desbma";
     repo = pname;
     rev = version;
-    sha256 = "sha256-vyOXZQ2X/LT/saBxcEbD96U34ufxjcWTHAobGI3bAE4=";
+    sha256 = "sha256-TuqzwmKB48xcdzrAr7MvDA9JChobraESQZPKoy24mPE=";
   };
 
-  cargoHash = "sha256-MNxHJ1iirHj78wq6ChDjr6mQS0UmHPjVMs1EPFZyTV0=";
+  cargoHash = "sha256-vg3al+eH9Q4D/T56jwWBlBT4IhuggiEVBl8WoZmUS2Y=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/tools/misc/hdfview/default.nix

···
   meta = {
     description = "A visual tool for browsing and editing HDF4 and HDF5 files";
     license = lib.licenses.free; # BSD-like
-    homepage = "https://portal.hdfgroup.org/display/HDFVIEW/HDFView";
+    homepage = "https://www.hdfgroup.org/downloads/hdfview";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [ jiegec ];
     mainProgram = "HDFView";

pkgs/tools/misc/hid-tools/default.nix

···
 
 python3.pkgs.buildPythonPackage rec {
   pname = "hid-tools";
-  version = "0.4";
+  version = "0.7";
 
-  format = "setuptools";
+  format = "pyproject";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libevdev";
     repo = "hid-tools";
     rev = version;
-    hash = "sha256-pxU1BvB+rjc5sptafMGnWi+vWPNDyCyUv8gTWg6z5hU=";
+    hash = "sha256-h880jJcZDc9pIPf+nr30wu2i9y3saAKFZpooJ4MF67E=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    hatchling
+    pypandoc
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     libevdev
     parse
     pyyaml
     click
     pyudev
+    typing-extensions
   ];
 
   nativeCheckInputs = with python3.pkgs; [
···
   ];
 
   # Tests require /dev/uhid
+  # https://gitlab.freedesktop.org/libevdev/hid-tools/-/issues/18#note_166353
   doCheck = false;
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "pypandoc_binary" "pypandoc"
+  '';
 
   meta = with lib; {
     description = "Python scripts to manipulate HID data";

pkgs/tools/misc/ipxe/default.nix

···
     { description = "Network boot firmware";
       homepage = "https://ipxe.org/";
       license = licenses.gpl2Only;
-      maintainers = with maintainers; [ ehmry ];
       platforms = platforms.linux;
     };
 }

pkgs/tools/misc/mise/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2024.2.4";
+  version = "2024.2.5";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-SBfnfEY2ostzVWUWPB1f381XnzcNpkqeV+L9xRcRYaw=";
+    hash = "sha256-dShe8h1aRDZPwzCKAhJag5xfylYqWJuCiB9A4afV8g0=";
   };
 
-  cargoHash = "sha256-Q63h6ln1uswyvAhWlKhMLJGCZRJCbY3Rovu+jJ1O+0c=";
+  cargoHash = "sha256-3yV26WZid5e7H9UsAaKLjSvL1MSQ+M5BjBR5Mt701Io=";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];

pkgs/tools/misc/moar/default.nix

···
 
 buildGoModule rec {
   pname = "moar";
-  version = "1.23.0";
+  version = "1.23.4";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tnFJKHrK1QlACYsiLlc5EX3du4H+nekEaeV+7wUsx48=";
+    hash = "sha256-gttx2AQMSaU7JE/UwZsUwsgTbUmkQKvCzlt+TuTGP0A=";
   };
 
   vendorHash = "sha256-1u/2OlMX2FuZaxWnpU4n5r/4xKe+rK++GoCJiSq/BdE=";

pkgs/tools/misc/mongodb-compass/default.nix

···
 }:
 
 let
-  version = "1.41.0";
+  version = "1.42.0";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
···
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.mongodb.com/compass/mongodb-compass_${version}_amd64.deb";
-        sha256 = "sha256-uVIN2oSpaRSeJK1bhjzMqSMmnQm+1i6xsw1RWjmsvGY=";
+        sha256 = "sha256-Y4ULngeAFljjQG9KTWhU/fIEXBUqbEx2qSakYYnOJoQ=";
       }
     else
       throw "MongoDB compass is not supported on ${stdenv.hostPlatform.system}";

pkgs/tools/misc/plantuml/default.nix

···
 { lib, stdenv, fetchurl, makeWrapper, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "1.2024.0";
+  version = "1.2024.1";
   pname = "plantuml";
 
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml/releases/download/v${version}/plantuml-pdf-${version}.jar";
-    sha256 = "sha256-jpO4BhOyTS9y2e9d3AK911HDQa04zhPeFGyhz1FJN+Q=";
+    sha256 = "sha256-lXo8eU6IX4JQFfhNUM2h6fi0HkShiwLsjMRTNbwLYwk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/networking/curl/configure-ipv6-autodetect.diff

···
-diff --git a/configure b/configure
-index 04d1de1..5de1b41 100755
---- a/configure
-+++ b/configure
-@@ -24949,15 +24949,12 @@ else $as_nop
- # include <netinet/in6.h>
- #endif
- #endif
--#include <stdlib.h> /* for exit() */
--main()
-+
-+int main(void)
- {
-  struct sockaddr_in6 s;
-  (void)s;
-- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
--   exit(1);
-- else
--   exit(0);
-+ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
- }
- 
- 
-diff --git a/configure.ac b/configure.ac
-index 2d71c83..bd38dd9 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1679,15 +1679,12 @@ AS_HELP_STRING([--disable-ipv6],[Disable IPv6 support]),
- # include <netinet/in6.h>
- #endif
- #endif
--#include <stdlib.h> /* for exit() */
--main()
-+
-+int main(void)
- {
-  struct sockaddr_in6 s;
-  (void)s;
-- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
--   exit(1);
-- else
--   exit(0);
-+ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
- }
- ]])
- ],

pkgs/tools/networking/curl/default.nix

···
 , haskellPackages
 , ocamlPackages
 , phpExtensions
+, pkgsStatic
 , python3
 , tests
 , testers
···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.5.0";
+  version = "8.6.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
       "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-QquNueINgpCjtjPn+7POwV2zTfZf0QFe+KweRyN1Dus=";
+    hash = "sha256-PM1V2Rr5UWU534BiX4GMc03G8uz5utozx2dl6ZEh2xU=";
   };
 
-  patches = [
-    # fix ipv6 autodetect compile error in configure script
-    # remove once https://github.com/curl/curl/pull/12607 released (8.6.0)
-    ./configure-ipv6-autodetect.diff
-  ];
+  postPatch = ''
+    patchShebangs scripts
+  '';
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
···
   preConfigure = ''
     sed -e 's|/usr/bin|/no-such-path|g' -i.bak configure
     rm src/tool_hugehelp.c
+  '' + lib.optionalString (pslSupport && stdenv.hostPlatform.isStatic) ''
+    # curl doesn't understand that libpsl2 has deps because it doesn't use
+    # pkg-config.
+    # https://github.com/curl/curl/pull/12919
+    configureFlagsArray+=("LIBS=-lidn2 -lunistring")
   '';
 
   configureFlags = [
···
       (lib.withFeature rtmpSupport "librtmp")
       (lib.withFeature rustlsSupport "rustls")
       (lib.withFeature zstdSupport "zstd")
+      (lib.withFeature pslSupport "libpsl")
       (lib.withFeatureAs brotliSupport "brotli" (lib.getDev brotli))
       (lib.withFeatureAs gnutlsSupport "gnutls" (lib.getDev gnutls))
       (lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2))
···
     inherit opensslSupport openssl;
     tests = {
       withCheck = finalAttrs.finalPackage.overrideAttrs (_: { doCheck = true; });
-      fetchpatch = tests.fetchpatch.simple.override { fetchpatch = (fetchpatch.override { fetchurl = useThisCurl fetchurl; }) // { version = 1; }; };
       curlpp = useThisCurl curlpp;
       coeurl = useThisCurl coeurl;
       haskell-curl = useThisCurl haskellPackages.curl;
···
       # nginx-http3 = useThisCurl nixosTests.nginx-http3;
       nginx-http3 = nixosTests.nginx-http3;
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+      static = pkgsStatic.curl;
+    } // lib.optionalAttrs (!stdenv.isDarwin) {
+      fetchpatch = tests.fetchpatch.simple.override { fetchpatch = (fetchpatch.override { fetchurl = useThisCurl fetchurl; }) // { version = 1; }; };
     };
   };
 

pkgs/tools/networking/dhcpcd/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "dhcpcd";
-  version = "10.0.3";
+  version = "10.0.6";
 
   src = fetchFromGitHub {
     owner = "NetworkConfiguration";
     repo = "dhcpcd";
     rev = "v${version}";
-    sha256 = "sha256-NXLOfSPGHiRDSagaT+37TAn9XtdcG4+wP9AvyGJi4Dc=";
+    sha256 = "sha256-tNC5XCA8dShaTIff15mQz8v+YK9sZkRNLCX5qnlpxx4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
···
     runtimeShellPackage # So patchShebangs finds a bash suitable for the installed scripts
   ];
 
-  prePatch = ''
+  postPatch = ''
     substituteInPlace hooks/dhcpcd-run-hooks.in --replace /bin/sh ${runtimeShell}
   '';
 

pkgs/tools/networking/openapi-generator-cli/default.nix

···
 { callPackage, lib, stdenv, fetchurl, jre, makeWrapper }:
 
 let this = stdenv.mkDerivation (finalAttrs: {
-  version = "7.2.0";
+  version = "7.3.0";
   pname = "openapi-generator-cli";
 
   jarfilename = "${finalAttrs.pname}-${finalAttrs.version}.jar";
···
 
   src = fetchurl {
     url = "mirror://maven/org/openapitools/${finalAttrs.pname}/${finalAttrs.version}/${finalAttrs.jarfilename}";
-    sha256 = "sha256-HPDIDeEsD9yFlCicGeQUtAIQjvELjdC/2hlTFRNBq10=";
+    sha256 = "sha256-h5wVNAp1oZp+cg78JCwyI+DkIHsGlNbRzqXH3YfPHM4=";
   };
 
   dontUnpack = true;

pkgs/tools/networking/proxify/default.nix

···
 
 buildGoModule rec {
   pname = "proxify";
-  version = "0.0.12";
+  version = "0.0.13";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "proxify";
     rev = "refs/tags/v${version}";
-    hash = "sha256-j2FuyoTCc9mcoI683xZkMCL6QXy0dGEheNaormlgUvY=";
+    hash = "sha256-5sicN/Z26nkxtU/6vDkEMBxyRNHIP7hQ+BvzHuQqBhw=";
   };
 
-  vendorHash = "sha256-kPj3KBi8Mbsj4BW7Vf1w4mW8EN07FuqgFhAkkLCl8Bc=";
+  vendorHash = "sha256-90wNln2C5/K1WfX8rv6kKQpHMpxW3hv5zpZpCSHy8ys=";
 
   meta = with lib; {
     description = "Proxy tool for HTTP/HTTPS traffic capture";

pkgs/tools/package-management/dnf5/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.1.10";
+  version = "5.1.12";
 
   outputs = [ "out" "man" ];
 
···
     owner = "rpm-software-management";
     repo = "dnf5";
     rev = finalAttrs.version;
-    hash = "sha256-u+UiiCl67VtIedW4kn3fycafkgBVsFFkWQcN3NXQKl4=";
+    hash = "sha256-AzyFc+fBQyyCNzr8ulMEtFEotdUzStsyYOv9ppcIBw4=";
   };
 
   nativeBuildInputs = [

pkgs/tools/package-management/libdnf/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libdnf";
-  version = "0.72.0";
+  version = "0.73.0";
 
   outputs = [ "out" "dev" "py" ];
 
···
     owner = "rpm-software-management";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Ou7cXJz4g8cx2KjeX+IFRA2m158PGKcb9jCXFuAOKqU=";
+    hash = "sha256-zduxlroqo7aeQYhiTWmEK47YG/ll8hLH/d3xtXdcYhk=";
   };
 
   nativeBuildInputs = [

pkgs/tools/package-management/nix/patches/boehmgc-coroutine-sp-fallback.patch

···
 diff --git a/pthread_stop_world.c b/pthread_stop_world.c
-index b5d71e62..aed7b0bf 100644
+index 2b45489..0e6d8ef 100644
 --- a/pthread_stop_world.c
 +++ b/pthread_stop_world.c
-@@ -768,6 +768,8 @@ STATIC void GC_restart_handler(int sig)
+@@ -776,6 +776,8 @@ STATIC void GC_restart_handler(int sig)
  /* world is stopped.  Should not fail if it isn't.                      */
  GC_INNER void GC_push_all_stacks(void)
  {
···
      GC_bool found_me = FALSE;
      size_t nthreads = 0;
      int i;
-@@ -851,6 +853,31 @@ GC_INNER void GC_push_all_stacks(void)
-           hi = p->altstack + p->altstack_size;
+@@ -868,6 +870,31 @@ GC_INNER void GC_push_all_stacks(void)
+             hi = p->altstack + p->altstack_size;
+ #         endif
            /* FIXME: Need to scan the normal stack too, but how ? */
-           /* FIXME: Assume stack grows down */
 +        } else {
 +          if (pthread_getattr_np(p->id, &pattr)) {
 +            ABORT("GC_push_all_stacks: pthread_getattr_np failed!");
···
 +          #error "STACK_GROWS_UP not supported in boost_coroutine2 (as of june 2021), so we don't support it in Nix."
 +          #endif
          }
-         GC_push_all_stack_sections(lo, hi, traced_stack_sect);
- #       ifdef STACK_GROWS_UP
+ #       ifdef STACKPTR_CORRECTOR_AVAILABLE
+           if (GC_sp_corrector != 0)

pkgs/tools/security/bitwarden-directory-connector/default.nix

···
+{
+  lib,
+  buildNpmPackage,
+  electron,
+  fetchFromGitHub,
+  buildPackages,
+  python3,
+  pkg-config,
+  libsecret,
+  nodejs_18,
+}:
+
+let
+  common = { name, npmBuildScript, installPhase }: buildNpmPackage rec {
+    pname = name;
+    version = "2023.10.0";
+    nodejs = nodejs_18;
+
+    src = fetchFromGitHub {
+      owner = "bitwarden";
+      repo = "directory-connector";
+      rev = "v${version}";
+      hash = "sha256-PlOtTh+rpTxAv8ajHBDHZuL7yeeLVpbAfKEDPQlejIg=";
+    };
+
+    postPatch = ''
+      ${lib.getExe buildPackages.jq} 'del(.scripts.preinstall)' package.json > package.json.tmp
+      mv -f package.json{.tmp,}
+
+      substituteInPlace electron-builder.json \
+        --replace-fail '"afterSign": "scripts/notarize.js",' "" \
+        --replace-fail "AppImage" "dir"
+    '';
+
+    npmDepsHash = "sha256-jBAWWY12qeX2EDhUvT3TQpnQvYXRsIilRrXGpVzxYvw=";
+
+    env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+    makeCacheWritable = true;
+    inherit npmBuildScript installPhase;
+
+    buildInputs = [
+      libsecret
+    ];
+
+    nativeBuildInputs = [
+      python3
+      pkg-config
+    ];
+
+    meta = with lib; {
+      description = "LDAP connector for Bitwarden";
+      homepage = "https://github.com/bitwarden/directory-connector";
+      license = licenses.gpl3Only;
+      maintainers = with maintainers; [ Silver-Golden SuperSandro2000 ];
+      platforms = platforms.linux;
+      mainProgram = name;
+    };
+  };
+in {
+  bitwarden-directory-connector = common {
+    name = "bitwarden-directory-connector";
+    npmBuildScript = "build:dist";
+    installPhase = ''
+      runHook preInstall
+
+      npm exec electron-builder -- \
+        --dir \
+        -c.electronDist=${electron}/libexec/electron \
+        -c.electronVersion=${electron.version} \
+        -c.npmRebuild=false
+
+      mkdir -p $out/share/bitwarden-directory-connector $out/bin
+      cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/bitwarden-directory-connector
+
+      makeWrapper ${lib.getExe electron} $out/bin/bitwarden-directory-connector \
+        --add-flags $out/share/bitwarden-directory-connector/resources/app.asar \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --set-default ELECTRON_IS_DEV 0 \
+        --inherit-argv0
+
+      runHook postInstall
+    '';
+  };
+
+  bitwarden-directory-connector-cli = common {
+    name = "bitwarden-directory-connector-cli";
+    npmBuildScript = "build:cli:prod";
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/libexec/bitwarden-directory-connector
+      cp -R build-cli node_modules $out/libexec/bitwarden-directory-connector
+
+      # needs to be wrapped with nodejs so that it can be executed
+      chmod +x $out/libexec/bitwarden-directory-connector/build-cli/bwdc.js
+      mkdir -p $out/bin
+      ln -s $out/libexec/bitwarden-directory-connector/build-cli/bwdc.js $out/bin/bitwarden-directory-connector-cli
+
+      runHook postInstall
+    '';
+  };
+}

pkgs/tools/security/bitwarden/default.nix

···
 , cargo
 , copyDesktopItems
 , dbus
-, electron_27
+, electron_28
 , fetchFromGitHub
 , fetchpatch2
 , glib
···
 let
   description = "A secure and free password manager for all of your devices";
   icon = "bitwarden";
-  electron = electron_27;
+  electron = electron_28;
 in buildNpmPackage rec {
   pname = "bitwarden";
-  version = "2024.1.0";
+  version = "2024.2.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-lDDy1b1yfw3nZrwEEkpvh6xYucgn20XHsGACc45eb2w=";
+    hash = "sha256-nCjcwe+7Riml/J0hAVv/t6/oHIDPhwFD5A3iQ/LNR5Y=";
   };
 
   patches = [
···
   makeCacheWritable = true;
   npmFlags = [ "--legacy-peer-deps" ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-RR8Ua41D9SXymiPuabOnIab3byu8DR63rOfdeTaQpy4=";
+  npmDepsHash = "sha256-GJl9pVwFWEg9yku9IXLcu2XMJZz+ZoQOxCf1TrW715Y=";
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     name = "${pname}-${version}";
···
       patches;
     patchFlags = [ "-p4" ];
     sourceRoot = "${src.name}/${cargoRoot}";
-    hash = "sha256-EiJjIWiyu8MvX3Tj0Fkeh0T0El5kdCko2maiY6kkPPA=";
+    hash = "sha256-KJUz5hvdsurnohUWRZedXvuWMnLtR0dcdTeHtJGrZBs=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 

pkgs/tools/security/bkcrack/default.nix

···
 , stdenv
 , fetchFromGitHub
 , cmake
+, nix-update-script
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bkcrack";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "kimci86";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-VfPRX9lOPyen8CujiBtTCbD5e7xd9X2OQ1uZ6JWKwtY=";
+    repo = "bkcrack";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-x7JK7+DcD2uSWZRTJQPGCcF2mHBlu6FwYUbuYzbvD+s=";
   };
+
+  passthru.updateScript = nix-update-script { };
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    "-DBKCRACK_BUILD_TESTING=${if finalAttrs.doCheck then "ON" else "OFF"}"
+  ];
+
   postInstall = ''
-    mkdir -p $out/bin $out/share/licenses/bkcrack
+    mkdir -p $out/bin $out/share/doc/bkcrack $out/share/licenses/bkcrack
     mv $out/bkcrack $out/bin/
     mv $out/license.txt $out/share/licenses/bkcrack
-    rm -r $out/example $out/tools $out/readme.md
+    mv $out/example $out/tools $out/readme.md $out/share/doc/bkcrack
   '';
+
+  doCheck = true;
 
   meta = with lib; {
     description = "Crack legacy zip encryption with Biham and Kocher's known plaintext attack";
···
     license = licenses.zlib;
     platforms = platforms.unix;
     maintainers = with maintainers; [ erdnaxe ];
+    mainProgram = "bkcrack";
   };
-}
+})

pkgs/tools/security/cfripper/default.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.15.2";
+  version = "1.15.3";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
-    repo = pname;
-    rev = "refs/tags/${version}";
+    repo = "cfripper";
+    rev = "refs/tags/v${version}";
     hash = "sha256-SmD3Dq5LicPRe3lWFsq4zqM/yDZ1LsgRwSUA5/RbN9I=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pluggy~=0.13.1" "pluggy" \
+  '';
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     boto3
     cfn-flip
···
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "click~=7.1.1" "click" \
-      --replace "pluggy~=0.13.1" "pluggy" \
-      --replace "pydash~=4.7.6" "pydash"
-  '';
-
   disabledTestPaths = [
     # Tests are failing
     "tests/test_boto3_client.py"
···
   meta = with lib; {
     description = "Tool for analysing CloudFormation templates";
     homepage = "https://github.com/Skyscanner/cfripper";
+    changelog = "https://github.com/Skyscanner/cfripper/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/tools/security/cnquery/default.nix

···
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "10.1.4";
+  version = "10.2.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     rev = "v${version}";
-    hash = "sha256-JQg1tQs+WojtSweA+tP37LqKH8l+CkTEwvoTjKwg3S0=";
+    hash = "sha256-bz4a4+mgssrRBthkN87aYxlZV6as2uocFvBKrKLmy8A=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-+tKz2Zy+tmqOVj9NoYe5lfqmzgBxVkNJOh4/9o9XfmY=";
+  vendorHash = "sha256-vq6R2FgvoET8SLTpktGLoFzZHqnmizDp0fWU7kqlLgU=";
 
   meta = with lib; {
     description = "cloud-native, graph-based asset inventory";

pkgs/tools/security/gnupg/24.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    hash = "sha256-onGubXMvb02AwlitnuiN2clMj9wzw+RTKMTXwSa9IZ0=";
+    hash = "sha256-Z+vgFsqQ+naIzmejh+vYLGJh6ViX23sj3yT/M1voW8Y=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/tools/security/osv-scanner/default.nix

···
 }:
 buildGoModule rec {
   pname = "osv-scanner";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ddzdOk2sHNzjCM4cLJY+H9h13MjamlC1RYcnOcDGV4M=";
+    hash = "sha256-/V0zn4Aic6tBJw23YJWkyeCZXf/ehIZlKWd9TZXe40Y=";
   };
 
-  vendorHash = "sha256-9cE4UcQipJYwQDZA4jlcV68BBTgft7oRVlngg/PAmWI=";
+  vendorHash = "sha256-wIXc0YYTdcnUBNbypVwZJ/RNTmaeMteEujmgs5WJ1g0=";
 
   subPackages = [
     "cmd/osv-scanner"

pkgs/tools/security/pcsclite/default.nix

···
   inherit pname;
   version = "2.0.1";
 
-  outputs = [ "bin" "out" "dev" "doc" "man" ];
+  outputs = [ "out" "lib" "dev" "doc" "man" ];
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
···
     (lib.enableFeature polkitSupport "polkit")
   ] ++ lib.optionals stdenv.isLinux [
     "--enable-ipcdir=/run/pcscd"
-    "--with-systemdsystemunitdir=${placeholder "bin"}/lib/systemd/system"
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
   ];
 
   makeFlags = [
     "POLICY_DIR=$(out)/share/polkit-1/actions"
   ];
+
+  # disable building pcsc-wirecheck{,-gen} when cross compiling
+  # see also: https://github.com/LudovicRousseau/PCSC/issues/25
+  postPatch = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    substituteInPlace src/Makefile.am \
+      --replace "noinst_PROGRAMS = testpcsc pcsc-wirecheck pcsc-wirecheck-gen" \
+                "noinst_PROGRAMS = testpcsc"
+  '';
 
   postInstall = ''
     # pcsc-spy is a debugging utility and it drags python into the closure

pkgs/tools/security/quark-engine/default.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quark-engine";
-  version = "23.12.1";
-  format = "setuptools";
+  version = "24.2.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-NeJGkqGpg2uOsz10gEYz/nzh21DhXSU4RgQtI1brASQ=";
+    sha256 = "sha256-77yfysmFEneVOiejoCooi1buqEM/Ljv5xqjKv17DFWE=";
   };
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
 
   propagatedBuildInputs = with python3.pkgs; [
     androguard

pkgs/tools/security/tor/torsocks-gethostbyaddr-darwin.patch

···
+diff --git a/tests/test_dns.c b/tests/test_dns.c
+index 7e07663..acf095c 100644
+--- a/tests/test_dns.c
++++ b/tests/test_dns.c
+@@ -76,6 +76,8 @@ static void test_gethostbyname(const struct test_host *host)
+ 	return;
+ }
+ 
++#ifdef __linux__
++
+ static void test_gethostbyaddr_r_failed(void)
+ {
+ 	int result;
+@@ -129,6 +131,8 @@ static void test_gethostbyaddr_r(const struct test_host *host)
+   ok(1, "Resolved address");
+ }
+ 
++#endif
++
+ static void test_gethostbyaddr(const struct test_host *host)
+ {
+ 	struct hostent *he;
+@@ -199,8 +203,10 @@ int main(int argc, char **argv)
+ 	test_getaddrinfo(&tor_check);
+ 	test_gethostbyname(&tor_dir_auth1);
+ 	test_gethostbyaddr(&tor_dir_auth2);
++#ifdef __linux__
+ 	test_gethostbyaddr_r(&tor_dir_auth2);
+ 	test_gethostbyaddr_r_failed();
++#endif
+ 	test_getaddrinfo(&tor_localhost);
+ 
+ end:

pkgs/tools/security/tor/torsocks.nix

···
-{ lib, stdenv, fetchgit, fetchurl, autoreconfHook, libcap }:
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchpatch
+, autoreconfHook
+, libcap
+}:
 
 stdenv.mkDerivation rec {
   pname = "torsocks";
-  version = "2.3.0";
+  version = "2.4.0";
 
-  src = fetchgit {
-    url    = "https://git.torproject.org/torsocks.git";
-    rev    = "refs/tags/v${version}";
-    sha256 = "0x0wpcigf22sjxg7bm0xzqihmsrz51hl4v8xf91qi4qnmr4ny1hb";
+  src = fetchFromGitLab {
+    domain = "gitlab.torproject.org";
+    group = "tpo";
+    owner = "core";
+    repo = "torsocks";
+    rev = "v${version}";
+    sha256 = "sha256-ocJkoF9LMLC84ukFrm5pzjp/1gaXqDz8lzr9TdG+f88=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
-
-  patches = lib.optional stdenv.isDarwin
-    (fetchurl {
-       url = "https://trac.torproject.org/projects/tor/raw-attachment/ticket/28538/0001-Fix-macros-for-accept4-2.patch";
-       sha256 = "97881f0b59b3512acc4acb58a0d6dfc840d7633ead2f400fad70dda9b2ba30b0";
-     });
+  patches = [
+    # fix compatibility with C99
+    # https://gitlab.torproject.org/tpo/core/torsocks/-/merge_requests/9
+    (fetchpatch {
+      url = "https://gitlab.torproject.org/tpo/core/torsocks/-/commit/1171bf2fd4e7a0cab02cf5fca59090b65af9cd29.patch";
+      hash = "sha256-qu5/0fy72+02QI0cVE/6YrR1kPuJxsZfG8XeODqVOPY=";
+    })
+    # tsocks_libc_accept4 only exists on Linux, use tsocks_libc_accept on other platforms
+    (fetchpatch {
+      url = "https://gitlab.torproject.org/tpo/core/torsocks/uploads/eeec9833512850306a42a0890d283d77/0001-Fix-macros-for-accept4-2.patch";
+      hash = "sha256-XWi8+UFB8XgBFSl5QDJ+hLu/dH4CvAwYbeZz7KB10Bs=";
+    })
+    # no gethostbyaddr_r on darwin
+    ./torsocks-gethostbyaddr-darwin.patch
+  ];
 
   postPatch = ''
     # Patch torify_app()
···
       src/bin/torsocks.in
   '';
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   doInstallCheck = true;
   installCheckTarget = "check-recursive";
 
   meta = {
     description      = "Wrapper to safely torify applications";
-    homepage         = "https://github.com/dgoulet/torsocks";
+    homepage         = "https://gitlab.torproject.org/tpo/core/torsocks";
     license          = lib.licenses.gpl2;
     platforms        = lib.platforms.unix;
     maintainers      = with lib.maintainers; [ thoughtpolice ];

pkgs/tools/system/amtterm/default.nix

···
     { description = "Intel AMT® SoL client + tools";
       homepage = "https://www.kraxel.org/cgit/amtterm/";
       license = licenses.gpl2;
-      maintainers = [ maintainers.ehmry ];
       platforms = platforms.linux;
     };
 })

pkgs/tools/system/efivar/default.nix

···
       url = "https://github.com/rhboot/efivar/commit/cece3ffd5be2f8641eb694513f2b73e5eb97ffd3.patch";
       sha256 = "7/E0gboU0A45/BY6jGPLuvds6qKtNjzpgKgdNTaVaZQ=";
     })
+
+    # Fix build against gcc-13: https://github.com/rhboot/efivar/pull/242
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/rhboot/efivar/commit/52fece47d4f3ebd588bd85598bfc7a0142365f7e.patch";
+      hash = "sha256-tOmxbY7kD6kzbBZ2RhQ5gCCpHtu+2gRNa7VUAWdCKu0=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config mandoc ];

pkgs/tools/system/netdata/go.d.plugin.nix

···
 
 buildGoModule rec {
   pname = "netdata-go-plugins";
-  version = "0.58.0";
+  version = "0.58.1";
 
   src = fetchFromGitHub {
     owner = "netdata";
     repo = "go.d.plugin";
     rev = "v${version}";
-    hash = "sha256-XZBF0uNXTo5UcBuhMVznij+QGhHM06j5J2xflZf40kI=";
+    hash = "sha256-zzHm98jec7MXnzVsrLlYIk+ILA3Ei43853dM1LdFz5c=";
   };
 
-  vendorHash = "sha256-bdW6ZDMYVFGWD7KEDU2kaoccgwbOPl7ADnZ1npGBLAc=";
+  vendorHash = "sha256-eb+GRFhfWxDkfH4x2VF3ogyT5z4OcIoqHtEVJ1tGsdA=";
 
   doCheck = false;
 

pkgs/tools/text/grip-search/default.nix

···
-{ lib, stdenv, fetchFromGitHub, boost, pkg-config, cmake, catch2 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, boost, pkg-config, cmake, catch2 }:
 
 stdenv.mkDerivation rec {
   pname = "grip-search";
···
 
   buildInputs = [ boost ];
 
-  patchPhase = ''
-    substituteInPlace src/general/config.h --replace "CUSTOM-BUILD" "${version}"
+  patches = [
+    # Can be removed after this upstream PR gets merged: https://github.com/sc0ty/grip/pull/6
+    (fetchpatch {
+      name = "include-cstdint.patch";
+      url = "https://github.com/sc0ty/grip/commit/da37b3c805306ee4ea617ce3f1487b8ee9876e50.patch";
+      hash = "sha256-Xh++oDn5qn5NPgng7gfeCkO5FN9OmW+8fGhDLpAJfR8=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/general/config.h --replace-fail "CUSTOM-BUILD" "${version}"
   '';
 
   meta = with lib; {

pkgs/top-level/aliases.nix

···
   cadence = throw "cadence has been removed from nixpkgs, as it was archived upstream"; # Added 2023-10-28
   cask = emacs.pkgs.cask; # Added 2022-11-12
   cargo-embed = throw "cargo-embed is now part of the probe-rs package"; # Added 2023-07-03
+  cargo-espflash = espflash;
   cargo-flash = throw "cargo-flash is now part of the probe-rs package"; # Added 2023-07-03
   catfish = throw "'catfish' has been renamed to/replaced by 'xfce.catfish'"; # Converted to throw 2023-09-10
   cawbird = throw "cawbird has been abandoned upstream and is broken anyways due to Twitter closing its API";
···
   drgeo = throw "'drgeo' has been removed as it is outdated and unmaintained"; # Added 2023-10-15
   dtv-scan-tables_linuxtv = dtv-scan-tables; # Added 2023-03-03
   dtv-scan-tables_tvheadend = dtv-scan-tables; # Added 2023-03-03
+  du-dust = dust; # Added 2024-01-19
   dylibbundler = macdylibbundler; # Added 2021-04-24
 
   ### E ###

pkgs/top-level/all-packages.nix

···
 
   bitwarden-cli = callPackage ../tools/security/bitwarden/cli.nix { };
 
+  inherit (callPackages ../tools/security/bitwarden-directory-connector { }) bitwarden-directory-connector-cli bitwarden-directory-connector;
+
   bitwarden-menu = python3Packages.callPackage ../applications/misc/bitwarden-menu { };
 
   inherit (nodePackages) concurrently;
···
 
   curl = curlMinimal.override ({
     idnSupport = true;
+    pslSupport = true;
     zstdSupport = true;
   } // lib.optionalAttrs (!stdenv.hostPlatform.isStatic) {
     brotliSupport = true;
···
 
   efibootmgr = callPackage ../tools/system/efibootmgr { };
 
-  efivar = disable-warnings-if-gcc13 (callPackage ../tools/system/efivar { });
+  efivar = callPackage ../tools/system/efivar { };
 
   eget = callPackage ../tools/misc/eget { };
 
···
 
   lzip = callPackage ../tools/compression/lzip { };
 
-  plzip = callPackage ../tools/compression/plzip { };
-
   lziprecover = callPackage ../tools/compression/lziprecover { };
 
   xz = callPackage ../tools/compression/xz { };
···
   buildRustCrateHelpers = callPackage ../build-support/rust/build-rust-crate/helpers.nix { };
 
   cargo2junit = callPackage ../development/tools/rust/cargo2junit { };
-
-  cargo-espflash = callPackage ../development/tools/rust/cargo-espflash {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
 
   cargo-web = callPackage ../development/tools/rust/cargo-web {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
···
       then overrideSDK stdenv { darwinMinVersion = "10.13"; }
       else stdenv;
   };
-  abseil-cpp = abseil-cpp_202301;
+  abseil-cpp = abseil-cpp_202401;
 
   accountsservice = callPackage ../development/libraries/accountsservice { };
 
···
 
   libantlr3c = callPackage ../development/libraries/libantlr3c { };
 
-  libaom = callPackage ../development/libraries/libaom {
-    # Remove circular dependency for libavif
-    libjxl = libjxl.override { buildDocs = false; };
-  };
+  libaom = callPackage ../development/libraries/libaom { };
 
   libappindicator-gtk2 = libappindicator.override { gtkVersion = "2"; };
   libappindicator-gtk3 = libappindicator.override { gtkVersion = "3"; };
···
 
   libcacard = callPackage ../development/libraries/libcacard { };
 
-  libcamera = callPackage ../development/libraries/libcamera { };
+  libcamera-qcam = callPackage ../by-name/li/libcamera/package.nix { withQcam = true; };
 
   libcanberra = callPackage ../development/libraries/libcanberra {
     inherit (darwin.apple_sdk.frameworks) Carbon CoreServices AppKit;
···
   };
 
   lyra = callPackage ../development/libraries/lyra { };
-
-  lzlib = callPackage ../development/libraries/lzlib { };
 
   lzo = callPackage ../development/libraries/lzo { };
 
···
 
   openexrid-unstable = callPackage ../development/libraries/openexrid-unstable { };
 
-  openldap = callPackage ../development/libraries/openldap {
-    openssl = openssl_legacy;
-  };
+  openldap = callPackage ../development/libraries/openldap { };
 
   opencolorio = darwin.apple_sdk_11_0.callPackage ../development/libraries/opencolorio {
     inherit (darwin.apple_sdk_11_0.frameworks) Carbon GLUT Cocoa;
···
 
   banking = callPackage ../applications/office/banking { };
 
-  baresip = callPackage ../applications/networking/instant-messengers/baresip { };
-
   barrier = libsForQt5.callPackage ../applications/misc/barrier { };
 
   bashSnippets = callPackage ../applications/misc/bashSnippets { };
···
 
   dunst = callPackage ../applications/misc/dunst { };
 
-  du-dust = callPackage ../tools/misc/dust {
+  dust = callPackage ../by-name/du/dust/package.nix {
     inherit (darwin.apple_sdk_11_0.frameworks) AppKit;
   };
 
···
 
   espeakup = callPackage ../applications/accessibility/espeakup { };
 
-  espflash = callPackage ../development/embedded/espflash {
+  espflash = callPackage ../by-name/es/espflash/package.nix {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
···
 
   xdg-user-dirs = callPackage ../tools/X11/xdg-user-dirs { };
 
-  xdg-utils = callPackage ../tools/X11/xdg-utils {
-    w3m = buildPackages.w3m-batch;
-  };
+  xdg-utils = callPackage ../tools/X11/xdg-utils {};
 
   xdgmenumaker = callPackage ../applications/misc/xdgmenumaker { };
 
···
 
   notus-scanner = with python3Packages; toPythonApplication notus-scanner;
 
-  openblas = callPackage ../development/libraries/science/math/openblas { };
+  openblas = callPackage ../development/libraries/science/math/openblas {
+    inherit (llvmPackages) openmp;
+  };
 
   # A version of OpenBLAS using 32-bit integers on all platforms for compatibility with
   # standard BLAS and LAPACK.
···
 
   suitesparse_4_2 = callPackage ../development/libraries/science/math/suitesparse/4.2.nix { };
   suitesparse_4_4 = callPackage ../development/libraries/science/math/suitesparse/4.4.nix { };
-  suitesparse_5_3 = callPackage ../development/libraries/science/math/suitesparse { };
+  suitesparse_5_3 = callPackage ../development/libraries/science/math/suitesparse {
+    inherit (llvmPackages) openmp;
+  };
   suitesparse = suitesparse_5_3;
 
   suitesparse-graphblas = callPackage ../development/libraries/science/math/suitesparse-graphblas { };

pkgs/top-level/java-packages.nix

···
 
     mkOpenjdkLinuxOnly = path-linux: args: let
       openjdk = callPackage path-linux  (gnomeArgs // args);
-    in openjdk // {
+    in assert stdenv.isLinux; openjdk // {
       headless = openjdk.override { headless = true; };
     };
 

pkgs/top-level/python-aliases.nix

···
   flask_sqlalchemy = flask-sqlalchemy; # added 2022-07-20
   flask_testing = flask-testing; # added 2022-04-25
   flask_wtf = flask-wtf; # added 2022-05-24
+  flask-autoindex = throw "flask-autoindex was removed, as it is not compatible with flask 3.0 and unmaintained since 2020.";
+  flask-basicauth = throw "flask-basicauth was removed, as it is not compatible with flask 3.0 and unmaintained since 2016.";
+  flask-sessionstore = throw "flask-sessionstore was removed, as it is not compatible with flask 3.0 and unmaintained since 2017.";
   flowlogs_reader = flowlogs-reader; # added 2024-01-03
   FormEncode = formencode; # added 2023-02-19
   foundationdb51 = throw "foundationdb51 is no longer maintained, use foundationdb71 instead"; # added 2023-06-06

pkgs/top-level/python-packages.nix

···
 
   flask-assets = callPackage ../development/python-modules/flask-assets { };
 
-  flask-autoindex = callPackage ../development/python-modules/flask-autoindex { };
-
   flask-babel = callPackage ../development/python-modules/flask-babel { };
 
   flask-babelex = callPackage ../development/python-modules/flask-babelex { };
-
-  flask-basicauth = callPackage ../development/python-modules/flask-basicauth { };
 
   flask-bcrypt = callPackage ../development/python-modules/flask-bcrypt { };
 
···
   flask-session = callPackage ../development/python-modules/flask-session { };
 
   flask-session-captcha = callPackage ../development/python-modules/flask-session-captcha { };
-
-  flask-sessionstore = callPackage ../development/python-modules/flask-sessionstore { };
 
   flask-security-too = callPackage ../development/python-modules/flask-security-too { };
 
···
 
   python-mbedtls = callPackage ../development/python-modules/python-mbedtls { };
 
-  python-memcached = callPackage ../development/python-modules/python-memcached { };
+  python-memcached = callPackage ../development/python-modules/python-memcached {
+    inherit (pkgs) memcached;
+  };
 
   python-otbr-api = callPackage ../development/python-modules/python-otbr-api { };
 
···
 
   stanza = callPackage ../development/python-modules/stanza { };
 
-  starlette = callPackage ../development/python-modules/starlette {
-    inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  starlette = callPackage ../development/python-modules/starlette { };
 
   starlette-wtf = callPackage ../development/python-modules/starlette-wtf { };
 

pkgs/top-level/release-attrpaths-superset.nix

···
     pkgsStatic = true;
     pkgsCross = true;
     pkgsi686Linux = true;
+    pkgsExtraHardening = true;
   };
 
   # No release package attrname may have any of these at a component

pkgs/top-level/stage.nix

···
         gcc.abi = "elfv2";
       };
     });
+
+    pkgsExtraHardening = nixpkgsFun {
+      overlays = [
+        (self': super': {
+          pkgsExtraHardening = super';
+          stdenv = super'.withDefaultHardeningFlags (
+            super'.stdenv.cc.defaultHardeningFlags ++ [
+              "zerocallusedregs"
+            ]
+          ) super'.stdenv;
+        })
+      ] ++ overlays;
+    };
   };
 
   # The complete chain of package set builders, applied from top to bottom.