Merge branch 'staging' into staging-next

Conflicts (tried to quickly resolve somehow, checked eval): pkgs/development/python-modules/apsw/default.nix pkgs/development/python-modules/mido/default.nix pkgs/development/python-modules/pytest-bdd/default.nix pkgs/development/python-modules/sparse/default.nix
2024-11-22 15:03:28 +00:00 · 2024-04-12 07:06:54 +02:00 · 2024-04-12 07:06:54 +02:00 · 24d4f2cd52
commit 24d4f2cd52
parent 4cfc319ea8 993400aeec
425 changed files with 3797 additions and 4221 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -497,40 +497,6 @@ are used in [`buildPythonPackage`](#buildpythonpackage-function).
  with the `pipInstallHook`.
 - `unittestCheckHook` will run tests with `python -m unittest discover`. See [example usage](#using-unittestcheckhook).

-### Development mode {#development-mode}
-
-Development or editable mode is supported. To develop Python packages
-[`buildPythonPackage`](#buildpythonpackage-function) has additional logic inside `shellPhase` to run `pip
-install -e . --prefix $TMPDIR/`for the package.
-
-Warning: `shellPhase` is executed only if `setup.py` exists.
-
-Given a `default.nix`:
-
-```nix
-with import <nixpkgs> {};
-
-python3Packages.buildPythonPackage {
-  name = "myproject";
-  buildInputs = with python3Packages; [ pyramid ];
-
-  src = ./.;
-}
-```
-
-Running `nix-shell` with no arguments should give you the environment in which
-the package would be built with `nix-build`.
-
-Shortcut to setup environments with C headers/libraries and Python packages:
-
-```shell
-nix-shell -p python3Packages.pyramid zlib libjpeg git
-```
-
-::: {.note}
-There is a boolean value `lib.inNixShell` set to `true` if nix-shell is invoked.
-:::
-
 ## User Guide {#user-guide}

 ### Using Python {#using-python}
@ -867,8 +833,7 @@ Above, we were mostly just focused on use cases and what to do to get started
 creating working Python environments in nix.

 Now that you know the basics to be up and running, it is time to take a step
-back and take a deeper look at how Python packages are packaged on Nix. Then,
-we will look at how you can use development mode with your code.
+back and take a deeper look at how Python packages are packaged on Nix.

 #### Python library packages in Nixpkgs {#python-library-packages-in-nixpkgs}

@ -1481,45 +1446,6 @@ documentation source root.
 The hook is also available to packages outside the python ecosystem by
 referencing it using `sphinxHook` from top-level.

-### Develop local package {#develop-local-package}
-
-As a Python developer you're likely aware of [development mode](http://setuptools.readthedocs.io/en/latest/setuptools.html#development-mode)
-(`python setup.py develop`); instead of installing the package this command
-creates a special link to the project code. That way, you can run updated code
-without having to reinstall after each and every change you make. Development
-mode is also available. Let's see how you can use it.
-
-In the previous Nix expression the source was fetched from a url. We can also
-refer to a local source instead using `src = ./path/to/source/tree;`
-
-If we create a `shell.nix` file which calls [`buildPythonPackage`](#buildpythonpackage-function), and if `src`
-is a local source, and if the local source has a `setup.py`, then development
-mode is activated.
-
-In the following example, we create a simple environment that has a Python 3.11
-version of our package in it, as well as its dependencies and other packages we
-like to have in the environment, all specified with `dependencies`.
-
-```nix
-with import <nixpkgs> {};
-with python311Packages;
-
-buildPythonPackage rec {
-  name = "mypackage";
-  src = ./path/to/package/source;
-  dependencies = [
-    pytest
-    numpy
-  ];
-  propagatedBuildInputs = [
-    pkgs.libsndfile
-  ];
-}
-```
-
-It is important to note that due to how development mode is implemented on Nix
-it is not possible to have multiple packages simultaneously in development mode.
-
 ### Organising your packages {#organising-your-packages}

 So far we discussed how you can use Python on Nix, and how you can develop with
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@ -1,5 +1,5 @@
 /*
-  <!-- This anchor is here for backwards compatibity -->
+  <!-- This anchor is here for backwards compatibility -->
  []{#sec-fileset}

  The [`lib.fileset`](#sec-functions-library-fileset) library allows you to work with _file sets_.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -16836,6 +16836,13 @@
    githubId = 12279531;
    name = "Ricardo Guevara";
  };
+  rhelmot = {
+    name = "Audrey Dutcher";
+    github = "rhelmot";
+    githubId = 2498805;
+    email = "audrey@rhelmot.io";
+    matrix = "@rhelmot:matrix.org";
+  };
  rhendric = {
    name = "Ryan Hendrickson";
    github = "rhendric";
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "fluidsynth";
-  version = "2.3.4";
+  version = "2.3.5";

  src = fetchFromGitHub {
    owner = "FluidSynth";
    repo = "fluidsynth";
    rev = "v${version}";
-    hash = "sha256-3qLmo9Ibl44v6Jj5Ix17ixwqfPt3ITTXUqBETF5pzE4=";
+    hash = "sha256-CzKfvQzhF4Mz2WZaJM/Nt6XjF6ThlX4jyQSaXfZukG8=";
  };

  outputs = [ "out" "dev" "man" ];
--- a/pkgs/applications/audio/miniplayer/default.nix
+++ b/pkgs/applications/audio/miniplayer/default.nix
@ -15,7 +15,11 @@ buildPythonApplication rec {
    hash = "sha256-iUUsVIDLQAiaMomfA2LvvJZ2ePhgADtC6GCwIpRC1MA=";
  };

-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
    colorthief
    ffmpeg-python
    mpd2
@ -25,6 +29,8 @@ buildPythonApplication rec {
    ueberzug
  ];

+  doCheck = false; # no tests
+
  # pythonImportsCheck is disabled because this package doesn't expose any modules.

  meta = with lib; {
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@ -15,17 +15,18 @@
 , jack
 , withConplay ? !stdenv.hostPlatform.isWindows
 , perl
+, writeScript
 }:

 assert withConplay -> !libOnly;

 stdenv.mkDerivation rec {
  pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.5";
+  version = "1.32.6";

  src = fetchurl {
    url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-r5CM32zbZUS5e8cGp5n3mJTmlGivWIG/RUoOu5Fx7WM=";
+    hash = "sha256-zN0dCrwx1z2LQ1/GWMeQSdCpBbMGabakKgOtFp3GCeY=";
  };

  outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
@ -69,6 +70,20 @@ stdenv.mkDerivation rec {
      --prefix PATH : $out/bin
  '';

+  passthru = {
+    updateScript = writeScript "update-mpg123" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl pcre common-updater-scripts
+
+      set -eu -o pipefail
+
+      # Expect the text in format of '<a href="download/mpg123-1.32.6.tar.bz2">'
+      new_version="$(curl -s https://mpg123.org/download.shtml |
+          pcregrep -o1 '<a href="download/mpg123-([0-9.]+).tar.bz2">')"
+      update-source-version ${pname} "$new_version"
+    '';
+  };
+
  meta = with lib; {
    description = "Fast console MPEG Audio Player and decoder library";
    homepage = "https://mpg123.org";
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, gettext, msgpack-c, libtermkey, libiconv
+{ lib, stdenv, fetchFromGitHub, removeReferencesTo, cmake, gettext, msgpack-c, libtermkey, libiconv
 , libuv, lua, ncurses, pkg-config
 , unibilium, gperf
 , libvterm-neovim
@ -121,6 +121,7 @@ in {
      cmake
      gettext
      pkg-config
+      removeReferencesTo
    ];

    # extra programs test via `make functionaltest`
@ -141,8 +142,11 @@ in {
      sed -i src/nvim/po/CMakeLists.txt \
        -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
    '';
+    postInstall = ''
+      find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
+    '';
    # check that the above patching actually works
-    disallowedReferences = [ stdenv.cc ] ++ lib.optional (lua != codegenLua) codegenLua;
+    disallowedRequisites = [ stdenv.cc ] ++ lib.optional (lua != codegenLua) codegenLua;

    cmakeFlags = [
      # Don't use downloaded dependencies. At the end of the configurePhase one
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0148";
+  version = "9.1.0200";

  outputs = [ "out" "xxd" ];

@ -8,7 +8,7 @@ rec {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-lBs9PwNE3GoxtMka9oftYx3gegjCv6D3sEyAWK6RZzM=";
+    hash = "sha256-MAMd+k4GpFUwEZzQTWtzSpYY6AEez+FMiqexozYK3Y4=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/editors/vim/plugins/vim-gen-doc-hook.sh
+++ b/pkgs/applications/editors/vim/plugins/vim-gen-doc-hook.sh
@ -23,7 +23,7 @@ vimPluginGenTags() {
        echo "$addonInfo" > $target/addon-info.json
    fi

-    echo "Finished executing vimPluginInstallPhase"
+    echo "Finished executing vimPluginGenTags"
 }

 preFixupHooks+=(vimPluginGenTags)
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@ -12,6 +12,10 @@ python3Packages.buildPythonApplication rec {
    sha256 = "sha256-xOyj5XerOwgfvI0qj7+7oshDvd18h5IeZvcJTis8nWo=";
  };

+  build-system = with python3Packages; [
+    cython
+  ];
+
  propagatedBuildInputs = with python3Packages; [
    # requirements
    pyaes
@ -36,7 +40,6 @@ python3Packages.buildPythonApplication rec {
    cryptography

    # requirements-hw
-    cython
    trezor
    keepkey
    btchip-python
--- a/pkgs/applications/misc/opencpn/default.nix
+++ b/pkgs/applications/misc/opencpn/default.nix
@ -108,12 +108,13 @@ stdenv.mkDerivation (finalAttrs: {
    wxGTK32
  ] ++ lib.optionals stdenv.isLinux [
    alsa-utils
-    elfutils
    libselinux
    libsepol
    util-linux
    xorg.libXdmcp
    xorg.libXtst
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
+    elfutils
  ] ++ lib.optionals stdenv.isDarwin [
    lame
  ];
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -179,7 +179,7 @@ stdenv.mkDerivation rec {
      --prefix PATH : ${lib.makeBinPath [ coreutils glib.dev pciutils procps util-linux ]} \
      --prefix LD_LIBRARY_PATH ":" ${libs}

-    # Backwards compatiblity: we used to call it zoom-us
+    # Backwards compatibility: we used to call it zoom-us
    ln -s $out/bin/{zoom,zoom-us}
  '';

--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@ -54,6 +54,10 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_64) [
    # fix `multiversioning needs 'ifunc' which is not supported on this target` error
    "--disable-roll-simd"
+  ] ++ lib.optionals (!enableZstd) [
+    "--disable-zstd"
+  ] ++ lib.optionals (!enableXXHash) [
+    "--disable-xxhash"
  ];

  enableParallelBuilding = true;
--- a/pkgs/applications/science/biology/macs2/default.nix
+++ b/pkgs/applications/science/biology/macs2/default.nix
@ -21,7 +21,7 @@ python3.pkgs.buildPythonPackage rec {
  ];

  nativeBuildInputs = with python3.pkgs; [
-    cython
+    cython_0
    numpy
    setuptools
    wheel
--- a/pkgs/applications/science/electronics/nvc/default.nix
+++ b/pkgs/applications/science/electronics/nvc/default.nix
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    llvm
    zlib
    zstd
-  ] ++ lib.optionals stdenv.isLinux [
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
    elfutils
  ];

--- a/pkgs/applications/science/math/sage/python-modules/sage-setup.nix
+++ b/pkgs/applications/science/math/sage/python-modules/sage-setup.nix
@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , sage-src
-, cython_3
+, cython
 , jinja2
 , pkgconfig # the python module, not the pkg-config alias
 }:
@ -11,7 +11,7 @@ buildPythonPackage rec {
  pname = "sage-setup";
  src = sage-src;

-  nativeBuildInputs = [ cython_3 ];
+  nativeBuildInputs = [ cython ];
  buildInputs = [ pkgconfig ];
  propagatedBuildInputs = [ jinja2 ];

--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@ -48,7 +48,7 @@
 , cvxopt
 , cypari2
 , cysignals
-, cython_3
+, cython
 , fpylll
 , gmpy2
 , importlib-metadata
@ -153,7 +153,7 @@ buildPythonPackage rec {
    cvxopt
    cypari2
    cysignals
-    cython_3
+    cython
    fpylll
    gmpy2
    importlib-metadata
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication rec {
    pytest-freezer
    pytest-mock
    pytest-regressions
-    (pytestCheckHook.override { pytest = pytest_7; })
+    pytest7CheckHook
  ];

  doCheck = true;
--- a/pkgs/applications/version-management/git-up/default.nix
+++ b/pkgs/applications/version-management/git-up/default.nix
@ -30,7 +30,7 @@ pythonPackages.buildPythonApplication rec {

  nativeCheckInputs = [
    git
-    pythonPackages.pytestCheckHook
+    pythonPackages.pytest7CheckHook
  ];

  # 1. git fails to run as it cannot detect the email address, so we set it
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@ -76,7 +76,7 @@ python3.pkgs.buildPythonApplication rec {
  '';

  nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
+    pytest7CheckHook
    cpio
    cdrtools
    xorriso
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@ -47,11 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString isMinimalBuild "-minimal"
    + lib.optionalString cursesUI "-cursesUI"
    + lib.optionalString qt5UI "-qt5UI";
-  version = "3.28.3";
+  version = "3.29.1";

  src = fetchurl {
    url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-crdXDlyFk95qxKtDO3PqsYxfsyiIBGDIbOMmCBQa1cE=";
+    hash = "sha256-f7Auj1e2Kzmqa0z3HoIBSLoaI3JIiElHNQIeMqsO78w=";
  };

  patches = [
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@ -10,7 +10,7 @@
 , darwin
 , libiconv
 , installShellFiles
-  # once eza upstream gets support for setting up a compatibilty symlink for exa, we should change
+  # once eza upstream gets support for setting up a compatibility symlink for exa, we should change
  # the handling here from postInstall to passing the required argument to the builder.
 , exaAlias ? true
 }:
--- a/pkgs/by-name/ja/jasper/package.nix
+++ b/pkgs/by-name/ja/jasper/package.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jasper";
-  version = "4.2.2";
+  version = "4.2.3";

  src = fetchFromGitHub {
    owner = "jasper-software";
    repo = "jasper";
    rev = "version-${finalAttrs.version}";
-    hash = "sha256-dcE9Cc+L/nLp/JCvYuGLRnkxL1i3dLIB9cSILWaZWn4=";
+    hash = "sha256-Hmmoe1lzUR1DBwgg30KGfsIDzSNe5shghaieEXX/am4=";
  };

  outputs = [ "out" "dev" "doc" "lib" "man" ];
--- a/pkgs/by-name/me/meson/0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch
+++ b/pkgs/by-name/me/meson/0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch
@ -0,0 +1,92 @@
+From 8304b645c655832c47ee9ca706d182c26d29eaff Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Tue, 9 Apr 2024 06:35:39 +0000
+Subject: [PATCH] Revert "rust: recursively pull proc-macro dependencies as
+ well"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit aee941559c4b88a062e88186819a820c69c200ae.
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ mesonbuild/build.py                                   |  2 ++
+ test cases/rust/18 proc-macro/lib.rs                  |  8 --------
+ test cases/rust/18 proc-macro/meson.build             | 11 -----------
+ test cases/rust/18 proc-macro/subdir/meson.build      |  1 -
+ .../rust/18 proc-macro/transitive-proc-macro.rs       |  7 -------
+ 5 files changed, 2 insertions(+), 27 deletions(-)
+ delete mode 100644 test cases/rust/18 proc-macro/lib.rs
+ delete mode 100644 test cases/rust/18 proc-macro/subdir/meson.build
+ delete mode 100644 test cases/rust/18 proc-macro/transitive-proc-macro.rs
+
+diff --git a/mesonbuild/build.py b/mesonbuild/build.py
+index 6f0d6a2dd..7be9b497b 100644
+--- a/mesonbuild/build.py
+++ b/mesonbuild/build.py
+@@ -1295,6 +1295,8 @@ def get_dependencies_recurse(self, result: OrderedSet[BuildTargetTypes], include
+         for t in self.link_targets:
+             if t in result:
+                 continue
+            if t.rust_crate_type == 'proc-macro':
+                continue
+             if include_internals or not t.is_internal():
+                 result.add(t)
+             if isinstance(t, StaticLibrary):
+diff --git a/test cases/rust/18 proc-macro/lib.rs b/test cases/rust/18 proc-macro/lib.rs
+deleted file mode 100644
+index 5242886cc..000000000
+--- a/test cases/rust/18 proc-macro/lib.rs	
+++ /dev/null
+@@ -1,8 +0,0 @@
+-extern crate proc_macro_examples;
+-use proc_macro_examples::make_answer;
+-
+-make_answer!();
+-
+-pub fn func() -> u32 {
+-    answer()
+-}
+diff --git a/test cases/rust/18 proc-macro/meson.build b/test cases/rust/18 proc-macro/meson.build
+index e8b28eda1..c5f0dfc82 100644
+--- a/test cases/rust/18 proc-macro/meson.build	
+++ b/test cases/rust/18 proc-macro/meson.build	
+@@ -31,14 +31,3 @@ main = executable(
+ )
+ 
+ test('main_test2', main)
+-
+-subdir('subdir')
+-
+-staticlib = static_library('staticlib', 'lib.rs',
+-  link_with: pm_in_subdir,
+-  rust_dependency_map : {'proc_macro_examples3' : 'proc_macro_examples'}
+-)
+-
+-executable('transitive-proc-macro', 'transitive-proc-macro.rs',
+-  link_with: staticlib,
+-)
+diff --git a/test cases/rust/18 proc-macro/subdir/meson.build b/test cases/rust/18 proc-macro/subdir/meson.build
+deleted file mode 100644
+index 04842c431..000000000
+--- a/test cases/rust/18 proc-macro/subdir/meson.build	
+++ /dev/null
+@@ -1 +0,0 @@
+-pm_in_subdir = rust.proc_macro('proc_macro_examples3', '../proc.rs')
+diff --git a/test cases/rust/18 proc-macro/transitive-proc-macro.rs b/test cases/rust/18 proc-macro/transitive-proc-macro.rs
+deleted file mode 100644
+index 4c804b3b6..000000000
+--- a/test cases/rust/18 proc-macro/transitive-proc-macro.rs	
+++ /dev/null
+@@ -1,7 +0,0 @@
+-extern crate staticlib;
+-use staticlib::func;
+-
+-
+-fn main() {
+-    assert_eq!(42, func());
+-}
+-- 
+2.44.0
+
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@ -14,17 +14,17 @@
 }:

 let
-  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation LDAP OpenGL;
+  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation LDAP OpenAL OpenGL;
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "meson";
-  version = "1.3.2";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "mesonbuild";
    repo = "meson";
    rev = "refs/tags/${version}";
-    hash = "sha256-7M/El2snWsQi+gaZWPHnEr9gpJW3trqG1RbnT43M49s=";
+    hash = "sha256-hRTmKO2E6SIdvAhO7OJtV8dcsGm39c51H+2ZGEkdcFY=";
  };

  patches = [
@ -65,6 +65,10 @@ python3.pkgs.buildPythonApplication rec {

    # Nixpkgs cctools does not have bitcode support.
    ./006-disable-bitcode.patch
+
+    # Fix cross-compilation of proc-macro (and mesa)
+    # https://github.com/mesonbuild/meson/issues/12973
+    ./0001-Revert-rust-recursively-pull-proc-macro-dependencies.patch
  ];

  buildInputs = lib.optionals (python3.pythonOlder "3.9") [
@ -86,6 +90,7 @@ python3.pkgs.buildPythonApplication rec {
    Cocoa
    Foundation
    LDAP
+    OpenAL
    OpenGL
    openldap
  ];
@ -96,6 +101,7 @@ python3.pkgs.buildPythonApplication rec {
      patchShebangs 'test cases'
      substituteInPlace \
        'test cases/native/8 external program shebang parsing/script.int.in' \
+        'test cases/common/273 customtarget exe for test/generate.py' \
          --replace /usr/bin/env ${coreutils}/bin/env
    ''
  ]
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -97,7 +97,6 @@ python.pkgs.buildPythonApplication rec {
  build-system = with python.pkgs; [
    gettext
    nodejs
-    pythonRelaxDepsHook
    setuptools
    tomli
  ];
--- a/pkgs/by-name/xo/xonsh/unwrapped.nix
+++ b/pkgs/by-name/xo/xonsh/unwrapped.nix
@ -90,6 +90,8 @@ python3.pkgs.buildPythonApplication {
    export HOME=$TMPDIR
  '';

+  dontWrapPythonPrograms = true;
+
  passthru = {
    shellPath = "/bin/xonsh";
    python = python3; # To the wrapper
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "iana-etc";
-  version = "20231227";
+  version = "20240318";

  src = fetchzip {
    url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-8Pa6LtAml8axjrUS32UbFIqTtM8v124U2Tt0J4sC0Is=";
+    sha256 = "sha256-t/VOTFDdAH+EdzofdMyUO9Yvl5qdMjdPl9ebYtBC388=";
  };

  installPhase = ''
--- a/pkgs/desktops/budgie/budgie-desktop-view/default.nix
+++ b/pkgs/desktops/budgie/budgie-desktop-view/default.nix
@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
    gtk3
  ];

+  mesonFlags = [ (lib.mesonBool "werror" false) ];
+
  meta = {
    description = "The official Budgie desktop icons application/implementation";
    homepage = "https://github.com/BuddiesOfBudgie/budgie-desktop-view";
--- a/pkgs/development/compilers/gcc/common/meta.nix
+++ b/pkgs/development/compilers/gcc/common/meta.nix
@ -1,6 +1,15 @@
 { lib, version, }:

-with lib; {
+let
+  inherit (lib)
+    licenses
+    maintainers
+    platforms
+    teams
+    versionOlder
+    ;
+in
+{
  homepage = "https://gcc.gnu.org/";
  license = licenses.gpl3Plus; # runtime support libraries are typically LGPLv3+
  description = "GNU Compiler Collection, version ${version}";
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
+{ lib, stdenv, targetPackages, fetchurl, fetchpatch, fetchFromGitHub, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
 , langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
@ -48,19 +48,37 @@
 }:

 let
-  versions = import ./versions.nix;
-  version = versions.fromMajorMinor majorMinorVersion;
+  inherit (lib)
+    callPackageWith
+    filter
+    getBin
+    maintainers
+    makeLibraryPath
+    makeSearchPathOutput
+    mapAttrs
+    optional
+    optionalAttrs
+    optionals
+    optionalString
+    pipe
+    platforms
+    versionAtLeast
+    versions
+    ;

-  majorVersion = lib.versions.major version;
-  atLeast13 = lib.versionAtLeast version "13";
-  atLeast12 = lib.versionAtLeast version "12";
-  atLeast11 = lib.versionAtLeast version "11";
-  atLeast10 = lib.versionAtLeast version "10";
-  atLeast9  = lib.versionAtLeast version  "9";
-  atLeast8  = lib.versionAtLeast version  "8";
-  atLeast7  = lib.versionAtLeast version  "7";
-  atLeast6  = lib.versionAtLeast version  "6";
-  atLeast49 = lib.versionAtLeast version  "4.9";
+  gccVersions = import ./versions.nix;
+  version = gccVersions.fromMajorMinor majorMinorVersion;
+
+  majorVersion = versions.major version;
+  atLeast13 = versionAtLeast version "13";
+  atLeast12 = versionAtLeast version "12";
+  atLeast11 = versionAtLeast version "11";
+  atLeast10 = versionAtLeast version "10";
+  atLeast9  = versionAtLeast version  "9";
+  atLeast8  = versionAtLeast version  "8";
+  atLeast7  = versionAtLeast version  "7";
+  atLeast6  = versionAtLeast version  "6";
+  atLeast49 = versionAtLeast version  "4.9";
  is13 = majorVersion == "13";
  is12 = majorVersion == "12";
  is11 = majorVersion == "11";
@ -69,37 +87,9 @@ let
  is8  = majorVersion == "8";
  is7  = majorVersion == "7";
  is6  = majorVersion == "6";
-  is49 = majorVersion == "4" && lib.versions.minor version == "9";
-  is48 = majorVersion == "4" && lib.versions.minor version == "8";
-in
+  is49 = majorVersion == "4" && versions.minor version == "9";
+  is48 = majorVersion == "4" && versions.minor version == "8";

-# We enable the isl cloog backend.
-assert !atLeast6 -> (cloog != null -> isl != null);
-
-assert langJava -> !atLeast7 && zip != null && unzip != null && zlib != null && boehmgc != null && perl != null;  # for `--enable-java-home'
-
-# Make sure we get GNU sed.
-assert stdenv.buildPlatform.isDarwin -> gnused != null;
-
-# The go frontend is written in c++
-assert langGo -> langCC;
-assert (atLeast6 && !is7 && !is8) -> (langAda -> gnat-bootstrap != null);
-
-# TODO: fixup D bootstapping, probably by using gdc11 (and maybe other changes).
-#   error: GDC is required to build d
-assert atLeast12 -> !langD;
-
-# threadsCross is just for MinGW
-assert threadsCross != {} -> stdenv.targetPlatform.isWindows;
-
-# profiledCompiler builds inject non-determinism in one of the compilation stages.
-# If turned on, we can't provide reproducible builds anymore
-assert reproducibleBuild -> profiledCompiler == false;
-
-with lib;
-with builtins;
-
-let inherit version;
    disableBootstrap = atLeast11 && !stdenv.hostPlatform.isDarwin && (atLeast12 -> !profiledCompiler);

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@ -117,7 +107,7 @@ let inherit version;
      libX11 libXt libSM libICE libXtst libXrender libXrandr libXi
      xorgproto
    ];
-    callFile = lib.callPackageWith ({
+    callFile = callPackageWith ({
      # lets
      inherit
        majorVersion
@ -182,7 +172,7 @@ let inherit version;
        zip
        zlib
      ;
-    } // lib.optionalAttrs (!atLeast7) {
+    } // optionalAttrs (!atLeast7) {
      inherit
        boehmgc
        flex
@ -225,10 +215,33 @@ let inherit version;

 in

+# We enable the isl cloog backend.
+assert !atLeast6 -> (cloog != null -> isl != null);
+
+assert langJava -> !atLeast7 && zip != null && unzip != null && zlib != null && boehmgc != null && perl != null;  # for `--enable-java-home'
+
+# Make sure we get GNU sed.
+assert stdenv.buildPlatform.isDarwin -> gnused != null;
+
+# The go frontend is written in c++
+assert langGo -> langCC;
+assert (atLeast6 && !is7 && !is8) -> (langAda -> gnat-bootstrap != null);
+
+# TODO: fixup D bootstapping, probably by using gdc11 (and maybe other changes).
+#   error: GDC is required to build d
+assert atLeast12 -> !langD;
+
+# threadsCross is just for MinGW
+assert threadsCross != {} -> stdenv.targetPlatform.isWindows;
+
+# profiledCompiler builds inject non-determinism in one of the compilation stages.
+# If turned on, we can't provide reproducible builds anymore
+assert reproducibleBuild -> profiledCompiler == false;
+
 # We need all these X libraries when building AWT with GTK.
 assert !atLeast7 -> (x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == []);

-lib.pipe ((callFile ./common/builder.nix {}) ({
+pipe ((callFile ./common/builder.nix {}) ({
  pname = "${crossNameAddon}${name}";
  inherit version;

@ -249,14 +262,14 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
          then "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz"
          else "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
    ${if is10 || is11 || is13 then "hash" else "sha256"} =
-      versions.srcHashForVersion version;
+      gccVersions.srcHashForVersion version;
  };

  inherit patches;

  outputs =
    if atLeast7
-    then [ "out" "man" "info" ] ++ lib.optional (!langJit) "lib"
+    then [ "out" "man" "info" ] ++ optional (!langJit) "lib"
    else if atLeast49 && (langJava || langGo || (if atLeast6 then langJit else targetPlatform.isDarwin)) then ["out" "man" "info"]
    else [ "out" "lib" "man" "info" ];

@ -265,9 +278,9 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
  libc_dev = stdenv.cc.libc_dev;

  hardeningDisable = [ "format" "pie" ]
-  ++ lib.optionals (is11 && langAda) [ "fortify3" ];
+  ++ optionals (is11 && langAda) [ "fortify3" ];

-  postPatch = lib.optionalString atLeast7 ''
+  postPatch = optionalString atLeast7 ''
    configureScripts=$(find . -name configure)
    for configureScript in $configureScripts; do
      patchShebangs $configureScript
@ -275,8 +288,8 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
  ''
  # This should kill all the stdinc frameworks that gcc and friends like to
  # insert into default search paths.
-  + lib.optionalString (atLeast6 && hostPlatform.isDarwin) ''
-    substituteInPlace gcc/config/darwin-c.c${lib.optionalString atLeast12 "c"} \
+  + optionalString (atLeast6 && hostPlatform.isDarwin) ''
+    substituteInPlace gcc/config/darwin-c.c${optionalString atLeast12 "c"} \
      --replace 'if (stdinc)' 'if (0)'

    substituteInPlace libgcc/config/t-slibgcc-darwin \
@ -286,7 +299,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
      --replace "-install_name \\\$rpath/\\\$soname" "-install_name ''${!outputLib}/lib/\\\$soname"
  ''
  + (
-    lib.optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
+    optionalString (targetPlatform != hostPlatform || stdenv.cc.libc != null)
      # On NixOS, use the right path to the dynamic linker instead of
      # `/lib/ld*.so'.
      (let
@ -296,18 +309,18 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
        '' echo "fixing the {GLIBC,UCLIBC,MUSL}_DYNAMIC_LINKER macros..."
           for header in "gcc/config/"*-gnu.h "gcc/config/"*"/"*.h
           do
-             grep -q ${lib.optionalString (!atLeast6) "LIBC"}_DYNAMIC_LINKER "$header" || continue
+             grep -q ${optionalString (!atLeast6) "LIBC"}_DYNAMIC_LINKER "$header" || continue
             echo "  fixing $header..."
             sed -i "$header" \
                 -e 's|define[[:blank:]]*\([UCG]\+\)LIBC_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define \1LIBC_DYNAMIC_LINKER\2 "${libc.out}\3"|g' \
                 -e 's|define[[:blank:]]*MUSL_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define MUSL_DYNAMIC_LINKER\1 "${libc.out}\2"|g'
             done
-        '' + lib.optionalString (atLeast6 && targetPlatform.libc == "musl") ''
+        '' + optionalString (atLeast6 && targetPlatform.libc == "musl") ''
           sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
        ''
        )
    ))
-      + lib.optionalString (atLeast7 && targetPlatform.isAvr) (''
+      + optionalString (atLeast7 && targetPlatform.isAvr) (''
            makeFlagsArray+=(
               '-s' # workaround for hitting hydra log limit
               'LIMITS_H_TEST=false'
@ -319,7 +332,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({

  inherit (callFile ./common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

-  preConfigure = (callFile ./common/pre-configure.nix { }) + lib.optionalString atLeast10 ''
+  preConfigure = (callFile ./common/pre-configure.nix { }) + optionalString atLeast10 ''
    ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
  '';

@ -338,9 +351,9 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
    assert atLeast12 -> (profiledCompiler -> !disableBootstrap);
    if atLeast11
    then let target =
-               lib.optionalString (profiledCompiler) "profiled" +
-               lib.optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
-         in lib.optional (target != "") target
+               optionalString (profiledCompiler) "profiled" +
+               optionalString (targetPlatform == hostPlatform && hostPlatform == buildPlatform && !disableBootstrap) "bootstrap";
+         in optional (target != "") target
    else
      optional
        (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
@ -394,24 +407,24 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
      EXTRA_LDFLAGS_FOR_TARGET
      ;
  } // optionalAttrs is7 {
-    NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument"
+    NIX_CFLAGS_COMPILE = optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument"
      # Downgrade register storage class specifier errors to warnings when building a cross compiler from a clang stdenv.
-      + lib.optionalString (stdenv.cc.isClang && targetPlatform != hostPlatform) " -Wno-register";
+      + optionalString (stdenv.cc.isClang && targetPlatform != hostPlatform) " -Wno-register";
  } // optionalAttrs (!is7 && !atLeast12 && stdenv.cc.isClang && targetPlatform != hostPlatform) {
    NIX_CFLAGS_COMPILE = "-Wno-register";
  } // optionalAttrs (!atLeast7) {
    inherit langJava;
  } // optionalAttrs atLeast6 {
-    NIX_LDFLAGS = lib.optionalString hostPlatform.isSunOS "-lm";
+    NIX_LDFLAGS = optionalString hostPlatform.isSunOS "-lm";
  });

  passthru = {
    inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
    isGNU = true;
-    hardeningUnsupportedFlags = lib.optional is48 "stackprotector"
-      ++ lib.optional (!atLeast11) "zerocallusedregs"
-      ++ lib.optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
-      ++ lib.optionals (langFortran) [ "fortify" "format" ];
+    hardeningUnsupportedFlags = optional is48 "stackprotector"
+      ++ optional (!atLeast11) "zerocallusedregs"
+      ++ optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
+      ++ optionals (langFortran) [ "fortify" "format" ];
  };

  enableParallelBuilding = true;
@ -426,19 +439,19 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
      platforms
      maintainers
    ;
-  } // lib.optionalAttrs (!atLeast11) {
+  } // optionalAttrs (!atLeast11) {
    badPlatforms =
      # avr-gcc8 is maintained for the `qmk` package
      if (is8 && targetPlatform.isAvr) then []
      else if !(is48 || is49) then [ "aarch64-darwin" ]
-      else lib.platforms.darwin;
-  } // lib.optionalAttrs is11 {
+      else platforms.darwin;
+  } // optionalAttrs is11 {
    badPlatforms = if targetPlatform != hostPlatform then [ "aarch64-darwin" ] else [ ];
  };
-} // lib.optionalAttrs (!atLeast10 && stdenv.targetPlatform.isDarwin) {
+} // optionalAttrs (!atLeast10 && stdenv.targetPlatform.isDarwin) {
  # GCC <10 requires default cctools `strip` instead of `llvm-strip` used by Darwin bintools.
  preBuild = ''
-    makeFlagsArray+=('STRIP=${lib.getBin darwin.cctools-port}/bin/${stdenv.cc.targetPrefix}strip')
+    makeFlagsArray+=('STRIP=${getBin darwin.cctools-port}/bin/${stdenv.cc.targetPrefix}strip')
  '';
 } // optionalAttrs (!atLeast8) {
  doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
--- a/pkgs/development/compilers/gnat-bootstrap/default.nix
+++ b/pkgs/development/compilers/gnat-bootstrap/default.nix
@ -67,8 +67,9 @@ in {
    zlib
  ] ++ lib.optionals stdenv.buildPlatform.isLinux [
    autoPatchelfHook
-    elfutils
    glibc
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.buildPlatform elfutils) [
+    elfutils
  ];

  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin) ''
--- a/pkgs/development/compilers/go/1.22.nix
+++ b/pkgs/development/compilers/go/1.22.nix
@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.22.1";
+  version = "1.22.2";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-ecm5HX8QlRWiX8Ps2q0SXWfmvbVPbU2YWA9GeZyuoyE=";
+    hash = "sha256-N06oKyiexzjpaCZ8rFnH1f8YD5SSJQJUeEsgROkN9ak=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/17/llvm/default.nix
@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
--- a/pkgs/development/compilers/llvm/18/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/18/llvm/default.nix
@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@ -8,7 +8,7 @@
 , python3
 , python3Packages
 , libffi
-, enableGoldPlugin ? true
+, enableGoldPlugin ? libbfd.hasPluginAPI
 , libbfd
 , libpfm
 , libxml2
--- a/pkgs/development/compilers/nasm/default.nix
+++ b/pkgs/development/compilers/nasm/default.nix
@ -1,12 +1,17 @@
-{ lib, stdenv, fetchurl, perl }:
+{ lib
+, stdenv
+, fetchurl
+, perl
+, gitUpdater
+}:

 stdenv.mkDerivation rec {
  pname = "nasm";
-  version = "2.16.01";
+  version = "2.16.02";

  src = fetchurl {
    url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-x3dF9IAjde/u4uxcCta38DfqnIfJKxSaljf/CZ8WJVg=";
+    sha256 = "sha256-HhuULqiPIu2uiWWeFb4m+gJ+rgdH9RQTVA9S1OrEeQ0=";
  };

  nativeBuildInputs = [ perl ];
@ -16,10 +21,20 @@ stdenv.mkDerivation rec {
  doCheck = true;

  checkPhase = ''
+    runHook preCheck
+
    make golden
    make test
+
+    runHook postCheck
  '';

+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/netwide-assembler/nasm.git";
+    rev-prefix = "nasm-";
+    ignoredVersions = "rc.*";
+  };
+
  meta = with lib; {
    homepage = "https://www.nasm.us/";
    description = "An 80x86 and x86-64 assembler designed for portability and modularity";
--- a/pkgs/development/compilers/orc/default.nix
+++ b/pkgs/development/compilers/orc/default.nix
@ -18,11 +18,11 @@
  inherit (lib) optional optionals;
 in stdenv.mkDerivation rec {
  pname = "orc";
-  version = "0.4.36";
+  version = "0.4.38";

  src = fetchurl {
    url = "https://gstreamer.freedesktop.org/src/orc/${pname}-${version}.tar.xz";
-    sha256 = "sha256-g7B0y2cxfVi+8ejQzIYveuinekW7/wVqH5h8ZIiy9f0=";
+    sha256 = "sha256-pVqY1HclZ6o/rtj7hNVAw9t36roW0+LhCwRPvJIoZo0=";
  };

  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
--- a/pkgs/development/compilers/rust/1_77.nix
+++ b/pkgs/development/compilers/rust/1_77.nix
@ -19,8 +19,8 @@
 } @ args:

 import ./default.nix {
-  rustcVersion = "1.76.0";
-  rustcSha256 = "sha256-nlz/Azp/DSJmgYmCrZDk0+Tvj47hcVd2xuJQc6E2wCE=";
+  rustcVersion = "1.77.1";
+  rustcSha256 = "7hBuTFafUtujtbKCsQWCD4a9j2s9CcBrjc6C+xuzpKE=";

  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
  llvmSharedForHost = pkgsBuildHost.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
@ -34,24 +34,24 @@ import ./default.nix {

  # Note: the version MUST be one version prior to the version we're
  # building
-  bootstrapVersion = "1.75.0";
+  bootstrapVersion = "1.76.0";

  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
  bootstrapHashes = {
-    i686-unknown-linux-gnu = "107b8d8825deab338f338b15f047829da6225bb34644790847e96f0957c6678f";
-    x86_64-unknown-linux-gnu = "473978b6f8ff216389f9e89315211c6b683cf95a966196e7914b46e8cf0d74f6";
-    x86_64-unknown-linux-musl = "cc6ef41aa811ab34f946fe2b4338d1107daf08642125fd566386bf45563597de";
-    arm-unknown-linux-gnueabihf = "985454b6c385cb461cc8a39d2d7d55dcf6c50495033fe5d28edcc717729d8ae9";
-    armv7-unknown-linux-gnueabihf = "bd876a75f72040d96be2fb882770b16b482ac0ab15d7e3ad24e6d25b7c74bcf7";
-    aarch64-unknown-linux-gnu = "30828cd904fcfb47f1ac43627c7033c903889ea4aca538f53dcafbb3744a9a73";
-    aarch64-unknown-linux-musl = "26b5989525b7cf623f3868a37549736e0efe1142a08f191a97e29758cc640ac4";
-    x86_64-apple-darwin = "ad066e4dec7ae5948c4e7afe68e250c336a5ab3d655570bb119b3eba9cf22851";
-    aarch64-apple-darwin = "878ecf81e059507dd2ab256f59629a4fb00171035d2a2f5638cb582d999373b1";
-    powerpc64le-unknown-linux-gnu = "2599cdfea5860b4efbceb7bca69845a96ac1c96aa50cf8261151e82280b397a0";
-    riscv64gc-unknown-linux-gnu = "7f7b73d8924d7dd24dcb2ef0da257eb48d9aed658b00fe68e8f1ade0b1ce4511";
+    i686-unknown-linux-gnu = "4c3eefc9341b8809235e6c4fbcbc19ab52a5cbe771292c400df068c12984fa3e";
+    x86_64-unknown-linux-gnu = "9d589d2036b503cc45ecc94992d616fb3deec074deb36cacc2f5c212408f7399";
+    x86_64-unknown-linux-musl = "aa8568f4d262468aaf4f622bd421c5435b24454d8fbcdae48da1162962205384";
+    arm-unknown-linux-gnueabihf = "7d1da067362fc64bcad198d90a61e024d5712aed76e17b28e1cd7e8ba263cc6f";
+    armv7-unknown-linux-gnueabihf = "c03346d56d4a860cd3a8d2d2a7ea75c510b68204e3ad97b3770076595261c913";
+    aarch64-unknown-linux-gnu = "2e8313421e8fb673efdf356cdfdd4bc16516f2610d4f6faa01327983104c05a0";
+    aarch64-unknown-linux-musl = "a1d1c8ccb8ea00cfa2b79d80411b8eb22b2bef5214f86536825361e98d7c617a";
+    x86_64-apple-darwin = "7bdbe085695df8e46389115e99eda7beed37a9494f6b961b45554c658e53b8e7";
+    aarch64-apple-darwin = "17496f15c3cb6ff73d5c36f5b54cc110f1ac31fa09521a7991c0d7ddd890dceb";
+    powerpc64le-unknown-linux-gnu = "44b3494675284d26b04747a824dc974e32fd8fd46fc0aa06a7c8ebe851332d2c";
+    riscv64gc-unknown-linux-gnu = "4a9db321874fc441235b71eb8aa295fc50251305e461540b25b4eef89fb56255";
  };

-  selectRustPackage = pkgs: pkgs.rust_1_76;
+  selectRustPackage = pkgs: pkgs.rust_1_77;

  rustcPatches = [ ];
 }
--- a/pkgs/development/compilers/rust/cargo-auditable.nix
+++ b/pkgs/development/compilers/rust/cargo-auditable.nix
@ -1,4 +1,4 @@
-{ lib, buildPackages, fetchFromGitHub, makeRustPlatform, installShellFiles, stdenv }:
+{ lib, buildPackages, fetchFromGitHub, fetchpatch, makeRustPlatform, installShellFiles, stdenv }:

 let
  args = rec {
@ -12,6 +12,14 @@ let
      sha256 = "sha256-ERIzx9Fveanq7/aWcB2sviTxIahvSu0sTwgpGf/aYE8=";
    };

+    patches = [
+      (fetchpatch {
+        name = "rust-1.77-tests.patch";
+        url = "https://github.com/rust-secure-code/cargo-auditable/commit/5317a27244fc428335c4e7a1d066ae0f65f0d496.patch";
+        hash = "sha256-UblGseiSC/2eE4rcnTgYzxAMrutHFSdxKTHqKj1mX5o=";
+      })
+    ];
+
    cargoHash = "sha256-4o3ctun/8VcBRuj+j0Yaawdkyn6Z6LPp+FTyhPxQWU8=";

    # Cargo.lock is outdated
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@ -93,7 +93,7 @@ in stdenv.mkDerivation (finalAttrs: {
    # attempts to download the missing source tarball
    "--set=build.rustfmt=${rustfmt}/bin/rustfmt"
  ] ++ [
-    "--tools=rustc,rust-analyzer-proc-macro-srv"
+    "--tools=rustc,rustdoc,rust-analyzer-proc-macro-srv"
    "--enable-rpath"
    "--enable-vendor"
    "--build=${stdenv.buildPlatform.rust.rustcTargetSpec}"
--- a/pkgs/development/interpreters/lua-5/build-luarocks-package.nix
+++ b/pkgs/development/interpreters/lua-5/build-luarocks-package.nix
@ -94,6 +94,7 @@ let
  ];

  inherit doCheck extraConfig rockspecFilename knownRockspec externalDeps nativeCheckInputs;
+  inherit dontWrapLuaPrograms;

  buildInputs = let
    # example externalDeps': [ { name = "CRYPTO"; dep = pkgs.openssl; } ]
@ -177,9 +178,11 @@ let
    runHook postBuild
  '';

-  postFixup = lib.optionalString (!dontWrapLuaPrograms) ''
-    wrapLuaPrograms
-  '' + attrs.postFixup or "";
+  fixupPhase = ''
+    runHook preFixup
+    ${lib.optionalString (!self.dontWrapLuaPrograms) "wrapLuaPrograms"}
+    runHook postFixup
+    '';

  installPhase = ''
    runHook preInstall
@ -196,6 +199,7 @@ let
    # maybe we could reestablish dependency checking via passing --rock-trees

    nix_debug "ROCKSPEC $rockspecFilename"
+    # deps-mode=all tells luarocks to use every configured rocks_trees
    luarocks $LUAROCKS_EXTRA_ARGS make --deps-mode=all --tree=$out ''${rockspecFilename}

    runHook postInstall
--- a/pkgs/development/interpreters/lua-5/hooks/setup-hook.sh
+++ b/pkgs/development/interpreters/lua-5/hooks/setup-hook.sh
@ -25,7 +25,8 @@ addToLuaSearchPathWithCustomDelimiter() {
  # export only if the folder contains lua files
  shopt -s globstar

-  for _file in ${absPattern/\?/\*\*}; do
+  local adjustedPattern="${absPattern/\?/\*\*\/\*}"
+  for _file in $adjustedPattern; do
    export "${varName}=${!varName:+${!varName};}${absPattern}"
    shopt -u globstar
    return;
--- a/pkgs/development/interpreters/lua-5/tests/default.nix
+++ b/pkgs/development/interpreters/lua-5/tests/default.nix
@ -66,6 +66,21 @@ in
      touch $out
    '');

+  # checks that lua's setup-hook adds dependencies to LUA_PATH
+  # Prevents the following regressions
+  # $ env NIX_PATH=nixpkgs=. nix-shell --pure -Q -p luajitPackages.lua luajitPackages.http
+  # nix-shell$ luajit
+  # > require('http.request')
+  # stdin:1: module 'http.request' not found:
+  checkSetupHook = pkgs.runCommandLocal "test-${lua.name}-setup-hook" ({
+      nativeBuildInputs = [lua];
+      buildInputs = [ lua.pkgs.http ];
+      meta.platforms = lua.meta.platforms;
+    }) (''
+      ${lua}/bin/lua -e "require'http.request'"
+      touch $out
+    '');
+
  checkRelativeImports = pkgs.runCommandLocal "test-${lua.name}-relative-imports" ({
    }) (''
      source ${./assert.sh}
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -318,6 +318,8 @@ in with passthru; stdenv.mkDerivation ({
    inherit passthru;

    postFixup = ''
+      # Include a sitecustomize.py file. Note it causes an error when it's in postInstall with 2.7.
+      cp ${../../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
    '' + lib.optionalString strip2to3 ''
      rm -R $out/bin/2to3 $out/lib/python*/lib2to3
    '' + lib.optionalString stripConfig ''
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -537,7 +537,8 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
    # Strip tests
    rm -R $out/lib/python*/test $out/lib/python*/**/test{,s}
    '' + optionalString includeSiteCustomize ''
-
+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
    '' + optionalString stripBytecode ''
    # Determinism: deterministic bytecode
    # First we delete all old bytecode.
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -20,10 +20,10 @@
      sourceVersion = {
        major = "3";
        minor = "11";
-        patch = "8";
+        patch = "9";
        suffix = "";
      };
-      hash = "sha256-ngYAjIkBkkOVvB2jA+rFZ6cprgErqhgqs5Jp9lA4O7M=";
+      hash = "sha256-mx6JZSP8UQaREmyGRAbZNgo9Hphqy9pZzaV7Wr2kW4c=";
    };
  };

@ -79,10 +79,10 @@ in {
    sourceVersion = {
      major = "3";
      minor = "12";
-      patch = "2";
+      patch = "3";
      suffix = "";
    };
-    hash = "sha256-vigRLayBPSBTVFwUvxOhZAGiGHfxpp626l2ExKDz2HA=";
+    hash = "sha256-Vr/vH9/BIhzmcg5DpmHj60F4XdkUzplpjYx4lq9L2qE=";
    inherit (darwin) configd;
    inherit passthruFun;
  };
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@ -191,10 +191,12 @@ in {

  setuptoolsBuildHook = callPackage ({ makePythonHook, setuptools, wheel }:
    makePythonHook {
-      name = "setuptools-setup-hook";
+      name = "setuptools-build-hook";
      propagatedBuildInputs = [ setuptools wheel ];
      substitutions = {
-        inherit pythonInterpreter pythonSitePackages setuppy;
+        inherit pythonInterpreter setuppy;
+        # python2.pkgs.setuptools does not support parallelism
+        setuptools_has_parallel = setuptools != null && lib.versionAtLeast setuptools.version "69";
      };
    } ./setuptools-build-hook.sh) {};

--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@ -3,7 +3,7 @@ echo "Sourcing setuptools-build-hook"

 setuptoolsBuildPhase() {
    echo "Executing setuptoolsBuildPhase"
-    local args
+    local args setuptools_has_parallel=@setuptools_has_parallel@
    runHook preBuild

    cp -f @setuppy@ nix_run_setup
@ -12,8 +12,10 @@ setuptoolsBuildPhase() {
        args+="$setupPyGlobalFlags"
    fi
    if [ -n "$enableParallelBuilding" ]; then
+        if [ -n "$setuptools_has_parallel" ]; then
            setupPyBuildFlags+=" --parallel $NIX_BUILD_CORES"
        fi
+    fi
    if [ -n "$setupPyBuildFlags" ]; then
        args+=" build_ext $setupPyBuildFlags"
    fi
@ -23,36 +25,7 @@ setuptoolsBuildPhase() {
    echo "Finished executing setuptoolsBuildPhase"
 }

-setuptoolsShellHook() {
-    echo "Executing setuptoolsShellHook"
-    runHook preShellHook
-
-    if test -e setup.py; then
-        tmp_path=$(mktemp -d)
-        export PATH="$tmp_path/bin:$PATH"
-        export PYTHONPATH="$tmp_path/@pythonSitePackages@:$PYTHONPATH"
-        mkdir -p "$tmp_path/@pythonSitePackages@"
-        eval "@pythonInterpreter@ -m pip install -e . --prefix $tmp_path \
-          --no-build-isolation >&2"
-
-        # Process pth file installed in tmp path. This allows one to
-        # actually import the editable installation. Note site.addsitedir
-        # appends, not prepends, new paths. Hence, it is not possible to override
-        # an existing installation of the package.
-        # https://github.com/pypa/setuptools/issues/2612
-        export NIX_PYTHONPATH="$tmp_path/@pythonSitePackages@:${NIX_PYTHONPATH-}"
-    fi
-
-    runHook postShellHook
-    echo "Finished executing setuptoolsShellHook"
-}
-
 if [ -z "${dontUseSetuptoolsBuild-}" ] && [ -z "${buildPhase-}" ]; then
    echo "Using setuptoolsBuildPhase"
    buildPhase=setuptoolsBuildPhase
 fi
-
-if [ -z "${dontUseSetuptoolsShellHook-}" ] && [ -z "${shellHook-}" ]; then
-    echo "Using setuptoolsShellHook"
-    shellHook=setuptoolsShellHook
-fi
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@ -126,6 +126,9 @@ in with passthru; stdenv.mkDerivation rec {
    ln -s $out/${executable}-c/include $out/include/${libPrefix}
    ln -s $out/${executable}-c/lib-python/${if isPy3k then "3" else pythonVersion} $out/lib/${libPrefix}

+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${if isPy38OrNewer then sitePackages else "lib/${libPrefix}/${sitePackages}"}/sitecustomize.py
+
    runHook postInstall
  '';

--- a/pkgs/development/interpreters/python/pypy/prebuilt.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt.nix
@ -95,6 +95,9 @@ in with passthru; stdenv.mkDerivation {
    echo "Removing bytecode"
    find . -name "__pycache__" -type d -depth -delete

+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+
    runHook postInstall
  '';

--- a/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
@ -96,6 +96,9 @@ in with passthru; stdenv.mkDerivation {
    echo "Removing bytecode"
    find . -name "__pycache__" -type d -depth -delete

+    # Include a sitecustomize.py file
+    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+
    runHook postInstall
  '';

--- a/pkgs/development/interpreters/python/sitecustomize.py
+++ b/pkgs/development/interpreters/python/sitecustomize.py
@ -0,0 +1,39 @@
+"""
+This is a Nix-specific module for discovering modules built with Nix.
+
+The module recursively adds paths that are on `NIX_PYTHONPATH` to `sys.path`. In
+order to process possible `.pth` files `site.addsitedir` is used.
+
+The paths listed in `PYTHONPATH` are added to `sys.path` afterwards, but they
+will be added before the entries we add here and thus take precedence.
+
+Note the `NIX_PYTHONPATH` environment variable is unset in order to prevent leakage.
+
+Similarly, this module listens to the environment variable `NIX_PYTHONEXECUTABLE`
+and sets `sys.executable` to its value.
+"""
+import site
+import sys
+import os
+import functools
+
+paths = os.environ.pop('NIX_PYTHONPATH', None)
+if paths:
+    functools.reduce(lambda k, p: site.addsitedir(p, k), paths.split(':'), site._init_pathinfo())
+
+# Check whether we are in a venv or virtualenv.
+# For Python 3 we check whether our `base_prefix` is different from our current `prefix`.
+# For Python 2 we check whether the non-standard `real_prefix` is set.
+# https://stackoverflow.com/questions/1871549/determine-if-python-is-running-inside-virtualenv
+in_venv = (sys.version_info.major == 3 and sys.prefix != sys.base_prefix) or (sys.version_info.major == 2 and hasattr(sys, "real_prefix"))
+
+if not in_venv:
+    executable = os.environ.pop('NIX_PYTHONEXECUTABLE', None)
+    prefix = os.environ.pop('NIX_PYTHONPREFIX', None)
+
+    if 'PYTHONEXECUTABLE' not in os.environ and executable is not None:
+        sys.executable = executable
+    if prefix is not None:
+        # Sysconfig does not like it when sys.prefix is set to None
+        sys.prefix = sys.exec_prefix = prefix
+        site.PREFIXES.insert(0, prefix)
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@ -38,22 +38,14 @@ let
        is_nixenv = "False";
        is_virtualenv = "False";
      };
-    } // lib.optionalAttrs (!python.isPyPy) {
-      # Use virtualenv with symlinks from a Nix env.
-      nixenv-virtualenv-links = rec {
-        env = runCommand "${python.name}-virtualenv-links" {} ''
-          ${pythonVirtualEnv.interpreter} -m virtualenv --system-site-packages --symlinks --no-seed $out
-        '';
-        interpreter = "${env}/bin/${python.executable}";
-        is_venv = "False";
-        is_nixenv = "True";
-        is_virtualenv = "True";
-      };
-    } // lib.optionalAttrs (!python.isPyPy) {
-      # Use virtualenv with copies from a Nix env.
-      nixenv-virtualenv-copies = rec {
-        env = runCommand "${python.name}-virtualenv-copies" {} ''
-          ${pythonVirtualEnv.interpreter} -m virtualenv --system-site-packages --copies --no-seed $out
+    } // lib.optionalAttrs (!python.isPyPy && !stdenv.isDarwin) {
+      # Use virtualenv from a Nix env.
+      # Fails on darwin with
+      #   virtualenv: error: argument dest: the destination . is not write-able at /nix/store
+      nixenv-virtualenv = rec {
+        env = runCommand "${python.name}-virtualenv" {} ''
+          ${pythonVirtualEnv.interpreter} -m virtualenv venv
+          mv venv $out
        '';
        interpreter = "${env}/bin/${python.executable}";
        is_venv = "False";
@ -69,48 +61,27 @@ let
        is_nixenv = "True";
        is_virtualenv = "False";
      };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8" && (!python.isPyPy)) {
-      # Venv built using links to plain Python
+    } // lib.optionalAttrs (python.isPy3k && (!python.isPyPy)) {
+      # Venv built using plain Python
      # Python 2 does not support venv
      # TODO: PyPy executable name is incorrect, it should be pypy-c or pypy-3c instead of pypy and pypy3.
-      plain-venv-links = rec {
-        env = runCommand "${python.name}-venv-links" {} ''
-          ${python.interpreter} -m venv --system-site-packages --symlinks --without-pip $out
-        '';
-        interpreter = "${env}/bin/${python.executable}";
-        is_venv = "True";
-        is_nixenv = "False";
-        is_virtualenv = "False";
-      };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8" && (!python.isPyPy)) {
-      # Venv built using copies from plain Python
-      # Python 2 does not support venv
-      # TODO: PyPy executable name is incorrect, it should be pypy-c or pypy-3c instead of pypy and pypy3.
-      plain-venv-copies = rec {
-        env = runCommand "${python.name}-venv-copies" {} ''
-          ${python.interpreter} -m venv --system-site-packages --copies --without-pip $out
+      plain-venv = rec {
+        env = runCommand "${python.name}-venv" {} ''
+          ${python.interpreter} -m venv $out
        '';
        interpreter = "${env}/bin/${python.executable}";
        is_venv = "True";
        is_nixenv = "False";
        is_virtualenv = "False";
      };
+
    } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
      # Venv built using Python Nix environment (python.buildEnv)
-      nixenv-venv-links = rec {
-        env = runCommand "${python.name}-venv-links" {} ''
-          ${pythonEnv.interpreter} -m venv --system-site-packages --symlinks --without-pip $out
-        '';
-        interpreter = "${env}/bin/${pythonEnv.executable}";
-        is_venv = "True";
-        is_nixenv = "True";
-        is_virtualenv = "False";
-      };
-    } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
-      # Venv built using Python Nix environment (python.buildEnv)
-      nixenv-venv-copies = rec {
-        env = runCommand "${python.name}-venv-copies" {} ''
-          ${pythonEnv.interpreter} -m venv --system-site-packages --copies --without-pip $out
+      # TODO: Cannot create venv from a  nix env
+      # Error: Command '['/nix/store/ddc8nqx73pda86ibvhzdmvdsqmwnbjf7-python3-3.7.6-venv/bin/python3.7', '-Im', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.
+      nixenv-venv = rec {
+        env = runCommand "${python.name}-venv" {} ''
+          ${pythonEnv.interpreter} -m venv $out
        '';
        interpreter = "${env}/bin/${pythonEnv.executable}";
        is_venv = "True";
@ -122,33 +93,11 @@ let
    testfun = name: attrs: runCommand "${python.name}-tests-${name}" ({
      inherit (python) pythonVersion;
    } // attrs) ''
-      mkdir $out
-
-      # set up the test files
      cp -r ${./tests/test_environments} tests
      chmod -R +w tests
      substituteAllInPlace tests/test_python.py
-
-      # run the tests by invoking the interpreter via full path
-      echo "absolute path: ${attrs.interpreter}"
-      ${attrs.interpreter} -m unittest discover --verbose tests 2>&1 | tee "$out/full.txt"
-
-      # run the tests by invoking the interpreter via $PATH
-      export PATH="$(dirname ${attrs.interpreter}):$PATH"
-      echo "PATH: $(basename ${attrs.interpreter})"
-      "$(basename ${attrs.interpreter})" -m unittest discover --verbose tests 2>&1 | tee "$out/path.txt"
-
-      # make sure we get the right path when invoking through a result link
-      ln -s "${attrs.env}" result
-      relative="result/bin/$(basename ${attrs.interpreter})"
-      expected="$PWD/$relative"
-      actual="$(./$relative -c "import sys; print(sys.executable)" | tee "$out/result.txt")"
-      if [ "$actual" != "$expected" ]; then
-        echo "expected $expected, got $actual"
-        exit 1
-      fi
-
-      # if we got this far, the tests passed
+      ${attrs.interpreter} -m unittest discover --verbose tests #/test_python.py
+      mkdir $out
      touch $out/success
    '';

--- a/pkgs/development/interpreters/python/tests/test_environments/test_python.py
+++ b/pkgs/development/interpreters/python/tests/test_environments/test_python.py
@ -38,7 +38,7 @@ class TestCasePython(unittest.TestCase):

    @unittest.skipIf(IS_PYPY or sys.version_info.major==2, "Python 2 does not have base_prefix")
    def test_base_prefix(self):
-        if IS_VENV or IS_VIRTUALENV:
+        if IS_VENV or IS_NIXENV or IS_VIRTUALENV:
            self.assertNotEqual(sys.prefix, sys.base_prefix)
        else:
            self.assertEqual(sys.prefix, sys.base_prefix)
--- a/pkgs/development/interpreters/python/wrapper.nix
+++ b/pkgs/development/interpreters/python/wrapper.nix
@ -35,8 +35,6 @@ let
      fi
      mkdir -p "$out/bin"

-      rm -f $out/bin/.*-wrapped
-
      for path in ${lib.concatStringsSep " " paths}; do
        if [ -d "$path/bin" ]; then
          cd "$path/bin"
@ -44,13 +42,7 @@ let
            if [ -f "$prg" ]; then
              rm -f "$out/bin/$prg"
              if [ -x "$prg" ]; then
-                if [ -f ".$prg-wrapped" ]; then
-                  echo "#!${pythonExecutable}" > "$out/bin/$prg"
-                  sed -e '1d' -e '3d' ".$prg-wrapped" >> "$out/bin/$prg"
-                  chmod +x "$out/bin/$prg"
-                else
-                  makeWrapper "$path/bin/$prg" "$out/bin/$prg" --inherit-argv0 --resolve-argv0 ${lib.optionalString (!permitUserSite) ''--set PYTHONNOUSERSITE "true"''} ${lib.concatStringsSep " " makeWrapperArgs}
-                fi
+                makeWrapper "$path/bin/$prg" "$out/bin/$prg" --set NIX_PYTHONPREFIX "$out" --set NIX_PYTHONEXECUTABLE ${pythonExecutable} --set NIX_PYTHONPATH ${pythonPath} ${lib.optionalString (!permitUserSite) ''--set PYTHONNOUSERSITE "true"''} ${lib.concatStringsSep " " makeWrapperArgs}
              fi
            fi
          done
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -74,7 +74,7 @@ let

        strictDeps = true;

-        nativeBuildInputs = [ autoreconfHook bison ]
+        nativeBuildInputs = [ autoreconfHook bison removeReferencesTo ]
          ++ (op docSupport groff)
          ++ (ops (dtraceSupport && stdenv.isLinux) [ systemtap libsystemtap ])
          ++ ops yjitSupport [ rustPlatform.cargoSetupHook cargo rustc ]
@ -190,10 +190,10 @@ let
          ${
            lib.optionalString (!jitSupport) ''
              # Get rid of the CC runtime dependency
-              ${removeReferencesTo}/bin/remove-references-to \
+              remove-references-to \
                -t ${stdenv.cc} \
                $out/lib/libruby*
-              ${removeReferencesTo}/bin/remove-references-to \
+              remove-references-to \
                -t ${stdenv.cc} \
                $rbConfig
              sed -i '/CC_VERSION_MESSAGE/d' $rbConfig
@ -237,7 +237,7 @@ let
          cp ${./rbconfig.rb} $devdoc/lib/ruby/site_ruby/rbconfig.rb
        '' + opString useBaseRuby ''
          # Prevent the baseruby from being included in the closure.
-          ${removeReferencesTo}/bin/remove-references-to \
+          remove-references-to \
            -t ${baseRuby} \
            $rbConfig $out/lib/libruby*
        '';
@ -257,7 +257,7 @@ let
        '';
        doInstallCheck = true;

-        disallowedRequisites = op (!jitSupport) stdenv.cc.cc
+        disallowedRequisites = op (!jitSupport) stdenv.cc
          ++ op useBaseRuby baseRuby;

        meta = with lib; {
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "rubygems";
-  version = "3.5.6";
+  version = "3.5.7";

  src = fetchurl {
    url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-8/zAMnzuC3677i7wFKQroFtAMtfhg0280xZd3nAMmcI=";
+    hash = "sha256-w9BKIE0vcmX+mmtDqF1tInhplHdBok1W5R1xNtRinjk=";
  };

  patches = [
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@ -58,13 +58,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "SDL2";
-  version = "2.30.1";
+  version = "2.30.2";

  src = fetchFromGitHub {
    owner = "libsdl-org";
    repo = "SDL";
    rev = "release-${finalAttrs.version}";
-    hash = "sha256-nwmmyJK1/5Mu7l1YCk4PsasJIrx3jdiM5f/Cu3n0paA=";
+    hash = "sha256-yYYtsF6+IKynXpfay0rUmCQPdL8vp6dlmon8N7UG89A=";
  };
  dontDisableStatic = if withStatic then 1 else 0;
  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/abseil-cpp/202401.nix
+++ b/pkgs/development/libraries/abseil-cpp/202401.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "abseil-cpp";
-  version = "20240116.1";
+  version = "20240116.2";

  src = fetchFromGitHub {
    owner = "abseil";
    repo = "abseil-cpp";
    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-D4E11bICKr3Z5RRah7QkfXVsXtuUg32FMmKpiOGjZDM=";
+    hash = "sha256-eA2/dZpNOlex1O5PNa3XSZhpMB3AmaIoHzVDI9TD/cg=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "libopenmpt";
-  version = "0.7.4";
+  version = "0.7.6";

  outputs = [ "out" "dev" "bin" ];

  src = fetchurl {
    url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-FgD5M16uOQQImmKG9SWBKWHFTONqBd/m7qpXbdkyjz8=";
+    hash = "sha256-Fi1yowa7LhFMJPolJn0NCgrBbzn9laXA38daZm7l5PU=";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/avahi/CVE-2023-38469.patch
+++ b/pkgs/development/libraries/avahi/CVE-2023-38469.patch
@ -1,102 +0,0 @@
-From a337a1ba7d15853fb56deef1f464529af6e3a1cf Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Mon, 23 Oct 2023 20:29:31 +0000
-Subject: [PATCH 1/2] core: reject overly long TXT resource records
-
-Closes https://github.com/lathiat/avahi/issues/455
-
-CVE-2023-38469
---
- avahi-core/rr.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/avahi-core/rr.c b/avahi-core/rr.c
-index 2bb89244..9c04ebbd 100644
--- a/avahi-core/rr.c
-+++ b/avahi-core/rr.c
-@@ -32,6 +32,7 @@
- #include <avahi-common/malloc.h>
- #include <avahi-common/defs.h>
- 
-+#include "dns.h"
- #include "rr.h"
- #include "log.h"
- #include "util.h"
-@@ -689,11 +690,17 @@ int avahi_record_is_valid(AvahiRecord *r) {
-         case AVAHI_DNS_TYPE_TXT: {
- 
-             AvahiStringList *strlst;
-+            size_t used = 0;
- 
-            for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next)
-+            for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next) {
-                 if (strlst->size > 255 || strlst->size <= 0)
-                     return 0;
- 
-+                used += 1+strlst->size;
-+                if (used > AVAHI_DNS_RDATA_MAX)
-+                    return 0;
-+            }
-+
-             return 1;
-         }
-     }
-
-From c6cab87df290448a63323c8ca759baa516166237 Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Wed, 25 Oct 2023 18:15:42 +0000
-Subject: [PATCH 2/2] tests: pass overly long TXT resource records
-
-to make sure they don't crash avahi any more.
-
-It reproduces https://github.com/lathiat/avahi/issues/455
---
- avahi-client/client-test.c       | 14 ++++++++++++++
- 2 files changed, 20 insertions(+)
-
-diff --git a/avahi-client/client-test.c b/avahi-client/client-test.c
-index ba979988..da0e43ad 100644
--- a/avahi-client/client-test.c
-+++ b/avahi-client/client-test.c
-@@ -22,6 +22,7 @@
- #endif
- 
- #include <stdio.h>
-+#include <string.h>
- #include <assert.h>
- 
- #include <avahi-client/client.h>
-@@ -33,6 +34,8 @@
- #include <avahi-common/malloc.h>
- #include <avahi-common/timeval.h>
- 
-+#include <avahi-core/dns.h>
-+
- static const AvahiPoll *poll_api = NULL;
- static AvahiSimplePoll *simple_poll = NULL;
- 
-@@ -222,6 +225,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
-     uint32_t cookie;
-     struct timeval tv;
-     AvahiAddress a;
-+    uint8_t rdata[AVAHI_DNS_RDATA_MAX+1];
-+    AvahiStringList *txt = NULL;
-+    int r;
- 
-     simple_poll = avahi_simple_poll_new();
-     poll_api = avahi_simple_poll_get(simple_poll);
-@@ -261,6 +267,14 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
-     error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0);
-     assert(error != AVAHI_OK);
- 
-+    memset(rdata, 1, sizeof(rdata));
-+    r = avahi_string_list_parse(rdata, sizeof(rdata), &txt);
-+    assert(r >= 0);
-+    assert(avahi_string_list_serialize(txt, NULL, 0) == sizeof(rdata));
-+    error = avahi_entry_group_add_service_strlst(group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", "_qotd._tcp", NULL, NULL, 123, txt);
-+    assert(error == AVAHI_ERR_INVALID_RECORD);
-+    avahi_string_list_free(txt);
-+
-     avahi_entry_group_commit (group);
- 
-     domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u");
--- a/pkgs/development/libraries/avahi/CVE-2023-38471-2.patch
+++ b/pkgs/development/libraries/avahi/CVE-2023-38471-2.patch
@ -1,47 +0,0 @@
-From 04ac71fd56a16365360f14bd4691219913e22f21 Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Tue, 24 Oct 2023 21:57:32 +0000
-Subject: [PATCH 1/2] smoke-test: call SetHostName with unusual names
-
-It's prompted by https://github.com/lathiat/avahi/issues/453
---
- avahi-core/server.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/avahi-core/server.c b/avahi-core/server.c
-index f6a21bb7..84df6b5d 100644
--- a/avahi-core/server.c
-+++ b/avahi-core/server.c
-@@ -1309,10 +1309,13 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     else
-         hn = avahi_normalize_name_strdup(host_name);
- 
-+    if (!hn)
-+        return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY);
-+
-     h = hn;
-     if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) {
-         avahi_free(h);
-        return AVAHI_ERR_INVALID_HOST_NAME;
-+        return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME);
-     }
- 
-     avahi_free(h);
-@@ -1320,7 +1323,7 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     h = label_escaped;
-     len = sizeof(label_escaped);
-     if (!avahi_escape_label(label, strlen(label), &h, &len))
-        return AVAHI_ERR_INVALID_HOST_NAME;
-+        return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME);
- 
-     if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION)
-         return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE);
-@@ -1330,7 +1333,7 @@ int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
-     avahi_free(s->host_name);
-     s->host_name = avahi_strdup(label_escaped);
-     if (!s->host_name)
-        return AVAHI_ERR_NO_MEMORY;
-+        return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY);
- 
-     update_fqdn(s);
- 
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@ -57,6 +57,12 @@ stdenv.mkDerivation rec {
      url = "https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c.patch";
      sha256 = "sha256-Fanh9bvz+uknr5pAmltqijuUAZIG39JR2Lyq5zGKJ58=";
    })
+    # https://github.com/avahi/avahi/pull/480 merged Sept 19
+    (fetchpatch {
+      name = "bail-out-unless-escaped-labels-fit.patch";
+      url = "https://github.com/avahi/avahi/commit/20dec84b2480821704258bc908e7b2bd2e883b24.patch";
+      sha256 = "sha256-p/dOuQ/GInIcUwuFhQR3mGc5YBL5J8ho+1gvzcqEN0c=";
+    })
    # CVE-2023-38473
    # https://github.com/lathiat/avahi/pull/486 merged Oct 18
    (fetchpatch {
@ -79,12 +85,39 @@ stdenv.mkDerivation rec {
      sha256 = "sha256-4dG+5ZHDa+A4/CszYS8uXWlpmA89m7/jhbZ7rheMs7U=";
    })
    # https://github.com/lathiat/avahi/pull/499 merged Oct 25
-    # (but with the changes to '.github/workflows/smoke-tests.sh removed)
-    ./CVE-2023-38471-2.patch
+    (fetchpatch {
+      name = "CVE-2023-38471-2.patch";
+      url = "https://github.com/avahi/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460.patch";
+      sha256 = "sha256-uDtMPWuz1lsu7n0Co/Gpyh369miQ6GWGyC0UPQB/yI8=";
+    })
    # CVE-2023-38469
    # https://github.com/lathiat/avahi/pull/500 merged Oct 25
-    # (but with the changes to '.github/workflows/smoke-tests.sh removed)
-    ./CVE-2023-38469.patch
+    (fetchpatch {
+      name = "CVE-2023-38469.patch";
+      url = "https://github.com/avahi/avahi/commit/61b9874ff91dd20a12483db07df29fe7f35db77f.patch";
+      sha256 = "sha256-qR7scfQqhRGxg2n4HQsxVxCLkXbwZi+PlYxrOSEPsL0=";
+      excludes = [ ".github/workflows/smoke-tests.sh" ];
+    })
+    # https://github.com/avahi/avahi/pull/515 merged Nov 3
+    (fetchpatch {
+      name = "fix-compare-rrs-with-zero-length-rdata.patch";
+      url = "https://github.com/avahi/avahi/commit/177d75e8c43be45a8383d794ce4084dd5d600a9e.patch";
+      sha256 = "sha256-uwIyruAWgiWt0yakRrvMdYjjhEhUk5cIGKt6twyXbHw=";
+    })
+    # https://github.com/avahi/avahi/pull/519 merged Nov 8
+    (fetchpatch {
+      name = "reject-non-utf-8-service-names.patch";
+      url = "https://github.com/avahi/avahi/commit/2b6d3e99579e3b6e9619708fad8ad8e07ada8218.patch";
+      sha256 = "sha256-lwSA3eEQgH0g51r0i9/HJMJPRXrhQnTIEDxcYqUuLdI=";
+      excludes = [ "fuzz/fuzz-domain.c" ];
+    })
+    # https://github.com/avahi/avahi/pull/523 merged Nov 12
+    (fetchpatch {
+      name = "core-no-longer-supply-bogus-services-to-callbacks.patch";
+      url = "https://github.com/avahi/avahi/commit/93b14365c1c1e04efd1a890e8caa01a2a514bfd8.patch";
+      sha256 = "sha256-VBm8vsBZkTbbWAK8FI71SL89lZuYd1yFNoB5o+FvlEU=";
+      excludes = [ ".github/workflows/smoke-tests.sh" "fuzz/fuzz-packet.c" ];
+    })
  ];

  depsBuildBuild = [
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-auth";
-  version = "0.7.10";
+  version = "0.7.16";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-auth";
    rev = "v${version}";
-    hash = "sha256-yJ0sgw0y9tIiIHgTPVnfYd8zAGjO83qfeeEzstGH9CE=";
+    hash = "sha256-76sBv4oChDrkv80HPktkULFNC37kfTNxjlwNg/FJiyA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-common";
-  version = "0.9.10";
+  version = "0.9.14";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-xqNqyVtibR8oSMvl5RTU166FIxcbvGjZJOjJ9j6fU78=";
+    hash = "sha256-aeuIXqnO8divpguDpiPlYJHABYIqegpaDNGwqJ5TKZw=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/aws-c-event-stream/default.nix
+++ b/pkgs/development/libraries/aws-c-event-stream/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-event-stream";
-  version = "0.3.2";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-uKprdBJn9yHDm2HCBOiuanizCtLi/VKrvUUScNv6OPY=";
+    hash = "sha256-wj3PZshUay3HJy+v7cidDL4mDAqSDiX+MmQtJDK4rTI=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-http";
-  version = "0.7.14";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-http";
    rev = "v${version}";
-    sha256 = "sha256-HrNdePWNw/5tDBeybnUjK3LgftnGQ4CBXPG0URaxIeU=";
+    hash = "sha256-S5ETVkdGTndt2GJBNL4DU5SycHAufsmN06xBDRMFVKo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-io";
-  version = "0.13.36";
+  version = "0.14.6";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-TwPcsTMBOE1uIInH6/eQdUMV6uD7d60773THzc1/G9Y=";
+    hash = "sha256-fekeGghqMKbUqKWIfpZg3a6dCpgxywhmXPoGz9y4Aos=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-mqtt";
-  version = "0.9.10";
+  version = "0.10.3";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-mqtt";
    rev = "v${version}";
-    sha256 = "sha256-hxisqBUARJLtmZniXaZ2th0hqWiKn4XQIy6I0Oz/kUs=";
+    hash = "sha256-MWcXTMwKtFnrNp+OnHxkiYCUXc3IUhM6iTQa+F9JwsQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-s3";
-  version = "0.4.0";
+  version = "0.5.4";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-s3";
    rev = "v${version}";
-    sha256 = "sha256-tb9h78Gd4N11DPB2ETq241lvDQqHIy2HYBsJrBlLpxA=";
+    hash = "sha256-8eKQsP7AftNDccsZHPC9PcwpbpgZSvsioUuSsiggQDs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/aws-c-sdkutils/default.nix
+++ b/pkgs/development/libraries/aws-c-sdkutils/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-sdkutils";
-  version = "0.1.12";
+  version = "0.1.15";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-sdkutils";
    rev = "v${version}";
-    sha256 = "sha256-4YuOC90FBcuNYGBsqw3wKYNGkg3MssezvR8bu6BNGeM=";
+    hash = "sha256-RTRDbdv+QmRG0Sk/R9qhl45WYEVyl+M0EceLFsoONTI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@ -17,7 +17,7 @@

 stdenv.mkDerivation rec {
  pname = "aws-crt-cpp";
-  version = "0.24.7";
+  version = "0.26.4";

  outputs = [ "out" "dev" ];

@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
    owner = "awslabs";
    repo = "aws-crt-cpp";
    rev = "v${version}";
-    sha256 = "sha256-AYO0ckqEx2jG7HduvaxASQMOsxuHGkRkyVsUP5WOs98=";
+    sha256 = "sha256-H5ms6fhhlkARn9g8S5Ma8bnisZv8mfNizP0QpzsF1tA=";
  };

  patches = [
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@ -27,13 +27,13 @@ in

 stdenv.mkDerivation rec {
  pname = "aws-sdk-cpp";
-  version = "1.11.207";
+  version = "1.11.296";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-sdk-cpp";
    rev = version;
-    sha256 = "sha256-IsPDQJo+TZ2noLefroiWl/Jx8fXmrmY73WHNRO41sik=";
+    hash = "sha256-yg+OkeUaqwUQGQ5ThIVQUpF2rHm4FuFbcl5gE5WHHOQ=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "enchant";
-  version = "2.6.7";
+  version = "2.6.8";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-ocLltZrMoAC7+ySBCvShFlcz1AfyFUeGWI4HbIzVe/w=";
+    hash = "sha256-9WWSMGLHfz1YhG8FWNIebQfKSkiMWIEt/e+zUgL6x64=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@ -6,13 +6,10 @@ let
    callPackage ./generic.nix (
      {
        inherit (darwin.apple_sdk.frameworks)
-          Cocoa
-          CoreServices
-          CoreAudio
-          CoreMedia
+          AppKit
+          AudioToolbox
          AVFoundation
-          MediaToolbox
-          VideoDecodeAcceleration
+          CoreImage
          VideoToolbox
          ;
      }
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -35,20 +35,26 @@
  # Feature flags
 , withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
 , withAom ? withFullDeps # AV1 reference encoder
+, withAppKit ? withHeadlessDeps && stdenv.isDarwin # Apple AppKit framework
 , withAribcaption ? withFullDeps && lib.versionAtLeast version "6.1" # ARIB STD-B24 Caption Decoder/Renderer
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
+, withAudioToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple AudioToolbox
+, withAvFoundation ? withHeadlessDeps && stdenv.isDarwin # Apple AVFoundation framework
 , withBluray ? withFullDeps # BluRay reading
 , withBs2b ? withFullDeps # bs2b DSP library
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
 , withChromaprint ? withFullDeps # Audio fingerprinting
-, withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch && !hostPlatform.isRiscV))
+, withCoreImage ? withHeadlessDeps && stdenv.isDarwin # Apple CoreImage framework
+, withCuda ? withFullDeps && withNvcodec
 , withCudaLLVM ? withFullDeps
+, withCuvid ? withHeadlessDeps && withNvcodec
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
 , withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
 , withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
 , withFdkAac ? withFullDeps && (!withGPL || withUnfree) # Fraunhofer FDK AAC de/encoder
+, withNvcodec ? withHeadlessDeps && (with stdenv; !isDarwin && !isAarch32 && !hostPlatform.isRiscV && hostPlatform == buildPlatform) # dynamically linked Nvidia code
 , withFlite ? withFullDeps # Voice Synthesis
 , withFontconfig ? withHeadlessDeps # Needed for drawtext filter
 , withFreetype ? withHeadlessDeps # Needed for drawtext filter
@ -66,14 +72,14 @@
 , withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
 , withMp3lame ? withHeadlessDeps # LAME MP3 encoder
 , withMysofa ? withFullDeps # HRTF support via SOFAlizer
-, withNvdec ? withHeadlessDeps && (with stdenv; !isDarwin && hostPlatform == buildPlatform && !isAarch32 && !hostPlatform.isRiscV)
-, withNvenc ? withHeadlessDeps && (with stdenv; !isDarwin && hostPlatform == buildPlatform && !isAarch32 && !hostPlatform.isRiscV)
+, withNvdec ? withHeadlessDeps && withNvcodec
+, withNvenc ? withHeadlessDeps && withNvcodec
 , withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
 , withOpenal ? withFullDeps # OpenAL 1.1 capture support
 , withOpencl ? withFullDeps
 , withOpencoreAmrnb ? withFullDeps && withVersion3 # AMR-NB de/encoder
 , withOpencoreAmrwb ? withFullDeps && withVersion3 # AMR-WB decoder
-, withOpengl ? false # OpenGL rendering
+, withOpengl ? withFullDeps && !stdenv.isDarwin # OpenGL rendering
 , withOpenh264 ? withFullDeps # H.264/AVC encoder
 , withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
 , withOpenmpt ? withFullDeps # Tracked music files decoder
@ -83,7 +89,7 @@
 , withQrencode ? withFullDeps && lib.versionAtLeast version "7" # QR encode generation
 , withQuirc ? withFullDeps && lib.versionAtLeast version "7" # QR decoding
 , withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
-, withRtmp ? false # RTMP[E] support
+, withRtmp ? withFullDeps # RTMP[E] support
 , withSamba ? withFullDeps && !stdenv.isDarwin && withGPLv3 # Samba protocol
 , withSdl2 ? withSmallDeps
 , withShaderc ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
@ -93,12 +99,13 @@
 , withSsh ? withHeadlessDeps # SFTP protocol
 , withSvg ? withFullDeps # SVG protocol
 , withSvtav1 ? withHeadlessDeps && !stdenv.isAarch64 && !stdenv.hostPlatform.isMinGW # AV1 encoder/decoder (focused on speed and correctness)
-, withTensorflow ? false # Tensorflow dnn backend support
+, withTensorflow ? false # Tensorflow dnn backend support (Increases closure size by ~390 MiB)
 , withTheora ? withHeadlessDeps # Theora encoder
 , withV4l2 ? withHeadlessDeps && stdenv.isLinux  # Video 4 Linux support
 , withV4l2M2m ? withV4l2
 , withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
 , withVdpau ? withSmallDeps && !stdenv.hostPlatform.isMinGW # Vdpau hardware acceleration
+, withVideoToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple VideoToolbox
 , withVidStab ? withFullDeps && withGPL # Video stabilization
 , withVmaf ? withFullDeps && !stdenv.isAarch64 && lib.versionAtLeast version "5" # Netflix's VMAF (Video Multi-Method Assessment Fusion)
 , withVoAmrwbenc ? withFullDeps && withVersion3 # AMR-WB encoder
@ -295,13 +302,10 @@
 /*
 *  Darwin frameworks
 */
+, AppKit
+, AudioToolbox
 , AVFoundation
-, Cocoa
-, CoreAudio
-, CoreMedia
-, CoreServices
-, MediaToolbox
-, VideoDecodeAcceleration
+, CoreImage
 , VideoToolbox
 /*
 *  Testing
@ -362,6 +366,11 @@ assert buildAvformat -> buildAvcodec && buildAvutil; # configure flag since 0.6
 assert buildPostproc -> buildAvutil;
 assert buildSwscale -> buildAvutil;

+/*
+ *  External Library dependencies
+ */
+assert (withCuda || withCuvid || withNvdec  || withNvenc) -> withNvcodec;
+
 stdenv.mkDerivation (finalAttrs: {
  pname = "ffmpeg" + (optionalString (ffmpegVariant != "small") "-${ffmpegVariant}");
  inherit version;
@ -507,22 +516,28 @@ stdenv.mkDerivation (finalAttrs: {
     */
    (enableFeature withAlsa "alsa")
    (enableFeature withAom "libaom")
+    (enableFeature withAppKit "appkit")
  ] ++ optionals (versionAtLeast version "6.1") [
    (enableFeature withAribcaption "libaribcaption")
  ] ++ [
    (enableFeature withAss "libass")
+    (enableFeature withAudioToolbox "audiotoolbox")
+    (enableFeature withAvFoundation "avfoundation")
    (enableFeature withBluray "libbluray")
    (enableFeature withBs2b "libbs2b")
    (enableFeature withBzlib "bzlib")
    (enableFeature withCaca "libcaca")
    (enableFeature withCelt "libcelt")
    (enableFeature withChromaprint "chromaprint")
+    (enableFeature withCoreImage "coreimage")
    (enableFeature withCuda "cuda")
    (enableFeature withCudaLLVM "cuda-llvm")
+    (enableFeature withCuvid "cuvid")
    (enableFeature withDav1d "libdav1d")
    (enableFeature withDc1394 "libdc1394")
    (enableFeature withDrm "libdrm")
    (enableFeature withFdkAac "libfdk-aac")
+    (enableFeature withNvcodec "ffnvcodec")
    (enableFeature withFlite "libflite")
    (enableFeature withFontconfig "fontconfig")
    (enableFeature withFontconfig "libfontconfig")
@ -543,7 +558,6 @@ stdenv.mkDerivation (finalAttrs: {
    (enableFeature withModplug "libmodplug")
    (enableFeature withMp3lame "libmp3lame")
    (enableFeature withMysofa "libmysofa")
-    (enableFeature withNvdec "cuvid")
    (enableFeature withNvdec "nvdec")
    (enableFeature withNvenc "nvenc")
    (enableFeature withOpenal "openal")
@ -585,6 +599,7 @@ stdenv.mkDerivation (finalAttrs: {
  ] ++ optionals (versionAtLeast version "6.0")  [
    (enableFeature withVpl "libvpl")
  ] ++ [
+    (enableFeature withVideoToolbox "videotoolbox")
    (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
    (enableFeature withVmaf "libvmaf")
    (enableFeature withVoAmrwbenc "libvo-amrwbenc")
@ -643,18 +658,23 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = []
  ++ optionals withAlsa [ alsa-lib ]
  ++ optionals withAom [ libaom ]
+  ++ optionals withAppKit [ AppKit ]
  ++ optionals withAribcaption [ libaribcaption ]
  ++ optionals withAss [ libass ]
+  ++ optionals withAudioToolbox [ AudioToolbox ]
+  ++ optionals withAvFoundation [ AVFoundation ]
  ++ optionals withBluray [ libbluray ]
  ++ optionals withBs2b [ libbs2b ]
  ++ optionals withBzlib [ bzip2 ]
  ++ optionals withCaca [ libcaca ]
  ++ optionals withCelt [ celt ]
  ++ optionals withChromaprint [ chromaprint ]
+  ++ optionals withCoreImage [ CoreImage ]
  ++ optionals withDav1d [ dav1d ]
  ++ optionals withDc1394 [ libdc1394 libraw1394 ]
  ++ optionals withDrm [ libdrm ]
  ++ optionals withFdkAac [ fdk_aac ]
+  ++ optionals withNvcodec [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
  ++ optionals withFlite [ flite ]
  ++ optionals withFontconfig [ fontconfig ]
  ++ optionals withFreetype [ freetype ]
@ -672,7 +692,6 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optionals withModplug [ libmodplug ]
  ++ optionals withMp3lame [ lame ]
  ++ optionals withMysofa [ libmysofa ]
-  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
  ++ optionals withOgg [ libogg ]
  ++ optionals withOpenal [ openal ]
  ++ optionals withOpencl [ ocl-icd opencl-headers ]
@ -702,6 +721,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optionals withV4l2 [ libv4l ]
  ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
  ++ optionals withVdpau [ libvdpau ]
+  ++ optionals withVideoToolbox [ VideoToolbox ]
  ++ optionals withVidStab [ vid-stab ]
  ++ optionals withVmaf [ libvmaf ]
  ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
@ -722,17 +742,7 @@ stdenv.mkDerivation (finalAttrs: {
  ++ optionals withZimg [ zimg ]
  ++ optionals withZlib [ zlib ]
  ++ optionals withZmq [ zeromq4 ]
-  ++ optionals stdenv.isDarwin [
-    # TODO fine-grained flags
-    AVFoundation
-    Cocoa
-    CoreAudio
-    CoreMedia
-    CoreServices
-    MediaToolbox
-    VideoDecodeAcceleration
-    VideoToolbox
-  ];
+  ;

  buildFlags = [ "all" ]
    ++ optional buildQtFaststart "tools/qt-faststart"; # Build qt-faststart executable
@ -800,7 +810,16 @@ stdenv.mkDerivation (finalAttrs: {
      ++ optional withGPLv3 gpl3Plus
      ++ optional withUnfree unfreeRedistributable
      ++ optional (withGPL && withUnfree) unfree;
-    pkgConfigModules = [ "libavutil" ];
+    pkgConfigModules = [ ]
+      ++ optional buildAvcodec "libavcodec"
+      ++ optional buildAvdevice "libavdevice"
+      ++ optional buildAvfilter "libavfilter"
+      ++ optional buildAvformat "libavformat"
+      ++ optional buildAvresample "libavresample"
+      ++ optional buildAvutil "libavutil"
+      ++ optional buildPostproc "libpostproc"
+      ++ optional buildSwresample "libswresample"
+      ++ optional buildSwscale "libswscale";
    platforms = platforms.all;
    # See https://github.com/NixOS/nixpkgs/pull/295344#issuecomment-1992263658
    broken = stdenv.hostPlatform.isMinGW && stdenv.hostPlatform.is64bit;
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@ -67,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
  ] ++ lib.optionals stdenv.isLinux [
    libcap
    libunwind
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [
    elfutils
  ] ++ lib.optionals stdenv.isDarwin [
    Cocoa
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@ -33,11 +33,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "8.3.0";
+  version = "8.4.0";

  src = fetchurl {
    url = "https://github.com/harfbuzz/harfbuzz/releases/download/${finalAttrs.version}/harfbuzz-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EJUB6uuL3j6tsl+rQWTpk/us4pw9d1vKocHlji8V+Ec=";
+    hash = "sha256-r06nPiWrdIyMBjt4wviOSIM9ubKsNp4pvRFXAueJdV4=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@ -8,11 +8,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "libaom";
-  version = "3.8.1";
+  version = "3.8.2";

  src = fetchzip {
    url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    hash = "sha256-qng9fEbm71HqPnPzfgqswSium9egIgpB6ZLesOQVg6c=";
+    hash = "sha256-x152jIe7QxeprFEFJnXBfou8yHuW0oHImLIVkSxByWw=";
    stripRoot = false;
  };

--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@ -44,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/libarchive/libarchive/commit/3bd918d92f8c34ba12de9c6604d96f9e262a59fc.patch";
      hash = "sha256-RM3xFM6S2DkM5DJ0kAba8eLzEXuY5/7AaU06maHJ6rM=";
    })
+    (fetchpatch {
+      name = "fix-suspicious-commit-from-known-bad-actor.patch";
+      url = "https://github.com/libarchive/libarchive/commit/6110e9c82d8ba830c3440f36b990483ceaaea52c.patch";
+      hash = "sha256-/j6rJ0xWhtXU0YCu1LOokxxNppy5Of6Q0XyO4U6la7M=";
+    })
  ];

  outputs = [ "out" "lib" "dev" ];
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libdeflate";
-  version = "1.19";
+  version = "1.20";

  src = fetchFromGitHub {
    owner = "ebiggers";
    repo = "libdeflate";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-HgZ2an1PCPhiLsd3ZA7tgZ1wVTOdHzDr8FHrqJhEbQw=";
+    sha256 = "sha256-kHLdu/Pb94+arj98Jjp57FpvWbAXW49s9cxCA1cf898=";
  };

  cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "-DLIBDEFLATE_BUILD_SHARED_LIB=OFF" ];
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@ -21,7 +21,7 @@

 stdenv.mkDerivation rec {
  pname = "libical";
-  version = "3.0.17";
+  version = "3.0.18";

  outputs = [ "out" "dev" ]; # "devdoc" ];

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    owner = "libical";
    repo = "libical";
    rev = "v${version}";
-    sha256 = "sha256-GqPCjI40kkqNv9zTnLdJgZVBxS4eZRHl+k/BN9vGnDo=";
+    sha256 = "sha256-32FNnCybXO67Vtg1LM6miJUaK+r0mlfjxgLQg1LD8Es=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@ -37,12 +37,12 @@ stdenv.mkDerivation rec {
    + lib.optionalString enableDarwinABICompat ''
      for iconv_h_in in iconv.h.in iconv.h.build.in; do
        substituteInPlace "include/$iconv_h_in" \
-          --replace "#define iconv libiconv" "" \
-          --replace "#define iconv_close libiconv_close" "" \
-          --replace "#define iconv_open libiconv_open" "" \
-          --replace "#define iconv_open_into libiconv_open_into" "" \
-          --replace "#define iconvctl libiconvctl" "" \
-          --replace "#define iconvlist libiconvlist" ""
+          --replace-fail "#define iconv libiconv" "" \
+          --replace-fail "#define iconv_close libiconv_close" "" \
+          --replace-fail "#define iconv_open libiconv_open" "" \
+          --replace-fail "#define iconv_open_into libiconv_open_into" "" \
+          --replace-fail "#define iconvctl libiconvctl" "" \
+          --replace-fail "#define iconvlist libiconvlist" ""
      done
    '';

--- a/pkgs/development/libraries/libimobiledevice-glue/default.nix
+++ b/pkgs/development/libraries/libimobiledevice-glue/default.nix
@ -8,7 +8,7 @@

 stdenv.mkDerivation rec {
  pname = "libimobiledevice-glue";
-  version = "1.0.0";
+  version = "1.2.0";

  outputs = [ "out" "dev" ];

@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    owner = "libimobiledevice";
    repo = pname;
    rev = version;
-    hash = "sha256-9TjIYz6w61JaJgOJtWteIDk9bO3NnXp/2ZJwdirFcYM=";
+    hash = "sha256-Rfs1i1Tt8uf3WfR+cDlF4L75nFHg9VypjMhHt0TgkyQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@ -8,15 +8,22 @@
 , libjpeg
 , libpng
 , libwebp
+, gdk-pixbuf
 , openexr_3
 , pkg-config
+, makeWrapper
 , zlib
 , asciidoc
 , graphviz
 , doxygen
 , python3
+, lcms2
 }:

+let
+  loadersPath = "${gdk-pixbuf.binaryDir}/jxl-loaders.cache";
+in
+
 stdenv.mkDerivation rec {
  pname = "libjxl";
  version = "0.9.1";
@ -37,6 +44,8 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    cmake
    pkg-config
+    gdk-pixbuf
+    makeWrapper
    asciidoc
    doxygen
    python3
@ -63,12 +72,14 @@ stdenv.mkDerivation rec {
  # conclusively in its README or otherwise; they can best be determined
  # by checking the CMake output for "Could NOT find".
  buildInputs = [
+    lcms2
    giflib
    gperftools # provides `libtcmalloc`
    gtest
    libjpeg
    libpng
    libwebp
+    gdk-pixbuf
    openexr_3
    zlib
  ];
@ -96,17 +107,30 @@ stdenv.mkDerivation rec {
    # Viewer tools for evaluation.
    # "-DJPEGXL_ENABLE_VIEWERS=ON"

-    # TODO: Update this package to enable this (overridably via an option):
    # Enable plugins, such as:
    # * the `gdk-pixbuf` one, which allows applications like `eog` to load jpeg-xl files
    # * the `gimp` one, which allows GIMP to load jpeg-xl files
-    # "-DJPEGXL_ENABLE_PLUGINS=ON"
+    "-DJPEGXL_ENABLE_PLUGINS=ON"
  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
    "-DJPEGXL_STATIC=ON"
  ] ++ lib.optionals stdenv.hostPlatform.isAarch32 [
    "-DJPEGXL_FORCE_NEON=ON"
  ];

+  postPatch = ''
+    substituteInPlace plugins/gdk-pixbuf/jxl.thumbnailer \
+      --replace '/usr/bin/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-jxl"
+  '';
+
+  postInstall = ''
+    GDK_PIXBUF_MODULEDIR="$out/${gdk-pixbuf.moduleDir}" \
+    GDK_PIXBUF_MODULE_FILE="$out/${loadersPath}" \
+      gdk-pixbuf-query-loaders --update-cache
+    mkdir -p "$out/bin"
+    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-jxl" \
+      --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
+  '';
+
  CXXFLAGS = lib.optionalString stdenv.hostPlatform.isAarch32 "-mfp16-format=ieee";

  # FIXME x86_64-darwin:
--- a/pkgs/development/libraries/liblc3/default.nix
+++ b/pkgs/development/libraries/liblc3/default.nix
@ -7,7 +7,7 @@

 let
  name = "liblc3";
-  version = "1.0.4";
+  version = "1.1.0";
 in
 stdenv.mkDerivation {
  pname = name;
@ -17,7 +17,7 @@ stdenv.mkDerivation {
    owner = "google";
    repo = "liblc3";
    rev = "v${version}";
-    sha256 = "sha256-nQJgF/cWoCx5TkX4xOaLB9SzvhVXPY29bLh7UwPMWEE=";
+    sha256 = "sha256-pKd9wOrDjKhWX8vTsg6qkE71FQlsC7VM/uq0ss1vsAQ=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libplist/default.nix
+++ b/pkgs/development/libraries/libplist/default.nix
@ -10,7 +10,7 @@

 stdenv.mkDerivation rec {
  pname = "libplist";
-  version = "2.3.0";
+  version = "2.4.0";

  outputs = [ "bin" "dev" "out" ] ++ lib.optional enablePython "py";

@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    owner = "libimobiledevice";
    repo = pname;
    rev = version;
-    hash = "sha256-fZfDSWVRg73dN+WF6LbgRSj8vtyeKeyjC8pWXFxUmBg=";
+    hash = "sha256-bH40HSp76w56tlxO5M1INAW4wRR7O27AY4H/CyEcp+Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@ -1,83 +1,122 @@
 { lib
-, stdenv
+, _experimental-update-script-combinators
+, curl
+, darwin
+, duktape
 , fetchFromGitHub
 , fetchpatch
-, pkg-config
-, cmake
-, zlib
-, dbus
-, networkmanager
-, enableJavaScript ? stdenv.isDarwin || lib.meta.availableOn stdenv.hostPlatform duktape
-, duktape
-, pcre
-, gsettings-desktop-schemas
+, gi-docgen
+, gitUpdater
 , glib
-, makeWrapper
-, python3
-, SystemConfiguration
-, CoreFoundation
-, JavaScriptCore
+, gobject-introspection
+, gsettings-desktop-schemas
+, makeHardcodeGsettingsPatch
+, meson
+, ninja
+, pkg-config
+, stdenv
+, substituteAll
+, vala
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libproxy";
-  version = "0.4.18";
+  version = "0.5.3";
+
+  outputs = [ "out" "dev" "devdoc" ];

  src = fetchFromGitHub {
    owner = "libproxy";
    repo = "libproxy";
-    rev = version;
-    hash = "sha256-pqj1LwRdOK2CUu3hYIsogQIXxWzShDuKEbDTbtWkgnQ=";
+    rev = finalAttrs.version;
+    hash = "sha256-qdYB6HJkgboS8kkTvTqLy6Z3JYY5SOJsRl6nZM0iuvw=";
  };

-  patches = lib.optionals stdenv.isDarwin [
-    # https://github.com/libproxy/libproxy/pull/189
+  patches = [
+    # Minor refactoring. Allows the following patches to apply without rebasing.
    (fetchpatch {
-      url = "https://github.com/libproxy/libproxy/commit/4331b9db427ce2c25ff5eeb597bec4bc35ed1a0b.patch";
-      sha256 = "sha256-uTh3rYVvEke1iWVHsT3Zj2H1F+gyLrffcmyt0JEKaCA=";
+      url = "https://github.com/libproxy/libproxy/commit/397f4dc72607cc1bb3b584ffd3de49f8ba80491a.patch";
+      hash = "sha256-iUMBMpcVOLG+NxEj8Nd7JtKZFmoGXn0t6A2r2ayiteg=";
+      includes = [
+        "src/backend/plugins/config-gnome/config-gnome.c"
+      ];
+    })
+
+    # Disable schema presence detection, it would fail because it cannot be autopatched,
+    # and it will be hardcoded by the next patch anyway.
+    ./skip-gsettings-detection.patch
+
+    # Hardcode path to Settings schemas for GNOME & related desktops.
+    # Otherwise every app using libproxy would need to be wrapped individually.
+    (substituteAll {
+      src = ./hardcode-gsettings.patch;
+      gds = glib.getSchemaPath gsettings-desktop-schemas;
    })
  ];

-  outputs = [ "out" "dev" "py3" ];
-
  nativeBuildInputs = [
+    gi-docgen
+    gobject-introspection
+    meson
+    ninja
    pkg-config
-    cmake
-    makeWrapper
+    vala
  ];

  buildInputs = [
-    pcre
-    python3
-    zlib
-  ] ++ lib.optionals enableJavaScript [
-    (if stdenv.hostPlatform.isDarwin then JavaScriptCore else duktape)
-  ] ++ (if stdenv.hostPlatform.isDarwin then [
-    SystemConfiguration
+    curl
+    duktape
+  ] ++ (if stdenv.hostPlatform.isDarwin then (with darwin.apple_sdk.frameworks; [
    CoreFoundation
-  ] else [
+    SystemConfiguration
+  ]) else [
    glib
-    dbus
-    networkmanager
+    gsettings-desktop-schemas
  ]);

-  cmakeFlags = [
-    "-DWITH_PYTHON2=OFF"
-    "-DPYTHON3_SITEPKG_DIR=${placeholder "py3"}/${python3.sitePackages}"
-  ] ++ lib.optional (enableJavaScript && !stdenv.hostPlatform.isDarwin) "-DWITH_MOZJS=ON";
+  doCheck = true;

-  postFixup = lib.optionalString stdenv.isLinux ''
-    # config_gnome3 uses the helper to find GNOME proxy settings
-    wrapProgram $out/libexec/pxgsettings --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"
+  postPatch = ''
+    # Fix running script that will try to install git hooks.
+    # Though it will not do anything since we do not keep .git/ directory.
+    # https://github.com/libproxy/libproxy/issues/262
+    chmod +x data/install-git-hook.sh
+    patchShebangs data/install-git-hook.sh
  '';

-  doCheck = false; # fails 1 out of 10 tests
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
+  passthru = {
+    hardcodeGsettingsPatch = makeHardcodeGsettingsPatch {
+      schemaIdToVariableMapping = {
+        "org.gnome.system.proxy" = "gds";
+        "org.gnome.system.proxy.http" = "gds";
+        "org.gnome.system.proxy.https" = "gds";
+        "org.gnome.system.proxy.ftp" = "gds";
+        "org.gnome.system.proxy.socks" = "gds";
+      };
+      inherit (finalAttrs) src;
+    };
+
+    updateScript =
+      let
+        updateSource = gitUpdater { };
+        updatePatch = _experimental-update-script-combinators.copyAttrOutputToFile "libproxy.hardcodeGsettingsPatch" ./hardcode-gsettings.patch;
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updatePatch
+      ];
+  };

  meta = with lib; {
-    platforms = platforms.linux ++ platforms.darwin;
-    license = licenses.lgpl21;
-    homepage = "https://libproxy.github.io/libproxy/";
    description = "A library that provides automatic proxy configuration management";
+    homepage = "https://libproxy.github.io/libproxy/";
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux ++ platforms.darwin;
    mainProgram = "proxy";
  };
-}
+})
--- a/pkgs/development/libraries/libproxy/hardcode-gsettings.patch
+++ b/pkgs/development/libraries/libproxy/hardcode-gsettings.patch
@ -0,0 +1,140 @@
+diff --git a/src/backend/plugins/config-gnome/config-gnome.c b/src/backend/plugins/config-gnome/config-gnome.c
+index 820827b..338e269 100644
+--- a/src/backend/plugins/config-gnome/config-gnome.c
+++ b/src/backend/plugins/config-gnome/config-gnome.c
+@@ -85,11 +85,60 @@ px_config_gnome_init (PxConfigGnome *self)
+   if (!self->available)
+     return;
+ 
+-  self->proxy_settings = g_settings_new ("org.gnome.system.proxy");
+-  self->http_proxy_settings = g_settings_new ("org.gnome.system.proxy.http");
+-  self->https_proxy_settings = g_settings_new ("org.gnome.system.proxy.https");
+-  self->ftp_proxy_settings = g_settings_new ("org.gnome.system.proxy.ftp");
+-  self->socks_proxy_settings = g_settings_new ("org.gnome.system.proxy.socks");
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy", FALSE);
+    self->proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy.http",
+                                             FALSE);
+    self->http_proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy.https",
+                                             FALSE);
+    self->https_proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy.ftp",
+                                             FALSE);
+    self->ftp_proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy.socks",
+                                             FALSE);
+    self->socks_proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+ }
+ 
+ static void
+diff --git a/tests/config-gnome-test.c b/tests/config-gnome-test.c
+index f80914a..118d429 100644
+--- a/tests/config-gnome-test.c
+++ b/tests/config-gnome-test.c
+@@ -60,11 +60,60 @@ static void
+ fixture_setup (Fixture       *self,
+                gconstpointer  data)
+ {
+-  self->proxy_settings = g_settings_new ("org.gnome.system.proxy");
+-  self->http_proxy_settings = g_settings_new ("org.gnome.system.proxy.http");
+-  self->https_proxy_settings = g_settings_new ("org.gnome.system.proxy.https");
+-  self->ftp_proxy_settings = g_settings_new ("org.gnome.system.proxy.ftp");
+-  self->socks_proxy_settings = g_settings_new ("org.gnome.system.proxy.socks");
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy", FALSE);
+    self->proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy.http",
+                                             FALSE);
+    self->http_proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy.https",
+                                             FALSE);
+    self->https_proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy.ftp",
+                                             FALSE);
+    self->ftp_proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@gds@",
+                                                                g_settings_schema_source_get_default(),
+                                                                TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source,
+                                             "org.gnome.system.proxy.socks",
+                                             FALSE);
+    self->socks_proxy_settings = g_settings_new_full(schema, NULL, NULL);
+  }
+ }
+ 
+ static void
--- a/pkgs/development/libraries/libproxy/skip-gsettings-detection.patch
+++ b/pkgs/development/libraries/libproxy/skip-gsettings-detection.patch
@ -0,0 +1,29 @@
+diff --git a/src/backend/plugins/config-gnome/config-gnome.c b/src/backend/plugins/config-gnome/config-gnome.c
+index 52e812e..a1edcab 100644
+--- a/src/backend/plugins/config-gnome/config-gnome.c
+++ b/src/backend/plugins/config-gnome/config-gnome.c
+@@ -57,7 +57,6 @@ enum {
+ static void
+ px_config_gnome_init (PxConfigGnome *self)
+ {
+-  GSettingsSchemaSource *source;
+   g_autoptr (GSettingsSchema) proxy_schema = NULL;
+   const char *desktops;
+ 
+@@ -71,15 +70,7 @@ px_config_gnome_init (PxConfigGnome *self)
+   if (strstr (desktops, "GNOME") == NULL)
+     return;
+ 
+-  source = g_settings_schema_source_get_default ();
+-  if (!source) {
+-    g_warning ("GNOME desktop detected but no schemes installed, aborting.");
+-    return;
+-  }
+-
+-  proxy_schema = g_settings_schema_source_lookup (source, "org.gnome.system.proxy", TRUE);
+-
+-  self->available = proxy_schema != NULL;
+  self->available = TRUE;
+   if (!self->available)
+     return;
+ 
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@ -42,7 +42,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "librsvg";
-  version = "2.57.92";
+  version = "2.58.0";

  outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
    "devdoc"
@ -50,13 +50,13 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Kiwwvqvzz91ApKbb7T+zPmd8ruXY8wR4gkm3Mee+OFI=";
+    hash = "sha256-18REqSZAa1l5C+DerhluGO0mBZ2lc/oaqeycp2WKVZw=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit (finalAttrs) src;
    name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-yJf3V2dPwI+RcDH6Lh/AhUgaisdbTnzdAFt+SeNw9NY=";
+    hash = "sha256-ta+3KkDtqTLGoKknUn89c+3XHzvcZyPFPFpgLH5f5uw=";
    # TODO: move this to fetchCargoTarball
    dontConfigure = true;
  };
--- a/pkgs/development/libraries/libsamplerate/default.nix
+++ b/pkgs/development/libraries/libsamplerate/default.nix
@ -5,11 +5,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "libsamplerate";
-  version = "0.1.9";
+  version = "0.2.2";

  src = fetchurl {
-    url = "http://www.mega-nerd.com/SRC/${pname}-${version}.tar.gz";
-    sha256 = "1ha46i0nbibq0pl0pjwcqiyny4hj8lp1bnl4dpxm64zjw9lb2zha";
+    url = "https://github.com/libsndfile/libsamplerate/releases/download/${version}/libsamplerate-${version}.tar.xz";
+    hash = "sha256-MljaKAUR0ktJ1rCGFbvoJNDKzJhCsOTK8RxSzysEOJM=";
  };

  nativeBuildInputs = [ pkg-config ];
@ -18,20 +18,17 @@ in stdenv.mkDerivation rec {

  configureFlags = [ "--disable-fftw" ];

-  outputs = [ "bin" "dev" "out" ];
+  outputs = [ "dev" "out" ];

  postConfigure = optionalString stdenv.isDarwin ''
    # need headers from the Carbon.framework in /System/Library/Frameworks to
    # compile this on darwin -- not sure how to handle
    NIX_CFLAGS_COMPILE+=" -I${Carbon}/Library/Frameworks/Carbon.framework/Headers"
-
-    substituteInPlace examples/Makefile --replace "-fpascal-strings" ""
  '';

  meta = with lib; {
    description = "Sample Rate Converter for audio";
-    mainProgram = "sndfile-resample";
-    homepage    = "http://www.mega-nerd.com/SRC/index.html";
+    homepage    = "https://libsndfile.github.io/libsamplerate/";
    license     = licenses.bsd2;
    maintainers = with maintainers; [ lovek323 ];
    platforms   = platforms.all;
--- a/pkgs/development/libraries/mesa/backport-radeon-crash-fix.patch
+++ b/pkgs/development/libraries/mesa/backport-radeon-crash-fix.patch
@ -1,13 +0,0 @@
-diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-index 2e1d9c488e2..7979cad75fa 100644
--- a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-+++ b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
-@@ -729,7 +729,7 @@ bool radeon_bo_can_reclaim_slab(void *priv, struct pb_slab_entry *entry)
- {
-    struct radeon_bo *bo = container_of(entry, struct radeon_bo, u.slab.entry);
- 
-   return radeon_bo_can_reclaim(NULL, &bo->base);
-+   return radeon_bo_can_reclaim(priv, &bo->base);
- }
- 
- static void radeon_bo_slab_destroy(void *winsys, struct pb_buffer_lean *_buf)
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -81,8 +81,8 @@
 # nix build .#mesa .#pkgsi686Linux.mesa .#pkgsCross.aarch64-multiplatform.mesa .#pkgsMusl.mesa

 let
-  version = "24.0.3";
-  hash = "sha256-d67JoqN7fTWW6hZAs8xT0LXZs7Uqvtid4H43F+kb/b4=";
+  version = "24.0.4";
+  hash = "sha256-kP69MKCYy82X/2Lsw9z1yT129/oxTelEz86BlRunRfA=";

  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
@ -141,11 +141,6 @@ self = stdenv.mkDerivation {

  patches = [
    ./opencl.patch
-
-    # Backport crash fix for Radeon (legacy) kernel driver
-    # see https://gitlab.freedesktop.org/mesa/mesa/-/issues/10613
-    # FIXME: remove when merged upstream
-    ./backport-radeon-crash-fix.patch
  ];

  postPatch = ''
@ -254,7 +249,8 @@ self = stdenv.mkDerivation {
  ] ++ [
    python3Packages.python # for shebang
  ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ elfutils libomxil-bellagio libva-minimal udev lm_sensors ]
+    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform elfutils) [ elfutils ]
    ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator ]
    ++ lib.optional withValgrind valgrind-light
    ++ lib.optional haveZink vulkan-loader
--- a/pkgs/development/libraries/mtdev/default.nix
+++ b/pkgs/development/libraries/mtdev/default.nix
@ -1,16 +1,26 @@
-{ lib, stdenv, fetchurl, evdev-proto }:
+{ lib
+, stdenv
+, fetchurl
+, evdev-proto
+, gitUpdater
+}:

 stdenv.mkDerivation rec {
  pname = "mtdev";
-  version = "1.1.6";
+  version = "1.1.7";

  src = fetchurl {
    url = "https://bitmath.org/code/mtdev/${pname}-${version}.tar.bz2";
-    sha256 = "1q700h9dqcm3zl6c3gj0qxxjcx6ibw2c51wjijydhwdcm26v5mqm";
+    hash = "sha256-oQetrSEB/srFSsf58OCg3RVdlUGT2lXCNAyX8v8dgU4=";
  };

  buildInputs = lib.optional stdenv.hostPlatform.isFreeBSD evdev-proto;

+  passthru.updateScript = gitUpdater {
+    url = "https://bitmath.org/git/mtdev.git";
+    rev-prefix = "v";
+  };
+
  meta = with lib; {
    homepage = "https://bitmath.org/code/mtdev/";
    description = "Multitouch Protocol Translation Library";
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@ -32,11 +32,11 @@ assert enableJemalloc -> enableApp;

 stdenv.mkDerivation rec {
  pname = "nghttp2";
-  version = "1.60.0";
+  version = "1.61.0";

  src = fetchurl {
    url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-W4wmgdQstLMcs+DaDggb+jAl1cNZKN6PYHAVUgFbAM4=";
+    sha256 = "sha256-Toz37DLUxaQwlmJC1yA10lXNlHCodm1h7tegGQ3VRP0=";
  };

  outputs = [ "out" "dev" "lib" "doc" "man" ];
--- a/pkgs/development/libraries/npth/default.nix
+++ b/pkgs/development/libraries/npth/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook }:
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, pkgsCross }:

 stdenv.mkDerivation rec {
  pname = "npth";
@ -21,6 +21,10 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  passthru.tests = {
+    musl = pkgsCross.musl64.npth;
+  };
+
  meta = with lib; {
    description = "The New GNU Portable Threads Library";
    mainProgram = "npth-config";
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "openexr";
-  version = "3.2.2";
+  version = "3.2.4";

  src = fetchFromGitHub {
    owner = "AcademySoftwareFoundation";
    repo = "openexr";
    rev = "v${version}";
-    hash = "sha256-7KBjZpImSaW4GiK0ZCpMcjBPQ9aMmN5LW+/m6lkGK68=";
+    hash = "sha256-mVUxxYe6teiJ18PQ9703/kjBpJ9+a7vcDme+NwtQQQM=";
  };

  outputs = [ "bin" "dev" "out" "doc" ];
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@ -13,6 +13,16 @@ stdenv.mkDerivation rec {
    hash = "sha256-4qU5hP8LB9/bWuRIa7ubIcyo598kNAlsyb8bcow1C8s=";
  };

+  postPatch = ''
+    # Fix jit autodetection:
+    #   https://github.com/PCRE2Project/pcre2/pull/396
+    # Applying manually to avoid fetchpatch and autoreconfHook.
+    # TODO: remove once 10.44 is released
+    substituteInPlace configure --replace-fail \
+      '#include "src/sljit/sljitConfigInternal.h"' \
+      '#include "src/sljit/sljitConfigCPU.h"'
+  '';
+
  configureFlags = [
    "--enable-pcre2-16"
    "--enable-pcre2-32"
--- a/Show More
+++ b/Show More