Merge branch 'staging' into staging-next

2024-11-25 00:12:56 +00:00 · 2024-11-07 11:38:24 +01:00 · 2024-11-07 11:38:24 +01:00 · 127a31c3cf
commit 127a31c3cf
parent 07f48745be 8d37fdd1bc
340 changed files with 2067 additions and 3675 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@ -149,8 +149,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza

 # Python-related code and docs
 /doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries            @natsukium
-/pkgs/development/interpreters/python                   @natsukium
+/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
+/pkgs/development/interpreters/python         @mweinelt @natsukium
 /pkgs/top-level/python-packages.nix                     @natsukium
 /pkgs/top-level/release-python.nix                      @natsukium

--- a/doc/hooks/meson.section.md
+++ b/doc/hooks/meson.section.md
@ -18,6 +18,16 @@ setup hook registering ninja-based build and install phases.

 Controls the flags passed to `meson setup` during configure phase.

+#### `mesonBuildDir` {#meson-build-dir}
+
+Directory where Meson will put intermediate files.
+
+Setting this can be useful for debugging multiple Meson builds while in the same source directory, for example, when building for different platforms.
+Different values for each build will prevent build artefacts from interefering with each other.
+This setting has no tangible effect when running the build in a sandboxed derivation.
+
+The default value is `build`.
+
 #### `mesonWrapMode` {#meson-wrap-mode}

 Which value is passed as
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -55,6 +55,7 @@ sets are
 * `pkgs.python311Packages`
 * `pkgs.python312Packages`
 * `pkgs.python313Packages`
+* `pkgs.python314Packages`
 * `pkgs.pypy27Packages`
 * `pkgs.pypy39Packages`
 * `pkgs.pypy310Packages`
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -890,6 +890,11 @@ lib.mapAttrs mkLicense ({
    fullName = "MIT License";
  };

+  mit-cmu = {
+    spdxId = "MIT-CMU";
+    fullName = "CMU License";
+  };
+
  mit-feh = {
    spdxId = "MIT-feh";
    fullName = "feh License";
--- a/pkgs/applications/audio/cdparanoia/default.nix
+++ b/pkgs/applications/audio/cdparanoia/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch
 , updateAutotoolsGnuConfigScriptsHook, autoreconfHook
-, IOKit, Carbon
 }:

 stdenv.mkDerivation rec {
@ -14,8 +13,8 @@ stdenv.mkDerivation rec {

  patches = lib.optionals stdenv.hostPlatform.isDarwin [
    (fetchpatch {
-      url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/osx_interface.patch";
-      sha256 = "0hq3lvfr0h1m3p0r33jij0s1aspiqlpy533rwv19zrfllb39qvr8";
+      url = "https://github.com/macports/macports-ports/raw/c8e15973bc3c1e1ab371bc0ee2de14209e639f17/audio/cdparanoia/files/osx_interface.patch";
+      hash = "sha256-9p4+9dRvqLHkpR0RWLQcNL1m7fb7L6r+c9Q2tt4jh0U=";
      # Our configure patch will subsume it, but we want our configure
      # patch to be used on all platforms so we cannot just start where
      # this leaves off.
@ -23,13 +22,38 @@ stdenv.mkDerivation rec {
    })
    (fetchurl {
      url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/patch-paranoia_paranoia.c.10.4.diff";
-      sha256 = "17l2qhn8sh4jy6ryy5si6ll6dndcm0r537rlmk4a6a8vkn852vad";
+      hash = "sha256-TW1RkJ0bKaPIrDSfUTKorNlmKDVRF++z8ZJAjSzEgp4=";
+    })
+    # add missing include files needed for function prototypes
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/f210a6061bc53c746730a37922399c6de6d69cb7/audio/cdparanoia/files/fixing-include.patch";
+      hash = "sha256-6a/u4b8/H/4XjyFup23xySgyAI9SMVMom4PLvH8KzhE=";
    })
  ] ++ [
    # Has to come after darwin patches
    ./fix_private_keyword.patch
    # Order does not matter
    ./configure.patch
+    # labs for long
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/f210a6061bc53c746730a37922399c6de6d69cb7/audio/cdparanoia/files/fixing-labs.patch";
+      hash = "sha256-BMMQ5bbPP3eevuwWUVjQCtRBiWbkAHD+O0C0fp+BPaw=";
+    })
+    # use "%s" for passing a buffer to fprintf
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/f210a6061bc53c746730a37922399c6de6d69cb7/audio/cdparanoia/files/fixing-fprintf.patch";
+      hash = "sha256-2dJl16p+f5l3wxVOJhsuLiQ9a4prq7jsRZP8/ygEae4=";
+    })
+    # add support for IDE4-9
+    (fetchpatch {
+      url = "https://salsa.debian.org/optical-media-team/cdparanoia/-/raw/bbf353721834b3784ccc0fd54a36a6b25181f5a4/debian/patches/02-ide-devices.patch";
+      hash = "sha256-S6OzftUIPPq9JHsoAE2K51ltsI1WkVaQrpgCjgm5AG4=";
+    })
+    # check buffer is non-null before dereferencing
+    (fetchpatch {
+      url = "https://salsa.debian.org/optical-media-team/cdparanoia/-/raw/f7bab3024c5576da1fdb7497abbd6abc8959a98c/debian/patches/04-endian.patch";
+      hash = "sha256-krfprwls0L3hsNfoj2j69J5k1RTKEQtzE0fLYG9EJKo=";
+    })
  ] ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch;

  nativeBuildInputs = [
@ -37,13 +61,6 @@ stdenv.mkDerivation rec {
    autoreconfHook
  ];

-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Carbon
-    IOKit
-  ];
-
-  hardeningDisable = [ "format" ];
-
  # Build system reuses the same object file names for shared and static
  # library. Occasionally fails in the middle:
  #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@ -22,11 +22,11 @@ assert withConplay -> !libOnly;

 stdenv.mkDerivation rec {
  pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.7";
+  version = "1.32.8";

  src = fetchurl {
    url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-PIkZJDcHlRysDjw5u/KGU7yv/EPJj/FoAaJzUNuPDyE=";
+    hash = "sha256-/u4TdMeVQODkBd8LxF/eIK1nARQlw2GidZ4hRolKJ6c=";
  };

  outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@ -31,24 +31,10 @@
 , qtnetworkauth
 , qttools
 , nixosTests
-, darwin
+, apple-sdk_11
 }:

-let
-  stdenv' = if stdenv.hostPlatform.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
-  # portaudio propagates Darwin frameworks. Rebuild it using the 11.0 stdenv
-  # from Qt and the 11.0 SDK frameworks.
-  portaudio' = if stdenv.hostPlatform.isDarwin then portaudio.override {
-    stdenv = stdenv';
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      AudioUnit
-      AudioToolbox
-      CoreAudio
-      CoreServices
-      Carbon
-    ;
-  } else portaudio;
-in stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "musescore";
  version = "4.4.3";

@ -116,7 +102,7 @@ in stdenv'.mkDerivation (finalAttrs: {
    libpulseaudio
    libsndfile
    libvorbis
-    portaudio'
+    portaudio
    portmidi
    flac
    libopusenc
@ -132,7 +118,7 @@ in stdenv'.mkDerivation (finalAttrs: {
    alsa-lib
    qtwayland
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk_11_0.frameworks.Cocoa
+    apple-sdk_11
  ];

  postInstall = ''
--- a/pkgs/applications/editors/emacs/build-support/elpa2nix.el
+++ b/pkgs/applications/editors/emacs/build-support/elpa2nix.el
@ -34,9 +34,10 @@ The file can either be a tar file or an Emacs Lisp file."

 (let ((flag (getenv "turnCompilationWarningToError")))
  (when (and flag
-             (not (string-empty-p flag)))
+             ;; we do not use `string-empty-p' because it requires subr-x in Emacs <= 26
+             (not (string= flag "")))
    (setq byte-compile-error-on-warn t)))

 (let ((flag (getenv "ignoreCompilationError")))
-  (when (string-empty-p flag)
+  (when (string= flag "")
    (setq byte-compile-debug t)))
--- a/pkgs/applications/editors/mg/default.nix
+++ b/pkgs/applications/editors/mg/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, ncurses, buildPackages, darwin }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, ncurses, buildPackages }:

 stdenv.mkDerivation {
  pname = "mg";
@ -25,7 +25,7 @@ stdenv.mkDerivation {
  '';
  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ ncurses ] ++ lib.optional stdenv.isDarwin [ darwin.libutil ];
+  buildInputs = [ ncurses ];

  meta = with lib; {
    description = "Micro GNU/emacs, a portable version of the mg maintained by the OpenBSD team";
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0765";
+  version = "9.1.0787";

  outputs = [ "out" "xxd" ];

@ -8,7 +8,7 @@ rec {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-LtEEMpdWXA6qyjAIjgsZoc4hNXXG2ZXxCsbWKC5aEPI=";
+    hash = "sha256-kV2SaIOUv+ZcDsqBibZZ38gCevVLhejcYtY0TCQVtig=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@ -139,7 +139,6 @@ stdenv.mkDerivation (finalAttrs: {
  # Xcode project or pass it as a flag to xcodebuild as well.
  postConfigure = ''
    substituteInPlace src/auto/config.mk \
-      --replace "PERL_CFLAGS${"\t"}=" "PERL_CFLAGS${"\t"}= -I${darwin.libutil}/include" \
      --replace " -L${stdenv.cc.libc}/lib" "" \
      --replace " -L${darwin.libobjc}/lib" "" \
      --replace " -L${darwin.libunwind}/lib" "" \
--- a/pkgs/applications/science/chemistry/apbs/default.nix
+++ b/pkgs/applications/science/chemistry/apbs/default.nix
@ -7,8 +7,6 @@
 , suitesparse
 , python3
 , libintl
-, libiconv
-, darwin
 }:
 let
  # this is a fork version of fetk (http://www.fetk.org/)
@ -87,8 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
    python3
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    libintl
-    libiconv
-    darwin.libutil
  ];

  cmakeFlags = [
--- a/pkgs/applications/science/logic/surelog/default.nix
+++ b/pkgs/applications/science/logic/surelog/default.nix
@ -12,7 +12,6 @@
 , antlr4
 , capnproto
 , nlohmann_json
-, darwin
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -46,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
    capnproto
    antlr4.runtime.cpp
    nlohmann_json
-  ] ++ lib.optional stdenv.isDarwin [ darwin.libutil ];
+  ];

  cmakeFlags = [
    "-DSURELOG_USE_HOST_CAPNP=On"
--- a/pkgs/applications/science/logic/uhdm/default.nix
+++ b/pkgs/applications/science/logic/uhdm/default.nix
@ -5,7 +5,6 @@
 , python3
 , capnproto
 , gtest
-, darwin
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -29,8 +28,6 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    capnproto
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.libutil
  ];

  cmakeFlags = [
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@ -4,14 +4,14 @@

 stdenv.mkDerivation rec {
  pname = "xterm";
-  version = "394";
+  version = "395";

  src = fetchurl {
    urls = [
      "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
      "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
    ];
-    hash = "sha256-oqDLIG6wQj3tw0eU9cLTjIM5DS3REGtmq6CWDDqXbHo=";
+    hash = "sha256-KG48qlk46uOOICgnYhVnYp3+quaJ6AcLQTyhE5gJPcg=";
  };

  patches = [ ./sixel-256.support.patch ];
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, stdenv, zlib, ncurses, libiconv, darwin }:
+{ lib, fetchurl, stdenv, zlib, ncurses, libiconv, apple-sdk_11, darwinMinVersionHook }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "fnc";
@ -9,18 +9,13 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-npS+sOxF0S/9TuFjtEFlev0HpIOsaP6zmcfopPNUehk=";
  };

-  buildInputs = [ libiconv ncurses zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.libutil
-  ];
+  buildInputs = [ libiconv ncurses zlib apple-sdk_11 (darwinMinVersionHook "11.0") ];

  makeFlags = [ "PREFIX=$(out)" ];

  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
    # Needed with GCC 12
    "-Wno-error=maybe-uninitialized"
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # error: 'strtonum' is only available on macOS 11.0 or newer
-    "-Wno-error=unguarded-availability-new"
  ]);

  preInstall = ''
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@ -245,10 +245,11 @@ stdenv.mkDerivation (finalAttrs: {

   + (if svnSupport then ''
        # wrap git-svn
-        wrapProgram $out/libexec/git-core/git-svn                                                                                \
-                     --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath (perlLibs ++ [svn.out])}" \
-                     --prefix PATH : "${svn.out}/bin" ''
-       else '' # replace git-svn by notification script
+        wrapProgram $out/libexec/git-core/git-svn \
+          --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath (perlLibs ++ [svn.out])}" \
+          --prefix PATH : "${svn.out}/bin"
+      '' else ''
+        # replace git-svn by notification script
        notSupported $out/libexec/git-core/git-svn
     '')

@ -261,9 +262,11 @@ stdenv.mkDerivation (finalAttrs: {
        notSupported $out/libexec/git-core/git-send-email
      '')

-   + lib.optionalString withManual ''# Install man pages
+   + lib.optionalString withManual ''
+       # Install man pages
       make -j $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
-         -C Documentation ''
+         -C Documentation
+     ''

   + (if guiSupport then ''
       # Wrap Tcl/Tk programs
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -21,11 +21,11 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.8.1";
+    version = "6.8.2";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-Aw6Kem1ZDk6utAPuJWdWFc2A0jbzq4oLVtzIQYEViwU=";
+      hash = "sha256-qsYYEGdorR7ZdsP+fIZZ/smebwtTN+pupVT66EkMT04=";
    };

    format = "other";
@ -35,7 +35,7 @@ let
    cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
      inherit src;
      name = "mercurial-${version}";
-      hash = "sha256-i5AVyi9m7qLLubhV8fBhhZ6/RYOjMdwmv9Bek9pT/xo=";
+      hash = "sha256-/HjgGtjKfLLufEqyT7xHYIlC5xnVunYoA+H1xLS1bVw=";
      sourceRoot = "mercurial-${version}/rust";
    } else null;
    cargoRoot = if rustSupport then "rust" else null;
--- a/pkgs/build-support/bintools-wrapper/add-darwin-ldflags-before.sh
+++ b/pkgs/build-support/bintools-wrapper/add-darwin-ldflags-before.sh
@ -79,19 +79,3 @@ if [ ! "$havePlatformVersionFlag" ]; then
        extraBefore+=(-@darwinPlatform@_version_min "${@darwinMinVersionVariable@_@suffixSalt@:-@darwinMinVersion@}")
    fi
 fi
-
-mangleVarSingle DEVELOPER_DIR ${role_suffixes[@]+"${role_suffixes[@]}"}
-
-# Allow wrapped bintools to do something useful when no `DEVELOPER_DIR` is set, which can happen when
-# the compiler is run outside of a stdenv or intentionally in an environment with no environment variables set.
-DEVELOPER_DIR=${DEVELOPER_DIR_@suffixSalt@:-@fallback_sdk@}
-
-# Darwin looks for frameworks in the SDK located at `DEVELOPER_DIR`.
-extraBefore+=("-F$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks")
-extraBefore+=("-L$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib")
-
-# While the Swift wrapper should take care of this, anything that needs to link Swift auto-linked frameworks
-# also needs these paths. Note: Test and conditionally add it because the path may not exist in older SDKs.
-if [ -d "$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib/swift" ]; then
-    extraBefore+=("-L$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib/swift")
-fi
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@ -372,24 +372,15 @@ stdenvNoCC.mkDerivation {
      substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
      substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
      substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
+      substituteAll ${../wrapper-common/darwin-sdk-setup.bash} $out/nix-support/darwin-sdk-setup.bash
    ''

    ###
    ### Ensure consistent LC_VERSION_MIN_MACOSX
    ###
-    + optionalString targetPlatform.isDarwin (
-      let
-        inherit (targetPlatform)
-          darwinPlatform darwinSdkVersion
-          darwinMinVersion darwinMinVersionVariable;
-      in ''
-        export darwinPlatform=${darwinPlatform}
-        export darwinMinVersion=${darwinMinVersion}
-        export darwinSdkVersion=${darwinSdkVersion}
-        export darwinMinVersionVariable=${darwinMinVersionVariable}
-        substituteAll ${./add-darwin-ldflags-before.sh} $out/nix-support/add-local-ldflags-before.sh
-      ''
-    )
+    + optionalString targetPlatform.isDarwin ''
+      substituteAll ${./add-darwin-ldflags-before.sh} $out/nix-support/add-local-ldflags-before.sh
+    ''

    ##
    ## Extra custom steps
@ -403,10 +394,17 @@ stdenvNoCC.mkDerivation {
    # TODO(@sternenseemann): rename env var via stdenv rebuild
    shell = (getBin runtimeShell + runtimeShell.shellPath or "");
    gnugrep_bin = optionalString (!nativeTools) gnugrep;
+    rm = if nativeTools then "rm" else lib.getExe' coreutils "rm";
+    mktemp = if nativeTools then "mktemp" else lib.getExe' coreutils "mktemp";
    wrapperName = "BINTOOLS_WRAPPER";
    inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
    inherit bintools_bin libc_bin libc_dev libc_lib;
    default_hardening_flags_str = builtins.toString defaultHardeningFlags;
+  } // lib.mapAttrs (_: lib.optionalString targetPlatform.isDarwin) {
+    # These will become empty strings when not targeting Darwin.
+    inherit (targetPlatform)
+      darwinPlatform darwinSdkVersion
+      darwinMinVersion darwinMinVersionVariable;
  } // lib.optionalAttrs (apple-sdk != null && stdenvNoCC.targetPlatform.isDarwin) {
    # Wrapped compilers should do something useful even when no SDK is provided at `DEVELOPER_DIR`.
    fallback_sdk = apple-sdk.__spliced.buildTarget or apple-sdk;
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@ -16,6 +16,8 @@ fi

 source @out@/nix-support/utils.bash

+source @out@/nix-support/darwin-sdk-setup.bash
+
 if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
    source @out@/nix-support/add-flags.sh
 fi
@ -42,9 +44,9 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
    while (( "$n" < "$nParams" )); do
        p=${params[n]}
        p2=${params[n+1]:-} # handle `p` being last one
-        if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
+        if [ "${p:0:3}" = -L/ ] && badPathWithDarwinSdk "${p:2}"; then
            skip "${p:2}"
-        elif [ "$p" = -L ] && badPath "$p2"; then
+        elif [ "$p" = -L ] && badPathWithDarwinSdk "$p2"; then
            n+=1; skip "$p2"
        elif [ "$p" = -rpath ] && badPath "$p2"; then
            n+=1; skip "$p2"
@ -251,8 +253,8 @@ PATH="$path_backup"
 # Old bash workaround, see above.

 if (( "${NIX_LD_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    responseFile=$(mktemp "${TMPDIR:-/tmp}/ld-params.XXXXXX")
-    trap 'rm -f -- "$responseFile"' EXIT
+    responseFile=$(@mktemp@ "${TMPDIR:-/tmp}/ld-params.XXXXXX")
+    trap '@rm@ -f -- "$responseFile"' EXIT
    printf "%q\n" \
       ${extraBefore+"${extraBefore[@]}"} \
       ${params+"${params[@]}"} \
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@ -78,28 +78,12 @@ if [ -e @out@/nix-support/cc-cflags-before ]; then
    NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@="$(< @out@/nix-support/cc-cflags-before) $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@"
 fi

-# Only add darwin min version flag and set up `DEVELOPER_DIR` if a default darwin min version is set,
+# Only add darwin min version flag if a default darwin min version is set,
 # which is a signal that we're targetting darwin.
 if [ "@darwinMinVersion@" ]; then
    mangleVarSingle @darwinMinVersionVariable@ ${role_suffixes[@]+"${role_suffixes[@]}"}

    NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@="-m@darwinPlatformForCC@-version-min=${@darwinMinVersionVariable@_@suffixSalt@:-@darwinMinVersion@} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@"
-
-    # `DEVELOPER_DIR` is used to dynamically locate libSystem (and the SDK frameworks) based on the SDK at that path.
-    mangleVarSingle DEVELOPER_DIR ${role_suffixes[@]+"${role_suffixes[@]}"}
-
-    # Allow wrapped compilers to do something useful when no `DEVELOPER_DIR` is set, which can happen when
-    # the compiler is run outside of a stdenv or intentionally in an environment with no environment variables set.
-    DEVELOPER_DIR=${DEVELOPER_DIR_@suffixSalt@:-@fallback_sdk@}
-
-    # xcbuild needs `SDKROOT` to be the name of the SDK, which it sets in its own wrapper,
-    # but compilers expect it to point to the absolute path.
-    SDKROOT="$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
-
-    # Set up various library paths since compilers may not support (or may have disabled) finding them in the sysroot.
-    NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@+=" -isysroot $SDKROOT"
-    NIX_CFLAGS_COMPILE_@suffixSalt@+=" -idirafter $SDKROOT/usr/include"
-    NIX_CFLAGS_COMPILE_@suffixSalt@+=" -iframework $SDKROOT/System/Library/Frameworks"
 fi

 # That way forked processes will not extend these environment variables again.
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -17,6 +17,8 @@ fi

 source @out@/nix-support/utils.bash

+source @out@/nix-support/darwin-sdk-setup.bash
+

 # Parse command line options and set several variables.
 # For instance, figure out if linker flags should be passed.
@ -101,7 +103,7 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
            -[IL] | -isystem) path=$p2 skipNext=true ;;
        esac

-        if [[ -n $path ]] && badPath "$path"; then
+        if [[ -n $path ]] && badPathWithDarwinSdk "$path"; then
            skip "$path"
            $skipNext && n+=1
            continue
@ -251,8 +253,8 @@ if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
 fi

 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    responseFile=$(mktemp "${TMPDIR:-/tmp}/cc-params.XXXXXX")
-    trap 'rm -f -- "$responseFile"' EXIT
+    responseFile=$(@mktemp@ "${TMPDIR:-/tmp}/cc-params.XXXXXX")
+    trap '@rm@ -f -- "$responseFile"' EXIT
    printf "%q\n" \
       ${extraBefore+"${extraBefore[@]}"} \
       ${params+"${params[@]}"} \
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -284,13 +284,6 @@ let
    if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx"
    else targetPlatform.darwinPlatform
  );
-
-  darwinMinVersion = optionalString targetPlatform.isDarwin (
-    targetPlatform.darwinMinVersion
-  );
-
-  darwinMinVersionVariable = optionalString targetPlatform.isDarwin
-    targetPlatform.darwinMinVersionVariable;
 in

 assert includeFortifyHeaders' -> fortify-headers != null;
@ -707,6 +700,7 @@ stdenvNoCC.mkDerivation {
      substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
      substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
      substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
+      substituteAll ${../wrapper-common/darwin-sdk-setup.bash} $out/nix-support/darwin-sdk-setup.bash
    ''

    + optionalString cc.langAda or false ''
@ -743,14 +737,19 @@ stdenvNoCC.mkDerivation {
    # TODO(@sternenseemann): rename env var via stdenv rebuild
    shell = getBin runtimeShell + runtimeShell.shellPath or "";
    gnugrep_bin = optionalString (!nativeTools) gnugrep;
+    rm = if nativeTools then "rm" else lib.getExe' coreutils "rm";
+    mktemp = if nativeTools then "mktemp" else lib.getExe' coreutils "mktemp";
    # stdenv.cc.cc should not be null and we have nothing better for now.
    # if the native impure bootstrap is gotten rid of this can become `inherit cc;` again.
    cc = optionalString (!nativeTools) cc;
    wrapperName = "CC_WRAPPER";
    inherit suffixSalt coreutils_bin bintools;
    inherit libc_bin libc_dev libc_lib;
-    inherit darwinPlatformForCC darwinMinVersion darwinMinVersionVariable;
+    inherit darwinPlatformForCC;
    default_hardening_flags_str = builtins.toString defaultHardeningFlags;
+  } // lib.mapAttrs (_: lib.optionalString targetPlatform.isDarwin) {
+    # These will become empty strings when not targeting Darwin.
+    inherit (targetPlatform) darwinMinVersion darwinMinVersionVariable;
  } // lib.optionalAttrs (apple-sdk != null && stdenvNoCC.targetPlatform.isDarwin) {
    # Wrapped compilers should do something useful even when no SDK is provided at `DEVELOPER_DIR`.
    fallback_sdk = apple-sdk.__spliced.buildTarget or apple-sdk;
--- a/pkgs/build-support/wrapper-common/darwin-sdk-setup.bash
+++ b/pkgs/build-support/wrapper-common/darwin-sdk-setup.bash
@ -0,0 +1,16 @@
+accumulateRoles
+
+# Only set up `DEVELOPER_DIR` if a default darwin min version is set,
+# which is a signal that we're targetting darwin.
+if [[ "@darwinMinVersion@" ]]; then
+    # `DEVELOPER_DIR` is used to dynamically locate libSystem (and the SDK frameworks) based on the SDK at that path.
+    mangleVarSingle DEVELOPER_DIR ${role_suffixes[@]+"${role_suffixes[@]}"}
+
+    # Allow wrapped compilers to do something useful when no `DEVELOPER_DIR` is set, which can happen when
+    # the compiler is run outside of a stdenv or intentionally in an environment with no environment variables set.
+    export DEVELOPER_DIR=${DEVELOPER_DIR_@suffixSalt@:-@fallback_sdk@}
+
+    # xcbuild needs `SDKROOT` to be the name of the SDK, which it sets in its own wrapper,
+    # but compilers expect it to point to the absolute path.
+    export SDKROOT="$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
+fi
--- a/pkgs/build-support/wrapper-common/utils.bash
+++ b/pkgs/build-support/wrapper-common/utils.bash
@ -118,6 +118,21 @@ badPath() {
        "${p#"${TEMPDIR:-/tmp}"}" = "$p"
 }

+# Like `badPath`, but handles paths that may be interpreted relative to
+# `$SDKROOT` on Darwin. For example, `-L/usr/lib/swift` is interpreted
+# as `-L$SDKROOT/usr/lib/swift` when `$SDKROOT` is set and
+# `$SDKROOT/usr/lib/swift` exists.
+badPathWithDarwinSdk() {
+    path=$1
+    if [[ "@darwinMinVersion@" ]]; then
+        sdkPath=$SDKROOT/$path
+        if [[ -e $sdkPath ]]; then
+            path=$sdkPath
+        fi
+    fi
+    badPath "$path"
+}
+
 expandResponseParams() {
    declare -ga params=("$@")
    local arg
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
@ -54,6 +54,8 @@ self: super: {
      libiconv
      darwin.libresolv
      darwin.libsbuf
+      # Shipped with the SDK only as a library with no headers
+      (lib.getLib darwin.libutil)
      # Required by some SDK headers
      cupsHeaders
    ]
--- a/pkgs/by-name/ap/apple-sdk/package.nix
+++ b/pkgs/by-name/ap/apple-sdk/package.nix
@ -48,9 +48,13 @@ let
      (callPackage ./common/propagate-inputs.nix { })
      (callPackage ./common/propagate-xcrun.nix { })
    ]
-    ++ [
-      # These have to happen last.
+    # Older SDKs do not include the libraries re-exported from umbrella frameworks in the umbrellas’ stubs, which causes
+    # link failures for those libraries unless their paths have been rewritten to point to the store.
+    ++ lib.optionals (lib.versionOlder sdkVersion "11.0") [
      (callPackage ./common/rewrite-sdk-paths.nix { inherit sdkVersion; })
+    ]
+    # This has to happen last.
+    ++ [
      (callPackage ./common/run-build-phase-hooks.nix { })
    ]
  );
--- a/pkgs/by-name/au/auto-patchelf/package.nix
+++ b/pkgs/by-name/au/auto-patchelf/package.nix
@ -1,18 +1,29 @@
 {
+  stdenv,
+  python3,
  lib,
-  python3Packages,
 }:

-python3Packages.buildPythonApplication {
+let
+  pythonEnv = python3.withPackages (ps: [ ps.pyelftools ]);
+
+in
+# Note: Not using python3Packages.buildPythonApplication because of dependency propagation.
+stdenv.mkDerivation {
  pname = "auto-patchelf";
  version = "0-unstable-2024-08-14";
-  pyproject = false;
+
+  buildInputs = [ pythonEnv ];

  src = ./source;

-  dependencies = with python3Packages; [
-    pyelftools
-  ];
+  buildPhase = ''
+    runHook preBuild
+
+    substituteInPlace auto-patchelf.py --replace-fail "@defaultBintools@" "$NIX_BINTOOLS"
+
+    runHook postBuild
+  '';

  installPhase = ''
    runHook preInstall
@ -22,10 +33,6 @@ python3Packages.buildPythonApplication {
    runHook postInstall
  '';

-  makeWrapperArgs = [
-    "--set DEFAULT_BINTOOLS $NIX_BINTOOLS"
-  ];
-
  meta = {
    description = "Automatically patch ELF binaries using patchelf";
    mainProgram = "auto-patchelf";
--- a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
+++ b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
@ -21,6 +21,9 @@ from elftools.elf.elffile import ELFFile  # type: ignore
 from elftools.elf.enums import ENUM_E_TYPE, ENUM_EI_OSABI  # type: ignore


+DEFAULT_BINTOOLS = "@defaultBintools@"
+
+
@contextmanager
 def open_elf(path: Path) -> Iterator[ELFFile]:
    with path.open('rb') as stream:
@ -425,7 +428,7 @@ interpreter_arch: str   = None # type: ignore
 libc_lib: Path          = None # type: ignore

 if __name__ == "__main__":
-    nix_support = Path(os.environ.get('NIX_BINTOOLS', os.environ['DEFAULT_BINTOOLS'])) / 'nix-support'
+    nix_support = Path(os.environ.get('NIX_BINTOOLS', DEFAULT_BINTOOLS)) / 'nix-support'
    interpreter_path = Path((nix_support / 'dynamic-linker').read_text().strip())
    libc_lib = Path((nix_support / 'orig-libc').read_text().strip()) / 'lib'

--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bmake";
-  version = "20240808";
+  version = "20240921";

  src = fetchurl {
    url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-tZGJJRtIPezUSS8fdDh7KlhMA9WqRjfNSLOOxiucCEg=";
+    hash = "sha256-s0ZXnoLSltGk2ineqFlOPuWWEwsgeG3sDziZo+ESdcI=";
  };

  patches = [
--- a/pkgs/by-name/bo/boehmgc/package.nix
+++ b/pkgs/by-name/bo/boehmgc/package.nix
@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , autoreconfHook
-# doc: https://github.com/ivmai/bdwgc/blob/v8.2.6/doc/README.macros (LARGE_CONFIG)
+# doc: https://github.com/ivmai/bdwgc/blob/v8.2.8/doc/README.macros (LARGE_CONFIG)
 , enableLargeConfig ? false
 , enableMmap ? true
 , enableStatic ? false
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "boehm-gc";
-  version = "8.2.6";
+  version = "8.2.8";

  src = fetchFromGitHub {
    owner = "ivmai";
    repo = "bdwgc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-y6hU5qU4qO9VvQvKNH9dvReCrf3+Ih2HHbF6IS1V3WQ=";
+    hash = "sha256-UQSLK/05uPal6/m+HMz0QwXVII1leonlmtSZsXjJ+/c=";
  };

  outputs = [ "out" "dev" "doc" ];
@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
  # not fix the problem the test failure will be a reminder to
  # extend the set of versions requiring the workaround).
  makeFlags = lib.optionals (stdenv.hostPlatform.isPower64 &&
-                  finalAttrs.version == "8.2.6")
+                  finalAttrs.version == "8.2.8")
    [
      # do not use /proc primitives to track dirty bits; see:
      # https://github.com/ivmai/bdwgc/issues/479#issuecomment-1279687537
--- a/pkgs/by-name/cm/cmake/008-FindCURL-Add-more-target-properties-from-pkg-config.diff
+++ b/pkgs/by-name/cm/cmake/008-FindCURL-Add-more-target-properties-from-pkg-config.diff
@ -0,0 +1,32 @@
+diff --git a/Modules/FindCURL.cmake b/Modules/FindCURL.cmake
+index 5ce8a9046b..f7361308b7 100644
+--- a/Modules/FindCURL.cmake
+++ b/Modules/FindCURL.cmake
+@@ -239,9 +239,24 @@ if(CURL_FOUND)
+         IMPORTED_LOCATION_DEBUG "${CURL_LIBRARY_DEBUG}")
+     endif()
+ 
+-    if(CURL_USE_STATIC_LIBS AND MSVC)
+-       set_target_properties(CURL::libcurl PROPERTIES
+-           INTERFACE_LINK_LIBRARIES "normaliz.lib;ws2_32.lib;wldap32.lib")
+    if(PC_CURL_FOUND)
+      if(PC_CURL_LINK_LIBRARIES)
+        set_property(TARGET CURL::libcurl PROPERTY
+                     INTERFACE_LINK_LIBRARIES "${PC_CURL_LINK_LIBRARIES}")
+      endif()
+      if(PC_CURL_LDFLAGS_OTHER)
+        set_property(TARGET CURL::libcurl PROPERTY
+                     INTERFACE_LINK_OPTIONS "${PC_CURL_LDFLAGS_OTHER}")
+      endif()
+      if(PC_CURL_CFLAGS_OTHER)
+        set_property(TARGET CURL::libcurl PROPERTY
+                     INTERFACE_COMPILE_OPTIONS "${PC_CURL_CFLAGS_OTHER}")
+      endif()
+    else()
+      if(CURL_USE_STATIC_LIBS AND MSVC)
+         set_target_properties(CURL::libcurl PROPERTIES
+             INTERFACE_LINK_LIBRARIES "normaliz.lib;ws2_32.lib;wldap32.lib")
+      endif()
+     endif()
+ 
+   endif()
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString isMinimalBuild "-minimal"
    + lib.optionalString cursesUI "-cursesUI"
    + lib.optionalString qt5UI "-qt5UI";
-  version = "3.30.4";
+  version = "3.30.5";

  src = fetchurl {
    url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-x1nJcnTx56qq/LHw0mH53pvzpdbst+LfYWMkpG/nBLI=";
+    hash = "sha256-n1XhpAUI8vKbfgZfoIwp+CxAL6BALag5//5koldVqG0=";
  };

  patches = [
@ -76,7 +76,12 @@ stdenv.mkDerivation (finalAttrs: {
    substituteAll {
      src = ./007-darwin-bsd-ps-abspath.diff;
      ps = lib.getExe ps;
-    });
+    })
+  ++ [
+    # Backport of https://gitlab.kitware.com/cmake/cmake/-/merge_requests/9900
+    # Needed to corretly link curl in pkgsStatic.
+    ./008-FindCURL-Add-more-target-properties-from-pkg-config.diff
+  ];

  outputs = [ "out" ] ++ lib.optionals buildDocs [ "man" "info" ];
  separateDebugInfo = true;
--- a/pkgs/by-name/cu/cue/validator.nix
+++ b/pkgs/by-name/cu/cue/validator.nix
@ -5,8 +5,8 @@
 # against the fragment described by `document` or the whole definition.
 # The script will be strict and enforce concrete values, i.e. partial documents are not supported.
 cueSchemaFile: { document ? null }:
-  writeShellScript "validate-using-cue"
-  ''${cue}/bin/cue \
+  writeShellScript "validate-using-cue" ''
+    ${cue}/bin/cue \
      --all-errors \
      --strict \
      vet \
--- a/pkgs/by-name/kv/kvazaar/package.nix
+++ b/pkgs/by-name/kv/kvazaar/package.nix
@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gitUpdater,
+  testers,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kvazaar";
+  version = "2.3.1";
+
+  src = fetchFromGitHub {
+    owner = "ultravideo";
+    repo = "kvazaar";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-d/OkX18nyHSQXJgNhBtiCLb/Fe8Y/MpddXxLpNMZiXI=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+    "man"
+  ];
+
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Open-source HEVC encoder";
+    homepage = "https://github.com/ultravideo/kvazaar";
+    changelog = "https://github.com/ultravideo/kvazaar/releases/tag/v${finalAttrs.version}";
+    pkgConfigModules = [ "kvazaar" ];
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+  };
+})
--- a/pkgs/by-name/lc/lcevcdec/package.nix
+++ b/pkgs/by-name/lc/lcevcdec/package.nix
@ -0,0 +1,104 @@
+{
+  cmake,
+  copyPkgconfigItems,
+  fetchFromGitHub,
+  fmt,
+  git,
+  gitUpdater,
+  gtest,
+  lib,
+  makePkgconfigItem,
+  pkg-config,
+  python3,
+  range-v3,
+  rapidjson,
+  stdenv,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lcevcdec";
+  version = "3.2.1";
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "v-novaltd";
+    repo = "LCEVCdec";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-Nf0YntB1A3AH0MTXlfUHhxYbzZqeB0EH9Fe9Xrqdsts=";
+  };
+
+  postPatch = ''
+    substituteInPlace cmake/tools/version_files.py \
+      --replace-fail "args.git_version" '"${finalAttrs.version}"' \
+      --replace-fail "args.git_hash" '"${finalAttrs.src.rev}"' \
+      --replace-fail "args.git_date" '"1970-01-01"'
+  '';
+
+  env = {
+    includedir = "${placeholder "dev"}/include";
+    libdir = "${placeholder "out"}/lib";
+  };
+
+  pkgconfigItems = [
+    (makePkgconfigItem rec {
+      name = "lcevc_dec";
+      inherit (finalAttrs) version;
+      libs = [
+        "-L${variables.libdir}"
+        "-llcevc_dec_api"
+      ];
+      libsPrivate = [
+        "-lpthread"
+        "-llcevc_dec_core"
+      ];
+      cflags = [
+        "-I${variables.includedir}"
+      ];
+      variables = {
+        prefix = "@dev@";
+        includedir = "@includedir@";
+        libdir = "@libdir@";
+      };
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    python3
+    git
+    pkg-config
+    copyPkgconfigItems
+  ];
+
+  buildInputs = [
+    rapidjson
+    fmt
+    range-v3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "VN_SDK_FFMPEG_LIBS_PACKAGE" "")
+    (lib.cmakeBool "VN_SDK_UNIT_TESTS" false)
+    (lib.cmakeBool "VN_SDK_SAMPLE_SOURCE" false)
+  ];
+
+  passthru = {
+    updateScript = gitUpdater { };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    homepage = "https://github.com/v-novaltd/LCEVCdec";
+    description = "MPEG-5 LCEVC Decoder";
+    license = lib.licenses.bsd3Clear;
+    pkgConfigModules = [ "lcevc_dec" ];
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/ld/ld64/0008-Disable-searching-in-standard-library-locations.patch
+++ b/pkgs/by-name/ld/ld64/0008-Disable-searching-in-standard-library-locations.patch
@ -1,25 +0,0 @@
-From 3e80d438e2a3ec50d666f2b6e32007c275d4a08a Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Thu, 11 Apr 2024 23:13:29 -0400
-Subject: [PATCH 8/8] Disable searching in standard library locations
-
---
- src/ld/Options.cpp | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/ld/Options.cpp b/src/ld/Options.cpp
-index 67a9f53..611b583 100644
--- a/src/ld/Options.cpp
-+++ b/src/ld/Options.cpp
-@@ -4320,7 +4320,7 @@ bool Options::shouldUseBuildVersion(ld::Platform plat, uint32_t minOSvers) const
- 
- void Options::buildSearchPaths(int argc, const char* argv[])
- {
-	bool addStandardLibraryDirectories = true;
-+	bool addStandardLibraryDirectories = false;
- 	ld::Platform platform = ld::Platform::unknown;
- 	std::vector<const char*> libraryPaths;
- 	std::vector<const char*> frameworkPaths;
-- 
-2.45.1
-
--- a/pkgs/by-name/ld/ld64/package.nix
+++ b/pkgs/by-name/ld/ld64/package.nix
@ -128,8 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
    ./0006-Add-libcd_is_blob_a_linker_signature-implementation.patch
    # Add OpenSSL implementation of CoreCrypto digest functions. Avoids use of private and non-free APIs.
    ./0007-Add-OpenSSL-based-CoreCrypto-digest-functions.patch
-    # ld64 will search `/usr/lib`, `/Library/Frameworks`, etc by default. Disable that.
-    ./0008-Disable-searching-in-standard-library-locations.patch
+    ./remove-unused-and-incomplete-blob-clone.diff
  ];

  postPatch = ''
--- a/pkgs/by-name/ld/ld64/remove-unused-and-incomplete-blob-clone.diff
+++ b/pkgs/by-name/ld/ld64/remove-unused-and-incomplete-blob-clone.diff
@ -0,0 +1,14 @@
+diff --git a/src/ld/code-sign-blobs/blob.h b/src/ld/code-sign-blobs/blob.h
+index 19c63a9..1dfb380 100644
+--- a/src/ld/code-sign-blobs/blob.h
+++ b/src/ld/code-sign-blobs/blob.h
+@@ -180,9 +180,6 @@ public:
+ 		return NULL;
+ 	}
+ 	
+-	BlobType *clone() const
+-	{ assert(validateBlob()); return specific(this->BlobCore::clone());	}
+-
+ 	static BlobType *readBlob(int fd)
+ 	{ return specific(BlobCore::readBlob(fd, _magic, sizeof(BlobType), 0), true); }
+ 
--- a/pkgs/by-name/le/less/package.nix
+++ b/pkgs/by-name/le/less/package.nix
@ -1,6 +1,8 @@
 {
  lib,
  fetchurl,
+  fetchpatch,
+  autoreconfHook,
  ncurses,
  pcre2,
  stdenv,
@ -22,6 +24,23 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-KBn1VWTYbVQqu+yv2C/2HoGaPuyWf6o2zT5o8VlqRLg=";
  };

+  patches = [
+    (fetchpatch {
+      # Fix configure parameters --with-secure=no and --without-secure.
+      url = "https://github.com/gwsw/less/commit/8fff6c56bfc833528b31ebdaee871f65fbe342b1.patch";
+      hash = "sha256-XV5XufivNWWLGeIpaP04YQPWcxIUKYYEINdT+eEx+WA=";
+      includes = [
+        "configure.ac"
+      ];
+    })
+  ];
+
+  # Need `autoreconfHook` since we patch `configure.ac`.
+  # TODO: Remove the `configure.ac` patch and `autoreconfHook` next release
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
  buildInputs = [
    ncurses
    pcre2
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@ -31,13 +31,13 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
  pname = "libarchive";
-  version = "3.7.6";
+  version = "3.7.7";

  src = fetchFromGitHub {
    owner = "libarchive";
    repo = "libarchive";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-smj8JV5irW/StUx/Zp62w5cnlKbF6GRIOSh8i4ocJ8s=";
+    hash = "sha256-maV2+Whi4aDG1VLAYpOTxluO9I0zNiZ8fA3w7epGlDg=";
  };

  outputs = [ "out" "lib" "dev" ];
--- a/pkgs/by-name/me/meson/007-case-sensitive-fs.patch
+++ b/pkgs/by-name/me/meson/007-case-sensitive-fs.patch
@ -1,87 +0,0 @@
-From a6fb2c165cda4bbf315424c96165ec9cc7052363 Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Wed, 3 Apr 2024 17:35:56 -0400
-Subject: [PATCH] dependencies: find extraframeworks on case-sensitive
- filesystems
-
-Fixes a test failure on case-sensitive filesystems when a CMake
-dependency is turned into an Apple framework.
---
- mesonbuild/dependencies/framework.py              | 9 +++++++--
- test cases/osx/11 case sensitive apfs/meson.build | 5 +++++
- test cases/osx/11 case sensitive apfs/prog.c      | 3 +++
- test cases/osx/11 case sensitive apfs/test.json   | 5 +++++
- 4 files changed, 20 insertions(+), 2 deletions(-)
- create mode 100644 test cases/osx/11 case sensitive apfs/meson.build
- create mode 100644 test cases/osx/11 case sensitive apfs/prog.c
- create mode 100644 test cases/osx/11 case sensitive apfs/test.json
-
-diff --git a/mesonbuild/dependencies/framework.py b/mesonbuild/dependencies/framework.py
-index 3c880c7430af..1fbd628235ba 100644
--- a/mesonbuild/dependencies/framework.py
-+++ b/mesonbuild/dependencies/framework.py
-@@ -47,6 +47,7 @@ def detect(self, name: str, paths: T.List[str]) -> None:
-             framework_path = self._get_framework_path(p, name)
-             if framework_path is None:
-                 continue
-+            framework_name = framework_path.stem
-             # We want to prefer the specified paths (in order) over the system
-             # paths since these are "extra" frameworks.
-             # For example, Python2's framework is in /System/Library/Frameworks and
-@@ -54,11 +55,15 @@ def detect(self, name: str, paths: T.List[str]) -> None:
-             # Python.framework. We need to know for sure that the framework was
-             # found in the path we expect.
-             allow_system = p in self.system_framework_paths
-            args = self.clib_compiler.find_framework(name, self.env, [p], allow_system)
-+            args = self.clib_compiler.find_framework(framework_name, self.env, [p], allow_system)
-             if args is None:
-                 continue
-             self.link_args = args
-             self.framework_path = framework_path.as_posix()
-+            # The search is done case-insensitively, so the found name may differ
-+            # from the one that was requested. Setting the name ensures the correct
-+            # one is used when linking on case-sensitive filesystems.
-+            self.name = framework_name
-             self.compile_args = ['-F' + self.framework_path]
-             # We need to also add -I includes to the framework because all
-             # cross-platform projects such as OpenGL, Python, Qt, GStreamer,
-@@ -74,7 +79,7 @@ def _get_framework_path(self, path: str, name: str) -> T.Optional[Path]:
-         p = Path(path)
-         lname = name.lower()
-         for d in p.glob('*.framework/'):
-            if lname == d.name.rsplit('.', 1)[0].lower():
-+            if lname == d.stem.lower():
-                 return d
-         return None
- 
-diff --git a/test cases/osx/11 case sensitive apfs/meson.build b/test cases/osx/11 case sensitive apfs/meson.build
-new file mode 100644
-index 000000000000..dd566b185f28
--- /dev/null
-+++ b/test cases/osx/11 case sensitive apfs/meson.build	
-@@ -0,0 +1,5 @@
-+project('case-sensitive APFS with extra frameworks test', 'c')
-+
-+dep = dependency('FoUnDaTiOn')
-+
-+exe = executable('prog', 'prog.c', install : true, dependencies: dep)
-diff --git a/test cases/osx/11 case sensitive apfs/prog.c b/test cases/osx/11 case sensitive apfs/prog.c
-new file mode 100644
-index 000000000000..9b6bdc2ec2f0
--- /dev/null
-+++ b/test cases/osx/11 case sensitive apfs/prog.c	
-@@ -0,0 +1,3 @@
-+int main(void) {
-+    return 0;
-+}
-diff --git a/test cases/osx/11 case sensitive apfs/test.json b/test cases/osx/11 case sensitive apfs/test.json
-new file mode 100644
-index 000000000000..a883714eaa27
--- /dev/null
-+++ b/test cases/osx/11 case sensitive apfs/test.json	
-@@ -0,0 +1,5 @@
-+{
-+  "installed": [
-+    {"type": "file", "file": "usr/bin/prog"}
-+  ]
-+}
--- a/pkgs/by-name/me/meson/007-freebsd-pkgconfig-path.patch
+++ b/pkgs/by-name/me/meson/007-freebsd-pkgconfig-path.patch
@ -1,15 +1,16 @@
-diff -ur a/mesonbuild/modules/pkgconfig.py b/mesonbuild/modules/pkgconfig.py
--- a/mesonbuild/modules/pkgconfig.py	2024-05-17 17:52:30.880877000 -0700
-+++ b/mesonbuild/modules/pkgconfig.py	2024-05-17 17:53:10.901068000 -0700
-@@ -693,10 +693,7 @@
+diff --git a/mesonbuild/modules/pkgconfig.py b/mesonbuild/modules/pkgconfig.py
+index 1bdf82931..db165ea12 100644
+--- a/mesonbuild/modules/pkgconfig.py
+++ b/mesonbuild/modules/pkgconfig.py
+@@ -701,10 +701,7 @@ class PkgConfigModule(NewExtensionModule):
         pcfile = filebase + '.pc'
         pkgroot = pkgroot_name = kwargs['install_dir'] or default_install_dir
         if pkgroot is None:
 -            if mesonlib.is_freebsd():
-                pkgroot = os.path.join(_as_str(state.environment.coredata.get_option(mesonlib.OptionKey('prefix'))), 'libdata', 'pkgconfig')
+-                pkgroot = os.path.join(_as_str(state.environment.coredata.get_option(OptionKey('prefix'))), 'libdata', 'pkgconfig')
 -                pkgroot_name = os.path.join('{prefix}', 'libdata', 'pkgconfig')
 -            elif mesonlib.is_haiku():
 +            if mesonlib.is_haiku():
-                 pkgroot = os.path.join(_as_str(state.environment.coredata.get_option(mesonlib.OptionKey('prefix'))), 'develop', 'lib', 'pkgconfig')
+                 pkgroot = os.path.join(_as_str(state.environment.coredata.get_option(OptionKey('prefix'))), 'develop', 'lib', 'pkgconfig')
                 pkgroot_name = os.path.join('{prefix}', 'develop', 'lib', 'pkgconfig')
             else:
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@ -13,7 +13,6 @@
 , python3
 , substituteAll
 , zlib
-, fetchpatch
 }:

 let
@ -21,13 +20,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "meson";
-  version = "1.5.2";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "mesonbuild";
    repo = "meson";
    rev = "refs/tags/${version}";
-    hash = "sha256-cesMepnD3fHX2CwnSQ3c5TE9kPSa0FkCVVVZDgXwo8M=";
+    hash = "sha256-st0dbb+GfF0KEyF+Qn/PIE2462ZrrXy8YcnrulHTI8M=";
  };

  patches = [
@ -74,24 +73,6 @@ python3.pkgs.buildPythonApplication rec {

    # This edge case is explicitly part of meson but is wrong for nix
    ./007-freebsd-pkgconfig-path.patch
-
-    (fetchpatch {
-      name = "tests-skip-framework-recasting-if-CMake-unavailable.patch";
-      url = "https://github.com/mesonbuild/meson/commit/8a8a3a0578fd8d5a8720a7a706f6f3b99e857f9c.patch";
-      hash = "sha256-XkwNQ5eg/fVekhsFg/V2/S2LbIVGz3H0wsSFlUT3ZZE=";
-    })
-
-    # Fix extraframework lookup on case-sensitive APFS.
-    # https://github.com/mesonbuild/meson/pull/13038
-    ./007-case-sensitive-fs.patch
-
-    # Fix meson's detection for zig's linker
-    # https://github.com/mesonbuild/meson/pull/12293
-    (fetchpatch {
-      name = "linker-support-zig-cc.patch";
-      url = "https://github.com/mesonbuild/meson/pull/12293/commits/2baae244c995794d9addfe6ed924dfa72f01be82.patch";
-      hash = "sha256-dDOmSRBKl/gs7I3kmLXIyQk3zsOdlaYov72pPSel4+I=";
-    })
  ];

  buildInputs = lib.optionals (python3.pythonOlder "3.9") [
@ -129,7 +110,7 @@ python3.pkgs.buildPythonApplication rec {
      patchShebangs 'test cases'
      substituteInPlace \
        'test cases/native/8 external program shebang parsing/script.int.in' \
-        'test cases/common/273 customtarget exe for test/generate.py' \
+        'test cases/common/274 customtarget exe for test/generate.py' \
          --replace /usr/bin/env ${coreutils}/bin/env
    ''
  ]
--- a/pkgs/by-name/me/meson/setup-hook.sh
+++ b/pkgs/by-name/me/meson/setup-hook.sh
@ -3,6 +3,8 @@
 mesonConfigurePhase() {
    runHook preConfigure

+    : ${mesonBuildDir:=build}
+
    local flagsArray=()

    if [ -z "${dontAddPrefix-}" ]; then
@ -28,8 +30,8 @@ mesonConfigurePhase() {

    echoCmd 'mesonConfigurePhase flags' "${flagsArray[@]}"

-    meson setup build "${flagsArray[@]}"
-    cd build || { echoCmd 'mesonConfigurePhase' "could not cd to build"; exit 1; }
+    meson setup "$mesonBuildDir" "${flagsArray[@]}"
+    cd "$mesonBuildDir" || { echoCmd 'mesonConfigurePhase' "could not cd to $mesonBuildDir"; exit 1; }

    if ! [[ -v enableParallelBuilding ]]; then
        enableParallelBuilding=1
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@ -6,7 +6,6 @@
  cmake,
  gettext,
  msgpack-c,
-  darwin,
  libuv,
  lua,
  pkg-config,
@ -145,7 +144,6 @@ stdenv.mkDerivation (
        tree-sitter
        unibilium
      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.libutil ]
      ++ lib.optionals finalAttrs.finalPackage.doCheck [
        glibcLocales
        procps
@ -185,16 +183,12 @@ stdenv.mkDerivation (
      ];

    # nvim --version output retains compilation flags and references to build tools
-    postPatch =
-      ''
-        substituteInPlace src/nvim/version.c --replace NVIM_VERSION_CFLAGS "";
-      ''
-      + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-        sed -i runtime/CMakeLists.txt \
-          -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-        sed -i src/nvim/po/CMakeLists.txt \
-          -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-      '';
+    postPatch = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      sed -i runtime/CMakeLists.txt \
+        -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+      sed -i src/nvim/po/CMakeLists.txt \
+        -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+    '';
    postInstall = ''
      find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
    '';
@ -228,10 +222,7 @@ stdenv.mkDerivation (
      ];

    preConfigure =
-      lib.optionalString stdenv.hostPlatform.isDarwin ''
-        substituteInPlace src/nvim/CMakeLists.txt --replace "    util" ""
      ''
-      + ''
        mkdir -p $out/lib/nvim/parser
      ''
      + lib.concatStrings (
--- a/pkgs/by-name/ni/nixpkgs-openjdk-updater/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-openjdk-updater/package.nix
@ -43,11 +43,17 @@ python3Packages.buildPythonApplication {
      featureVersionPrefix,
    }:
    let
-      # TODO: Tighten up after update scripts are run.
-      src = fetchFromGitHub (lib.importJSON sourceFile);
+      sourceInfo = lib.importJSON sourceFile;
    in
    {
-      inherit src;
+      src = fetchFromGitHub {
+        inherit (sourceInfo)
+          owner
+          repo
+          rev
+          hash
+          ;
+      };

      updateScript = {
        command = [
@ -57,10 +63,10 @@ python3Packages.buildPythonApplication {
          sourceFile

          "--owner"
-          src.owner
+          sourceInfo.owner

          "--repo"
-          src.repo
+          sourceInfo.repo

          "--feature-version-prefix"
          featureVersionPrefix
--- a/pkgs/by-name/op/openjfx/17/deps.json
+++ b/pkgs/by-name/op/openjfx/17/deps.json
@ -7,8 +7,8 @@
  }
 },
 "https://github.com": {
-  "unicode-org/icu/releases/download/release-71-1/icu4c-71_1-data-bin-l": {
-   "zip": "sha256-pVWIy0BkICsthA5mxhR9SJQHleMNnaEcGl/AaLi5qZM="
+  "unicode-org/icu/releases/download/release-73-1/icu4c-73_1-data-bin-l": {
+   "zip": "sha256-QDgpjuAqDDiRcYXvj/Tr3pyLVSx3f9A+TfbGtLGCXiA="
  }
 },
 "https://repo.maven.apache.org/maven2": {
--- a/pkgs/by-name/op/openjfx/17/source.json
+++ b/pkgs/by-name/op/openjfx/17/source.json
@ -1,6 +1,6 @@
 {
+  "hash": "sha256-WV8NHlYlt7buGbirLSorLnS2TnyBD17zUquFfwSL3xE=",
  "owner": "openjdk",
  "repo": "jfx17u",
-  "rev": "17.0.11-ga",
-  "sha256": "sha256-9VfXk2EfMebMyVKPohPRP2QXRFf8XemUtfY0JtBCHyw="
+  "rev": "refs/tags/17.0.11+3"
 }
--- a/pkgs/by-name/op/openjfx/21/source.json
+++ b/pkgs/by-name/op/openjfx/21/source.json
@ -2,5 +2,5 @@
  "hash": "sha256-7z0GIbkQwG9mXY9dssaicqaKpMo3FkNEpyAvkswoQQ4=",
  "owner": "openjdk",
  "repo": "jfx21u",
-  "rev": "21.0.3-ga"
+  "rev": "refs/tags/21.0.3+2"
 }
--- a/pkgs/by-name/op/openjfx/23/source.json
+++ b/pkgs/by-name/op/openjfx/23/source.json
@ -1,6 +1,6 @@
 {
-  "hash": "sha256-a/ev91Rq7D3z9O56ZZQCgvvbfj5GBt5Lonow2NH3s/E=",
+  "hash": "sha256-H3BPLo7yKWBiiI8sd3wkLJDN9h6jbWj5119cs2YHLwU=",
  "owner": "openjdk",
  "repo": "jfx23u",
-  "rev": "23-ga"
+  "rev": "refs/tags/23.0.1+4"
 }
--- a/pkgs/by-name/op/openjfx/package.nix
+++ b/pkgs/by-name/op/openjfx/package.nix
@ -69,17 +69,8 @@ stdenv.mkDerivation {

  inherit (source) src;

-  patches =
-    if featureVersion == "23" then
-      [
-        # 8338701: Provide media support for libavcodec version 61
-        # <https://github.com/openjdk/jfx23u/pull/18>
-        (fetchpatch2 {
-          url = "https://github.com/openjdk/jfx23u/commit/aba60fda1c82f00e8e685107592305c403a31287.patch?full_index=1";
-          hash = "sha256-+aRhTwi4VQthAq1SH1jxPl0mTosNMKoTY52jm+jiKso=";
-        })
-      ]
-    else if atLeast21 then
+  patches = lib.optionals (!atLeast23) (
+    if atLeast21 then
      [
        ./21/patches/backport-ffmpeg-7-support-jfx21.patch
      ]
@ -87,7 +78,8 @@ stdenv.mkDerivation {
      [
        ./17/patches/backport-ffmpeg-6-support-jfx11.patch
        ./17/patches/backport-ffmpeg-7-support-jfx11.patch
-      ];
+      ]
+  );

  nativeBuildInputs = [
    gradle_openjfx
@ -139,11 +131,6 @@ stdenv.mkDerivation {
        -i modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/Heap.cpp \
           modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/IsoSharedPageInlines.h

-    ''
-    + lib.optionalString (!atLeast21) ''
-      substituteInPlace modules/javafx.web/src/main/native/Source/JavaScriptCore/offlineasm/parser.rb \
-        --replace-fail "File.exists?" "File.exist?"
-
    ''
    + ''
      ln -s $config gradle.properties
--- a/pkgs/development/libraries/serd/default.nix
+++ b/pkgs/development/libraries/serd/default.nix
@ -1,25 +1,32 @@
-{ lib
-, stdenv
-, fetchurl
-, doxygen
-, mandoc
-, meson
-, ninja
-, pkg-config
-, python3
-, sphinx
-, writeScript
+{
+  lib,
+  stdenv,
+  fetchurl,
+  doxygen,
+  mandoc,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  sphinx,
+  sphinxygen,
+  writeScript,
 }:

 stdenv.mkDerivation rec {
  pname = "serd";
-  version = "0.30.16";
+  version = "0.32.2";

-  outputs = [ "out" "dev" "doc" "man" ];
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "man"
+  ];

  src = fetchurl {
    url = "https://download.drobilla.net/${pname}-${version}.tar.xz";
-    hash = "sha256-9Q9IbaUZzdjQOyDJ5CQU5FkTP1okRBHY5jyu+NmskUY=";
+    hash = "sha256-333CyW8rod7P11bkWOBh3tfYFY0lVVTnaTSDrAljxWs=";
  };

  nativeBuildInputs = [
@ -30,6 +37,7 @@ stdenv.mkDerivation rec {
    pkg-config
    python3
    sphinx
+    sphinxygen
  ];

  postPatch = ''
@ -51,12 +59,12 @@ stdenv.mkDerivation rec {
    '';
  };

-  meta = with lib; {
+  meta = {
    description = "Lightweight C library for RDF syntax which supports reading and writing Turtle and NTriples";
    homepage = "https://drobilla.net/software/serd";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ samueltardieu ];
    mainProgram = "serdi";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/by-name/ti/tinysparql/package.nix
+++ b/pkgs/by-name/ti/tinysparql/package.nix
@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch2
 , fetchurl
 , gettext
 , meson
@ -106,13 +107,15 @@ stdenv.mkDerivation (finalAttrs: {
    "-Dsystemd_user_services=false"
  ];

-  doCheck =
-    # https://gitlab.gnome.org/GNOME/tinysparql/-/issues/402
-    !stdenv.hostPlatform.isDarwin
-    # https://gitlab.gnome.org/GNOME/tinysparql/-/issues/398
-    && !stdenv.hostPlatform.is32bit
-    # https://gitlab.gnome.org/GNOME/tinysparql/-/issues/474
-    && !stdenv.hostPlatform.isMusl;
+  patches = [
+    # https://gitlab.gnome.org/GNOME/tinysparql/-/merge_requests/730
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/tinysparql/commit/12ed969913cb579f638fa0aa0853aeb6c6c6f536.patch";
+      hash = "sha256-jyx9hdWUUxfCSTGn7lZL4RUiQAF4pkf4gfCP8g9Ep3U=";
+    })
+  ];
+
+  doCheck = true;

  postPatch = ''
    chmod +x \
--- a/pkgs/by-name/ti/tinyxxd/package.nix
+++ b/pkgs/by-name/ti/tinyxxd/package.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tinyxxd";
-  version = "1.3.5";
+  version = "1.3.7";

  src = fetchFromGitHub {
    repo = "tinyxxd";
    owner = "xyproto";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-W7BrQga98ACrhTHF3UlGQMRmcdJaxgorDP6FpD5mr2A=";
+    hash = "sha256-Yj9n/reWAjKY1spXiW/fjPGTgj1Yc18FzFln6f5LK9c=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/vv/vvenc/package.nix
+++ b/pkgs/by-name/vv/vvenc/package.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  gitUpdater,
+  testers,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vvenc";
+  version = "1.12.0";
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "fraunhoferhhi";
+    repo = "vvenc";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-C7ApayhubunkXBqJ/EqntaFPn6zk8rZ9fUqg7kbhvAk=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "VVENC_INSTALL_FULLFEATURE_APP" true)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+  ];
+
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    homepage = "https://github.com/fraunhoferhhi/vvenc";
+    description = "Fraunhofer Versatile Video Encoder";
+    license = lib.licenses.bsd3Clear;
+    mainProgram = "vvencapp";
+    pkgConfigModules = [ "libvvenc" ];
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/wa/waf/package.nix
+++ b/pkgs/by-name/wa/waf/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "waf";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitLab {
    owner = "ita1024";
    repo = "waf";
    rev = "waf-${finalAttrs.version}";
-    hash = "sha256-/7V+GA3YBhdaJkDlZ1k4IUYkgh0yuTG09G+frnnMoIw=";
+    hash = "sha256-7ujlE0brLFmET7tAy0/RTdDORUyr6keZ3OjvxBOC/BI=";
  };

  nativeBuildInputs = [
@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    homepage = "https://waf.io";
    description = "Meta build system";
-    changelog  = "https://gitlab.com/ita1024/waf/blob/${finalAttrs.version}/ChangeLog";
+    changelog  = "https://gitlab.com/ita1024/waf/blob/waf-${finalAttrs.version}/ChangeLog";
    license = lib.licenses.bsd3;
    mainProgram = "waf";
    maintainers = with lib.maintainers; [ AndersonTorres ];
--- a/pkgs/by-name/xc/xcbuild/package.nix
+++ b/pkgs/by-name/xc/xcbuild/package.nix
@ -80,8 +80,10 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    # Add missing header for `abort`
    ./patches/includes.patch
-    # Prevent xcrun from recursively invoking itself
-    ./patches/Avoid-fork-bomb-when-searching-system-paths.patch
+    # Prevent xcrun from recursively invoking itself but still find native toolchain binaries
+    ./patches/Use-system-toolchain-for-usr-bin.patch
+    # Suppress warnings due to newer SDKs with unknown keys
+    ./patches/Suppress-unknown-key-warnings.patch
  ];

  prePatch = ''
--- a/pkgs/by-name/xc/xcbuild/patches/Avoid-fork-bomb-when-searching-system-paths.patch
+++ b/pkgs/by-name/xc/xcbuild/patches/Avoid-fork-bomb-when-searching-system-paths.patch
@ -1,47 +0,0 @@
-diff --git a/Libraries/xcsdk/Tools/xcrun.cpp b/Libraries/xcsdk/Tools/xcrun.cpp
-index 9d6d4576d7..7400267c2b 100644
--- a/Libraries/xcsdk/Tools/xcrun.cpp
-+++ b/Libraries/xcsdk/Tools/xcrun.cpp
-@@ -23,6 +23,8 @@
- #include <process/DefaultUser.h>
- #include <pbxsetting/Type.h>
- 
-+#include <algorithm>
-+
- using libutil::DefaultFilesystem;
- using libutil::Filesystem;
- using libutil::FSUtil;
-@@ -398,6 +400,8 @@
-             fprintf(stderr, "\n");
-         }
- 
-+        std::unordered_map<std::string, std::string> environment = processContext->environmentVariables();
-+
-         /*
-          * Collect search paths for the tool.
-          * Can be in toolchains, target (if one is provided), developer root,
-@@ -408,6 +412,15 @@
-         executablePaths.insert(executablePaths.end(), defaultExecutablePaths.begin(), defaultExecutablePaths.end());
- 
-         /*
-+         * Don’t look for tools in `/usr/bin` because it can cause an infinite recursion when `xcrun` finds a shim
-+         * that tries to invoke `xcrun` to run the tool.
-+         */
-+        executablePaths.erase(
-+            std::remove(executablePaths.begin(), executablePaths.end(), "/usr/bin"),
-+            executablePaths.end()
-+        );
-+
-+        /*
-          * Find the tool to execute.
-          */
-         ext::optional<std::string> executable = filesystem->findExecutable(*options.tool(), executablePaths);
-@@ -428,8 +441,6 @@
-         } else {
-             /* Run is the default. */
- 
-            std::unordered_map<std::string, std::string> environment = processContext->environmentVariables();
-
-             if (target != nullptr) {
-                 /*
-                  * Update effective environment to include the target path.
--- a/pkgs/by-name/xc/xcbuild/patches/Suppress-unknown-key-warnings.patch
+++ b/pkgs/by-name/xc/xcbuild/patches/Suppress-unknown-key-warnings.patch
@ -0,0 +1,26 @@
+diff --git a/Libraries/xcsdk/Sources/SDK/Product.cpp b/Libraries/xcsdk/Sources/SDK/Product.cpp
+index f291d475c7..bc339f567c 100644
+--- a/Libraries/xcsdk/Sources/SDK/Product.cpp
+++ b/Libraries/xcsdk/Sources/SDK/Product.cpp
+@@ -33,7 +33,7 @@
+     auto PBV  = unpack.cast <plist::String> ("ProductBuildVersion");
+     auto PC   = unpack.cast <plist::String> ("ProductCopyright");
+ 
+-    if (!unpack.complete(true)) {
+    if (!unpack.complete(false)) {
+         fprintf(stderr, "%s", unpack.errorText().c_str());
+     }
+ 
+diff --git a/Libraries/xcsdk/Sources/SDK/Target.cpp b/Libraries/xcsdk/Sources/SDK/Target.cpp
+index 523c1e4cbd..2197b1d6d1 100644
+--- a/Libraries/xcsdk/Sources/SDK/Target.cpp
+++ b/Libraries/xcsdk/Sources/SDK/Target.cpp
+@@ -86,7 +86,7 @@
+     /* Ignored: seems to be a typo. */
+     (void)unpack.cast <plist::String> ("isBaseSDK");
+ 
+-    if (!unpack.complete(true)) {
+    if (!unpack.complete(false)) {
+         fprintf(stderr, "%s", unpack.errorText().c_str());
+     }
+ 
--- a/pkgs/by-name/xc/xcbuild/patches/Use-system-toolchain-for-usr-bin.patch
+++ b/pkgs/by-name/xc/xcbuild/patches/Use-system-toolchain-for-usr-bin.patch
@ -0,0 +1,80 @@
+diff --git a/Libraries/xcsdk/Tools/xcrun.cpp b/Libraries/xcsdk/Tools/xcrun.cpp
+index 9d6d4576d7..73aabc3d42 100644
+--- a/Libraries/xcsdk/Tools/xcrun.cpp
+++ b/Libraries/xcsdk/Tools/xcrun.cpp
+@@ -23,10 +23,14 @@
+ #include <process/DefaultUser.h>
+ #include <pbxsetting/Type.h>
+ 
+#include <algorithm>
+
+ using libutil::DefaultFilesystem;
+ using libutil::Filesystem;
+ using libutil::FSUtil;
+ 
+#define SYSTEM_DEVELOPER_DIR "/private/var/select/developer_dir"
+
+ class Options {
+ private:
+     ext::optional<bool>        _help;
+@@ -398,6 +402,8 @@
+             fprintf(stderr, "\n");
+         }
+ 
+        std::unordered_map<std::string, std::string> environment = processContext->environmentVariables();
+
+         /*
+          * Collect search paths for the tool.
+          * Can be in toolchains, target (if one is provided), developer root,
+@@ -408,10 +414,42 @@
+         executablePaths.insert(executablePaths.end(), defaultExecutablePaths.begin(), defaultExecutablePaths.end());
+ 
+         /*
+         * Remove `/usr/bin` from the search paths to avoid infinite recursions from stubs that try to invoke `xcrun`.
+         */
+        const auto originalSize = executablePaths.size();
+        auto result = executablePaths.erase(
+            std::remove(executablePaths.begin(), executablePaths.end(), "/usr/bin"),
+            executablePaths.end()
+        );
+
+        /*
+          * Find the tool to execute.
+          */
+         ext::optional<std::string> executable = filesystem->findExecutable(*options.tool(), executablePaths);
+         if (!executable) {
+            /*
+             * However, check for the system developer dir and look there if the binaries can’t be found in the store.
+             * This is done only if a binary is not found in the store to ensure those always take priority.
+             * Fixes https://github.com/NixOS/nixpkgs/issues/353875.
+             */
+            std::vector<std::string> toolchainPaths = { };
+            if (executablePaths.size() < originalSize && filesystem->exists(SYSTEM_DEVELOPER_DIR)) {
+                auto linkTarget = filesystem->readSymbolicLinkCanonical(SYSTEM_DEVELOPER_DIR);
+                if (linkTarget) {
+                    auto usrBinPath = FSUtil::NormalizePath(*linkTarget + "/usr/bin");
+                    if (filesystem->exists(usrBinPath)) {
+                        toolchainPaths.push_back(usrBinPath);
+                    }
+                    auto toolchainUsrBinPath = FSUtil::NormalizePath(*linkTarget + "/Toolchains/XcodeDefault.xctoolchain/usr/bin");
+                    if (filesystem->exists(toolchainUsrBinPath)) {
+                        toolchainPaths.push_back(toolchainUsrBinPath);
+                    }
+                }
+            }
+            executable = filesystem->findExecutable(*options.tool(), toolchainPaths);
+        }
+
+        if (!executable) {
+             fprintf(stderr, "error: tool '%s' not found\n", options.tool()->c_str());
+             return 1;
+         }
+@@ -428,8 +466,6 @@
+         } else {
+             /* Run is the default. */
+ 
+-            std::unordered_map<std::string, std::string> environment = processContext->environmentVariables();
+-
+             if (target != nullptr) {
+                 /*
+                  * Update effective environment to include the target path.
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -200,9 +200,6 @@ rustPlatform.buildRustPackage rec {
    ZED_UPDATE_EXPLANATION = "Zed has been installed using Nix. Auto-updates have thus been disabled.";
    # Used by `zed --version`
    RELEASE_VERSION = version;
-    # Required until `-isysroot` can be used with libclang in nixpkgs on darwin, otherwise
-    # rust bindgen will not work as expected
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-F${apple-sdk_15.sdkroot}/System/Library/Frameworks";
  };

  RUSTFLAGS = if withGLES then "--cfg gles" else "";
--- a/pkgs/data/misc/publicsuffix-list/default.nix
+++ b/pkgs/data/misc/publicsuffix-list/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation {
  pname = "publicsuffix-list";
-  version = "0-unstable-2024-09-10";
+  version = "0-unstable-2024-10-25";

  src = fetchFromGitHub {
    owner = "publicsuffix";
    repo = "list";
-    rev = "fbcc4c495e8aed1fe0e90156e6b3796556eb6978";
-    hash = "sha256-L6TepLI91IWImX453GO8VNSSle75f0H1IZbFr2qepDA=";
+    rev = "435e07efb28973ea116592dc2291b1f8c27080aa";
+    hash = "sha256-nLuZVgPHNnxOT3GcGz6TEbHkiNgVU5f2uWcgCfr7tZ8=";
  };

  dontBuild = true;
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch2
 , fetchzip
 , meson
 , ninja
@ -22,6 +23,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-Zl2bOGDJIe/bhMFNsy969JYCYqtXTOzgb+bbOlKqOco=";
  };

+  patches = [
+    (fetchpatch2 {
+      # https://github.com/dgibson/dtc/pull/141
+      url = "https://github.com/dgibson/dtc/commit/56a7d0cb3be5f2f7604bc42299e24d13a39c72d8.patch";
+      hash = "sha256-GmAyk/K2OolH/Z8SsgwCcq3/GOlFuSpnVPr7jsy8Cs0=";
+    })
+  ];
+
  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;

  nativeBuildInputs = [
--- a/pkgs/development/compilers/flutter/wrapper.nix
+++ b/pkgs/development/compilers/flutter/wrapper.nix
@ -146,7 +146,8 @@ in
      '' + lib.optionalString (flutter ? engine && flutter.engine.meta.available) ''
        --set-default FLUTTER_ENGINE "${flutter.engine}" \
        --add-flags "--local-engine-host ${flutter.engine.outName}" \
-      '' + '' --suffix PATH : '${lib.makeBinPath (tools ++ buildTools)}' \
+      '' + ''
+      --suffix PATH : '${lib.makeBinPath (tools ++ buildTools)}' \
      --suffix PKG_CONFIG_PATH : "$FLUTTER_PKG_CONFIG_PATH" \
      --suffix LIBRARY_PATH : '${lib.makeLibraryPath appStaticBuildDeps}' \
      --prefix CXXFLAGS "''\t" '${builtins.concatStringsSep " " (includeFlags ++ extraCxxFlags)}' \
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@ -226,7 +226,8 @@ pipe ((callFile ./common/builder.nix {}) ({
        libc = if libcCross != null then libcCross else stdenv.cc.libc;
      in
        (
-        '' echo "fixing the {GLIBC,UCLIBC,MUSL}_DYNAMIC_LINKER macros..."
+        ''
+           echo "fixing the {GLIBC,UCLIBC,MUSL}_DYNAMIC_LINKER macros..."
           for header in "gcc/config/"*-gnu.h "gcc/config/"*"/"*.h
           do
             grep -q _DYNAMIC_LINKER "$header" || continue
--- a/pkgs/development/compilers/go/1.23.nix
+++ b/pkgs/development/compilers/go/1.23.nix
@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.23.2";
+  version = "1.23.3";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-NpMBYqk99BfZC9IsbhTa/0cFuqwrAkGO3aZxzfqc0H8=";
+    hash = "sha256-jWp3MySHVXxq+iQhExtQ+D20rjxXnDvHLmcO4faWhZk=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@ -79,13 +79,17 @@ let
      # Make sure clang passes the correct location of libLTO to ld64
      substituteInPlace lib/Driver/ToolChains/Darwin.cpp \
        --replace-fail 'StringRef P = llvm::sys::path::parent_path(D.Dir);' 'StringRef P = "${lib.getLib libllvm}";'
-    '' + (if lib.versionOlder release_version "13" then ''
-      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
-             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
-             lib/Driver/ToolChains/*.cpp
-    '' else ''
-      (cd tools && ln -s ../../clang-tools-extra extra)
-    '') + lib.optionalString stdenv.hostPlatform.isMusl ''
+    '' + (
+      # See the comment on the `add-nostdlibinc-flag.patch` patch in
+      # `../default.nix` for why we skip Darwin here.
+      if lib.versionOlder release_version "13" && (!stdenv.hostPlatform.isDarwin || !stdenv.targetPlatform.isDarwin) then ''
+        sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+               -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+               lib/Driver/ToolChains/*.cpp
+      '' else ''
+        (cd tools && ln -s ../../clang-tools-extra extra)
+      ''
+    ) + lib.optionalString stdenv.hostPlatform.isMusl ''
      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
    '';

--- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
@ -188,6 +188,13 @@ stdenv.mkDerivation ({
    substituteInPlace ../libcxx/utils/merge_archives.py \
      --replace-fail "import distutils.spawn" "from shutil import which as find_executable" \
      --replace-fail "distutils.spawn." ""
+  '' + lib.optionalString (lib.versionAtLeast release_version "19")
+    # codesign in sigtool doesn't support the various options used by the build
+    # and is present in the bootstrap-tools. Removing find_program prevents the
+    # build from trying to use it and failing.
+    ''
+    substituteInPlace cmake/Modules/AddCompilerRT.cmake \
+      --replace-fail 'find_program(CODESIGN codesign)' ""
  '';

  # Hack around weird upsream RPATH bug
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@ -529,8 +529,24 @@ let
            # mis-compilation in firefox.
            # See: https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
            (metadata.getVersionFile "clang/revert-malloc-alignment-assumption.patch")
+          # This patch prevents global system header directories from
+          # leaking through on non‐NixOS Linux. However, on macOS, the
+          # SDK path is used as the sysroot, and forcing `-nostdlibinc`
+          # breaks `-isysroot` with an unwrapped compiler. As macOS has
+          # no `/usr/include`, there’s essentially no risk to skipping
+          # the patch there. It’s possible that Homebrew headers in
+          # `/usr/local/include` might leak through to unwrapped
+          # compilers being used without an SDK set or something, but
+          # it hopefully shouldn’t matter.
+          #
+          # TODO: Figure out a better solution to this whole problem so
+          # that we won’t have to choose between breaking unwrapped
+          # compilers breaking libclang when we can do Linux‐to‐Darwin
+          # cross‐compilation again.
+          ++ lib.optional (
+            !args.stdenv.hostPlatform.isDarwin || !args.stdenv.targetPlatform.isDarwin
+          ) ./clang/add-nostdlibinc-flag.patch
          ++ [
-            ./clang/add-nostdlibinc-flag.patch
            (substituteAll {
              src =
                if (lib.versionOlder metadata.release_version "16") then
@ -947,6 +963,10 @@ let
            url = "https://github.com/llvm/llvm-project/commit/abc2eae68290c453e1899a94eccc4ed5ea3b69c1.patch";
            hash = "sha256-oxCxOjhi5BhNBEraWalEwa1rS3Mx9CuQgRVZ2hrbd7M=";
          })
+          (fetchpatch {
+            url = "https://github.com/llvm/llvm-project/commit/5909979869edca359bcbca74042c2939d900680e.patch";
+            hash = "sha256-l4rQHYbblEADBXaZIdqTG0sZzH4fEQvYiqhLYNZDMa8=";
+          })
        ];
      };
    }
--- a/pkgs/development/compilers/llvm/common/libclc.nix
+++ b/pkgs/development/compilers/llvm/common/libclc.nix
@ -17,6 +17,14 @@ let
  spirv-llvm-translator = buildPackages.spirv-llvm-translator.override {
    inherit (buildLlvmTools) llvm;
  };
+
+  # The build requires an unwrapped clang but wrapped clang++ thus we need to
+  # split the unwrapped clang out to prevent the build from finding the
+  # unwrapped clang++
+  clang-only = runCommand "clang-only" { } ''
+    mkdir -p "$out"/bin
+    ln -s "${lib.getExe' buildLlvmTools.clang.cc "clang"}" "$out"/bin
+  '';
 in
 stdenv.mkDerivation rec {
  pname = "libclc";
@ -78,7 +86,7 @@ stdenv.mkDerivation rec {
      python3
    ]
    ++ lib.optional (lib.versionAtLeast release_version "19") [
-      buildLlvmTools.clang.cc
+      clang-only
      buildLlvmTools.llvm
      spirv-llvm-translator
    ];
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@ -28,7 +28,7 @@ let
    "16.0.6".officialRelease.sha256 = "sha256-fspqSReX+VD+Nl/Cfq+tDcdPtnQPV1IRopNDfd5VtUs=";
    "17.0.6".officialRelease.sha256 = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag=";
    "18.1.8".officialRelease.sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE=";
-    "19.1.1".officialRelease.sha256 = "sha256-xTo44+vH1Bz49fEl4bIpU3eIgQtFuBTGbgU7mzeY33s=";
+    "19.1.3".officialRelease.sha256 = "sha256-NUx01eJNsYMlk+8mtlf10isIqhK8zBmqaOTjuFqMNRQ=";
    "20.0.0-git".gitRelease = {
      rev = "0e8555d4dbfdfeddc01dc2ecf9a9b6e804f7b645";
      rev-version = "20.0.0-unstable-2024-10-07";
--- a/pkgs/development/compilers/openjdk/11/source.json
+++ b/pkgs/development/compilers/openjdk/11/source.json
@ -1,6 +1,6 @@
 {
-  "hash": "sha256-H/VmT6NYbbZBba7Js8xk+epVZ2kLfvlwTNgg5SQ4ljA=",
+  "hash": "sha256-HqFm4qESB5T4Y1FLgfHZxURi7l7NkLzx2w8GzmB1jSY=",
  "owner": "openjdk",
  "repo": "jdk11u",
-  "rev": "jdk-11.0.24+8"
+  "rev": "refs/tags/jdk-11.0.25+9"
 }
--- a/pkgs/development/compilers/openjdk/17/patches/fix-library-path-jdk17.patch
+++ b/pkgs/development/compilers/openjdk/17/patches/fix-library-path-jdk17.patch
@ -1,6 +1,8 @@
+diff --git a/src/hotspot/os/linux/os_linux.cpp b/src/hotspot/os/linux/os_linux.cpp
+index 7c951cee51..bcc61ff43d 100644
 --- a/src/hotspot/os/linux/os_linux.cpp
 +++ b/src/hotspot/os/linux/os_linux.cpp
-@@ -412,18 +412,8 @@ void os::init_system_properties_values() {
+@@ -416,18 +416,8 @@
   //        1: ...
   //        ...
   //        7: The default directories, normally /lib and /usr/lib.
@ -18,8 +20,8 @@
 -#define SYS_EXT_DIR     "/usr/java/packages"
 #define EXTENSIONS_DIR  "/lib/ext"
 
-   // Buffer that fits several sprintfs.
-@@ -431,7 +421,7 @@ void os::init_system_properties_values() {
+   // Buffer that fits several snprintfs.
+@@ -435,7 +425,7 @@
   // by the nulls included by the sizeof operator.
   const size_t bufsize =
     MAX2((size_t)MAXPATHLEN,  // For dll_dir & friends.
@ -28,28 +30,26 @@
   char *buf = NEW_C_HEAP_ARRAY(char, bufsize, mtInternal);
 
   // sysclasspath, java_home, dll_dir
-@@ -478,26 +468,22 @@ void os::init_system_properties_values() {
+@@ -482,24 +472,20 @@
     // should always exist (until the legacy problem cited above is
     // addressed).
     const char *v = ::getenv("LD_LIBRARY_PATH");
 -    const char *v_colon = ":";
 -    if (v == NULL) { v = ""; v_colon = ""; }
+-    // That's +1 for the colon and +1 for the trailing '\0'.
+-    size_t pathsize = strlen(v) + 1 + sizeof(SYS_EXT_DIR) + sizeof("/lib/") + sizeof(DEFAULT_LIBPATH) + 1;
 +    if (v == NULL) { v = ""; }
-     // That's +1 for the colon and +1 for the trailing '\0'.
-     char *ld_library_path = NEW_C_HEAP_ARRAY(char,
-                                             strlen(v) + 1 +
-                                             sizeof(SYS_EXT_DIR) + sizeof("/lib/") + sizeof(DEFAULT_LIBPATH) + 1,
-+                                             strlen(v) + 1,
-                                              mtInternal);
-    sprintf(ld_library_path, "%s%s" SYS_EXT_DIR "/lib:" DEFAULT_LIBPATH, v, v_colon);
-+    sprintf(ld_library_path, "%s", v);
+    size_t pathsize = strlen(v) + 1;
+     char *ld_library_path = NEW_C_HEAP_ARRAY(char, pathsize, mtInternal);
+-    os::snprintf_checked(ld_library_path, pathsize, "%s%s" SYS_EXT_DIR "/lib:" DEFAULT_LIBPATH, v, v_colon);
+    os::snprintf_checked(ld_library_path, pathsize, "%s", v);
     Arguments::set_library_path(ld_library_path);
     FREE_C_HEAP_ARRAY(char, ld_library_path);
   }
 
   // Extensions directories.
-  sprintf(buf, "%s" EXTENSIONS_DIR ":" SYS_EXT_DIR EXTENSIONS_DIR, Arguments::get_java_home());
-+  sprintf(buf, "%s" EXTENSIONS_DIR, Arguments::get_java_home());
+-  os::snprintf_checked(buf, bufsize, "%s" EXTENSIONS_DIR ":" SYS_EXT_DIR EXTENSIONS_DIR, Arguments::get_java_home());
+  os::snprintf_checked(buf, bufsize, "%s" EXTENSIONS_DIR, Arguments::get_java_home());
   Arguments::set_ext_dirs(buf);
 
   FREE_C_HEAP_ARRAY(char, buf);
@ -57,4 +57,5 @@
 -#undef DEFAULT_LIBPATH
 -#undef SYS_EXT_DIR
 #undef EXTENSIONS_DIR
- }
+ }
+ 
--- a/pkgs/development/compilers/openjdk/17/source.json
+++ b/pkgs/development/compilers/openjdk/17/source.json
@ -1,6 +1,6 @@
 {
-  "hash": "sha256-9UB1H3gd+b4wWxOMgsdDPgX/IGWNORKk1gMsSjYoZMw=",
+  "hash": "sha256-wHJlCmaE8titkfcWb2WboqemekPBn3JWc4bGyWskmoY=",
  "owner": "openjdk",
  "repo": "jdk17u",
-  "rev": "jdk-17.0.12+7"
+  "rev": "refs/tags/jdk-17.0.13+11"
 }
--- a/pkgs/development/compilers/openjdk/21/source.json
+++ b/pkgs/development/compilers/openjdk/21/source.json
@ -1,6 +1,6 @@
 {
-  "hash": "sha256-+xpQtQ1IQ7btVWnENT9XS5A/2VP101/+XR3BMo8BqYI=",
+  "hash": "sha256-H28Hp1SzANkrgnC6xdkiSEcRK6bm8BcT/lbJDEUvRYY=",
  "owner": "openjdk",
  "repo": "jdk21u",
-  "rev": "jdk-21.0.4+7"
+  "rev": "refs/tags/jdk-21.0.5+11"
 }
--- a/pkgs/development/compilers/openjdk/23/source.json
+++ b/pkgs/development/compilers/openjdk/23/source.json
@ -1,6 +1,6 @@
 {
-  "hash": "sha256-lcLnWAiskWindOqWmOWiIHiYKXGSJZK4d20k19QZfrE=",
+  "hash": "sha256-Sl0aEtndzlyuwMtcjOeDe2CVls89ONzicP5IXhAU2FA=",
  "owner": "openjdk",
  "repo": "jdk23u",
-  "rev": "jdk-23-ga"
+  "rev": "refs/tags/jdk-23.0.1+11"
 }
--- a/pkgs/development/compilers/openjdk/8/source.json
+++ b/pkgs/development/compilers/openjdk/8/source.json
@ -1,6 +1,6 @@
 {
-  "hash": "sha256-uMo1DIkji+FPTbFRwURXybkLE5xv+teSClWP9RfAvfo=",
+  "hash": "sha256-48DyJXD7D28LFa+4ONeMgSddqrCLn6FLwEGWGeP4upM=",
  "owner": "openjdk",
  "repo": "jdk8u",
-  "rev": "jdk8u422-ga"
+  "rev": "refs/tags/jdk8u432-b06"
 }
--- a/pkgs/development/compilers/openjdk/generic.nix
+++ b/pkgs/development/compilers/openjdk/generic.nix
@ -99,12 +99,8 @@ let
  atLeast23 = lib.versionAtLeast featureVersion "23";

  tagPrefix = if atLeast11 then "jdk-" else "jdk";
-  # TODO: Merge these `lib.removePrefix` calls once update scripts have
-  # been run.
-  version = lib.removePrefix tagPrefix (lib.removePrefix "refs/tags/" source.src.rev);
-  versionSplit =
-    # TODO: Remove `-ga` logic once update scripts have been run.
-    builtins.match (if atLeast11 then "(.+)[-+](.+)" else "(.+)-b?(.+)") version;
+  version = lib.removePrefix "refs/tags/${tagPrefix}" source.src.rev;
+  versionSplit = builtins.match (if atLeast11 then "(.+)+(.+)" else "(.+)-b(.+)") version;
  versionBuild = lib.elemAt versionSplit 1;

  # The JRE 8 libraries are in directories that depend on the CPU.
@ -221,15 +217,6 @@ stdenv.mkDerivation (finalAttrs: {
        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
      })
    ]
-    ++ lib.optionals (featureVersion == "17") [
-      # Backport fixes for musl 1.2.4 which are already applied in jdk21+
-      # Fetching patch from chimera because they already went through the effort of rebasing it onto jdk17
-      (fetchurl {
-        name = "lfs64.patch";
-        url = "https://raw.githubusercontent.com/chimera-linux/cports/4614075d19e9c9636f3f7e476687247f63330a35/contrib/openjdk17/patches/lfs64.patch";
-        hash = "sha256-t2mRbdEiumBAbIAC0zsJNwCn59WYWHsnRtuOSL6bWB4=";
-      })
-    ]
    ++ lib.optionals (!headless && enableGtk) [
      (
        if atLeast17 then
--- a/pkgs/development/compilers/rust/1_82.nix
+++ b/pkgs/development/compilers/rust/1_82.nix
@ -104,25 +104,26 @@ import ./default.nix
      else
        llvmPackages_18;

-    # Note: the version MUST be one version prior to the version we're
-    # building
-    bootstrapVersion = "1.81.0";
+    # Note: the version MUST be the same version that we are building. Upstream
+    # ensures that each released compiler can compile itself:
+    # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
+    bootstrapVersion = "1.82.0";

    # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
    bootstrapHashes = {
-      i686-unknown-linux-gnu = "0ab6ff2da7218220a2fb6e9538f5582c5d27448e91ff6ea2e296b2aee2b5e2d9";
-      x86_64-unknown-linux-gnu = "4ca7c24e573dae2f382d8d266babfddc307155e1a0a4025f3bc11db58a6cab3e";
-      x86_64-unknown-linux-musl = "2a0829c842425ab316a63adb0d604421be1c4df332388ac26d63aef47e857c12";
-      arm-unknown-linux-gnueabihf = "0da7b4a3b760fa514ba5e1a731fd212f1d082468f118f19e852136a30d2c0253";
-      armv7-unknown-linux-gnueabihf = "5a8d799a09cc605ea3a88dc43bd348bd6335847a0b71ba8e73b40968a0a7bf6f";
-      aarch64-unknown-linux-gnu = "ef4da9c1ecd56bbbb36f42793524cce3062e6a823ae22cb679a945c075c7755b";
-      aarch64-unknown-linux-musl = "fab9a1a69e61326399becab2571381b079ee42f2b648d862b0c3df05004dc864";
-      x86_64-apple-darwin = "f74d8ad24cc3cbfb825da98a08d98319565e4d18ec2c3e9503bf0a33c81ba767";
-      aarch64-apple-darwin = "60a41dea4ae0f4006325745a6400e6fdc3e08ad3f924fac06f04c238cf23f4ec";
-      powerpc64le-unknown-linux-gnu = "bf98b27de08a2fd5a2202a2b621b02bfde2a6fde397df2a735d018aeffcdc5e2";
-      riscv64gc-unknown-linux-gnu = "664e7a50c03848afc86d579a9cbf82cd0b2291a97776f7f81cee9bbf9fc1f648";
-      s390x-unknown-linux-gnu = "e0450ff125cadd3813c7888f5ca42f78e68df13c212b12d5eac3325062632723";
-      x86_64-unknown-freebsd = "b96ebbc043058eedebccd20f1d01e64f2241107665fe2336e6927966d8b9d8d3";
+      i686-unknown-linux-gnu = "77b261fb3d9efa7fe39e87c024987495e03b647b6cb23a66b8e69aeb12a8be61";
+      x86_64-unknown-linux-gnu = "0265c08ae997c4de965048a244605fb1f24a600bbe35047b811c638b8fcf676b";
+      x86_64-unknown-linux-musl = "9dd781c64f71c1d3f854b0937eb751f19e8ebac1110e68e08b94223ad9b022ba";
+      arm-unknown-linux-gnueabihf = "d6a2857d0ab8880c3bc691607b10b68fb2750eae35144e035a9a5eeef820b740";
+      armv7-unknown-linux-gnueabihf = "eff9939c4b98c6ad91a759fa1a2ebdd81b4d05e47ac523218bf9d7093226589b";
+      aarch64-unknown-linux-gnu = "d7db04fce65b5f73282941f3f1df5893be9810af17eb7c65b2e614461fe31a48";
+      aarch64-unknown-linux-musl = "f061eabf0324805637c1e89e7d936365f705be1359699efbda59b637dbe9715f";
+      x86_64-apple-darwin = "b1a289cabc523f259f65116a41374ac159d72fbbf6c373bd5e545c8e835ceb6a";
+      aarch64-apple-darwin = "49b6d36b308addcfd21ae56c94957688338ba7b8985bff57fc626c8e1b32f62c";
+      powerpc64le-unknown-linux-gnu = "44f3a1e70be33f91927ae8d89a11843a79b8b6124d62a9ddd9030a5275ebc923";
+      riscv64gc-unknown-linux-gnu = "a72e8aa3fff374061ff90ada317a8d170c2a15eb079ddc828c97189179d3eebd";
+      s390x-unknown-linux-gnu = "63760886a9b2de6cb38f75a236db358939d904e205e1e2bc9d96cec69e00ae83";
+      x86_64-unknown-freebsd = "f7b51943dbed0af3387e3269c1767fee916fb22b8e7897b3594bf5e422403137";
    };

    selectRustPackage = pkgs: pkgs.rust_1_82;
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -523,7 +523,7 @@ self: super: builtins.intersectAttrs super {
      "--extra-include-dirs=${pkgs.cwiid}/include"
      "--extra-include-dirs=${pkgs.bluez.dev}/include"
    ];
-    prePatch = '' sed -i -e "/Extra-Lib-Dirs/d" -e "/Include-Dirs/d" "hcwiid.cabal" '';
+    prePatch = ''sed -i -e "/Extra-Lib-Dirs/d" -e "/Include-Dirs/d" "hcwiid.cabal"'';
  }) super.hcwiid;

  # cabal2nix doesn't pick up some of the dependencies.
--- a/pkgs/development/interpreters/chibi/default.nix
+++ b/pkgs/development/interpreters/chibi/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, darwin }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper }:

 stdenv.mkDerivation rec {
  version = "0.11";
@ -13,8 +13,6 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ makeWrapper ];

-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.libutil;
-
  installPhase = ''
    make install PREFIX="$out"
  '';
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -140,10 +140,6 @@ let
    ] ++ lib.optionals (x11Support && stdenv.hostPlatform.isDarwin) [
      ./use-correct-tcl-tk-on-darwin.patch

-    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # Fix darwin build https://bugs.python.org/issue34027
-      ../3.7/darwin-libutil.patch
-
    ] ++ lib.optionals stdenv.hostPlatform.isLinux [

      # Disable the use of ldconfig in ctypes.util.find_library (since
--- a/pkgs/development/interpreters/python/cpython/3.11/darwin-libutil.patch
+++ b/pkgs/development/interpreters/python/cpython/3.11/darwin-libutil.patch
@ -1,13 +0,0 @@
-diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c
-index 40229bce0f..3cc604930e 100644
--- a/Modules/posixmodule.c
-+++ b/Modules/posixmodule.c
-@@ -7258,7 +7258,7 @@ os_sched_getaffinity_impl(PyObject *module, pid_t pid)
- #ifdef HAVE_UTMP_H
- #include <utmp.h>
- #endif /* HAVE_UTMP_H */
-#elif defined(HAVE_LIBUTIL_H)
-+#elif defined(HAVE_LIBUTIL_H) && !defined(__APPLE__)
- #include <libutil.h>
- #elif defined(HAVE_UTIL_H)
- #include <util.h>
--- a/pkgs/development/interpreters/python/cpython/3.14/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.14/no-ldconfig.patch
@ -0,0 +1,40 @@
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index 117bf06cb01..ff50cb083bd 100644
+--- a/Lib/ctypes/util.py
+++ b/Lib/ctypes/util.py
+@@ -280,34 +280,7 @@ def find_library(name, is64 = False):
+     else:
+ 
+         def _findSoname_ldconfig(name):
+-            import struct
+-            if struct.calcsize('l') == 4:
+-                machine = os.uname().machine + '-32'
+-            else:
+-                machine = os.uname().machine + '-64'
+-            mach_map = {
+-                'x86_64-64': 'libc6,x86-64',
+-                'ppc64-64': 'libc6,64bit',
+-                'sparc64-64': 'libc6,64bit',
+-                's390x-64': 'libc6,64bit',
+-                'ia64-64': 'libc6,IA-64',
+-                }
+-            abi_type = mach_map.get(machine, 'libc6')
+-
+-            # XXX assuming GLIBC's ldconfig (with option -p)
+-            regex = r'\s+(lib%s\.[^\s]+)\s+\(%s'
+-            regex = os.fsencode(regex % (re.escape(name), abi_type))
+-            try:
+-                with subprocess.Popen(['/sbin/ldconfig', '-p'],
+-                                      stdin=subprocess.DEVNULL,
+-                                      stderr=subprocess.DEVNULL,
+-                                      stdout=subprocess.PIPE,
+-                                      env={'LC_ALL': 'C', 'LANG': 'C'}) as p:
+-                    res = re.search(regex, p.stdout.read())
+-                    if res:
+-                        return os.fsdecode(res.group(1))
+-            except OSError:
+-                pass
+            return None
+ 
+         def _findLib_ld(name):
+             # See issue #9998 for why this is needed
--- a/pkgs/development/interpreters/python/cpython/3.7/darwin-libutil.patch
+++ b/pkgs/development/interpreters/python/cpython/3.7/darwin-libutil.patch
@ -1,23 +0,0 @@
-diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c
-index c3682b4..16826c6 100644
--- a/Modules/posixmodule.c
-+++ b/Modules/posixmodule.c
-@@ -5880,15 +5880,13 @@ error:
- #if defined(HAVE_OPENPTY) || defined(HAVE_FORKPTY) || defined(HAVE_DEV_PTMX)
- #ifdef HAVE_PTY_H
- #include <pty.h>
-#else
-+#endif
- #ifdef HAVE_LIBUTIL_H
- #include <libutil.h>
-#else
-+#endif
- #ifdef HAVE_UTIL_H
- #include <util.h>
-#endif /* HAVE_UTIL_H */
-#endif /* HAVE_LIBUTIL_H */
-#endif /* HAVE_PTY_H */
-+#endif
- #ifdef HAVE_STROPTS_H
- #include <stropts.h>
- #endif
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -271,11 +271,6 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
  ] ++ optionals mimetypesSupport [
    # Make the mimetypes module refer to the right file
    ./mimetypes.patch
-  ] ++ optionals (pythonAtLeast "3.7" && pythonOlder "3.11") [
-    # Fix darwin build https://bugs.python.org/issue34027
-    ./3.7/darwin-libutil.patch
-  ] ++ optionals (pythonAtLeast "3.11") [
-    ./3.11/darwin-libutil.patch
  ] ++ optionals (pythonAtLeast "3.9" && pythonOlder "3.11" && stdenv.hostPlatform.isDarwin) [
    # Stop checking for TCL/TK in global macOS locations
    ./3.9/darwin-tcl-tk.patch
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -93,6 +93,18 @@ in {
    hash = "sha256-CG3liC48sxDU3KSEV1IuLkgBjs1D2pzfgn9qB1nvsH0=";
    inherit passthruFun;
  };
+
+  python314 = callPackage ./cpython {
+    self = __splicedPackages.python314;
+    sourceVersion = {
+      major = "3";
+      minor = "14";
+      patch = "0";
+      suffix = "a1";
+    };
+    hash = "sha256-PkZLDLt1NeLbNCYv0ZoKOT0OYr4PQ7FRPtmDebBU6tQ=";
+    inherit passthruFun;
+  };
  # Minimal versions of Python (built without optional dependencies)
  python3Minimal = (callPackage ./cpython ({
    self = __splicedPackages.python3Minimal;
--- a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
@ -1,22 +1,27 @@
 # Setup hook to use for pip projects
-echo "Sourcing pip-build-hook"
+# shellcheck shell=bash

-declare -a pipBuildFlags
+echo "Sourcing pip-build-hook"

 pipBuildPhase() {
    echo "Executing pipBuildPhase"
    runHook preBuild

    mkdir -p dist
+
+    local -a flagsArray=(
+        --verbose
+        --no-index
+        --no-deps
+        --no-clean
+        --no-build-isolation
+        --wheel-dir dist
+    )
+    concatTo flagsArray pipBuildFlags
+
    echo "Creating a wheel..."
-    @pythonInterpreter@ -m pip wheel \
-        --verbose \
-        --no-index \
-        --no-deps \
-        --no-clean \
-        --no-build-isolation \
-        --wheel-dir dist \
-        $pipBuildFlags .
+    echoCmd 'pip build flags' "${flagsArray[@]}"
+    @pythonInterpreter@ -m pip wheel "${flagsArray[@]}" .
    echo "Finished creating a wheel..."

    runHook postBuild
--- a/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-install-hook.sh
@ -1,17 +1,27 @@
 # Setup hook for pip.
-echo "Sourcing pip-install-hook"
+# shellcheck shell=bash

-declare -a pipInstallFlags
+echo "Sourcing pip-install-hook"

 pipInstallPhase() {
    echo "Executing pipInstallPhase"
    runHook preInstall

+    # shellcheck disable=SC2154
    mkdir -p "$out/@pythonSitePackages@"
    export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"

+    local -a flagsArray=(
+        --no-index
+        --no-warn-script-location
+        --prefix="$out"
+        --no-cache
+    )
+    concatTo flagsArray pipInstallFlags
+
    pushd dist || return 1
-    @pythonInterpreter@ -m pip install ./*.whl --no-index --no-warn-script-location --prefix="$out" --no-cache $pipInstallFlags
+    echoCmd 'pip install flags' "${flagsArray[@]}"
+    @pythonInterpreter@ -m pip install ./*.whl "${flagsArray[@]}"
    popd || return 1

    runHook postInstall
--- a/pkgs/development/interpreters/python/hooks/pypa-build-hook-test.nix
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook-test.nix
@ -10,9 +10,9 @@
    '';
    # the source of the example project
    projectSource = runCommand "my-project-source" {} ''
-      mkdir -p $out/src
+      mkdir -p $out/src/my_project
      cp ${pyprojectToml} $out/pyproject.toml
-      touch $out/src/__init__.py
+      touch $out/src/my_project/__init__.py
    '';
    in
    # this build must never triger conflicts
@ -20,11 +20,13 @@
      pname = "dont-propagate-conflicting-deps";
      version = "0.0.0";
      src = projectSource;
-      format = "pyproject";
-      propagatedBuildInputs = [
+      pyproject = true;
+      dependencies = [
        # At least one dependency of `build` should be included here to
        # keep the test meaningful
        (mkConflict pythonOnBuildForHost.pkgs.tomli)
+      ];
+      build-system = [
        # setuptools is also needed to build the example project
        pythonOnBuildForHost.pkgs.setuptools
      ];
--- a/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
@ -1,12 +1,22 @@
 # Setup hook to use for pypa/build projects
+# shellcheck shell=bash
+
 echo "Sourcing pypa-build-hook"

 pypaBuildPhase() {
    echo "Executing pypaBuildPhase"
    runHook preBuild

+    local -a flagsArray=(
+        --no-isolation
+        --outdir dist/
+        --wheel
+    )
+    concatTo flagsArray pypaBuildFlags
+
    echo "Creating a wheel..."
-    @build@/bin/pyproject-build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
+    echoCmd 'pypa build flags' "${flagsArray[@]}"
+    @build@/bin/pyproject-build "${flagsArray[@]}"
    echo "Finished creating a wheel..."

    runHook postBuild
--- a/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh
@ -1,22 +1,28 @@
+# shellcheck shell=bash
+
 # Setup hook for checking whether Python imports succeed
 echo "Sourcing python-imports-check-hook.sh"

 pythonImportsCheckPhase() {
    echo "Executing pythonImportsCheckPhase"

-    if [ -n "$pythonImportsCheck" ]; then
-        echo "Check whether the following modules can be imported: $pythonImportsCheck"
-        pythonImportsCheckOutput=$out
-        if [ -n "$python" ]; then
+    if [[ -n "${pythonImportsCheck[*]-}" ]]; then
+        echo "Check whether the following modules can be imported: ${pythonImportsCheck[*]}"
+        # shellcheck disable=SC2154
+        pythonImportsCheckOutput="$out"
+        if [[ -n "${python-}" ]]; then
            echo "Using python specific output \$python for imports check"
            pythonImportsCheckOutput=$python
        fi
        export PYTHONPATH="$pythonImportsCheckOutput/@pythonSitePackages@:$PYTHONPATH"
-        (cd $pythonImportsCheckOutput && @pythonCheckInterpreter@ -c 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ["pythonImportsCheck"].split()))')
+        # Python modules and namespaces names are Python identifiers, which must not contain spaces.
+        # See https://docs.python.org/3/reference/lexical_analysis.html
+        # shellcheck disable=SC2048,SC2086
+        (cd "$pythonImportsCheckOutput" && @pythonCheckInterpreter@ -c 'import sys; import importlib; list(map(lambda mod: importlib.import_module(mod), sys.argv[1:]))' ${pythonImportsCheck[*]})
    fi
 }

-if [ -z "${dontUsePythonImportsCheck-}" ]; then
+if [[ -z "${dontUsePythonImportsCheck-}" ]]; then
    echo "Using pythonImportsCheckPhase"
    appendToVar preDistPhases pythonImportsCheckPhase
 fi
--- a/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
@ -1,20 +1,26 @@
 # Clean up __init__.py's found in namespace directories
+# shellcheck shell=bash
+
 echo "Sourcing python-namespaces-hook"

 pythonNamespacesHook() {
    echo "Executing pythonNamespacesHook"

-    for namespace in ${pythonNamespaces[@]}; do
+    # Python namespaces names are Python identifiers, which must not contain spaces.
+    # See https://docs.python.org/3/reference/lexical_analysis.html
+    # shellcheck disable=SC2048
+    for namespace in ${pythonNamespaces[*]-}; do
        echo "Enforcing PEP420 namespace: ${namespace}"

        # split namespace into segments. "azure.mgmt" -> "azure mgmt"
-        IFS='.' read -ra pathSegments <<<$namespace
+        IFS='.' read -ra pathSegments <<<"$namespace"
+        # shellcheck disable=SC2154
        constructedPath=$out/@pythonSitePackages@

        # Need to remove the __init__.py at each namespace level
        # E.g `azure/__init__.py` and `azure/mgmt/__init__.py`
        # The __pycache__ entry also needs to be removed
-        for pathSegment in ${pathSegments[@]}; do
+        for pathSegment in "${pathSegments[@]}"; do
            constructedPath=${constructedPath}/${pathSegment}
            pathToRemove=${constructedPath}/__init__.py
            pycachePath=${constructedPath}/__pycache__/
@ -30,9 +36,9 @@ pythonNamespacesHook() {
            # event of a "meta-package" package, which will just install
            # other packages, but not produce anything in site-packages
            # besides meta information
-            if [ -d "${constructedPath}/../" -a -z ${dontRemovePth-} ]; then
+            if [[ -d "${constructedPath}/../" ]] && [[ -z "${dontRemovePth-}" ]]; then
                # .pth files are located in the parent directory of a module
-                @findutils@/bin/find ${constructedPath}/../ -name '*-nspkg.pth' -exec rm -v "{}" +
+                @findutils@/bin/find "${constructedPath}/../" -name '*-nspkg.pth' -exec rm -v "{}" +
            fi

            # remove __pycache__/ entry, can be interpreter specific. E.g. __init__.cpython-38.pyc
@ -46,6 +52,6 @@ pythonNamespacesHook() {
    echo "Finished executing pythonNamespacesHook"
 }

-if [ -z "${dontUsePythonNamespacesHook-}" -a -n "${pythonNamespaces-}" ]; then
+if [[ -z "${dontUsePythonNamespacesHook-}" ]] && [[ -n "${pythonNamespaces-}" ]]; then
    postFixupHooks+=(pythonNamespacesHook)
 fi
--- a/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh
@ -1,9 +1,12 @@
 # Setup hook for storing dist folder (wheels/sdists) in a separate output
+# shellcheck shell=bash
+
 echo "Sourcing python-catch-conflicts-hook.sh"

 pythonOutputDistPhase() {
    echo "Executing pythonOutputDistPhase"
    if [[ -d dist ]]; then
+        # shellcheck disable=SC2154
        mv "dist" "$dist"
    else
        cat >&2 <<EOF
@ -21,4 +24,4 @@ EOF
    echo "Finished executing pythonOutputDistPhase"
 }

-preFixupPhases+=" pythonOutputDistPhase"
+appendToVar preFixupPhases pythonOutputDistPhase
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@ -42,13 +42,14 @@
 _pythonRelaxDeps() {
    local -r metadata_file="$1"

-    if [[ -z "${pythonRelaxDeps:-}" ]] || [[ "$pythonRelaxDeps" == 0 ]]; then
+    if [[ -z "${pythonRelaxDeps[*]-}" ]] || [[ "$pythonRelaxDeps" == 0 ]]; then
        return
    elif [[ "$pythonRelaxDeps" == 1 ]]; then
        sed -i "$metadata_file" -r \
            -e 's/(Requires-Dist: [a-zA-Z0-9_.-]+\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/'
    else
-        for dep in $pythonRelaxDeps; do
+        # shellcheck disable=SC2048
+        for dep in ${pythonRelaxDeps[*]}; do
            sed -i "$metadata_file" -r \
                -e "s/(Requires-Dist: $dep\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/i"
        done
@ -58,13 +59,14 @@ _pythonRelaxDeps() {
 _pythonRemoveDeps() {
    local -r metadata_file="$1"

-    if [[ -z "${pythonRemoveDeps:-}" ]] || [[ "$pythonRemoveDeps" == 0 ]]; then
+    if [[ -z "${pythonRemoveDeps[*]-}" ]] || [[ "$pythonRemoveDeps" == 0 ]]; then
        return
    elif [[ "$pythonRemoveDeps" == 1 ]]; then
        sed -i "$metadata_file" \
            -e '/Requires-Dist:.*/d'
    else
-        for dep in $pythonRemoveDeps; do
+        # shellcheck disable=SC2048
+        for dep in ${pythonRemoveDeps[*]-}; do
            sed -i "$metadata_file" \
                -e "/Requires-Dist: $dep/d"
        done
@ -86,11 +88,14 @@ pythonRelaxDepsHook() {
        rm -rf "$wheel"

        # Using no quotes on purpose since we need to expand the glob from `$metadata_file`
+        # shellcheck disable=SC2086
        _pythonRelaxDeps $metadata_file
+        # shellcheck disable=SC2086
        _pythonRemoveDeps $metadata_file

        if (("${NIX_DEBUG:-0}" >= 1)); then
            echo "pythonRelaxDepsHook: resulting METADATA for '$wheel':"
+            # shellcheck disable=SC2086
            cat $metadata_file
        fi

--- a/pkgs/development/interpreters/python/hooks/python-remove-tests-dir-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-remove-tests-dir-hook.sh
@ -1,11 +1,14 @@
 # Clean up top-level tests directory in site-package installation.
+# shellcheck shell=bash
+
 echo "Sourcing python-remove-tests-dir-hook"

 pythonRemoveTestsDir() {
    echo "Executing pythonRemoveTestsDir"

-    rm -rf $out/@pythonSitePackages@/tests
-    rm -rf $out/@pythonSitePackages@/test
+    # shellcheck disable=SC2154
+    rm -rf "$out/@pythonSitePackages@/tests"
+    rm -rf "$out/@pythonSitePackages@/test"

    echo "Finished executing pythonRemoveTestsDir"
 }
--- a/pkgs/development/interpreters/python/hooks/setuptools-rust-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-rust-hook.sh
@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 echo "Sourcing setuptools-rust-hook"

 setuptoolsRustSetup() {
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, substituteAll, fetchurl
 , zlibSupport ? true, zlib
-, bzip2, pkg-config, libffi, darwin
+, bzip2, pkg-config, libffi
 , sqlite, openssl, ncurses, python, expat, tcl, tk, tclPackages, libX11
 , gdbm, db, xz, python-setup-hook
 , optimizationLevel ? "jit", boehmgc
@ -63,8 +63,6 @@ in with passthru; stdenv.mkDerivation rec {
    zlib
  ] ++ lib.optionals (lib.any (l: l == optimizationLevel) [ "0" "1" "2" "3"]) [
    boehmgc
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-   darwin.libutil
  ];

  # Remove bootstrap python from closure
--- a/Show More
+++ b/Show More