Merge #285983: staging-next 2024-02-03

.git-blame-ignore-revs

@@ -96,3 +96,9 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 
 # nixos/*: add trivial defaultText for options with simple defaults
 25124556397ba17bfd70297000270de1e6523b0a
+
+# systemd: rewrite comments
+92dfeb7b3dab820ae307c56c216d175c69ee93cd
+
+# systemd: break too long lines of Nix code
+67643f8ec84bef1482204709073e417c9f07eb87

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -8,6 +8,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `cryptsetup` has been upgraded from 2.6.1 to 2.7.0. Cryptsetup is a critical component enabling LUKS-based (but not only) full disk encryption.
+  Take the time to review [the release notes](https://gitlab.com/cryptsetup/cryptsetup/-/raw/v2.7.0/docs/v2.7.0-ReleaseNotes).
+  One of the highlight is that it is now possible to use hardware OPAL-based encryption of your disk with `cryptsetup`, it has a lot of caveats, see the above notes for the full details.
+
 - `screen`'s module has been cleaned, and will now require you to set `programs.screen.enable` in order to populate `screenrc` and add the program to the environment.
 
 - `linuxPackages_testing_bcachefs` is now fully deprecated by `linuxPackages_latest`, and is therefore no longer available.
@@ -258,6 +262,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   After upgrading, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all user accounts to strong password hashes.
   Support for weak password hashes will be removed in NixOS 24.11.
 
+- A stdenv's default set of hardening flags can now be set via its `bintools-wrapper`'s `defaultHardeningFlags` argument. A convenient stdenv adapter, `withDefaultHardeningFlags`, can be used to override an existing stdenv's `defaultHardeningFlags`.
+
 - `libass` now uses the native CoreText backend on Darwin, which may fix subtitle rendering issues with `mpv`, `ffmpeg`, etc.
 
 - [Lilypond](https://lilypond.org/index.html) and [Denemo](https://www.denemo.org) are now compiled with Guile 3.0.
@@ -282,6 +288,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `stdenv`: The `--replace` flag in `substitute`, `substituteInPlace`, `substituteAll`, `substituteAllStream`, and `substituteStream` is now deprecated if favor of the new `--replace-fail`, `--replace-warn` and `--replace-quiet`. The deprecated `--replace` equates to `--replace-warn`.
 
+- A new hardening flag, `zerocallusedregs` was made available, corresponding to the gcc/clang option `-fzero-call-used-regs=used-gpr`.
+
 - New options were added to the dnsdist module to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
   The module can generate the DNSCrypt provider key pair, certificates and also performs their rotation automatically with no downtime.
 
@@ -298,6 +306,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   `globalRedirect` can now have redirect codes other than 301 through
   `redirectCode`.
 
+- `libjxl` 0.9.0 [dropped support for the butteraugli API](https://github.com/libjxl/libjxl/pull/2576). You will no longer be able to set `enableButteraugli` on `libaom`.
+
 - The source of the `mockgen` package has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
 
 - `security.pam.enableSSHAgentAuth` was renamed to `security.pam.sshAgentAuth.enable` and an `authorizedKeysFiles`
@@ -306,6 +316,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [](#opt-boot.kernel.sysctl._net.core.wmem_max_) changed from a string to an integer because of the addition of a custom merge option (taking the highest value defined to avoid conflicts between 2 services trying to set that value), just as [](#opt-boot.kernel.sysctl._net.core.rmem_max_) since 22.11.
 
+- A new top-level package set, `pkgsExtraHardening` is added. This is a set of packages built with stricter hardening flags - those that have not yet received enough testing to be applied universally, those that are more likely to cause build failures or those that have drawbacks to their use (e.g. performance or required hardware features).
+
 - `services.zfs.zed.enableMail` now uses the global `sendmail` wrapper defined by an email module
   (such as msmtp or Postfix). It no longer requires using a special ZFS build with email support.
 

nixos/modules/services/hardware/pcscd.nix

@@ -46,8 +46,8 @@ in
   config = mkIf config.services.pcscd.enable {
     environment.etc."reader.conf".source = cfgFile;
 
-    environment.systemPackages = [ package.out ];
-    systemd.packages = [ (getBin package) ];
+    environment.systemPackages = [ package ];
+    systemd.packages = [ package ];
 
     services.pcscd.plugins = [ pkgs.ccid ];
 
@@ -64,7 +64,7 @@ in
       # around it, we force the path to the cfgFile.
       #
       # https://github.com/NixOS/nixpkgs/issues/121088
-      serviceConfig.ExecStart = [ "" "${getBin package}/bin/pcscd -f -x -c ${cfgFile}" ];
+      serviceConfig.ExecStart = [ "" "${package}/bin/pcscd -f -x -c ${cfgFile}" ];
     };
   };
 }

nixos/modules/services/networking/dhcpcd.nix

@@ -219,6 +219,8 @@ in
       '';
     } ];
 
+    environment.etc."dhcpcd.conf".source = dhcpcdConf;
+
     systemd.services.dhcpcd = let
       cfgN = config.networking;
       hasDefaultGatewaySet = (cfgN.defaultGateway != null && cfgN.defaultGateway.address != "")

pkgs/applications/editors/ed/sources.nix

@@ -23,10 +23,10 @@ in
 {
   ed = let
     pname = "ed";
-    version = "1.19";
+    version = "1.20";
     src = fetchurl {
       url = "mirror://gnu/ed/ed-${version}.tar.lz";
-      hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
+      hash = "sha256-xgMN7+auFy8Wh5Btc1QFTHWmqRMK8xnU5zxQqRlZxaY=";
     };
   in import ./generic.nix {
     inherit pname version src meta;

pkgs/applications/editors/emacs/sources.nix

@@ -77,10 +77,10 @@ in
 
   emacs29 = import ./make-emacs.nix (mkArgs {
     pname = "emacs";
-    version = "29.1";
+    version = "29.2";
     variant = "mainline";
-    rev = "29.1";
-    hash = "sha256-3HDCwtOKvkXwSULf3W7YgTz4GV8zvYnh2RrL28qzGKg=";
+    rev = "29.2";
+    hash = "sha256-qSQmQzVyEGSr4GAI6rqnEwBvhl09D2D8MNasHqZQPL8=";
   });
 
   emacs28-macport = import ./make-emacs.nix (mkArgs {

pkgs/applications/graphics/krita/generic.nix

@@ -28,6 +28,12 @@ mkDerivation rec {
       url = "https://invent.kde.org/graphics/krita/-/commit/2d71c47661d43a4e3c1ab0c27803de980bdf2bb2.diff";
       hash = "sha256-U3E44nj4vra++PJV20h4YHjES78kgrJtr4ktNeQfOdA=";
     })
+    # Fixes build with libjxl 0.9.0
+    (fetchpatch {
+      name = "fix-build-with-libjxl-0.9.0.patch";
+      url = "https://invent.kde.org/graphics/krita/-/commit/ace7edcca6ad322581ab39620f21ccf3ffbd3b5a.diff";
+      hash = "sha256-dXk4+HNS0+Ie/8V4+Oj4rBJrJbNHG57gIzPymXLEc9M=";
+    })
   ];
 
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip makeWrapper ];

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format)
+  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -110,6 +110,10 @@ for flag in "${!hardeningEnableMap[@]}"; do
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
       hardeningCFlagsBefore+=('-Wformat' '-Wformat-security' '-Werror=format-security')
       ;;
+    zerocallusedregs)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling zerocallusedregs >&2; fi
+      hardeningCFlagsBefore+=('-fzero-call-used-regs=used-gpr')
+      ;;
     *)
       # Ignore unsupported. Checked in Nix that at least *some*
       # tool supports each flag.

pkgs/build-support/cc-wrapper/default.nix

@@ -223,6 +223,15 @@ let
 
   defaultHardeningFlags = bintools.defaultHardeningFlags or [];
 
+  # if cc.hardeningUnsupportedFlagsByTargetPlatform exists, this is
+  # called with the targetPlatform as an argument and
+  # cc.hardeningUnsupportedFlags is completely ignored - the function
+  # is responsible for including the constant hardeningUnsupportedFlags
+  # list however it sees fit.
+  ccHardeningUnsupportedFlags = if cc ? hardeningUnsupportedFlagsByTargetPlatform
+    then cc.hardeningUnsupportedFlagsByTargetPlatform targetPlatform
+    else (cc.hardeningUnsupportedFlags or []);
+
   darwinPlatformForCC = optionalString stdenv.targetPlatform.isDarwin (
     if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx"
     else targetPlatform.darwinPlatform
@@ -584,7 +593,7 @@ stdenv.mkDerivation {
     ## Hardening support
     ##
     + ''
-      export hardening_unsupported_flags="${builtins.concatStringsSep " " (cc.hardeningUnsupportedFlags or [])}"
+      export hardening_unsupported_flags="${builtins.concatStringsSep " " ccHardeningUnsupportedFlags}"
     ''
 
     # Machine flags. These are necessary to support

pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh

@@ -4,7 +4,7 @@ defaultSysroot=(@sysroot@)
 
 for arg; do
     case "$arg" in
-        --sysroot)
+        --sysroot|--sysroot=*)
             defaultSysroot=()
             ;;
         --)

pkgs/by-name/al/alsa-lib/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.9";
+  version = "1.2.11";
 
   src = fetchurl {
     url = "mirror://alsa/lib/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-3JxkP9xMz9BXLMaFhY3UHgivtYPzBGCzF+QYgnX2FbI=";
+    hash = "sha256-nz8vabmV+a03NZBy+8aaOoi/uggfyD6b4w4UZieVu00=";
   };
 
   patches = [

pkgs/by-name/al/alsa-ucm-conf/package.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "alsa-ucm-conf";
@@ -9,6 +9,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-nCHj8B/wC6p1jfF+hnzTbiTrtBpr7ElzfpkQXhbyrpc=";
   };
 
+  patches = [
+    (fetchpatch {
+      # ToDo: Remove this patch in the next package upgrade
+      # Fixes SplitPCM to make some audio devices work with alsa-ucm-conf v1.2.10 again
+      name = "alsa-ucm-conf-splitpcm-device-argument-fix.patch";
+      url = "https://github.com/alsa-project/alsa-ucm-conf/commit/b68aa52acdd2763fedad5eec0f435fbf43e5ccc6.patch";
+      hash = "sha256-8WE4+uhi4W7cCSZYmL7uFpcHJ9muX09UkGXyZIpEd9I=";
+    })
+  ];
+
   dontBuild = true;
 
   installPhase = ''

pkgs/by-name/bl/bluez/package.nix

@@ -5,7 +5,6 @@
 , docutils
 , ell
 , enableExperimental ? false
-, fetchpatch
 , fetchurl
 , glib
 , json_c
@@ -19,13 +18,23 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez";
-  version = "5.71";
+  version = "5.72";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-uCjUGMk87R9Vthb7VILPAVN0QL+zT72hpWTz7OlHNdg=";
+    hash = "sha256-SZ1/o0WplsG7ZQ9cZ0nh2SkRH6bs4L4OmGh/7mEkU24=";
   };
 
+  patches =
+    # Disable one failing test with musl libc, also seen by alpine
+    # https://github.com/bluez/bluez/issues/726
+    lib.optional (stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isx86_64)
+      (fetchurl {
+        url = "https://git.alpinelinux.org/aports/plain/main/bluez/disable_aics_unit_testcases.patch?id=8e96f7faf01a45f0ad8449c1cd825db63a8dfd48";
+        hash = "sha256-1PJkipqBO3qxxOqRFQKfpWlne1kzTCgtnTFYI1cFQt4=";
+      })
+  ;
+
   buildInputs = [
     alsa-lib
     dbus
@@ -41,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     docutils
     pkg-config
+    python3.pkgs.pygments
     python3.pkgs.wrapPython
   ];
 

pkgs/by-name/cm/cmake/package.nix

@@ -46,11 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.27.8";
+  version = "3.27.9";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/s4kVj9peHD7uYLqi/F0gsnV+FXYyb8LgkY9dsno0Mw=";
+    hash = "sha256-YJqbmFcqal6kd/kSz/uXMQntTQpqaz+eI1PSzcBIcI4=";
   };
 
   patches = [
@@ -68,6 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.isDarwin ./006-darwin-always-set-runtime-c-flag.diff;
 
   outputs = [ "out" ] ++ lib.optionals buildDocs [ "man" "info" ];
+  separateDebugInfo = true;
   setOutputFlags = false;
 
   setupHooks = [

pkgs/by-name/li/libcamera/package.nix

@@ -1,7 +1,7 @@
 { stdenv
 , fetchgit
-, fetchpatch
 , lib
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -18,29 +18,23 @@
 , python3
 , python3Packages
 , systemd # for libudev
+, withQcam ? false
+, qt5 # withQcam
+, libtiff # withQcam
 }:
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-icHZtv25QvJEv0DlELT3cDxho3Oz2BJAMNKr5W4bshk=";
+    hash = "sha256-x0Im9m9MoACJhQKorMI34YQ+/bd62NdAPc2nWwaJAvM=";
   };
 
   outputs = [ "out" "dev" "doc" ];
 
-  patches = [
-    (fetchpatch {
-      # https://git.libcamera.org/libcamera/libcamera.git/commit/?id=6cb92b523bd60bd7718df134cc5b1eff51cf42e5
-      name = "libcamera-sphinx7.0-compat.patch";
-      url = "https://git.libcamera.org/libcamera/libcamera.git/patch/?id=6cb92b523bd60bd7718df134cc5b1eff51cf42e5";
-      hash = "sha256-gs0EiT3gWlmRjDim+o2C0VmnoWqEouP5pNTD4XbNSdE=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs utils/
   '';
@@ -69,7 +63,7 @@ stdenv.mkDerivation rec {
     libyaml
 
     gtest
-  ];
+  ] ++ lib.optionals withQcam [ libtiff qt5.qtbase qt5.qttools ];
 
   nativeBuildInputs = [
     meson
@@ -83,22 +77,22 @@ stdenv.mkDerivation rec {
     graphviz
     doxygen
     openssl
-  ];
+  ] ++ lib.optional withQcam qt5.wrapQtAppsHook;
 
   mesonFlags = [
     "-Dv4l2=true"
-    "-Dqcam=disabled"
+    "-Dqcam=${if withQcam then "enabled" else "disabled"}"
     "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
     # Avoid blanket -Werror to evade build failures on less
     # tested compilers.
     "-Dwerror=false"
-    ];
+  ];
 
   # Fixes error on a deprecated declaration
   env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
 
   # Silence fontconfig warnings about missing config
-  FONTCONFIG_FILE = makeFontsConf { fontDirectories = []; };
+  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
 
   # libcamera signs the IPA module libraries at install time, but they are then
   # modified by stripping and RPATH fixup. Therefore, we need to generate the

pkgs/by-name/ti/tinycompress/package.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tinycompress";
-  version = "1.2.8";
+  version = "1.2.11";
 
   src = fetchurl {
     url = "mirror://alsa/tinycompress/${pname}-${version}.tar.bz2";
-    hash = "sha256-L4l+URLNO8pnkLXOz9puBmLIvF7g+6uXKyR6DMYg1mw=";
+    hash = "sha256-6754jCgyjnzKJFqvkZSlrQ3JHp4NyIPCz5/rbULJ8/w=";
   };
 
   meta = with lib; {

pkgs/data/misc/publicsuffix-list/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "unstable-2023-02-16";
+  version = "0-unstable-2024-01-07";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "8ec4d3049fe139f92937b6137155c33b81dcaf18";
-    hash = "sha256-wA8zk0iADFNP33veIf+Mfx22zdMzHsMNWEizMp1SnuA=";
+    rev = "5db9b65997e3c9230ac4353b01994c2ae9667cb9";
+    hash = "sha256-kIJVS2ETAXQa1MMG8cjRUSFUn+jm9jBWH8go3L+lqHE=";
   };
 
   dontBuild = true;

pkgs/data/misc/tzdata/default.nix

@@ -1,17 +1,17 @@
 { lib, stdenv, fetchurl, buildPackages }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2023d";
+  version = "2024a";
 
   srcs = [
     (fetchurl {
-      url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-28ohlwsKi4wM7O7B17kfqQO+D27KWucytTKWciMqCPM=";
+      url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
+      hash = "sha256-DQQ0RZrL0gWaeo2h8zBKhKhlkfbtacYkj/+lArbt/+M=";
     })
     (fetchurl {
-      url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-6aX54RiIbS3pK2K7BVEKKMxsBY15HJO9a4TTKSw8Fh4=";
+      url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
+      hash = "sha256-gAcolK3/WkWPHRQ+FuTKHYsqEiycU5naSCy2jLpqH/g=";
     })
   ];
 
@@ -25,14 +25,14 @@ stdenv.mkDerivation rec {
   propagatedBuildOutputs = [ ];
 
   makeFlags = [
-    "TOPDIR=$(out)"
-    "TZDIR=$(out)/share/zoneinfo"
-    "BINDIR=$(bin)/bin"
-    "ZICDIR=$(bin)/bin"
+    "TOPDIR=${placeholder "out"}"
+    "TZDIR=${placeholder "out"}/share/zoneinfo"
+    "BINDIR=${placeholder "bin"}/bin"
+    "ZICDIR=${placeholder "bin"}/bin"
     "ETCDIR=$(TMPDIR)/etc"
     "TZDEFAULT=tzdefault-to-remove"
-    "LIBDIR=$(dev)/lib"
-    "MANDIR=$(man)/share/man"
+    "LIBDIR=${placeholder "dev"}/lib"
+    "MANDIR=${placeholder "man"}/share/man"
     "AWK=awk"
     "CFLAGS=-DHAVE_LINK=0"
     "CFLAGS+=-DZIC_BLOAT_DEFAULT=\\\"fat\\\""
@@ -45,7 +45,9 @@ stdenv.mkDerivation rec {
     "CFLAGS+=-DRESERVE_STD_EXT_IDS"
   ];
 
-  doCheck = false; # needs more tools
+  doCheck = true;
+  # everything except for check_web, because that needs curl and wants to talk to https://validator.w3.org
+  checkTarget = "check_back check_character_set check_white_space check_links check_name_lengths check_now check_slashed_abbrs check_sorted check_tables check_ziguard check_zishrink check_tzs";
 
   installFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "zic=${buildPackages.tzdata.bin}/bin/zic"
@@ -70,7 +72,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://www.iana.org/time-zones";
     description = "Database of current and historical time zones";
-    changelog = "https://github.com/eggert/tz/blob/${version}/NEWS";
+    changelog = "https://github.com/eggert/tz/blob/${finalAttrs.version}/NEWS";
     license = with licenses; [
       bsd3 # tzcode
       publicDomain # tzdata
@@ -78,4 +80,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ ajs124 fpletz ];
   };
-}
+})

pkgs/development/compilers/edk2/default.nix

@@ -59,6 +59,11 @@ edk2 = stdenv.mkDerivation rec {
     mkdir -p $out/CryptoPkg/Library/OpensslLib/openssl
     tar --strip-components=1 -xf ${buildPackages.openssl.src} -C $out/CryptoPkg/Library/OpensslLib/openssl
     chmod -R +w $out/
+
+    # Fix missing INT64_MAX include that edk2 explicitly does not provide
+    # via it's own <stdint.h>. Let's pull in openssl's definition instead:
+    sed -i $out/CryptoPkg/Library/OpensslLib/openssl/crypto/property/property_parse.c \
+        -e '1i #include "internal/numbers.h"'
   '';
 
   nativeBuildInputs = [ pythonEnv ];

pkgs/development/compilers/gcc/default.nix

@@ -407,6 +407,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
     isGNU = true;
     hardeningUnsupportedFlags = lib.optional is48 "stackprotector"
+      ++ lib.optional (!atLeast11) "zerocallusedregs"
       ++ lib.optional (!atLeast12) "fortify3"
       ++ lib.optionals (langFortran) [ "fortify" "format" ];
   };

pkgs/development/compilers/llvm/10/clang/default.nix

@@ -0,0 +1,133 @@
+{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+, buildLlvmTools
+, fixDarwinDylibNames
+, enableManpages ? false
+}:
+
+let
+  self = stdenv.mkDerivation ({
+    pname = "clang";
+    inherit version;
+
+    src = fetch "clang" "091bvcny2lh32zy8f3m9viayyhb2zannrndni7325rl85cwgr6pr";
+
+    unpackPhase = ''
+      unpackFile $src
+      mv clang-${version}* clang
+      sourceRoot=$PWD/clang
+      unpackFile ${clang-tools-extra_src}
+      mv clang-tools-extra-* $sourceRoot/tools/extra
+    '';
+
+    nativeBuildInputs = [ cmake python3 ]
+      ++ lib.optional enableManpages python3.pkgs.sphinx
+      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+    buildInputs = [ libxml2 libllvm ];
+
+    cmakeFlags = [
+      "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ lib.optionals enableManpages [
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DLLVM_ENABLE_SPHINX=ON"
+      "-DSPHINX_OUTPUT_MAN=ON"
+      "-DSPHINX_OUTPUT_HTML=OFF"
+      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
+    ];
+
+    patches = [
+      ./purity.patch
+      # https://reviews.llvm.org/D51899
+      ./compiler-rt-baremetal.patch
+      ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-6-10-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
+    ];
+
+    postPatch = ''
+      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+             lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace tools/extra/clangd/CMakeLists.txt \
+        --replace "NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB" FALSE
+    '';
+
+    outputs = [ "out" "lib" "dev" "python" ];
+
+    postInstall = ''
+      ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+      moveToOutput "lib/libclang-cpp.*" "$lib"
+      substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
+
+      mkdir -p $python/bin $python/share/{clang,scan-view}
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
+      rm $out/bin/c-index-test
+      patchShebangs $python/bin
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
+    '';
+
+    passthru = {
+      inherit libllvm;
+      isClang = true;
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
+    };
+
+    meta = llvm_meta // {
+      homepage = "https://clang.llvm.org/";
+      description = "A C language family frontend for LLVM";
+      longDescription = ''
+        The Clang project provides a language front-end and tooling
+        infrastructure for languages in the C language family (C, C++, Objective
+        C/C++, OpenCL, CUDA, and RenderScript) for the LLVM project.
+        It aims to deliver amazingly fast compiles, extremely useful error and
+        warning messages and to provide a platform for building great source
+        level tools. The Clang Static Analyzer and clang-tidy are tools that
+        automatically find bugs in your code, and are great examples of the sort
+        of tools that can be built using the Clang frontend as a library to
+        parse C/C++ code.
+      '';
+      mainProgram = "clang";
+    };
+  } // lib.optionalAttrs enableManpages {
+    pname = "clang-manpages";
+
+    buildPhase = ''
+      make docs-clang-man
+    '';
+
+    installPhase = ''
+      mkdir -p $out/share/man/man1
+      # Manually install clang manpage
+      cp docs/man/*.1 $out/share/man/man1/
+    '';
+
+    outputs = [ "out" ];
+
+    doCheck = false;
+
+    meta = llvm_meta // {
+      description = "man page for Clang ${version}";
+    };
+  });
+in self

pkgs/development/compilers/llvm/11/clang/default.nix

@@ -95,7 +95,7 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/12/clang/default.nix

@@ -89,7 +89,7 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/13/clang/default.nix

@@ -83,7 +83,7 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/14/clang/default.nix

@@ -86,7 +86,7 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/15/clang/default.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  self = stdenv.mkDerivation (rec {
+  self = stdenv.mkDerivation (finalAttrs: rec {
     pname = "clang";
     inherit version;
 
@@ -97,7 +97,12 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [
+        "fortify3"
+      ];
+      hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
+        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/16/clang/default.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  self = stdenv.mkDerivation (rec {
+  self = stdenv.mkDerivation (finalAttrs: rec {
     pname = "clang";
     inherit version;
 
@@ -91,7 +91,12 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [
+        "fortify3"
+      ];
+      hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
+        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/17/clang/default.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  self = stdenv.mkDerivation (rec {
+  self = stdenv.mkDerivation (finalAttrs: rec {
     pname = "clang";
     inherit version;
 
@@ -95,7 +95,12 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [
+        "fortify3"
+      ];
+      hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
+        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/8/clang/default.nix

@@ -0,0 +1,145 @@
+{ lib, stdenv, llvm_meta, fetch, substituteAll, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+, buildLlvmTools
+, fixDarwinDylibNames
+, enableManpages ? false
+, enablePolly ? false # TODO: get this info from llvm (passthru?)
+}:
+
+let
+  self = stdenv.mkDerivation ({
+    pname = "clang";
+    inherit version;
+
+    src = fetch "cfe" "0ihnbdl058gvl2wdy45p5am55bq8ifx8m9mhcsgj9ax8yxlzvvvh";
+
+    unpackPhase = ''
+      unpackFile $src
+      mv cfe-${version}* clang
+      sourceRoot=$PWD/clang
+      unpackFile ${clang-tools-extra_src}
+      mv clang-tools-extra-* $sourceRoot/tools/extra
+    '';
+
+    nativeBuildInputs = [ cmake python3 ]
+      ++ lib.optional enableManpages python3.pkgs.sphinx
+      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+    buildInputs = [ libxml2 libllvm ];
+
+    cmakeFlags = [
+      "-DCMAKE_CXX_FLAGS=-std=c++11"
+      "-DCLANGD_BUILD_XPC=OFF"
+      "-DLLVM_ENABLE_RTTI=ON"
+    ] ++ lib.optionals enableManpages [
+      "-DCLANG_INCLUDE_DOCS=ON"
+      "-DLLVM_ENABLE_SPHINX=ON"
+      "-DSPHINX_OUTPUT_MAN=ON"
+      "-DSPHINX_OUTPUT_HTML=OFF"
+      "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
+      "-DCLANG_TABLEGEN=${buildLlvmTools.libclang.dev}/bin/clang-tblgen"
+    ] ++ lib.optionals enablePolly [
+      "-DWITH_POLLY=ON"
+      "-DLINK_POLLY_INTO_TOOLS=ON"
+    ];
+
+    patches = [
+      ../../common/clang/5-8-purity.patch
+      ./xpc.patch
+      # Backport for -static-pie, which the latter touches, and which is nice in
+      # its own right.
+      ./static-pie.patch
+      # Backport for the `--unwindlib=[libgcc|compiler-rt]` flag, which is
+      # needed for our bootstrapping to not interfere with C.
+      ./unwindlib.patch
+      # https://reviews.llvm.org/D51899
+      ./compiler-rt-baremetal.patch
+      # make clang -xhip use $PATH to find executables
+      ./HIP-use-PATH-8.patch
+      ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-6-10-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
+    ];
+
+    postPatch = ''
+      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
+             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
+             lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i -e 's/lgcc_s/lgcc_eh/' lib/Driver/ToolChains/*.cpp
+    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace tools/extra/clangd/CMakeLists.txt \
+        --replace "NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB" FALSE
+    '';
+
+    outputs = [ "out" "lib" "dev" "python" ];
+
+    postInstall = ''
+      ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+      substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
+          --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang."
+
+      mkdir -p $python/bin $python/share/{clang,scan-view}
+      mv $out/bin/{git-clang-format,scan-view} $python/bin
+      if [ -e $out/bin/set-xcode-analyzer ]; then
+        mv $out/bin/set-xcode-analyzer $python/bin
+      fi
+      mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
+      rm $out/bin/c-index-test
+      patchShebangs $python/bin
+
+      mkdir -p $dev/bin
+      cp bin/clang-tblgen $dev/bin
+    '';
+
+    passthru = {
+      inherit libllvm;
+      isClang = true;
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
+    };
+
+    meta = llvm_meta // {
+      homepage = "https://clang.llvm.org/";
+      description = "A C language family frontend for LLVM";
+      longDescription = ''
+        The Clang project provides a language front-end and tooling
+        infrastructure for languages in the C language family (C, C++, Objective
+        C/C++, OpenCL, CUDA, and RenderScript) for the LLVM project.
+        It aims to deliver amazingly fast compiles, extremely useful error and
+        warning messages and to provide a platform for building great source
+        level tools. The Clang Static Analyzer and clang-tidy are tools that
+        automatically find bugs in your code, and are great examples of the sort
+        of tools that can be built using the Clang frontend as a library to
+        parse C/C++ code.
+      '';
+      mainProgram = "clang";
+    };
+  } // lib.optionalAttrs enableManpages {
+    pname = "clang-manpages";
+
+    buildPhase = ''
+      make docs-clang-man
+    '';
+
+    installPhase = ''
+      mkdir -p $out/share/man/man1
+      # Manually install clang manpage
+      cp docs/man/*.1 $out/share/man/man1/
+    '';
+
+    outputs = [ "out" ];
+
+    doCheck = false;
+
+    meta = llvm_meta // {
+      description = "man page for Clang ${version}";
+    };
+  });
+in self

pkgs/development/compilers/llvm/9/clang/default.nix

@@ -97,7 +97,7 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" ];
     };
 
     meta = llvm_meta // {

pkgs/development/compilers/llvm/git/clang/default.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  self = stdenv.mkDerivation (rec {
+  self = stdenv.mkDerivation (finalAttrs: rec {
     pname = "clang";
     inherit version;
 
@@ -96,7 +96,12 @@ let
     passthru = {
       inherit libllvm;
       isClang = true;
-      hardeningUnsupportedFlags = [ "fortify3" ];
+      hardeningUnsupportedFlags = [
+        "fortify3"
+      ];
+      hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
+        lib.optional (!(targetPlatform.isx86_64 || targetPlatform.isAarch64)) "zerocallusedregs"
+        ++ (finalAttrs.passthru.hardeningUnsupportedFlags or []);
     };
 
     meta = llvm_meta // {

pkgs/development/interpreters/python/cpython/3.10/asyncio-deprecation.patch

@@ -1,598 +0,0 @@
-REVERT https://github.com/python/cpython/commit/300d812fd1c4d9244e71de0d228cc72439d312a7
---- b/Doc/library/asyncio-eventloop.rst
-+++ a/Doc/library/asyncio-eventloop.rst
-@@ -43,12 +43,10 @@
- 
-    Get the current event loop.
- 
-+   If there is no current event loop set in the current OS thread,
-+   the OS thread is main, and :func:`set_event_loop` has not yet
-+   been called, asyncio will create a new event loop and set it as the
-+   current one.
--   When called from a coroutine or a callback (e.g. scheduled with
--   call_soon or similar API), this function will always return the
--   running event loop.
--
--   If there is no running event loop set, the function will return
--   the result of ``get_event_loop_policy().get_event_loop()`` call.
- 
-    Because this function has rather complex behavior (especially
-    when custom event loop policies are in use), using the
-@@ -60,14 +58,10 @@
-    event loop.
- 
-    .. deprecated:: 3.10
-+      Emits a deprecation warning if there is no running event loop.
-+      In future Python releases, this function may become an alias of
-+      :func:`get_running_loop` and will accordingly raise a
-+      :exc:`RuntimeError` if there is no running event loop.
--      Deprecation warning is emitted if there is no current event loop.
--      In Python 3.12 it will be an error.
--
--   .. note::
--      In Python versions 3.10.0--3.10.8 this function
--      (and other functions which used it implicitly) emitted a
--      :exc:`DeprecationWarning` if there was no running event loop, even if
--      the current loop was set.
- 
- .. function:: set_event_loop(loop)
- 
-reverted:
---- b/Doc/library/asyncio-llapi-index.rst
-+++ a/Doc/library/asyncio-llapi-index.rst
-@@ -19,7 +19,7 @@
-       - The **preferred** function to get the running event loop.
- 
-     * - :func:`asyncio.get_event_loop`
-+      - Get an event loop instance (current or via the policy).
--      - Get an event loop instance (running or current via the current policy).
- 
-     * - :func:`asyncio.set_event_loop`
-       - Set the event loop as current via the current policy.
-reverted:
---- b/Doc/library/asyncio-policy.rst
-+++ a/Doc/library/asyncio-policy.rst
-@@ -112,11 +112,6 @@
- 
-       On Windows, :class:`ProactorEventLoop` is now used by default.
- 
--   .. deprecated:: 3.10.9
--      :meth:`get_event_loop` now emits a :exc:`DeprecationWarning` if there
--      is no current event loop set and a new event loop has been implicitly
--      created. In Python 3.12 it will be an error.
--
- 
- .. class:: WindowsSelectorEventLoopPolicy
- 
-reverted:
---- b/Lib/asyncio/events.py
-+++ a/Lib/asyncio/events.py
-@@ -650,21 +650,6 @@
-         if (self._local._loop is None and
-                 not self._local._set_called and
-                 threading.current_thread() is threading.main_thread()):
--            stacklevel = 2
--            try:
--                f = sys._getframe(1)
--            except AttributeError:
--                pass
--            else:
--                while f:
--                    module = f.f_globals.get('__name__')
--                    if not (module == 'asyncio' or module.startswith('asyncio.')):
--                        break
--                    f = f.f_back
--                    stacklevel += 1
--            import warnings
--            warnings.warn('There is no current event loop',
--                          DeprecationWarning, stacklevel=stacklevel)
-             self.set_event_loop(self.new_event_loop())
- 
-         if self._local._loop is None:
-@@ -778,13 +763,12 @@
- 
- 
- def _get_event_loop(stacklevel=3):
--    # This internal method is going away in Python 3.12, left here only for
--    # backwards compatibility with 3.10.0 - 3.10.8 and 3.11.0.
--    # Similarly, this method's C equivalent in _asyncio is going away as well.
--    # See GH-99949 for more details.
-     current_loop = _get_running_loop()
-     if current_loop is not None:
-         return current_loop
-+    import warnings
-+    warnings.warn('There is no current event loop',
-+                  DeprecationWarning, stacklevel=stacklevel)
-     return get_event_loop_policy().get_event_loop()
- 
- 
-reverted:
---- b/Lib/test/test_asyncio/test_base_events.py
-+++ a/Lib/test/test_asyncio/test_base_events.py
-@@ -752,7 +752,7 @@
-     def test_env_var_debug(self):
-         code = '\n'.join((
-             'import asyncio',
-+            'loop = asyncio.get_event_loop()',
--            'loop = asyncio.new_event_loop()',
-             'print(loop.get_debug())'))
- 
-         # Test with -E to not fail if the unit test was run with
-reverted:
---- b/Lib/test/test_asyncio/test_events.py
-+++ a/Lib/test/test_asyncio/test_events.py
-@@ -2561,9 +2561,8 @@
-     def test_get_event_loop(self):
-         policy = asyncio.DefaultEventLoopPolicy()
-         self.assertIsNone(policy._local._loop)
-+
-+        loop = policy.get_event_loop()
--        with self.assertWarns(DeprecationWarning) as cm:
--            loop = policy.get_event_loop()
--        self.assertEqual(cm.filename, __file__)
-         self.assertIsInstance(loop, asyncio.AbstractEventLoop)
- 
-         self.assertIs(policy._local._loop, loop)
-@@ -2577,10 +2576,7 @@
-                 policy, "set_event_loop",
-                 wraps=policy.set_event_loop) as m_set_event_loop:
- 
-+            loop = policy.get_event_loop()
--            with self.assertWarns(DeprecationWarning) as cm:
--                loop = policy.get_event_loop()
--            self.addCleanup(loop.close)
--            self.assertEqual(cm.filename, __file__)
- 
-             # policy._local._loop must be set through .set_event_loop()
-             # (the unix DefaultEventLoopPolicy needs this call to attach
-@@ -2614,8 +2610,7 @@
- 
-     def test_set_event_loop(self):
-         policy = asyncio.DefaultEventLoopPolicy()
-+        old_loop = policy.get_event_loop()
--        old_loop = policy.new_event_loop()
--        policy.set_event_loop(old_loop)
- 
-         self.assertRaises(AssertionError, policy.set_event_loop, object())
- 
-@@ -2728,11 +2723,15 @@
-             asyncio.set_event_loop_policy(Policy())
-             loop = asyncio.new_event_loop()
- 
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaises(TestError):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaises(TestError):
--                asyncio.get_event_loop()
-             asyncio.set_event_loop(None)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaises(TestError):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaises(TestError):
--                asyncio.get_event_loop()
- 
-             with self.assertRaisesRegex(RuntimeError, 'no running'):
-                 asyncio.get_running_loop()
-@@ -2746,11 +2745,16 @@
-             loop.run_until_complete(func())
- 
-             asyncio.set_event_loop(loop)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaises(TestError):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
-+
--            with self.assertRaises(TestError):
--                asyncio.get_event_loop()
-             asyncio.set_event_loop(None)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaises(TestError):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaises(TestError):
--                asyncio.get_event_loop()
- 
-         finally:
-             asyncio.set_event_loop_policy(old_policy)
-@@ -2774,8 +2778,10 @@
-             self.addCleanup(loop2.close)
-             self.assertEqual(cm.warnings[0].filename, __file__)
-             asyncio.set_event_loop(None)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaisesRegex(RuntimeError, 'no current'):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaisesRegex(RuntimeError, 'no current'):
--                asyncio.get_event_loop()
- 
-             with self.assertRaisesRegex(RuntimeError, 'no running'):
-                 asyncio.get_running_loop()
-@@ -2789,11 +2795,15 @@
-             loop.run_until_complete(func())
- 
-             asyncio.set_event_loop(loop)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                self.assertIs(asyncio.get_event_loop(), loop)
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            self.assertIs(asyncio.get_event_loop(), loop)
- 
-             asyncio.set_event_loop(None)
-+            with self.assertWarns(DeprecationWarning) as cm:
-+                with self.assertRaisesRegex(RuntimeError, 'no current'):
-+                    asyncio.get_event_loop()
-+            self.assertEqual(cm.warnings[0].filename, __file__)
--            with self.assertRaisesRegex(RuntimeError, 'no current'):
--                asyncio.get_event_loop()
- 
-         finally:
-             asyncio.set_event_loop_policy(old_policy)
-reverted:
---- b/Lib/test/test_asyncio/test_futures.py
-+++ a/Lib/test/test_asyncio/test_futures.py
-@@ -145,8 +145,10 @@
-         self.assertTrue(f.cancelled())
- 
-     def test_constructor_without_loop(self):
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                self._new_future()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            self._new_future()
- 
-     def test_constructor_use_running_loop(self):
-         async def test():
-@@ -156,10 +158,12 @@
-         self.assertIs(f.get_loop(), self.loop)
- 
-     def test_constructor_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10, undeprecated in 3.11.1
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            f = self._new_future()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        f = self._new_future()
-         self.assertIs(f._loop, self.loop)
-         self.assertIs(f.get_loop(), self.loop)
- 
-@@ -495,8 +499,10 @@
-             return (arg, threading.get_ident())
-         ex = concurrent.futures.ThreadPoolExecutor(1)
-         f1 = ex.submit(run, 'oi')
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaises(RuntimeError):
-+                asyncio.wrap_future(f1)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.wrap_future(f1)
-         ex.shutdown(wait=True)
- 
-     def test_wrap_future_use_running_loop(self):
-@@ -511,14 +517,16 @@
-         ex.shutdown(wait=True)
- 
-     def test_wrap_future_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10, undeprecated in 3.11.1
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-         def run(arg):
-             return (arg, threading.get_ident())
-         ex = concurrent.futures.ThreadPoolExecutor(1)
-         f1 = ex.submit(run, 'oi')
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            f2 = asyncio.wrap_future(f1)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        f2 = asyncio.wrap_future(f1)
-         self.assertIs(self.loop, f2._loop)
-         ex.shutdown(wait=True)
- 
-reverted:
---- b/Lib/test/test_asyncio/test_streams.py
-+++ a/Lib/test/test_asyncio/test_streams.py
-@@ -747,8 +747,10 @@
-         self.assertEqual(data, b'data')
- 
-     def test_streamreader_constructor_without_loop(self):
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.StreamReader()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.StreamReader()
- 
-     def test_streamreader_constructor_use_running_loop(self):
-         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
-@@ -762,17 +764,21 @@
-     def test_streamreader_constructor_use_global_loop(self):
-         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
-         # retrieves the current loop if the loop parameter is not set
-+        # Deprecated in 3.10
--        # Deprecated in 3.10, undeprecated in 3.11.1
-         self.addCleanup(asyncio.set_event_loop, None)
-         asyncio.set_event_loop(self.loop)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            reader = asyncio.StreamReader()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        reader = asyncio.StreamReader()
-         self.assertIs(reader._loop, self.loop)
- 
- 
-     def test_streamreaderprotocol_constructor_without_loop(self):
-         reader = mock.Mock()
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.StreamReaderProtocol(reader)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.StreamReaderProtocol(reader)
- 
-     def test_streamreaderprotocol_constructor_use_running_loop(self):
-         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
-@@ -786,11 +792,13 @@
-     def test_streamreaderprotocol_constructor_use_global_loop(self):
-         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
-         # retrieves the current loop if the loop parameter is not set
-+        # Deprecated in 3.10
--        # Deprecated in 3.10, undeprecated in 3.11.1
-         self.addCleanup(asyncio.set_event_loop, None)
-         asyncio.set_event_loop(self.loop)
-         reader = mock.Mock()
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            protocol = asyncio.StreamReaderProtocol(reader)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        protocol = asyncio.StreamReaderProtocol(reader)
-         self.assertIs(protocol._loop, self.loop)
- 
-     def test_multiple_drain(self):
-reverted:
---- b/Lib/test/test_asyncio/test_tasks.py
-+++ a/Lib/test/test_asyncio/test_tasks.py
-@@ -210,8 +210,10 @@
- 
-         a = notmuch()
-         self.addCleanup(a.close)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.ensure_future(a)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.ensure_future(a)
- 
-         async def test():
-             return asyncio.ensure_future(notmuch())
-@@ -221,10 +223,12 @@
-         self.assertTrue(t.done())
-         self.assertEqual(t.result(), 'ok')
- 
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            t = asyncio.ensure_future(notmuch())
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        t = asyncio.ensure_future(notmuch())
-         self.assertIs(t._loop, self.loop)
-         self.loop.run_until_complete(t)
-         self.assertTrue(t.done())
-@@ -243,8 +247,10 @@
- 
-         a = notmuch()
-         self.addCleanup(a.close)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.ensure_future(a)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
--            asyncio.ensure_future(a)
- 
-         async def test():
-             return asyncio.ensure_future(notmuch())
-@@ -254,10 +260,12 @@
-         self.assertTrue(t.done())
-         self.assertEqual(t.result(), 'ok')
- 
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            t = asyncio.ensure_future(notmuch())
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        t = asyncio.ensure_future(notmuch())
-         self.assertIs(t._loop, self.loop)
-         self.loop.run_until_complete(t)
-         self.assertTrue(t.done())
-@@ -1480,8 +1488,10 @@
-         self.addCleanup(a.close)
- 
-         futs = asyncio.as_completed([a])
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                list(futs)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            list(futs)
- 
-     def test_as_completed_coroutine_use_running_loop(self):
-         loop = self.new_test_loop()
-@@ -1497,14 +1507,17 @@
-         loop.run_until_complete(test())
- 
-     def test_as_completed_coroutine_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         async def coro():
-             return 42
- 
-         loop = self.new_test_loop()
-         asyncio.set_event_loop(loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        futs = asyncio.as_completed([coro()])
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            futs = list(futs)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        futs = list(asyncio.as_completed([coro()]))
-         self.assertEqual(len(futs), 1)
-         self.assertEqual(loop.run_until_complete(futs[0]), 42)
- 
-@@ -1974,8 +1987,10 @@
- 
-         inner = coro()
-         self.addCleanup(inner.close)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
-+                asyncio.shield(inner)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.shield(inner)
- 
-     def test_shield_coroutine_use_running_loop(self):
-         async def coro():
-@@ -1989,13 +2004,15 @@
-         self.assertEqual(res, 42)
- 
-     def test_shield_coroutine_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         async def coro():
-             return 42
- 
-         asyncio.set_event_loop(self.loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            outer = asyncio.shield(coro())
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        outer = asyncio.shield(coro())
-         self.assertEqual(outer._loop, self.loop)
-         res = self.loop.run_until_complete(outer)
-         self.assertEqual(res, 42)
-@@ -2933,7 +2950,7 @@
-         self.assertIsNone(asyncio.current_task(loop=self.loop))
- 
-     def test_current_task_no_running_loop_implicit(self):
-+        with self.assertRaises(RuntimeError):
--        with self.assertRaisesRegex(RuntimeError, 'no running event loop'):
-             asyncio.current_task()
- 
-     def test_current_task_with_implicit_loop(self):
-@@ -3097,8 +3114,10 @@
-         return asyncio.gather(*args, **kwargs)
- 
-     def test_constructor_empty_sequence_without_loop(self):
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaises(RuntimeError):
-+                asyncio.gather()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.gather()
- 
-     def test_constructor_empty_sequence_use_running_loop(self):
-         async def gather():
-@@ -3111,10 +3130,12 @@
-         self.assertEqual(fut.result(), [])
- 
-     def test_constructor_empty_sequence_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         asyncio.set_event_loop(self.one_loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            fut = asyncio.gather()
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        fut = asyncio.gather()
-         self.assertIsInstance(fut, asyncio.Future)
-         self.assertIs(fut._loop, self.one_loop)
-         self._run_loop(self.one_loop)
-@@ -3202,8 +3223,10 @@
-         self.addCleanup(gen1.close)
-         gen2 = coro()
-         self.addCleanup(gen2.close)
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            with self.assertRaises(RuntimeError):
-+                asyncio.gather(gen1, gen2)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
--            asyncio.gather(gen1, gen2)
- 
-     def test_constructor_use_running_loop(self):
-         async def coro():
-@@ -3217,14 +3240,16 @@
-         self.one_loop.run_until_complete(fut)
- 
-     def test_constructor_use_global_loop(self):
-+        # Deprecated in 3.10
--        # Deprecated in 3.10.0, undeprecated in 3.10.9
-         async def coro():
-             return 'abc'
-         asyncio.set_event_loop(self.other_loop)
-         self.addCleanup(asyncio.set_event_loop, None)
-         gen1 = coro()
-         gen2 = coro()
-+        with self.assertWarns(DeprecationWarning) as cm:
-+            fut = asyncio.gather(gen1, gen2)
-+        self.assertEqual(cm.warnings[0].filename, __file__)
--        fut = asyncio.gather(gen1, gen2)
-         self.assertIs(fut._loop, self.other_loop)
-         self.other_loop.run_until_complete(fut)
- 
-reverted:
---- b/Lib/test/test_asyncio/test_unix_events.py
-+++ a/Lib/test/test_asyncio/test_unix_events.py
-@@ -1740,8 +1740,7 @@
- 
-     def test_child_watcher_replace_mainloop_existing(self):
-         policy = self.create_policy()
-+        loop = policy.get_event_loop()
--        loop = policy.new_event_loop()
--        policy.set_event_loop(loop)
- 
-         # Explicitly setup SafeChildWatcher,
-         # default ThreadedChildWatcher has no _loop property
-reverted:
---- b/Lib/test/test_coroutines.py
-+++ a/Lib/test/test_coroutines.py
-@@ -2319,8 +2319,7 @@
-     def test_unawaited_warning_during_shutdown(self):
-         code = ("import asyncio\n"
-                 "async def f(): pass\n"
-+                "asyncio.gather(f())\n")
--                "async def t(): asyncio.gather(f())\n"
--                "asyncio.run(t())\n")
-         assert_python_ok("-c", code)
- 
-         code = ("import sys\n"
-reverted:
---- b/Modules/_asynciomodule.c
-+++ a/Modules/_asynciomodule.c
-@@ -332,6 +332,13 @@
-         return loop;
-     }
- 
-+    if (PyErr_WarnEx(PyExc_DeprecationWarning,
-+                     "There is no current event loop",
-+                     stacklevel))
-+    {
-+        return NULL;
-+    }
-+
-     policy = PyObject_CallNoArgs(asyncio_get_event_loop_policy);
-     if (policy == NULL) {
-         return NULL;
-@@ -3085,11 +3092,6 @@
-     return get_event_loop(1);
- }
- 
--// This internal method is going away in Python 3.12, left here only for
--// backwards compatibility with 3.10.0 - 3.10.8 and 3.11.0.
--// Similarly, this method's Python equivalent in asyncio.events is going
--// away as well.
--// See GH-99949 for more details.
- /*[clinic input]
- _asyncio._get_event_loop
-     stacklevel: int = 3

pkgs/development/interpreters/python/cpython/default.nix

@@ -1,40 +1,55 @@
-{ lib, stdenv, fetchurl, fetchpatch, fetchgit
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, fetchgit
+
+# build dependencies
+, autoconf-archive
+, autoreconfHook
+, nukeReferences
+, pkg-config
+, python-setup-hook
+
+# runtime dependencies
 , bzip2
 , expat
 , libffi
-, gdbm
-, xz
-, mailcap, mimetypesSupport ? true
+, libxcrypt
+, mpdecimal
 , ncurses
 , openssl
-, openssl_legacy
-, readline
 , sqlite
-, tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
-, bluez ? null, bluezSupport ? false
+, xz
 , zlib
-, tzdata ? null
-, libxcrypt
-, self
+
+# platform-specific dependencies
+, bash
 , configd
 , darwin
 , windows
-, autoreconfHook
-, autoconf-archive
-, pkg-config
-, python-setup-hook
-, nukeReferences
-# For the Python package set
-, packageOverrides ? (self: super: {})
+
+# optional dependencies
+, bluezSupport ? false, bluez
+, mimetypesSupport ? true, mailcap
+, tzdata
+, withGdbm ? !stdenv.hostPlatform.isWindows, gdbm
+, withReadline ? !stdenv.hostPlatform.isWindows, readline
+, x11Support ? false, tcl, tk, tix, libX11, xorgproto
+
+# splicing/cross
+, pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
+, self
 , pkgsBuildBuild
 , pkgsBuildHost
 , pkgsBuildTarget
 , pkgsHostHost
 , pkgsTargetTarget
+
+# build customization
 , sourceVersion
 , hash
 , passthruFun
-, bash
 , stripConfig ? false
 , stripIdlelib ? false
 , stripTests ? false
@@ -44,21 +59,28 @@
 , includeSiteCustomize ? true
 , static ? stdenv.hostPlatform.isStatic
 , enableFramework ? false
+, noldconfigPatch ? ./. + "/${sourceVersion.major}.${sourceVersion.minor}/no-ldconfig.patch"
+
+# pgo (not reproducible) + -fno-semantic-interposition
+# https://docs.python.org/3/using/configure.html#cmdoption-enable-optimizations
 , enableOptimizations ? false
-# these dont build for windows
-, withGdbm ? !stdenv.hostPlatform.isWindows
-, withReadline ? !stdenv.hostPlatform.isWindows
-# enableNoSemanticInterposition is a subset of the enableOptimizations flag that doesn't harm reproducibility.
-# clang starts supporting `-fno-sematic-interposition` with version 10
-, enableNoSemanticInterposition ? (!stdenv.cc.isClang || (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "10"))
-# enableLTO is a subset of the enableOptimizations flag that doesn't harm reproducibility.
+
+# improves performance, but remains reproducible
+, enableNoSemanticInterposition ? true
+
 # enabling LTO on 32bit arch causes downstream packages to fail when linking
 # enabling LTO on *-darwin causes python3 to fail when linking.
 , enableLTO ? stdenv.is64bit && stdenv.isLinux
+
+# enable asserts to ensure the build remains reproducible
 , reproducibleBuild ? false
-, pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
-, noldconfigPatch ? ./. + "/${sourceVersion.major}.${sourceVersion.minor}/no-ldconfig.patch"
+
+# for the Python package set
+, packageOverrides ? (self: super: {})
+
+# tests
 , testers
+
 } @ inputs:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -73,7 +95,11 @@ assert x11Support -> tcl != null
 
 assert bluezSupport -> bluez != null;
 
-assert enableFramework -> stdenv.isDarwin;
+assert lib.assertMsg (bluezSupport -> stdenv.isLinux)
+  "Bluez support is only available on Linux.";
+
+assert lib.assertMsg (enableFramework -> stdenv.isDarwin)
+  "Framework builds are only supported on Darwin.";
 
 assert lib.assertMsg (reproducibleBuild -> stripBytecode)
   "Deterministic builds require stripping bytecode.";
@@ -84,18 +110,21 @@ assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations))
 assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
   "Deterministic builds are not achieved when (default unoptimized) bytecode is created.";
 
-with lib;
-
 let
-  # some python packages need legacy ciphers, so we're using openssl 3, but with that config
-  # null check for Minimal
-  openssl' = if openssl != null then openssl_legacy else null;
+  inherit (lib)
+    concatMapStringsSep
+    concatStringsSep
+    getDev
+    getLib
+    optionals
+    optionalString
+    replaceStrings
+    versionOlder
+  ;
 
   buildPackages = pkgsBuildHost;
   inherit (passthru) pythonOnBuildForHost;
 
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
-
   tzdataSupport = tzdata != null && passthru.pythonAtLeast "3.9";
 
   passthru = let
@@ -119,12 +148,12 @@ let
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
-  nativeBuildInputs = optionals (!stdenv.isDarwin) [
+  nativeBuildInputs = [
+    nukeReferences
+  ] ++ optionals (!stdenv.isDarwin) [
+    autoconf-archive # needed for AX_CHECK_COMPILE_FLAG
     autoreconfHook
     pkg-config
-    autoconf-archive # needed for AX_CHECK_COMPILE_FLAG
-  ] ++ [
-    nukeReferences
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     buildPackages.stdenv.cc
     pythonOnBuildForHost
@@ -132,19 +161,38 @@ let
     stdenv.cc.cc.libllvm.out
   ];
 
-  buildInputs = filter (p: p != null) ([
-    zlib bzip2 expat xz libffi libxcrypt ]
-    ++ optional withGdbm gdbm
-    ++ [ sqlite ]
-    ++ optional withReadline readline
-    ++ [ ncurses openssl' ]
-    ++ optionals x11Support [ tcl tk libX11 xorgproto ]
-    ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
-    ++ optionals stdenv.isDarwin [ configd ])
-
-    ++ optionals enableFramework [ Cocoa ]
-    ++ optionals stdenv.hostPlatform.isMinGW [ windows.mingw_w64_pthreads windows.dlfcn ]
-    ++ optionals tzdataSupport [ tzdata ];  # `zoneinfo` module
+  buildInputs = lib.filter (p: p != null) ([
+    bzip2
+    expat
+    libffi
+    libxcrypt
+    mpdecimal
+    ncurses
+    openssl
+    sqlite
+    xz
+    zlib
+  ] ++ optionals bluezSupport [
+    bluez
+  ] ++ optionals enableFramework [
+    darwin.apple_sdk.frameworks.Cocoa
+  ] ++ optionals stdenv.hostPlatform.isMinGW [
+    windows.dlfcn
+    windows.mingw_w64_pthreads
+  ] ++ optionals stdenv.isDarwin [
+    configd
+  ] ++ optionals tzdataSupport [
+    tzdata
+  ] ++ optionals withGdbm [
+    gdbm
+  ] ++ optionals withReadline [
+    readline
+  ] ++ optionals x11Support [
+    libX11
+    tcl
+    tk
+    xorgproto
+  ]);
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
 
@@ -207,7 +255,7 @@ let
       pythonAbi = nixpkgsPythonAbiMappings.${parsed.abi.name} or parsed.abi.name;
     in
       # Python <3.11 doesn't distinguish musl and glibc and always prefixes with "gnu"
-      if lib.versionOlder version "3.11" then
+      if versionOlder version "3.11" then
         replaceStrings [ "musl" ] [ "gnu" ] pythonAbi
       else
         pythonAbi;
@@ -238,29 +286,18 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
   inherit src version;
 
   inherit nativeBuildInputs;
-  buildInputs = lib.optionals (!stdenv.hostPlatform.isWindows) [ bash ] ++ buildInputs; # bash is only used for patchShebangs
-
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isWindows) [
+    bash # only required for patchShebangs
+  ] ++ buildInputs;
 
   prePatch = optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace '`/usr/bin/arch`' '"i386"'
+    substituteInPlace configure --replace-fail '`/usr/bin/arch`' '"i386"'
   '' + optionalString (pythonOlder "3.9" && stdenv.isDarwin && x11Support) ''
     # Broken on >= 3.9; replaced with ./3.9/darwin-tcl-tk.patch
-    substituteInPlace setup.py --replace /Library/Frameworks /no-such-path
+    substituteInPlace setup.py --replace-fail /Library/Frameworks /no-such-path
   '';
 
-  patches = optionals (version == "3.10.9") [
-    # https://github.com/python/cpython/issues/100160
-    ./3.10/asyncio-deprecation.patch
-  ] ++ optionals (version == "3.11.1") [
-    # https://github.com/python/cpython/issues/100160
-    (fetchpatch {
-      name = "asyncio-deprecation-3.11.patch";
-      url = "https://github.com/python/cpython/commit/3fae04b10e2655a20a3aadb5e0d63e87206d0c67.diff";
-      revert = true;
-      excludes = [ "Misc/NEWS.d/*" ];
-      hash = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
-    })
-  ] ++ [
+  patches = [
     # Disable the use of ldconfig in ctypes.util.find_library (since
     # ldconfig doesn't work on NixOS), and don't use
     # ctypes.util.find_library during the loading of the uuid module
@@ -282,7 +319,7 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
   ] ++ optionals (pythonAtLeast "3.9" && pythonOlder "3.11" && stdenv.isDarwin) [
     # Stop checking for TCL/TK in global macOS locations
     ./3.9/darwin-tcl-tk.patch
-  ] ++ optionals (isPy3k && hasDistutilsCxxPatch && pythonOlder "3.12") [
+  ] ++ optionals (hasDistutilsCxxPatch && pythonOlder "3.12") [
     # Fix for http://bugs.python.org/issue1222585
     # Upstream distutils is calling C compiler to compile C++ code, which
     # only works for GCC and Apple Clang. This makes distutils to call C++
@@ -323,12 +360,14 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
 
   postPatch = optionalString (!stdenv.hostPlatform.isWindows) ''
     substituteInPlace Lib/subprocess.py \
-      --replace "'/bin/sh'" "'${bash}/bin/sh'"
+      --replace-fail "'/bin/sh'" "'${bash}/bin/sh'"
   '' + optionalString mimetypesSupport ''
     substituteInPlace Lib/mimetypes.py \
-      --replace "@mime-types@" "${mailcap}"
+      --replace-fail "@mime-types@" "${mailcap}"
   '' + optionalString (pythonOlder "3.13" && x11Support && (tix != null)) ''
-    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+    substituteInPlace "Lib/tkinter/tix.py" --replace-fail \
+      "os.environ.get('TIX_LIBRARY')" \
+      "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
   '';
 
   env = {
@@ -343,25 +382,30 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     PYTHONHASHSEED=0;
   };
 
+  # https://docs.python.org/3/using/configure.html
   configureFlags = [
     "--without-ensurepip"
     "--with-system-expat"
-    "--with-system-ffi"
+  ] ++ optionals (!(stdenv.isDarwin && pythonAtLeast "3.12")) [
+    #  ./Modules/_decimal/_decimal.c:4673:6: error: "No valid combination of CONFIG_64, CONFIG_32 and _PyHASH_BITS"
+    # https://hydra.nixos.org/build/248410479/nixlog/2/tail
+    "--with-system-libmpdec"
+  ] ++ optionals (openssl != null) [
+    "--with-openssl=${openssl.dev}"
+  ] ++ optionals tzdataSupport [
+    "--with-tzpath=${tzdata}/share/zoneinfo"
+  ] ++ optionals (execSuffix != "") [
+    "--with-suffix=${execSuffix}"
+  ] ++ optionals enableLTO [
+    "--with-lto"
   ] ++ optionals (!static && !enableFramework) [
     "--enable-shared"
   ] ++ optionals enableFramework [
     "--enable-framework=${placeholder "out"}/Library/Frameworks"
   ] ++ optionals enableOptimizations [
     "--enable-optimizations"
-  ] ++ optionals enableLTO [
-    "--with-lto"
-  ] ++ optionals (pythonOlder "3.7") [
-    # This is unconditionally true starting in CPython 3.7.
-    "--with-threads"
-  ] ++ optionals (sqlite != null && isPy3k) [
+  ] ++ optionals (sqlite != null) [
     "--enable-loadable-sqlite-extensions"
-  ] ++ optionals (openssl' != null) [
-    "--with-openssl=${openssl'.dev}"
   ] ++ optionals (libxcrypt != null) [
     "CFLAGS=-I${libxcrypt}/include"
     "LIBS=-L${libxcrypt}/lib"
@@ -393,14 +437,14 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     # Never even try to use lchmod on linux,
     # don't rely on detecting glibc-isms.
     "ac_cv_func_lchmod=no"
-  ] ++ optionals tzdataSupport [
-    "--with-tzpath=${tzdata}/share/zoneinfo"
-  ] ++ optional static "LDFLAGS=-static"
-  ++ optional (execSuffix != "") "--with-suffix=${execSuffix}";
+  ] ++ optionals static [
+    "LDFLAGS=-static"
+  ];
 
   preConfigure = optionalString (pythonOlder "3.12") ''
-    for i in /usr /sw /opt /pkg; do	# improve purity
-      substituteInPlace ./setup.py --replace $i /no-such-path
+    # Improve purity
+    for path in /usr /sw /opt /pkg; do
+      substituteInPlace ./setup.py --replace-warn $path /no-such-path
     done
   '' + optionalString stdenv.isDarwin ''
     # Override the auto-detection in setup.py, which assumes a universal build
@@ -408,10 +452,6 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
   '' + optionalString (stdenv.isDarwin && x11Support && pythonAtLeast "3.11") ''
     export TCLTK_LIBS="-L${tcl}/lib -L${tk}/lib -l${tcl.libPrefix} -l${tk.libPrefix}"
     export TCLTK_CFLAGS="-I${tcl}/include -I${tk}/include"
-  '' + optionalString (isPy3k && pythonOlder "3.7") ''
-    # Determinism: The interpreter is patched to write null timestamps when compiling Python files
-    #   so Python doesn't try to update the bytecode when seeing frozen timestamps in Nix's store.
-    export DETERMINISTIC_BUILD=1;
   '' + optionalString stdenv.hostPlatform.isMusl ''
     export NIX_CFLAGS_COMPILE+=" -DTHREAD_STACK_SIZE=0x100000"
   '' +
@@ -482,9 +522,6 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     # This allows build Python to import host Python's sysconfigdata
     mkdir -p "$out/${sitePackages}"
     ln -s "$out/lib/${libPrefix}/"_sysconfigdata*.py "$out/${sitePackages}/"
-    '' + lib.optionalString (pythonOlder "3.8") ''
-    # This is gone in Python >= 3.8
-    ln -s "$out/include/${executable}m" "$out/include/${executable}"
     '' + optionalString stripConfig ''
     rm -R $out/bin/python*-config $out/lib/python*/config-*
     '' + optionalString stripIdlelib ''
@@ -498,7 +535,6 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     '' + optionalString includeSiteCustomize ''
     # Include a sitecustomize.py file
     cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
-
     '' + optionalString stripBytecode ''
     # Determinism: deterministic bytecode
     # First we delete all old bytecode.
@@ -556,9 +592,9 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
 
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
-  disallowedReferences =
-    lib.optionals (openssl' != null && !static && !enableFramework) [ openssl'.dev ]
-    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  disallowedReferences = lib.optionals (openssl != null && !static && !enableFramework) [
+    openssl.dev
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # Ensure we don't have references to build-time packages.
     # These typically end up in shebangs.
     pythonOnBuildForHost buildPackages.bash
@@ -591,11 +627,11 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with lib; {
     homepage = "https://www.python.org";
     changelog = let
-      majorMinor = lib.versions.majorMinor version;
-      dashedVersion = lib.replaceStrings [ "." "a" ] [ "-" "-alpha-" ] version;
+      majorMinor = versions.majorMinor version;
+      dashedVersion = replaceStrings [ "." "a" ] [ "-" "-alpha-" ] version;
     in
       if sourceVersion.suffix == "" then
         "https://docs.python.org/release/${version}/whatsnew/changelog.html"

pkgs/development/interpreters/python/default.nix

@@ -16,16 +16,6 @@
   passthruFun = import ./passthrufun.nix args;
 
   sources = {
-    python310 = {
-      sourceVersion = {
-        major = "3";
-        minor = "10";
-        patch = "13";
-        suffix = "";
-      };
-      hash = "sha256-XIiEhmhkDT4VKzW0U27xwjsspL0slX7x7LsFP1cd0/Y=";
-    };
-
     python311 = {
       sourceVersion = {
         major = "3";
@@ -78,11 +68,18 @@ in {
     inherit passthruFun;
   };
 
-  python310 = callPackage ./cpython ({
+  python310 = callPackage ./cpython {
     self = __splicedPackages.python310;
+    sourceVersion = {
+      major = "3";
+      minor = "10";
+      patch = "13";
+      suffix = "";
+    };
+    hash = "sha256-XIiEhmhkDT4VKzW0U27xwjsspL0slX7x7LsFP1cd0/Y=";
     inherit (darwin) configd;
     inherit passthruFun;
-  } // sources.python310);
+  };
 
   python311 = callPackage ./cpython ({
     self = __splicedPackages.python311;
@@ -125,8 +122,8 @@ in {
     readline = null;
     ncurses = null;
     gdbm = null;
-    sqlite = null;
     configd = null;
+    sqlite = null;
     tzdata = null;
     libffi = libffiBoot; # without test suite
     stripConfig = true;

pkgs/development/interpreters/wamr/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = lib.optionals stdenv.isDarwin [
-    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.targetPlatform.darwinSdkVersion}"
+    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.hostPlatform.darwinSdkVersion}"
   ];
 
   sourceRoot = let

pkgs/development/libraries/acl/LFS64.patch

@@ -1,38 +0,0 @@
-From 2b42f64737adf6a2ddd491213580d6e9cdd2f5af Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Thu, 10 Nov 2022 18:04:15 -0800
-Subject: chacl: Use portable version of dirent and readdir
-
-Using 64bit versions on 32bit architectures should be enabled with
---enable-largefile, this makes it portable across musl and glibc
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- tools/chacl.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tools/chacl.c b/tools/chacl.c
-index 525a7ff..8fff875 100644
---- a/tools/chacl.c
-+++ b/tools/chacl.c
-@@ -320,7 +320,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
- {
- 	int failed = 0;
- 	DIR *dir;
--	struct dirent64 *d;
-+	struct dirent *d;
- 	char *name;
- 
- 	if ((dir = opendir(fname)) == NULL) {
-@@ -332,7 +332,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
- 		return(0);	/* got a file, not an error */
- 	}
- 
--	while ((d = readdir64(dir)) != NULL) {
-+	while ((d = readdir(dir)) != NULL) {
- 		/* skip "." and ".." entries */
- 		if (strcmp(d->d_name, ".") == 0 || strcmp(d->d_name, "..") == 0)
- 			continue;
--- 
-cgit v1.1
-

pkgs/development/libraries/acl/default.nix

@@ -7,31 +7,19 @@
 
 stdenv.mkDerivation rec {
   pname = "acl";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchurl {
     url = "mirror://savannah/acl/acl-${version}.tar.gz";
-    sha256 = "sha256-dgxhxokBs3/dXu/ur0wMeia9/disdHoe3/HODiQ8Ea8=";
+    hash = "sha256-XyvbrWKXB6p9hcYj+ZSqih0t7FWnPeUgW6wL9gWKL3w=";
   };
 
-  patches = [
-    ./LFS64.patch
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ gettext ];
   buildInputs = [ attr ];
 
-  # causes failures in coreutils test suite
-  hardeningDisable = [ "fortify3" ];
-
-  # Upstream use C++-style comments in C code. Remove them.
-  # This comment breaks compilation if too strict gcc flags are used.
   postPatch = ''
-    echo "Removing C++-style comments from include/acl.h"
-    sed -e '/^\/\//d' -i include/acl.h
-
     patchShebangs .
   '';
 

pkgs/development/libraries/at-spi2-core/default.nix

@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
   version = "2.50.0";
 
   outputs = [ "out" "dev" ];
+  separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";

pkgs/development/libraries/attr/default.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "attr";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchurl {
     url = "mirror://savannah/attr/${pname}-${version}.tar.gz";
-    sha256 = "1y6sibbkrcjygv8naadnsg6xmsqwfh6cwrqk01l0v2i5kfacdqds";
+    sha256 = "sha256-Ob9nRS+kHQlIwhl2AQU/SLPXigKTiXNDMqYwmmgMbIc=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];

pkgs/development/libraries/audio/lilv/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.24.22";
+  version = "0.24.24";
 
   outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.xz";
-    hash = "sha256-dvlJ0OWfyDNjQJtexeFcEEb7fdZYnTwbkgzsH9Kfn/M=";
+    hash = "sha256-a7a+n4hQQXbQZC8S3oCbK54txVYhporbjH7bma76u08=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config python3 ];

pkgs/development/libraries/boehm-gc/default.nix

@@ -1,7 +1,8 @@
 { lib
 , stdenv
-, fetchurl
-# doc: https://github.com/ivmai/bdwgc/blob/v8.2.2/doc/README.macros (LARGE_CONFIG)
+, fetchFromGitHub
+, autoreconfHook
+# doc: https://github.com/ivmai/bdwgc/blob/v8.2.4/doc/README.macros (LARGE_CONFIG)
 , enableLargeConfig ? false
 , enableMmap ? true
 , enableStatic ? false
@@ -10,19 +11,22 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "boehm-gc";
-  version = "8.2.2";
+  version = "8.2.4";
 
-  src = fetchurl {
-    urls = [
-      # "https://www.hboehm.info/gc/gc_source/gc-${finalAttrs.version}.tar.gz"
-      "https://github.com/ivmai/bdwgc/releases/download/v${finalAttrs.version}/gc-${finalAttrs.version}.tar.gz"
-    ];
-    sha256 = "sha256-8wEHvLBi4JIKeQ//+lbZUSNIVGhZNkwjoUviZLOINqA=";
+  src = fetchFromGitHub {
+    owner = "ivmai";
+    repo = "bdwgc";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-KHijT4BBKfDvTpHpwognN+3ZXoC6JabBTFSYFyOUT9o=";
   };
 
   outputs = [ "out" "dev" "doc" ];
   separateDebugInfo = stdenv.isLinux && stdenv.hostPlatform.libc != "musl";
 
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
   configureFlags = [
     "--enable-cplusplus"
     "--with-libatomic-ops=none"
@@ -38,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   # not fix the problem the test failure will be a reminder to
   # extend the set of versions requiring the workaround).
   makeFlags = lib.optionals (stdenv.hostPlatform.isPower64 &&
-                  finalAttrs.version == "8.2.2")
+                  finalAttrs.version == "8.2.4")
     [
       # do not use /proc primitives to track dirty bits; see:
       # https://github.com/ivmai/bdwgc/issues/479#issuecomment-1279687537

pkgs/development/libraries/dav1d/default.nix

@@ -26,13 +26,13 @@ assert useVulkan -> withExamples;
 
 stdenv.mkDerivation rec {
   pname = "dav1d";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "videolan";
     repo = pname;
     rev = version;
-    hash = "sha256-RrEim3HXXjx2RUU7K3wPH3QbhNTRN9ZX/oAcyE9aV8I=";
+    hash = "sha256-c7Dur+0HpteI7KkR9oo3WynoH/FCRaBwZA7bJmPDJp8=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/dbus-cplusplus/default.nix

@@ -32,7 +32,6 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-template-operators.patch";
       hash = "sha256-B8S7z/YH2YEQgaRsBJBBVTx8vHQhHW7z171TZmogpL8=";
     })
-  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
       name = "0001-src-eventloop.cpp-use-portable-method-for-initializi.patch";
       url = "https://github.com/openembedded/meta-openembedded/raw/119e75e48dbf0539b4e440417901458ffff79b38/meta-oe/recipes-core/dbus/libdbus-c++-0.9.0/0001-src-eventloop.cpp-use-portable-method-for-initializi.patch";

pkgs/development/libraries/enchant/2.x.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.6.3";
+  version = "2.6.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-wcVxnypZfOPgbJOM+5n7aX2gk96nuFfMAE3B3PG7oYI=";
+    hash = "sha256-no/SjLZae22jVFh4pcL1KhXwPASTOl/0jbif6GhFco4=";
   };
 
   strictDeps = true;

pkgs/development/libraries/exempi/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "exempi";
-  version = "2.6.4";
+  version = "2.6.5";
 
   src = fetchurl {
     url = "https://libopenraw.freedesktop.org/download/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-p1FJyWth45zcsEb9XlbYjP7qtuCPiU4V6//ZlECSv9A=";
+    sha256 = "sha256-6fmj1Cv/c7XrD3fsIs0BY8PiGUnMQUrR8ZoEZd3kH/4=";
   };
 
   configureFlags = [

pkgs/development/libraries/fdk-aac/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fdk-aac";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/opencore-amr/fdk-aac/${pname}-${version}.tar.gz";
-    sha256 = "sha256-yehjDPnUM/POrXSQahUg0iI/ibzT+pJUhhAXRAuOsi8=";
+    sha256 = "sha256-gptrie7zgkCc2mhX/YKvhPq7Y0F7CO3p6npVP4Ect54=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/ffmpeg/generic.nix

@@ -34,15 +34,17 @@
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
 , withCelt ? withFullDeps # CELT decoder
+, withChromaprint ? withFullDeps # Audio fingerprinting
 , withCuda ? withFullDeps && (with stdenv; (!isDarwin && !hostPlatform.isAarch && !hostPlatform.isRiscV))
 , withCudaLLVM ? withFullDeps
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
 , withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
 , withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
 , withFdkAac ? withFullDeps && withUnfree # Fraunhofer FDK AAC de/encoder
+, withFlite ? withFullDeps # Voice Synthesis
 , withFontconfig ? withHeadlessDeps # Needed for drawtext filter
 , withFreetype ? withHeadlessDeps # Needed for drawtext filter
-, withFrei0r ? withFullDeps # frei0r video filtering
+, withFrei0r ? withFullDeps && withGPL # frei0r video filtering
 , withFribidi ? withFullDeps # Needed for drawtext filter
 , withGme ? withFullDeps # Game Music Emulator
 , withGnutls ? withHeadlessDeps
@@ -50,7 +52,6 @@
 , withIconv ? withHeadlessDeps
 , withJack ? withFullDeps && !stdenv.isDarwin # Jack audio
 , withLadspa ? withFullDeps # LADSPA audio filtering
-, withLibplacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
 , withLzma ? withHeadlessDeps # xz-utils
 , withMfx ? withFullDeps && (with stdenv.hostPlatform; isLinux && !isAarch) # Hardware acceleration via intel-media-sdk/libmfx
 , withModplug ? withFullDeps && !stdenv.isDarwin # ModPlug support
@@ -61,16 +62,17 @@
 , withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
 , withOpenal ? withFullDeps # OpenAL 1.1 capture support
 , withOpencl ? withFullDeps
-, withOpencoreAmrnb ? withFullDeps # AMR-NB de/encoder & AMR-WB decoder
+, withOpencoreAmrnb ? withFullDeps && withVersion3 # AMR-NB de/encoder & AMR-WB decoder
 , withOpengl ? false # OpenGL rendering
 , withOpenh264 ? withFullDeps # H.264/AVC encoder
 , withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
 , withOpenmpt ? withFullDeps # Tracked music files decoder
 , withOpus ? withHeadlessDeps # Opus de/encoder
+, withPlacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
 , withPulse ? withSmallDeps && !stdenv.isDarwin # Pulseaudio input support
 , withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
 , withRtmp ? false # RTMP[E] support
-, withSamba ? withFullDeps && !stdenv.isDarwin # Samba protocol
+, withSamba ? withFullDeps && !stdenv.isDarwin && withGPLv3 # Samba protocol
 , withSdl2 ? withSmallDeps
 , withShaderc ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
 , withSoxr ? withHeadlessDeps # Resampling via soxr
@@ -85,23 +87,23 @@
 , withV4l2M2m ? withV4l2
 , withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
 , withVdpau ? withSmallDeps # Vdpau hardware acceleration
-, withVidStab ? withFullDeps # Video stabilization
-, withVmaf ? withFullDeps && withGPLv3 && !stdenv.isAarch64 && lib.versionAtLeast version "5" # Netflix's VMAF (Video Multi-Method Assessment Fusion)
-, withVoAmrwbenc ? withFullDeps # AMR-WB encoder
+, withVidStab ? withFullDeps && withGPL # Video stabilization
+, withVmaf ? withFullDeps && !stdenv.isAarch64 && lib.versionAtLeast version "5" # Netflix's VMAF (Video Multi-Method Assessment Fusion)
+, withVoAmrwbenc ? withFullDeps && withVersion3 # AMR-WB encoder
 , withVorbis ? withHeadlessDeps # Vorbis de/encoding, native encoder exists
 , withVpx ? withHeadlessDeps && stdenv.buildPlatform == stdenv.hostPlatform # VP8 & VP9 de/encoding
 , withVulkan ? withFullDeps && !stdenv.isDarwin
 , withWebp ? withFullDeps # WebP encoder
-, withX264 ? withHeadlessDeps # H.264/AVC encoder
-, withX265 ? withHeadlessDeps # H.265/HEVC encoder
-, withXavs ? withFullDeps # AVS encoder
+, withX264 ? withHeadlessDeps && withGPL # H.264/AVC encoder
+, withX265 ? withHeadlessDeps && withGPL # H.265/HEVC encoder
+, withXavs ? withFullDeps && withGPL # AVS encoder
 , withXcb ? withXcbShm || withXcbxfixes || withXcbShape # X11 grabbing using XCB
 , withXcbShape ? withFullDeps # X11 grabbing shape rendering
 , withXcbShm ? withFullDeps # X11 grabbing shm communication
 , withXcbxfixes ? withFullDeps # X11 grabbing mouse rendering
 , withXlib ? withFullDeps # Xlib support
 , withXml2 ? withFullDeps # libxml2 support, for IMF and DASH demuxers
-, withXvid ? withHeadlessDeps # Xvid encoder, native encoder exists
+, withXvid ? withHeadlessDeps && withGPL # Xvid encoder, native encoder exists
 , withZimg ? withHeadlessDeps
 , withZlib ? withHeadlessDeps
 , withZmq ? withFullDeps # Message passing
@@ -110,7 +112,8 @@
  *  Licensing options (yes some are listed twice, filters and such are not listed)
  */
 , withGPL ? true
-, withGPLv3 ? true
+, withVersion3 ? true # When withGPL is set this implies GPLv3 otherwise it is LGPLv3
+, withGPLv3 ? withGPL && withVersion3
 , withUnfree ? false
 
 /*
@@ -125,6 +128,11 @@
 , withMultithread ? true # Multithreading via pthreads/win32 threads
 , withNetwork ? withHeadlessDeps # Network support
 , withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
+, withStatic ? stdenv.hostPlatform.isStatic
+, withShared ? !stdenv.hostPlatform.isStatic
+, withPic ? true
+, withThumb ? false # On some ARM platforms
+
 /*
  *  Program options
  */
@@ -181,9 +189,11 @@
 , alsa-lib
 , bzip2
 , celt
+, chromaprint
 , clang
 , dav1d
 , fdk_aac
+, flite
 , fontconfig
 , freetype
 , frei0r
@@ -301,8 +311,8 @@ assert lib.elem ffmpegVariant [ "headless" "small" "full" ];
 /*
  *  Licensing dependencies
  */
-assert withGPLv3 -> withGPL;
-assert withUnfree -> withGPL && withGPLv3;
+assert withGPLv3 -> withGPL && withVersion3;
+
 /*
  *  Build dependencies
  */
@@ -376,14 +386,15 @@ stdenv.mkDerivation (finalAttrs: {
      *  Licensing flags
      */
     (enableFeature withGPL "gpl")
-    (enableFeature withGPLv3 "version3")
+    (enableFeature withVersion3 "version3")
     (enableFeature withUnfree "nonfree")
     /*
      *  Build flags
      */
-    # On some ARM platforms --enable-thumb
-    "--enable-shared"
-    "--enable-pic"
+    (enableFeature withStatic "static")
+    (enableFeature withShared "shared")
+    (enableFeature withPic "pic")
+    (enableFeature withThumb "thumb")
 
     (enableFeature withSmallBuild "small")
     (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
@@ -447,15 +458,23 @@ stdenv.mkDerivation (finalAttrs: {
      *  External libraries
      */
     (enableFeature withAlsa "alsa")
-    # FIXME: see if jellyfin-ffmpeg is already on a version >= 6.1 to use enableFeature
-    (optionalString (withAribcaption && lib.versionAtLeast finalAttrs.version "6.1") "--enable-libaribcaption")
+    (enableFeature withAom "libaom")
+  ] ++ optionals (versionAtLeast finalAttrs.version "6.1") [
+    (enableFeature withAribcaption "libaribcaption")
+  ] ++ [
+    (enableFeature withAss "libass")
+    (enableFeature withBluray "libbluray")
+    (enableFeature withBs2b "libbs2b")
     (enableFeature withBzlib "bzlib")
     (enableFeature withCelt "libcelt")
+    (enableFeature withChromaprint "chromaprint")
     (enableFeature withCuda "cuda")
     (enableFeature withCudaLLVM "cuda-llvm")
     (enableFeature withDav1d "libdav1d")
+    (enableFeature withDc1394 "libdc1394")
+    (enableFeature withDrm "libdrm")
     (enableFeature withFdkAac "libfdk-aac")
-    "--disable-libflite" # Force disable until a solution is found
+    (enableFeature withFlite "libflite")
     (enableFeature withFontconfig "fontconfig")
     (enableFeature withFreetype "libfreetype")
     (enableFeature withFrei0r "frei0r")
@@ -463,41 +482,14 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withGme "libgme")
     (enableFeature withGnutls "gnutls")
     (enableFeature withGsm "libgsm")
-    (enableFeature withLadspa "ladspa")
-    (enableFeature withMp3lame "libmp3lame")
-    (enableFeature withAom "libaom")
-    (enableFeature withAss "libass")
-    (enableFeature withBluray "libbluray")
-    (enableFeature withBs2b "libbs2b")
-    (enableFeature withDc1394 "libdc1394")
-    (enableFeature withDrm "libdrm")
     (enableFeature withIconv "iconv")
     (enableFeature withJack "libjack")
+    (enableFeature withLadspa "ladspa")
+    (enableFeature withLzma "lzma")
     (enableFeature withMfx "libmfx")
     (enableFeature withModplug "libmodplug")
+    (enableFeature withMp3lame "libmp3lame")
     (enableFeature withMysofa "libmysofa")
-    (enableFeature withOpus "libopus")
-    (optionalString (versionAtLeast finalAttrs.version "5.0" && withLibplacebo) "--enable-libplacebo")
-    (enableFeature withSvg "librsvg")
-    (enableFeature withSrt "libsrt")
-    (enableFeature withSsh "libssh")
-    (enableFeature withTensorflow "libtensorflow")
-    (enableFeature withTheora "libtheora")
-    (enableFeature withV4l2 "libv4l2")
-    (enableFeature withV4l2M2m "v4l2-m2m")
-    (enableFeature withVaapi "vaapi")
-    (enableFeature withVdpau "vdpau")
-    (enableFeature withVorbis "libvorbis")
-    (enableFeature withVmaf "libvmaf")
-    (enableFeature withVpx "libvpx")
-    (enableFeature withWebp "libwebp")
-    (enableFeature withXlib "xlib")
-    (enableFeature withXcb "libxcb")
-    (enableFeature withXcbShm "libxcb-shm")
-    (enableFeature withXcbxfixes "libxcb-xfixes")
-    (enableFeature withXcbShape "libxcb-shape")
-    (enableFeature withXml2 "libxml2")
-    (enableFeature withLzma "lzma")
     (enableFeature withNvdec "cuvid")
     (enableFeature withNvdec "nvdec")
     (enableFeature withNvenc "nvenc")
@@ -508,25 +500,50 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withOpenh264 "libopenh264")
     (enableFeature withOpenjpeg "libopenjpeg")
     (enableFeature withOpenmpt "libopenmpt")
+    (enableFeature withOpus "libopus")
+  ] ++ optionals (versionAtLeast finalAttrs.version "5.0") [
+    (enableFeature withPlacebo "libplacebo")
+  ] ++ [
     (enableFeature withPulse "libpulse")
     (enableFeature withRav1e "librav1e")
-    (enableFeature withSvtav1 "libsvtav1")
     (enableFeature withRtmp "librtmp")
+    (enableFeature withSamba "libsmbclient")
     (enableFeature withSdl2 "sdl2")
+  ] ++ optionals (versionAtLeast finalAttrs.version "5.0") [
+    (enableFeature withShaderc "libshaderc")
+  ] ++ [
     (enableFeature withSoxr "libsoxr")
     (enableFeature withSpeex "libspeex")
+    (enableFeature withSrt "libsrt")
+    (enableFeature withSsh "libssh")
+    (enableFeature withSvg "librsvg")
+    (enableFeature withSvtav1 "libsvtav1")
+    (enableFeature withTensorflow "libtensorflow")
+    (enableFeature withTheora "libtheora")
+    (enableFeature withV4l2 "libv4l2")
+    (enableFeature withV4l2M2m "v4l2-m2m")
+    (enableFeature withVaapi "vaapi")
+    (enableFeature withVdpau "vdpau")
     (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
+    (enableFeature withVmaf "libvmaf")
     (enableFeature withVoAmrwbenc "libvo-amrwbenc")
+    (enableFeature withVorbis "libvorbis")
+    (enableFeature withVpx "libvpx")
+    (enableFeature withVulkan "vulkan")
+    (enableFeature withWebp "libwebp")
     (enableFeature withX264 "libx264")
     (enableFeature withX265 "libx265")
     (enableFeature withXavs "libxavs")
+    (enableFeature withXcb "libxcb")
+    (enableFeature withXcbShape "libxcb-shape")
+    (enableFeature withXcbShm "libxcb-shm")
+    (enableFeature withXcbxfixes "libxcb-xfixes")
+    (enableFeature withXlib "xlib")
+    (enableFeature withXml2 "libxml2")
     (enableFeature withXvid "libxvid")
-    (enableFeature withZmq "libzmq")
     (enableFeature withZimg "libzimg")
     (enableFeature withZlib "zlib")
-    (enableFeature withVulkan "vulkan")
-    (optionalString (lib.versionAtLeast finalAttrs.version "5") (enableFeature withShaderc "libshaderc"))
-    (enableFeature withSamba "libsmbclient")
+    (enableFeature withZmq "libzmq")
     /*
      * Developer flags
      */
@@ -558,10 +575,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ]
   ++ optionals withCudaLLVM [ clang ];
 
-  # TODO This was always in buildInputs before, why?
-  buildInputs = optionals withFullDeps [ libdc1394 ]
-  ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
-  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast finalAttrs.version "6") then nv-codec-headers-12 else nv-codec-headers) ]
+  buildInputs = optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast finalAttrs.version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
   ++ optionals withAribcaption [ libaribcaption ]
@@ -571,9 +585,12 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withBzlib [ bzip2 ]
   ++ optionals withCaca [ libcaca ]
   ++ optionals withCelt [ celt ]
+  ++ optionals withChromaprint [ chromaprint ]
   ++ optionals withDav1d [ dav1d ]
+  ++ optionals withDc1394 [ libdc1394 libraw1394 ]
   ++ optionals withDrm [ libdrm ]
   ++ optionals withFdkAac [ fdk_aac ]
+  ++ optionals withFlite [ flite ]
   ++ optionals withFontconfig [ fontconfig ]
   ++ optionals withFreetype [ freetype ]
   ++ optionals withFrei0r [ frei0r ]
@@ -584,7 +601,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
   ++ optionals withJack [ libjack2 ]
   ++ optionals withLadspa [ ladspaH ]
-  ++ optionals withLibplacebo [ (if (lib.versionAtLeast finalAttrs.version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withLzma [ xz ]
   ++ optionals withMfx [ intel-media-sdk ]
   ++ optionals withModplug [ libmodplug ]
@@ -599,6 +615,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withOpenjpeg [ openjpeg ]
   ++ optionals withOpenmpt [ libopenmpt ]
   ++ optionals withOpus [ libopus ]
+  ++ optionals withPlacebo [ (if (lib.versionAtLeast finalAttrs.version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withPulse [ libpulseaudio ]
   ++ optionals withRav1e [ rav1e ]
   ++ optionals withRtmp [ rtmpdump ]
@@ -613,6 +630,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withSvtav1 [ svt-av1 ]
   ++ optionals withTensorflow [ libtensorflow ]
   ++ optionals withTheora [ libtheora ]
+  ++ optionals withV4l2 [ libv4l ]
   ++ optionals withVaapi [ (if withSmallDeps then libva else libva-minimal) ]
   ++ optionals withVdpau [ libvdpau ]
   ++ optionals withVidStab [ vid-stab ]
@@ -620,7 +638,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
   ++ optionals withVorbis [ libvorbis ]
   ++ optionals withVpx [ libvpx ]
-  ++ optionals withV4l2 [ libv4l ]
   ++ optionals withVulkan [ vulkan-headers vulkan-loader ]
   ++ optionals withWebp [ libwebp ]
   ++ optionals withX264 [ x264 ]
@@ -703,11 +720,13 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = with licenses; [ lgpl21Plus ]
       ++ optional withGPL gpl2Plus
+      ++ optional withVersion3 lgpl3Plus
       ++ optional withGPLv3 gpl3Plus
-      ++ optional withUnfree unfreeRedistributable;
+      ++ optional withUnfree unfreeRedistributable
+      ++ optional (withGPL && withUnfree) unfree;
     pkgConfigModules = [ "libavutil" ];
     platforms = platforms.all;
-    maintainers = with maintainers; [ atemu arthsmn ];
+    maintainers = with maintainers; [ atemu arthsmn jopejoe1 ];
     mainProgram = "ffmpeg";
   };
 })

pkgs/development/libraries/gjs/default.nix

@@ -32,13 +32,13 @@ let
   ];
 in stdenv.mkDerivation (finalAttrs: {
   pname = "gjs";
-  version = "1.78.1";
+  version = "1.78.3";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fpBRHEKRJ8OerABoxKyaNT335vu8ZG9fGOiWKILBhkE=";
+    hash = "sha256-QtUDZMql15LHZzT+W7zEudu0iBnaIKQGAGHouVJhNKQ=";
   };
 
   patches = [

pkgs/development/libraries/glib/default.nix

@@ -50,11 +50,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.78.3";
+  version = "2.78.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "YJgB3Tc3luUVlyv5X8Cy2qRFRUge4vRlxPIE0iSyvCE=";
+    sha256 = "sha256-JLjgZy3KEgzDLTlLzLhYROcy4E/nXRi7BXOy28dUj2M=";
   };
 
   patches = lib.optionals stdenv.isDarwin [

pkgs/development/libraries/glibc/common.nix

@@ -44,7 +44,7 @@
 
 let
   version = "2.38";
-  patchSuffix = "-27";
+  patchSuffix = "-44";
   sha256 = "sha256-+4KZiZiyspllRnvBtp0VLpwwfSzzAcnq+0VVt3DvP9I=";
 in
 
@@ -60,7 +60,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.38/master && git describe
-          glibc-2.38-27-g750a45a783
+          glibc-2.38-44-gd37c2b20a4
           $ git show --minimal --reverse glibc-2.38.. | gzip -9n --rsyncable - > 2.38-master.patch.gz
 
          To compare the archive contents zdiff can be used.
@@ -96,6 +96,11 @@ stdenv.mkDerivation ({
          & https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991
       */
       ./reenable_DT_HASH.patch
+
+      /* Retrieved from https://salsa.debian.org/glibc-team/glibc/-/commit/662dbc4f9287139a0d9c91df328a5ba6cc6abee1#0f3c6d67cb8cf5bb35c421c20f828fea97b68edf
+         Qualys advisory: https://www.qualys.com/2024/01/30/qsort.txt
+       */
+      ./local-qsort-memory-corruption.patch
     ]
     /* NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost
        every HPC piece of software, without this patch CUDA compilation on ARM
@@ -155,7 +160,7 @@ stdenv.mkDerivation ({
       # and on aarch64 with binutils 2.30 or later.
       # https://sourceware.org/glibc/wiki/PortStatus
       "--enable-static-pie"
-    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
+    ] ++ lib.optionals stdenv.hostPlatform.isx86_64 [
       # Enable Intel Control-flow Enforcement Technology (CET) support
       "--enable-cet"
     ] ++ lib.optionals withLinuxHeaders [

pkgs/development/libraries/glibc/local-qsort-memory-corruption.patch

@@ -0,0 +1,14 @@
+diff -rup a/stdlib/qsort.c b/stdlib/qsort.c
+--- a/stdlib/qsort.c	2023-07-31 10:54:16.000000000 -0700
++++ b/stdlib/qsort.c	2024-01-15 09:08:25.596167959 -0800
+@@ -224,7 +224,8 @@ _quicksort (void *const pbase, size_t to
+     while ((run_ptr += size) <= end_ptr)
+       {
+ 	tmp_ptr = run_ptr - size;
+-	while ((*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
++	while (tmp_ptr != base_ptr
++	       && (*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
+ 	  tmp_ptr -= size;
+ 
+ 	tmp_ptr += size;
+

pkgs/development/libraries/gperftools/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gperftools";
-  version = "2.10";
+  version = "2.15";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-lUX9T31cYZEi+0DgF52EDSL9yiSHa8ToMxhpQFKHOGk=";
+    sha256 = "sha256-3ibr8AHzo7txX1U+9oOWA60qeeJs/OGeevv+sgBwQa0=";
   };
 
   patches = [

pkgs/development/libraries/graphene/default.nix

@@ -11,10 +11,13 @@
 , mutest
 , nixosTests
 , glib
+, withDocumentation ? !stdenv.hostPlatform.isStatic
 , gtk-doc
 , docbook_xsl
 , docbook_xml_dtd_43
+, buildPackages
 , gobject-introspection
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , makeWrapper
 }:
 
@@ -22,7 +25,8 @@ stdenv.mkDerivation rec {
   pname = "graphene";
   version = "1.10.8";
 
-  outputs = [ "out" "dev" "devdoc" ]
+  outputs = [ "out" "dev" ]
+    ++ lib.optionals withDocumentation [ "devdoc" ]
     ++ lib.optionals (stdenv.hostPlatform == stdenv.buildPlatform) [ "installedTests" ];
 
   src = fetchFromGitHub {
@@ -51,15 +55,17 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    docbook_xml_dtd_43
-    docbook_xsl
-    gtk-doc
     meson
     ninja
     pkg-config
-    gobject-introspection
     python3
     makeWrapper
+  ] ++ lib.optionals withDocumentation [
+    docbook_xml_dtd_43
+    docbook_xsl
+    gtk-doc
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     mesonEmulatorHook
   ];
@@ -73,8 +79,8 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
-    "-Dintrospection=enabled"
+    (lib.mesonBool "gtk_doc" withDocumentation)
+    (lib.mesonEnable "introspection" withIntrospection)
     "-Dinstalled_test_datadir=${placeholder "installedTests"}/share"
     "-Dinstalled_test_bindir=${placeholder "installedTests"}/libexec"
   ] ++ lib.optionals stdenv.isAarch32 [
@@ -87,12 +93,13 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs tests/gen-installed-test.py
+  '' + lib.optionalString withIntrospection ''
     PATH=${python3.withPackages (pp: [ pp.pygobject3 pp.tappy ])}/bin:$PATH patchShebangs tests/introspection.py
   '';
 
   postFixup = let
     introspectionPy = "${placeholder "installedTests"}/libexec/installed-tests/graphene-1.0/introspection.py";
-  in ''
+  in lib.optionalString withIntrospection ''
     if [ -x '${introspectionPy}' ] ; then
       wrapProgram '${introspectionPy}' \
         --prefix GI_TYPELIB_PATH : "$out/lib/girepository-1.0"

pkgs/development/libraries/grpc/default.nix

@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.60.0"; # N.B: if you change this, please update:
+  version = "1.61.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-0mn+nQAgaurd1WomzcLUAYwp88l26qGkP+cP1SSYxsE=";
+    hash = "sha256-NLxcGFQ1F5RLoSFC0XYMjvGXkSWc/vLzgtk5qsOndEo=";
     fetchSubmodules = true;
   };
 
@@ -40,6 +40,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/lopsided98/grpc/commit/a9b917666234f5665c347123d699055d8c2537b2.patch";
       hash = "sha256-Lm0GQsz/UjBbXXEE14lT0dcRzVmCKycrlrdBJj+KLu8=";
     })
+    (fetchpatch {
+      # Fix compatibility with Abseil 202401. Remove with the next release.
+      url = "https://github.com/grpc/grpc/commit/bc044174401a0842b36b8682936fc93b5041cf88.patch";
+      hash = "sha256-VKAuPtLqsR2dmrpKuFXq2HIhuDxPJVSH2w1G00N07RI=";
+      excludes = [ "src/core/lib/transport/message.cc" ];
+    })
   ];
 
   nativeBuildInputs = [ cmake pkg-config ]

pkgs/development/libraries/iso-codes/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iso-codes";
-  version = "4.15.0";
+  version = "4.16.0";
 
   src = fetchurl {
     url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz";
-    sha256 = "sha256-uDtUudfdbrh3OAs+xG83CwXa8sv6ExxhLwNZjWVMDvg=";
+    sha256 = "sha256-fJkPw5oFl1vtsBdeP/Cfw4MEiBX2i0Yqu/BVqAMuZsw=";
   };
 
   nativeBuildInputs = [ gettext python3 ];

pkgs/development/libraries/jellyfin-ffmpeg/default.nix

@@ -1,5 +1,4 @@
 { ffmpeg_6-full
-, chromaprint
 , fetchFromGitHub
 , lib
 }:
@@ -18,12 +17,9 @@ ffmpeg_6-full.overrideAttrs (old: rec {
   # Clobber upstream patches as they don't apply to the Jellyfin fork
   patches = [];
 
-  buildInputs = old.buildInputs ++ [ chromaprint ];
-
   configureFlags = old.configureFlags ++ [
     "--extra-version=Jellyfin"
     "--disable-ptx-compression" # https://github.com/jellyfin/jellyfin/issues/7944#issuecomment-1156880067
-    "--enable-chromaprint"
   ];
 
   postPatch = ''

pkgs/development/libraries/libaom/default.nix

@@ -1,5 +1,4 @@
 { lib, stdenv, fetchzip, yasm, perl, cmake, pkg-config, python3
-, enableButteraugli ? true, libjxl
 , enableVmaf ? true, libvmaf
 , gitUpdater
 }:
@@ -9,11 +8,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    hash = "sha256-JxMz+XnjmUvk8TlTqdU2HP1Gq3bXfcLkXp5AEv9+7hM=";
+    hash = "sha256-qng9fEbm71HqPnPzfgqswSium9egIgpB6ZLesOQVg6c=";
     stripRoot = false;
   };
 
@@ -23,8 +22,7 @@ stdenv.mkDerivation rec {
     yasm perl cmake pkg-config python3
   ];
 
-  propagatedBuildInputs = lib.optional enableButteraugli libjxl
-    ++ lib.optional enableVmaf libvmaf;
+  propagatedBuildInputs = lib.optional enableVmaf libvmaf;
 
   preConfigure = ''
     # build uses `git describe` to set the build version
@@ -42,8 +40,6 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
     "-DENABLE_TESTS=OFF"
-  ] ++ lib.optionals enableButteraugli [
-    "-DCONFIG_TUNE_BUTTERAUGLI=1"
   ] ++ lib.optionals enableVmaf [
     "-DCONFIG_TUNE_VMAF=1"
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [

pkgs/development/libraries/libcbor/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "unstable-2023-01-29"; # Musl fix hasn't been released yet.
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "PJK";
     repo = "libcbor";
-    rev = "cb4162f40d94751141b4d43b07c4add83e738a68";
-    sha256 = "sha256-ZTa+wG1g9KsVoqJG/yqxo2fJ7OhPnaI9QcfOmpOT3pg=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-eE11hYPsOKqfoX8fx/oYfOAichhUe4mMpNQNVZ6vAUI=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libdecor/default.nix

@@ -10,18 +10,19 @@
 , cairo
 , dbus
 , pango
+, gtk3
 }:
 
 stdenv.mkDerivation rec {
   pname = "libdecor";
-  version = "0.1.1";
+  version = "0.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libdecor";
     repo = "libdecor";
     rev = version;
-    hash = "sha256-8b6qCqOSDDbhYwAeAaUyI71tSopTkGtCJaxZaJw1vQQ=";
+    hash = "sha256-mID19uHXFKJUZtQsSOXjRdz541YVjMxmSHVa+DlkPRc=";
   };
 
   outputs = [ "out" "dev" ];
@@ -45,6 +46,7 @@ stdenv.mkDerivation rec {
     cairo
     dbus
     pango
+    gtk3
   ];
 
   meta = with lib; {

pkgs/development/libraries/libedit/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libedit";
-  version = "20221030-3.1";
+  version = "20230828-3.1";
 
   src = fetchurl {
     url = "https://thrysoee.dk/editline/${pname}-${version}.tar.gz";
-    sha256 = "sha256-8JJaWt9LG/EW7hl2a32qdmkXrsGYdHlDscTt9npL4rs=";
+    sha256 = "sha256-TugYK25WkpDn0fRPD3jayHFrNfZWt2Uo9pnGnJiBTa0=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libei/default.nix

@@ -23,14 +23,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libei";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";
     repo = "libei";
     rev = version;
-    hash = "sha256-ebZZ2dGXrPBUDPsuu5GZY5kDv9qndnxepQUGFDe9PUg=";
+    hash = "sha256-MHPWEBMtxoEJ8j3LyDPD+m3DsO9u8nE+/pPtRHHXEXA=";
   };
 
   buildInputs = [

pkgs/development/libraries/libgit2/default.nix

@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
   version = "1.7.1";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
+  outputs = ["lib" "dev" "out"];
+
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
@@ -47,7 +49,22 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = lib.optional (!stdenv.isLinux) libiconv;
 
-  doCheck = false; # hangs. or very expensive?
+  doCheck = true;
+  checkPhase = ''
+    testArgs=(-v -xonline)
+
+    # slow
+    testArgs+=(-xclone::nonetwork::bad_urls)
+
+    # failed to set permissions on ...: Operation not permitted
+    testArgs+=(-xrepo::init::extended_1)
+    testArgs+=(-xrepo::template::extended_with_template_and_shared_mode)
+
+    (
+      set -x
+      ./libgit2_tests ''${testArgs[@]}
+    )
+  '';
 
   passthru.tests = {
     inherit libgit2-glib;

pkgs/development/libraries/libgudev/default.nix

@@ -9,7 +9,6 @@
 , gnome
 , vala
 , gobject-introspection
-, fetchpatch
 , glibcLocales
 , umockdev
 }:
@@ -25,6 +24,18 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-YSZqsa/J1z28YKiyr3PpnS/f9H2ZVE0IV2Dk+mZ7XdE=";
   };
 
+  patches = [
+    # Conditionally disable one test that requires a locale implementation
+    # https://gitlab.gnome.org/GNOME/libgudev/-/merge_requests/31
+    ./tests-skip-double-test-on-stub-locale-impls.patch
+  ];
+
+  postPatch = ''
+    # The relative location of LD_PRELOAD works for Glibc but not for other loaders (e.g. pkgsMusl)
+    substituteInPlace tests/meson.build \
+      --replace "LD_PRELOAD=libumockdev-preload.so.0" "LD_PRELOAD=${lib.getLib umockdev}/lib/libumockdev-preload.so.0"
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [

pkgs/development/libraries/libgudev/tests-skip-double-test-on-stub-locale-impls.patch

@@ -0,0 +1,41 @@
+From ad8b10870ee2092268f87144d8e5ab7db2011139 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Tue, 30 Jan 2024 20:47:21 +0100
+Subject: [PATCH] tests: Skip double test on stub locale impls
+
+On musl, setlocale() with an unknown locale name will succeed, but
+treat the requested locale as if it were C.UTF-8.  Therefore, to
+properly check whether the locale is supported, we need to actually
+verify whether it works the way we expect when deciding whether to
+skip the test.
+---
+ tests/test-double.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tests/test-double.c b/tests/test-double.c
+index 91e77c9..e9d9232 100644
+--- a/tests/test-double.c
++++ b/tests/test-double.c
+@@ -39,8 +39,6 @@ fixture_teardown (Fixture *f, G_GNUC_UNUSED const void *data)
+ static void
+ test_double (Fixture *f, G_GNUC_UNUSED const void *data)
+ {
+-	g_assert_cmpstr (nl_langinfo(RADIXCHAR), ==, ",");
+-
+ 	umockdev_testbed_add_device (f->testbed, "platform", "dev1", NULL,
+ 				     "in_accel_scale", "0.0000098", NULL,
+ 				     "ID_MODEL", "KoolGadget", "SCALE", "0.0000098", NULL);
+@@ -73,6 +71,10 @@ int main(int argc, char **argv)
+ 	if (setlocale (LC_NUMERIC, "fr_FR.UTF-8") == NULL)
+ 		return GNU_SKIP_RETURNCODE;
+ 
++	/* Skip if locale doesn't work how we expect. */
++	if (strcmp (nl_langinfo(RADIXCHAR), ","))
++		return GNU_SKIP_RETURNCODE;
++
+ 	g_test_init (&argc, &argv, NULL);
+ 
+ 	g_test_add ("/gudev/double", Fixture, NULL,
+-- 
+GitLab
+

pkgs/development/libraries/libidn/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libidn";
-  version = "1.41";
+  version = "1.42";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-iE1wY2S4Gr3Re+6Whtj/KudDHFoUZRBHxorfizH9iUU=";
+    sha256 = "sha256-1sGZ3NgG5P4nk2DLSwg0mg05Vg7VSP/RzK3ajN7LRyM=";
   };
 
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];

pkgs/development/libraries/libidn2/default.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libidn2";
-  version = "2.3.4";
+  version = "2.3.7";
 
   src = fetchurl {
     url = "https://ftp.gnu.org/gnu/libidn/${pname}-${version}.tar.gz";
-    sha256 = "sha256-k8q6crTgUdH41PWgdqtjyZt3+u4Bm3K5eDsmeYbbtF8=";
+    hash = "sha256-TCGnkbYQuVGbnQ4SuAl78vNZsS+N2SZHYRqSnmv9fWQ=";
   };
 
   strictDeps = true;

pkgs/development/libraries/libimagequant/Cargo.lock

@@ -10,13 +10,14 @@ checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "ahash"
-version = "0.8.3"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
+checksum = "77c3a9648d43b9cd48db467b3f87fdd6e146bcc88ab0180006cef2179fe11d01"
 dependencies = [
  "cfg-if",
  "once_cell",
  "version_check",
+ "zerocopy",
 ]
 
 [[package]]
@@ -25,17 +26,11 @@ version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
 
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
 [[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 
 [[package]]
 name = "bytemuck"
@@ -77,36 +72,28 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
  "crossbeam-utils",
- "memoffset",
- "scopeguard",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "either"
@@ -144,7 +131,7 @@ dependencies = [
 
 [[package]]
 name = "imagequant"
-version = "4.2.2"
+version = "4.3.0"
 dependencies = [
  "arrayvec",
  "lodepng",
@@ -156,7 +143,7 @@ dependencies = [
 
 [[package]]
 name = "imagequant-sys"
-version = "4.0.3"
+version = "4.0.4"
 dependencies = [
  "bitflags",
  "imagequant",
@@ -165,15 +152,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.149"
+version = "0.2.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
+checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
 
 [[package]]
 name = "lodepng"
-version = "3.9.1"
+version = "3.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3cdccd0cf57a5d456f0656ebcff72c2e19503287e1afbf3b84382812adc0606"
+checksum = "a42d298694b14401847de29abd44adf278b42e989e516deac7b72018400002d8"
 dependencies = [
  "crc32fast",
  "fallible_collections",
@@ -182,15 +169,6 @@ dependencies = [
  "rgb",
 ]
 
-[[package]]
-name = "memoffset"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "miniz_oxide"
 version = "0.7.1"
@@ -202,15 +180,33 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
 dependencies = [
  "either",
  "rayon-core",
@@ -218,9 +214,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
@@ -228,18 +224,23 @@ dependencies = [
 
 [[package]]
 name = "rgb"
-version = "0.8.36"
+version = "0.8.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20ec2d3e3fc7a92ced357df9cebd5a10b6fb2aa1ee797bf7e9ce2f17dffc8f59"
+checksum = "05aaa8004b64fd573fc9d002f4e632d51ad4f026c2b5ba95fcb6c2f32c2c47d8"
 dependencies = [
  "bytemuck",
 ]
 
 [[package]]
-name = "scopeguard"
-version = "1.2.0"
+name = "syn"
+version = "2.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
 
 [[package]]
 name = "thread_local"
@@ -251,8 +252,34 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
 [[package]]
 name = "version_check"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]

pkgs/development/libraries/libimagequant/default.nix

@@ -1,14 +1,27 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, rust, rustPlatform, cargo-c, python3 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchurl
+, rust
+, rustPlatform
+, cargo-c
+, python3
+
+# tests
+, testers
+, vips
+, libimagequant
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "4.2.2";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
-    repo = pname;
+    repo = "libimagequant";
     rev = version;
-    hash = "sha256-cZgnJOmj+xJDcewsxH2Jp5AAnFZKVuYxKPtoGeN03g4=";
+    hash = "sha256-/gHe3LQaBWOQImBesKvHK46T42TtRld988wgxbut4i0=";
   };
 
   cargoLock = {
@@ -34,7 +47,13 @@ rustPlatform.buildRustPackage rec {
   '';
 
   passthru.tests = {
+    inherit vips;
     inherit (python3.pkgs) pillow;
+
+    pkg-config = testers.hasPkgConfigModules {
+      package = libimagequant;
+      moduleNames = [ "imagequant" ];
+    };
   };
 
   meta = with lib; {

pkgs/development/libraries/libinput/default.nix

@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.24.0";
+  version = "1.25.0";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     owner = "libinput";
     repo = "libinput";
     rev = version;
-    sha256 = "sha256-gTcgEZ7cs4jq8w5Genxtio9nVFy7y3n0nNXJ6SVtYHY=";
+    hash = "sha256-c2FU5OW+CIgtYTQy+bwIbaw3SP1pVxaLokhO+ag5/1s=";
   };
 
   patches = [

pkgs/development/libraries/libipt/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libipt";
-  version = "2.0.6";
+  version = "2.1";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "libipt";
     rev = "v${version}";
-    sha256 = "sha256-RuahOkDLbac9bhXn8QSf7lMRw11PIpXQo3eaQ9N4Rtc=";
+    sha256 = "sha256-SLCuNTFRGFh0mTv1xLCIDg7b6DbWCxgHhrCoPu9xpmw=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/libjpeg-turbo/0001-Compile-transupp.c-as-part-of-the-library.patch

@@ -1,29 +1,26 @@
-From 4a0584f7c05641143151ebdc1be1163bebf9d35d Mon Sep 17 00:00:00 2001
+From 6442d11617f95d13e2a371bd3e01f5082a9c356d Mon Sep 17 00:00:00 2001
 From: Las <las@protonmail.ch>
 Date: Sun, 3 Jan 2021 18:35:37 +0000
 Subject: [PATCH] Compile transupp.c as part of the library
 
-The exported symbols are made weak to not conflict with users
-of the library that already vendor this functionality.
 ---
  CMakeLists.txt |  4 ++--
- transupp.c     | 14 +++++++-------
- 2 files changed, 9 insertions(+), 9 deletions(-)
+ 1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 0ca6f98..a9a0fae 100644
+index adb0ca45..46fc16dd 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -533,7 +533,7 @@ set(JPEG_SOURCES jcapimin.c jcapistd.c jccoefct.c jccolor.c jcdctmgr.c jchuff.c
-   jdatasrc.c jdcoefct.c jdcolor.c jddctmgr.c jdhuff.c jdicc.c jdinput.c
-   jdmainct.c jdmarker.c jdmaster.c jdmerge.c jdphuff.c jdpostct.c jdsample.c
-   jdtrans.c jerror.c jfdctflt.c jfdctfst.c jfdctint.c jidctflt.c jidctfst.c
--  jidctint.c jidctred.c jquant1.c jquant2.c jutils.c jmemmgr.c jmemnobs.c)
-+  jidctint.c jidctred.c jquant1.c jquant2.c jutils.c jmemmgr.c jmemnobs.c transupp.c)
+@@ -581,7 +581,7 @@ set(JPEG_SOURCES ${JPEG12_SOURCES} jcapimin.c jchuff.c jcicc.c jcinit.c
+   jclhuff.c jcmarker.c jcmaster.c jcomapi.c jcparam.c jcphuff.c jctrans.c
+   jdapimin.c jdatadst.c jdatasrc.c jdhuff.c jdicc.c jdinput.c jdlhuff.c
+   jdmarker.c jdmaster.c jdphuff.c jdtrans.c jerror.c jfdctflt.c jmemmgr.c
+-  jmemnobs.c jpeg_nbits.c)
++  jmemnobs.c jpeg_nbits.c transupp.c)
  
  if(WITH_ARITH_ENC OR WITH_ARITH_DEC)
    set(JPEG_SOURCES ${JPEG_SOURCES} jaricom.c)
-@@ -1489,7 +1489,7 @@ install(EXPORT ${CMAKE_PROJECT_NAME}Targets
+@@ -1803,7 +1803,7 @@ install(EXPORT ${CMAKE_PROJECT_NAME}Targets
  
  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/jconfig.h
    ${CMAKE_CURRENT_SOURCE_DIR}/jerror.h ${CMAKE_CURRENT_SOURCE_DIR}/jmorecfg.h
@@ -32,73 +29,6 @@ index 0ca6f98..a9a0fae 100644
    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
  
  include(cmakescripts/BuildPackages.cmake)
-diff --git a/transupp.c b/transupp.c
-index 6e86077..2da49a7 100644
---- a/transupp.c
-+++ b/transupp.c
-@@ -1386,7 +1386,7 @@ jt_read_integer(const char **strptr, JDIMENSION *result)
-  * This code is loosely based on XParseGeometry from the X11 distribution.
-  */
- 
--GLOBAL(boolean)
-+GLOBAL(boolean) __attribute__((weak))
- jtransform_parse_crop_spec(jpeg_transform_info *info, const char *spec)
- {
-   info->crop = FALSE;
-@@ -1486,7 +1486,7 @@ trim_bottom_edge(jpeg_transform_info *info, JDIMENSION full_height)
-  * and transformation is not perfect.  Otherwise returns TRUE.
-  */
- 
--GLOBAL(boolean)
-+GLOBAL(boolean) __attribute__((weak))
- jtransform_request_workspace(j_decompress_ptr srcinfo,
-                              jpeg_transform_info *info)
- {
-@@ -2033,7 +2033,7 @@ adjust_exif_parameters(JOCTET *data, unsigned int length, JDIMENSION new_width,
-  * to jpeg_write_coefficients().
-  */
- 
--GLOBAL(jvirt_barray_ptr *)
-+GLOBAL(jvirt_barray_ptr *) __attribute__((weak))
- jtransform_adjust_parameters(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-                              jvirt_barray_ptr *src_coef_arrays,
-                              jpeg_transform_info *info)
-@@ -2152,7 +2152,7 @@ jtransform_adjust_parameters(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-  * Note that some transformations will modify the source data arrays!
-  */
- 
--GLOBAL(void)
-+GLOBAL(void) __attribute__((weak))
- jtransform_execute_transform(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-                              jvirt_barray_ptr *src_coef_arrays,
-                              jpeg_transform_info *info)
-@@ -2264,7 +2264,7 @@ jtransform_execute_transform(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-  *           (may use custom action then)
-  */
- 
--GLOBAL(boolean)
-+GLOBAL(boolean) __attribute__((weak))
- jtransform_perfect_transform(JDIMENSION image_width, JDIMENSION image_height,
-                              int MCU_width, int MCU_height,
-                              JXFORM_CODE transform)
-@@ -2303,7 +2303,7 @@ jtransform_perfect_transform(JDIMENSION image_width, JDIMENSION image_height,
-  * This must be called before jpeg_read_header() to have the desired effect.
-  */
- 
--GLOBAL(void)
-+GLOBAL(void) __attribute__((weak))
- jcopy_markers_setup(j_decompress_ptr srcinfo, JCOPY_OPTION option)
- {
- #ifdef SAVE_MARKERS_SUPPORTED
-@@ -2331,7 +2331,7 @@ jcopy_markers_setup(j_decompress_ptr srcinfo, JCOPY_OPTION option)
-  * JFIF APP0 or Adobe APP14 markers if selected.
-  */
- 
--GLOBAL(void)
-+GLOBAL(void) __attribute__((weak))
- jcopy_markers_execute(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
-                       JCOPY_OPTION option)
- {
 -- 
-2.29.2
+2.43.0
 

pkgs/development/libraries/libjpeg-turbo/0002-Make-exported-symbols-in-transupp.c-weak.patch

@@ -0,0 +1,81 @@
+From 6442d11617f95d13e2a371bd3e01f5082a9c356d Mon Sep 17 00:00:00 2001
+From: Las <las@protonmail.ch>
+Date: Sun, 3 Jan 2021 18:35:37 +0000
+Subject: [PATCH] Make exported symbols in transupp.c weak
+
+The exported symbols are made weak to not conflict with users
+of the library that already vendor this functionality.
+---
+ transupp.c     | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/transupp.c b/transupp.c
+index 34fbb371..c0ade5a9 100644
+--- a/transupp.c
++++ b/transupp.c
+@@ -1388,7 +1388,7 @@ jt_read_integer(const char **strptr, JDIMENSION *result)
+  * This code is loosely based on XParseGeometry from the X11 distribution.
+  */
+ 
+-GLOBAL(boolean)
++GLOBAL(boolean) __attribute__((weak))
+ jtransform_parse_crop_spec(jpeg_transform_info *info, const char *spec)
+ {
+   info->crop = FALSE;
+@@ -1488,7 +1488,7 @@ trim_bottom_edge(jpeg_transform_info *info, JDIMENSION full_height)
+  * and transformation is not perfect.  Otherwise returns TRUE.
+  */
+ 
+-GLOBAL(boolean)
++GLOBAL(boolean) __attribute__((weak))
+ jtransform_request_workspace(j_decompress_ptr srcinfo,
+                              jpeg_transform_info *info)
+ {
+@@ -2035,7 +2035,7 @@ adjust_exif_parameters(JOCTET *data, unsigned int length, JDIMENSION new_width,
+  * to jpeg_write_coefficients().
+  */
+ 
+-GLOBAL(jvirt_barray_ptr *)
++GLOBAL(jvirt_barray_ptr *) __attribute__((weak))
+ jtransform_adjust_parameters(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+                              jvirt_barray_ptr *src_coef_arrays,
+                              jpeg_transform_info *info)
+@@ -2154,7 +2154,7 @@ jtransform_adjust_parameters(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+  * Note that some transformations will modify the source data arrays!
+  */
+ 
+-GLOBAL(void)
++GLOBAL(void) __attribute__((weak))
+ jtransform_execute_transform(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+                              jvirt_barray_ptr *src_coef_arrays,
+                              jpeg_transform_info *info)
+@@ -2266,7 +2266,7 @@ jtransform_execute_transform(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+  *           (may use custom action then)
+  */
+ 
+-GLOBAL(boolean)
++GLOBAL(boolean) __attribute__((weak))
+ jtransform_perfect_transform(JDIMENSION image_width, JDIMENSION image_height,
+                              int MCU_width, int MCU_height,
+                              JXFORM_CODE transform)
+@@ -2305,7 +2305,7 @@ jtransform_perfect_transform(JDIMENSION image_width, JDIMENSION image_height,
+  * This must be called before jpeg_read_header() to have the desired effect.
+  */
+ 
+-GLOBAL(void)
++GLOBAL(void) __attribute__((weak))
+ jcopy_markers_setup(j_decompress_ptr srcinfo, JCOPY_OPTION option)
+ {
+ #ifdef SAVE_MARKERS_SUPPORTED
+@@ -2337,7 +2337,7 @@ jcopy_markers_setup(j_decompress_ptr srcinfo, JCOPY_OPTION option)
+  * JFIF APP0 or Adobe APP14 markers if selected.
+  */
+ 
+-GLOBAL(void)
++GLOBAL(void) __attribute__((weak))
+ jcopy_markers_execute(j_decompress_ptr srcinfo, j_compress_ptr dstinfo,
+                       JCOPY_OPTION option)
+ {
+-- 
+2.43.0
+

pkgs/development/libraries/libjpeg-turbo/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , nasm
 , openjdk
@@ -32,19 +33,29 @@ assert !(enableJpeg7 && enableJpeg8);  # pick only one or none, not both
 stdenv.mkDerivation (finalAttrs: {
 
   pname = "libjpeg-turbo";
-  version = "2.1.5.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "libjpeg-turbo";
     repo = "libjpeg-turbo";
     rev = finalAttrs.version;
-    sha256 = "sha256-96SBBZp+/4WkXLvHKSPItNi5WuzdVccI/ZcbJOFjYYk=";
+    hash = "sha256-xHjd0WHN50b75wdWPHUwfmJGsiWKmj+zA59UwakIo74=";
   };
 
-  # This is needed by freeimage
-  patches = [ ./0001-Compile-transupp.c-as-part-of-the-library.patch ]
-    ++ lib.optional stdenv.hostPlatform.isMinGW
-    ./mingw-boolean.patch;
+  patches = [
+    (fetchpatch {
+      name = "CMAKE_CROSSCOMPILING_EMULATOR=env-fix.patch";
+      url = "https://github.com/libjpeg-turbo/libjpeg-turbo/compare/36c51dd3eb60ebde3ca77d3cfa7df3422f1aaaf1..b6ee1016abbc55116304ad396cf88aa19391e10a.patch";
+      hash = "sha256-dNwXicvZEsG02TBaM5nYMlZ+VczT/Dfx6ZM/6huZpwE=";
+    })
+
+    # This is needed by freeimage
+    ./0001-Compile-transupp.c-as-part-of-the-library.patch
+  ] ++ lib.optionals (!stdenv.hostPlatform.isMinGW) [
+    ./0002-Make-exported-symbols-in-transupp.c-weak.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
+    ./mingw-boolean.patch
+  ];
 
   outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
 

pkgs/development/libraries/libjxl/default.nix

@@ -1,5 +1,4 @@
 { stdenv, lib, fetchFromGitHub
-, fetchpatch
 , brotli
 , cmake
 , giflib
@@ -12,7 +11,6 @@
 , openexr_3
 , pkg-config
 , zlib
-, buildDocs ? true
 , asciidoc
 , graphviz
 , doxygen
@@ -21,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.8.2";
+  version = "0.9.1";
 
   outputs = [ "out" "dev" ];
 
@@ -29,31 +27,21 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     rev = "v${version}";
-    hash = "sha256-I3PGgh0XqRkCFz7lUZ3Q4eU0+0GwaQcVb6t4Pru1kKo=";
+    hash = "sha256-n5KNbbw6NQRROEM7Cojla/igRCFNawUq7nfhzJlMlPI=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
 
-  patches = [
-    # Add missing <atomic> content to fix gcc compilation for RISCV architecture
-    # https://github.com/libjxl/libjxl/pull/2211
-    (fetchpatch {
-      url = "https://github.com/libjxl/libjxl/commit/22d12d74e7bc56b09cfb1973aa89ec8d714fa3fc.patch";
-      hash = "sha256-X4fbYTMS+kHfZRbeGzSdBW5jQKw8UN44FEyFRUtw0qo=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     gtest
     pkg-config
-  ] ++ lib.optionals buildDocs [
     asciidoc
     doxygen
     python3
   ];
 
-  depsBuildBuild = lib.optionals buildDocs [
+  depsBuildBuild = [
     graphviz
   ];
 

pkgs/development/libraries/libmaxminddb/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmaxminddb";
-  version = "1.7.1";
+  version = "1.9.1";
 
   src = fetchurl {
     url = meta.homepage + "/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-6EFPDe3Oy8H2wxy2XNgWUJUqsGd6TYxJyrYDs7j7CD4=";
+    sha256 = "sha256-qAaCqJ2RX99gs10xYjL7BOvzb/8n/am9Of6KONPNPxI=";
   };
 
   meta = with lib; {

pkgs/development/libraries/libplacebo/default.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libplacebo";
-  version = "6.338.1";
+  version = "6.338.2";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NZmwR3+lIC2PF+k+kqCjoMYkMM/PKOJmDwAq7t6YONY=";
+    hash = "sha256-gE6yKnFvsOFh8bFYc7b+bS+zmdDU7jucr0HwhdDeFzU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libpsl/default.nix

@@ -14,22 +14,13 @@
 , publicsuffix-list
 }:
 
-let
-  enableValgrindTests = !stdenv.isDarwin && lib.meta.availableOn stdenv.hostPlatform valgrind
-    # Apparently valgrind doesn't support some new ARM features on (some) Hydra machines:
-    #  VEX: Mismatch detected between RDMA and atomics features.
-    && !stdenv.isAarch64
-    # Valgrind on musl does not hook malloc calls properly, resulting in errors `Invalid free() / delete / delete[] / realloc()`
-    # https://bugs.kde.org/show_bug.cgi?id=435441
-    && !stdenv.hostPlatform.isMusl
-  ;
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "libpsl";
-  version = "0.21.2";
+  version = "0.21.5";
 
   src = fetchurl {
     url = "https://github.com/rockdaboot/libpsl/releases/download/${version}/libpsl-${version}.tar.lz";
-    sha256 = "sha256-qj1wbEUnhtE0XglNriAc022B8Dz4HWNtXPwQ02WQfxc=";
+    hash = "sha256-mp9qjG7bplDPnqVUdc0XLdKEhzFoBOnHMgLZdXLNOi0=";
   };
 
   nativeBuildInputs = [
@@ -41,8 +32,6 @@ in stdenv.mkDerivation rec {
     pkg-config
     python3
     libxslt
-  ] ++ lib.optionals enableValgrindTests [
-    valgrind
   ];
 
   buildInputs = [
@@ -69,8 +58,6 @@ in stdenv.mkDerivation rec {
     "--with-psl-distfile=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
     "--with-psl-file=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
     "--with-psl-testfile=${publicsuffix-list}/share/publicsuffix/test_psl.txt"
-  ] ++ lib.optionals enableValgrindTests [
-    "--enable-valgrind-tests"
   ];
 
   enableParallelBuilding = true;

pkgs/development/libraries/libusb1/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libusb";
-  version = "1.0.26";
+  version = "1.0.27";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "libusb";
     rev = "v${version}";
-    sha256 = "sha256-LEy45YiFbueCCi8d2hguujMsxBezaTUERHUpFsTKGZQ=";
+    sha256 = "sha256-OtzYxWwiba0jRK9X+4deWWDDTeZWlysEt0qMyGUarDo=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libuv/default.nix

@@ -69,6 +69,9 @@ stdenv.mkDerivation (finalAttrs: {
         "fs_event_watch_dir_recursive" "fs_event_watch_file"
         "fs_event_watch_file_current_dir" "fs_event_watch_file_exact_path"
         "process_priority" "udp_create_early_bad_bind"
+    ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+        # fail on macos < 10.15 (starting in libuv 1.47.0)
+        "fs_write_alotof_bufs_with_offset" "fs_write_multiple_bufs" "fs_read_bufs"
     ] ++ lib.optionals stdenv.isAarch32 [
       # I observe this test failing with some regularity on ARMv7:
       # https://github.com/libuv/libuv/issues/1871

pkgs/development/libraries/libvpx/default.nix

@@ -75,13 +75,13 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.13.1";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KTbzZ5/qCH+bCvatYZhFiWcT+L2duD40E2w/BUaRorQ=";
+    hash = "sha256-duU1exUg7JiKCtZfNxyb/y40hxsXeTIMShf9YounTWA=";
   };
 
   postPatch = ''

pkgs/development/libraries/libwpe/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libwpe";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchurl {
     url = "https://wpewebkit.org/releases/libwpe-${version}.tar.xz";
-    sha256 = "sha256-sdDNzw+Nu0lOZbD3kT41cQbamg1X9Pu3udEjim2+mt4=";
+    sha256 = "sha256-iuOAIsUMs0DJb9vuEhfx5Gq1f7wci6mBQlZau+2+Iu8=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libxml2/default.nix

@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchFromGitLab
 , zlib
 , pkg-config
 , autoreconfHook
@@ -35,19 +34,16 @@ in
 let
 libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.12.3-unstable-2023-12-14";
+  version = "2.12.4";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
   outputMan = "bin";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "GNOME";
-    repo = "libxml2";
-    rev = "f006355eda722cae204606b9f95ba51f5ce9189b";
-    hash = "sha256-3WE90KDZq4Uaawuulc3t2+R8duCqgjEGUDN4HSXxohY=";
+  src = fetchurl {
+    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+    hash = "sha256-SXNg5CPPC9merNt8YhXeqS5tbonulAOTwrrg53y5t9A=";
   };
 
   strictDeps = true;

pkgs/development/libraries/lmdb/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "lmdb";
-  version = "0.9.31";
+  version = "0.9.32";
 
   src = fetchFromGitLab {
     domain = "git.openldap.org";
     owner = "openldap";
     repo = "openldap";
     rev = "LMDB_${version}";
-    sha256 = "sha256-SBbo7MX3NST+OFPDtQshevIYrIsZD9bOkSsH91inMBw=";
+    sha256 = "sha256-29ZrGIiGqrvX+WsPRs2V25hPmAJSHTHaGo19nMldsb8=";
   };
 
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
@@ -66,6 +66,7 @@ stdenv.mkDerivation rec {
       limited to the size of the virtual address space.
     '';
     homepage = "https://symas.com/lmdb/";
+    changelog = "https://git.openldap.org/openldap/openldap/-/blob/LMDB_${version}/libraries/liblmdb/CHANGES";
     maintainers = with maintainers; [ jb55 vcunat ];
     license = licenses.openldap;
     platforms = platforms.all;

pkgs/development/libraries/mesa/default.nix

@@ -86,8 +86,8 @@
 */
 
 let
-  version = "23.3.3";
-  hash = "sha256-UYMHwAV/o87otY33i+Qx1N9ar6ftxg0JJ4stegqA87Q=";
+  version = "23.3.5";
+  hash = "sha256-acyxJ4ZB/1utccoPhmGIrrGpKq3E27nTX1CuvsW4tQ8=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
@@ -121,7 +121,6 @@ self = stdenv.mkDerivation {
     ./musl.patch
 
     ./opencl.patch
-    ./disk_cache-include-dri-driver-path-in-cache-key.patch
 
     # Backports to fix build
     # FIXME: remove when applied upstream
@@ -170,7 +169,6 @@ self = stdenv.mkDerivation {
     # https://gitlab.freedesktop.org/mesa/mesa/blob/master/docs/meson.html#L327
     "-Db_ndebug=true"
 
-    "-Ddisk-cache-key=${placeholder "drivers"}"
     "-Ddri-search-path=${libglvnd.driverLink}/lib/dri"
 
     "-Dplatforms=${lib.concatStringsSep "," eglPlatforms}"
@@ -316,8 +314,9 @@ self = stdenv.mkDerivation {
 
   postFixup = lib.optionalString stdenv.isLinux ''
     # set the default search path for DRI drivers; used e.g. by X server
-    substituteInPlace "$dev/lib/pkgconfig/dri.pc" --replace "$drivers" "${libglvnd.driverLink}"
-    [ -f "$dev/lib/pkgconfig/d3d.pc" ] && substituteInPlace "$dev/lib/pkgconfig/d3d.pc" --replace "$drivers" "${libglvnd.driverLink}"
+    for pc in lib/pkgconfig/{dri,d3d}.pc; do
+      [ -f "$dev/$pc" ] && substituteInPlace "$dev/$pc" --replace "$drivers" "${libglvnd.driverLink}"
+    done
 
     # remove pkgconfig files for GL/EGL; they are provided by libGL.
     rm -f $dev/lib/pkgconfig/{gl,egl}.pc

pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch

@@ -1,59 +0,0 @@
-diff --git a/meson_options.txt b/meson_options.txt
-index 591ed957c85..6cb550593e3 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -519,6 +519,13 @@ option(
-   description : 'Enable direct rendering in GLX and EGL for DRI',
- )
- 
-+option(
-+  'disk-cache-key',
-+  type : 'string',
-+  value : '',
-+  description : 'Mesa cache key.'
-+)
-+
- option('egl-lib-suffix',
-   type : 'string',
-   value : '',
-diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index 1d23b92af7e..fbb4b04f3cf 100644
---- a/src/util/disk_cache.c
-+++ b/src/util/disk_cache.c
-@@ -218,8 +218,10 @@ disk_cache_type_create(const char *gpu_name,
- 
-    /* Create driver id keys */
-    size_t id_size = strlen(driver_id) + 1;
-+   size_t key_size = strlen(DISK_CACHE_KEY) + 1;
-    size_t gpu_name_size = strlen(gpu_name) + 1;
-    cache->driver_keys_blob_size += id_size;
-+   cache->driver_keys_blob_size += key_size;
-    cache->driver_keys_blob_size += gpu_name_size;
- 
-    /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -240,6 +242,7 @@ disk_cache_type_create(const char *gpu_name,
-    uint8_t *drv_key_blob = cache->driver_keys_blob;
-    DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
-    DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
-+   DRV_KEY_CPY(drv_key_blob, DISK_CACHE_KEY, key_size)
-    DRV_KEY_CPY(drv_key_blob, gpu_name, gpu_name_size)
-    DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
-    DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
-diff --git a/src/util/meson.build b/src/util/meson.build
-index eb88f235c47..eae5c54cc10 100644
---- a/src/util/meson.build
-+++ b/src/util/meson.build
-@@ -286,7 +286,12 @@ _libmesa_util = static_library(
-   include_directories : [inc_util, include_directories('format')],
-   dependencies : deps_for_libmesa_util,
-   link_with: [libmesa_util_sse41],
--  c_args : [c_msvc_compat_args],
-+  c_args : [
-+    c_msvc_compat_args,
-+    '-DDISK_CACHE_KEY="@0@"'.format(
-+      get_option('disk-cache-key')
-+    ),
-+  ],
-   gnu_symbol_visibility : 'hidden',
-   build_by_default : false
- )

pkgs/development/libraries/minizip/default.nix

@@ -4,14 +4,6 @@ stdenv.mkDerivation {
   pname = "minizip";
   inherit (zlib) src version;
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-45853.patch";
-      url = "https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c.patch";
-      hash = "sha256-yayfe1g9HsvgMN28WF/MYkH7dGMX4PsK53FcnfL3InM=";
-    })
-  ];
-
   patchFlags = [ "-p3" ];
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/development/libraries/mpdecimal/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "mpdecimal";
-  version = "4.0.0";
+  version = "2.5.1";
   outputs = [ "out" "cxx" "doc" "dev" ];
 
   src = fetchurl {
     url = "https://www.bytereef.org/software/mpdecimal/releases/mpdecimal-${version}.tar.gz";
-    hash = "sha256-lCRFwyRbInMP1Bpnp8XCMdEcsbmTa5wPdjNPt9C0Row=";
+    hash = "sha256-n5zUwEH5m1xJ/7e1nZ8S2VtoPYhYVgiqVqYwdmeysh8=";
   };
 
   configureFlags = [ "LD=${stdenv.cc.targetPrefix}cc" ];

pkgs/development/libraries/nghttp2/default.nix

@@ -32,11 +32,11 @@ assert enableJemalloc -> enableApp;
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.57.0";
+  version = "1.59.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-xjdnfLrESU6q+LDgOGFzFGhFgw76/+To3JL7O0KOWtI=";
+    sha256 = "sha256-A1P8u6ENKl9304ouSS5eZ3tjexdxI0WkcyXDw1+0d/g=";
   };
 
   outputs = [ "out" "dev" "lib" "doc" "man" ];

pkgs/development/libraries/opencv/4.x.nix

@@ -233,7 +233,7 @@ let
   printEnabled = enabled: if enabled then "ON" else "OFF";
   withOpenblas = (enableBlas && blas.provider.pname == "openblas");
   #multithreaded openblas conflicts with opencv multithreading, which manifest itself in hung tests
-  #https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+  #https://github.com/OpenMathLib/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
   openblas_ = blas.provider.override { singleThreaded = true; };
 
   inherit (cudaPackages) cudaFlags cudaVersion;

pkgs/development/libraries/openldap/default.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "openldap";
-  version = "2.6.6";
+  version = "2.6.7";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
-    hash = "sha256-CC6ZjPVCmE1DY0RC2+EdqGB1nlEJBxUupXm9xC/jnqA=";
+    hash = "sha256-zXdfYlyUTteKPaGKA7A7CO6nPIqryXtBuzNumhCVSTA=";
   };
 
   # TODO: separate "out" and "bin"
@@ -99,6 +99,11 @@ stdenv.mkDerivation rec {
 
     # skip flaky tests
     rm -f tests/scripts/test063-delta-multiprovider
+
+    # https://bugs.openldap.org/show_bug.cgi?id=10009
+    # can probably be re-added once https://github.com/cyrusimap/cyrus-sasl/pull/772
+    # has made it to a release
+    rm -f tests/scripts/test076-authid-rewrite
   '';
 
   doCheck = true;

pkgs/development/libraries/openssl/default.nix

@@ -264,8 +264,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.12";
-    hash = "sha256-+Tyejt3l6RZhGd4xdV/Ie0qjSGNmL2fd/LoU0La2m2E=";
+    version = "3.0.13";
+    hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
@@ -287,8 +287,8 @@ in {
   };
 
   openssl_3_2 = common {
-    version = "3.2.0";
-    hash = "sha256-FMgm8Hx+QzcG+1xp+p4l2rlWhIRLTJYqLPG/GD60aQ4=";
+    version = "3.2.1";
+    hash = "sha256-g8cyn+UshQZ3115dCwyiRTCbl+jsvP3B39xKufrDWzk=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch

pkgs/development/libraries/p11-kit/default.nix

@@ -73,6 +73,13 @@ stdenv.mkDerivation rec {
       --replace 'install_dir: prefix / p11_system_config' "install_dir: '$out/etc/pkcs11'"
   '';
 
+  preCheck = ''
+    # Tests run in fakeroot for non-root users (with Nix single-user install)
+    if [ "$(id -u)" != "0" ]; then
+      export FAKED_MODE=1
+    fi
+  '';
+
   meta = with lib; {
     description = "Library for loading and sharing PKCS#11 modules";
     longDescription = ''

pkgs/development/libraries/pipewire/default.nix

@@ -1,8 +1,6 @@
 { stdenv
 , lib
-, buildPackages
 , fetchFromGitLab
-, fetchpatch
 , python3
 , meson
 , ninja
@@ -28,7 +26,6 @@
 , readline # meson can't find <7 as those versions don't have a .pc file
 , lilv
 , makeFontsConf
-, callPackage
 , nixosTests
 , withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind
 , valgrind
@@ -76,147 +73,141 @@
 # Bluetooth codec only makes sense if general bluetooth enabled
 assert ldacbtSupport -> bluezSupport;
 
-let
-  mesonEnableFeature = b: if b then "enabled" else "disabled";
+stdenv.mkDerivation(finalAttrs: {
+  pname = "pipewire";
+  version = "1.0.3";
 
-  self = stdenv.mkDerivation rec {
-    pname = "pipewire";
-    version = "1.0.1";
+  outputs = [
+    "out"
+    "jack"
+    "dev"
+    "doc"
+    "man"
+    "installedTests"
+  ];
 
-    outputs = [
-      "out"
-      "jack"
-      "dev"
-      "doc"
-      "man"
-      "installedTests"
-    ];
-
-    src = fetchFromGitLab {
-      domain = "gitlab.freedesktop.org";
-      owner = "pipewire";
-      repo = "pipewire";
-      rev = version;
-      sha256 = "sha256-rvf0sZRgDDLcqroLg7hcMUqXD/4JT+3lBRX6/m+3Ry8=";
-    };
-
-    patches = [
-      # Load libjack from a known location
-      ./0060-libjack-path.patch
-      # Move installed tests into their own output.
-      ./0070-installed-tests-path.patch
-    ];
-
-    strictDeps = true;
-    nativeBuildInputs = [
-      docutils
-      doxygen
-      graphviz
-      meson
-      ninja
-      pkg-config
-      python3
-      glib
-    ];
-
-    buildInputs = [
-      alsa-lib
-      dbus
-      glib
-      libjack2
-      libusb1
-      libselinux
-      libsndfile
-      lilv
-      ncurses
-      readline
-      udev
-      vulkan-headers
-      vulkan-loader
-      tinycompress
-    ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
-    ++ (if lib.meta.availableOn stdenv.hostPlatform webrtc-audio-processing_1 then [ webrtc-audio-processing_1 ] else [ webrtc-audio-processing ])
-    ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
-    ++ lib.optionals libcameraSupport [ libcamera libdrm ]
-    ++ lib.optional ffmpegSupport ffmpeg
-    ++ lib.optionals bluezSupport [ bluez libfreeaptx liblc3 sbc fdk_aac libopus ]
-    ++ lib.optional ldacbtSupport ldacbt
-    ++ lib.optional nativeModemManagerSupport modemmanager
-    ++ lib.optional pulseTunnelSupport libpulseaudio
-    ++ lib.optional zeroconfSupport avahi
-    ++ lib.optional raopSupport openssl
-    ++ lib.optional rocSupport roc-toolkit
-    ++ lib.optionals x11Support [ libcanberra xorg.libX11 xorg.libXfixes ]
-    ++ lib.optional mysofaSupport libmysofa
-    ++ lib.optional ffadoSupport ffado;
-
-    # Valgrind binary is required for running one optional test.
-    nativeCheckInputs = lib.optional withValgrind valgrind;
-
-    mesonFlags = [
-      "-Ddocs=enabled"
-      "-Dudevrulesdir=lib/udev/rules.d"
-      "-Dinstalled_tests=enabled"
-      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-      "-Dlibjack-path=${placeholder "jack"}/lib"
-      "-Dlibcamera=${mesonEnableFeature libcameraSupport}"
-      "-Dlibffado=${mesonEnableFeature ffadoSupport}"
-      "-Droc=${mesonEnableFeature rocSupport}"
-      "-Dlibpulse=${mesonEnableFeature pulseTunnelSupport}"
-      "-Davahi=${mesonEnableFeature zeroconfSupport}"
-      "-Dgstreamer=${mesonEnableFeature gstreamerSupport}"
-      "-Dsystemd-system-service=${mesonEnableFeature enableSystemd}"
-      "-Dudev=${mesonEnableFeature (!enableSystemd)}"
-      "-Dffmpeg=${mesonEnableFeature ffmpegSupport}"
-      "-Dbluez5=${mesonEnableFeature bluezSupport}"
-      "-Dbluez5-backend-hsp-native=${mesonEnableFeature nativeHspSupport}"
-      "-Dbluez5-backend-hfp-native=${mesonEnableFeature nativeHfpSupport}"
-      "-Dbluez5-backend-native-mm=${mesonEnableFeature nativeModemManagerSupport}"
-      "-Dbluez5-backend-ofono=${mesonEnableFeature ofonoSupport}"
-      "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
-      # source code is not easily obtainable
-      "-Dbluez5-codec-lc3plus=disabled"
-      "-Dbluez5-codec-lc3=${mesonEnableFeature bluezSupport}"
-      "-Dbluez5-codec-ldac=${mesonEnableFeature ldacbtSupport}"
-      "-Dsysconfdir=/etc"
-      "-Draop=${mesonEnableFeature raopSupport}"
-      "-Dsession-managers="
-      "-Dvulkan=enabled"
-      "-Dx11=${mesonEnableFeature x11Support}"
-      "-Dx11-xfixes=${mesonEnableFeature x11Support}"
-      "-Dlibcanberra=${mesonEnableFeature x11Support}"
-      "-Dlibmysofa=${mesonEnableFeature mysofaSupport}"
-      "-Dsdl2=disabled" # required only to build examples, causes dependency loop
-      "-Drlimits-install=false" # installs to /etc, we won't use this anyway
-      "-Dcompress-offload=enabled"
-      "-Dman=enabled"
-    ];
-
-    # Fontconfig error: Cannot load default config file
-    FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
-
-    doCheck = true;
-
-    postUnpack = ''
-      patchShebangs source/doc/*.py
-      patchShebangs source/doc/input-filter-h.sh
-    '';
-
-    postInstall = ''
-      moveToOutput "bin/pw-jack" "$jack"
-    '';
-
-    passthru.tests.installed-tests = nixosTests.installed-tests.pipewire;
-
-    meta = with lib; {
-      description = "Server and user space API to deal with multimedia pipelines";
-      changelog = "https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/${version}";
-      homepage = "https://pipewire.org/";
-      license = licenses.mit;
-      platforms = platforms.linux;
-      maintainers = with maintainers; [ kranzes k900 ];
-    };
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "pipewire";
+    repo = "pipewire";
+    rev = finalAttrs.version;
+    sha256 = "sha256-QVw7Q+RNo8BBy/uxoZeSQQn/vQcIl1bOiA9fYMR0+oI=";
   };
 
-in
-self
+  patches = [
+    # Load libjack from a known location
+    ./0060-libjack-path.patch
+    # Move installed tests into their own output.
+    ./0070-installed-tests-path.patch
+  ];
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    docutils
+    doxygen
+    graphviz
+    meson
+    ninja
+    pkg-config
+    python3
+    glib
+  ];
+
+  buildInputs = [
+    alsa-lib
+    dbus
+    glib
+    libjack2
+    libusb1
+    libselinux
+    libsndfile
+    lilv
+    ncurses
+    readline
+    udev
+    vulkan-headers
+    vulkan-loader
+    tinycompress
+  ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
+  ++ (if lib.meta.availableOn stdenv.hostPlatform webrtc-audio-processing_1 then [ webrtc-audio-processing_1 ] else [ webrtc-audio-processing ])
+  ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
+  ++ lib.optionals libcameraSupport [ libcamera libdrm ]
+  ++ lib.optional ffmpegSupport ffmpeg
+  ++ lib.optionals bluezSupport [ bluez libfreeaptx liblc3 sbc fdk_aac libopus ]
+  ++ lib.optional ldacbtSupport ldacbt
+  ++ lib.optional nativeModemManagerSupport modemmanager
+  ++ lib.optional pulseTunnelSupport libpulseaudio
+  ++ lib.optional zeroconfSupport avahi
+  ++ lib.optional raopSupport openssl
+  ++ lib.optional rocSupport roc-toolkit
+  ++ lib.optionals x11Support [ libcanberra xorg.libX11 xorg.libXfixes ]
+  ++ lib.optional mysofaSupport libmysofa
+  ++ lib.optional ffadoSupport ffado;
+
+  # Valgrind binary is required for running one optional test.
+  nativeCheckInputs = lib.optional withValgrind valgrind;
+
+  mesonFlags = [
+    (lib.mesonEnable "docs" true)
+    (lib.mesonOption "udevrulesdir" "lib/udev/rules.d")
+    (lib.mesonEnable "installed_tests" true)
+    (lib.mesonOption "installed_test_prefix" (placeholder "installedTests"))
+    (lib.mesonOption "libjack-path" "${placeholder "jack"}/lib")
+    (lib.mesonEnable "libcamera" libcameraSupport)
+    (lib.mesonEnable "libffado" ffadoSupport)
+    (lib.mesonEnable "roc" rocSupport)
+    (lib.mesonEnable "libpulse" pulseTunnelSupport)
+    (lib.mesonEnable "avahi" zeroconfSupport)
+    (lib.mesonEnable "gstreamer" gstreamerSupport)
+    (lib.mesonEnable "systemd-system-service" enableSystemd)
+    (lib.mesonEnable "udev" (!enableSystemd))
+    (lib.mesonEnable "ffmpeg" ffmpegSupport)
+    (lib.mesonEnable "bluez5" bluezSupport)
+    (lib.mesonEnable "bluez5-backend-hsp-native" nativeHspSupport)
+    (lib.mesonEnable "bluez5-backend-hfp-native" nativeHfpSupport)
+    (lib.mesonEnable "bluez5-backend-native-mm" nativeModemManagerSupport)
+    (lib.mesonEnable "bluez5-backend-ofono" ofonoSupport)
+    (lib.mesonEnable "bluez5-backend-hsphfpd" hsphfpdSupport)
+    # source code is not easily obtainable
+    (lib.mesonEnable "bluez5-codec-lc3plus" false)
+    (lib.mesonEnable "bluez5-codec-lc3" bluezSupport)
+    (lib.mesonEnable "bluez5-codec-ldac" ldacbtSupport)
+    (lib.mesonOption "sysconfdir" "/etc")
+    (lib.mesonEnable "raop" raopSupport)
+    (lib.mesonOption "session-managers" "")
+    (lib.mesonEnable "vulkan" true)
+    (lib.mesonEnable "x11" x11Support)
+    (lib.mesonEnable "x11-xfixes" x11Support)
+    (lib.mesonEnable "libcanberra" x11Support)
+    (lib.mesonEnable "libmysofa" mysofaSupport)
+    (lib.mesonEnable "sdl2" false) # required only to build examples, causes dependency loop
+    (lib.mesonBool "rlimits-install" false) # installs to /etc, we won't use this anyway
+    (lib.mesonEnable "compress-offload" true)
+    (lib.mesonEnable "man" true)
+  ];
+
+  # Fontconfig error: Cannot load default config file
+  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
+
+  doCheck = true;
+
+  postUnpack = ''
+    patchShebangs source/doc/*.py
+    patchShebangs source/doc/input-filter-h.sh
+  '';
+
+  postInstall = ''
+    moveToOutput "bin/pw-jack" "$jack"
+  '';
+
+  passthru.tests.installed-tests = nixosTests.installed-tests.pipewire;
+
+  meta = with lib; {
+    description = "Server and user space API to deal with multimedia pipelines";
+    changelog = "https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/${version}";
+    homepage = "https://pipewire.org/";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kranzes k900 ];
+  };
+})

pkgs/development/libraries/pixman/default.nix

@@ -20,14 +20,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pixman";
-  version = "0.43.0";
+  version = "0.43.2";
 
   src = fetchurl {
     urls = [
       "mirror://xorg/individual/lib/${pname}-${version}.tar.gz"
       "https://cairographics.org/releases/${pname}-${version}.tar.gz"
     ];
-    hash = "sha256-plwoIJhY+xa+5Q2AnID5Co5BXA5P2DIQeKGCJ4WlVgo=";
+    hash = "sha256-6nkpflQY+1KNBGbotbkdG+iIV/o3BvSXd7KSWnKumSQ=";
   };
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;

pkgs/development/libraries/qca/default.nix

@@ -4,11 +4,11 @@ let
   isQt6 = lib.versions.major qtbase.version == "6";
 in stdenv.mkDerivation rec {
   pname = "qca";
-  version = "2.3.7";
+  version = "2.3.8";
 
   src = fetchurl {
     url = "mirror://kde/stable/qca/${version}/qca-${version}.tar.xz";
-    sha256 = "sha256-/uI0O1RofVvj4w+zPOKW7lCseuXiPXq3JfY//fevP0M=";
+    sha256 = "sha256-SHWcqGoCAkYdkIumYTQ4DMO7fSD+08AxufwCiXlqgmQ=";
   };
 
   buildInputs = [ openssl qtbase qt5compat ];

pkgs/development/libraries/qpdf/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qpdf";
-  version = "11.6.3";
+  version = "11.8.0";
 
   src = fetchFromGitHub {
     owner = "qpdf";
     repo = "qpdf";
     rev = "v${version}";
-    hash = "sha256-asGNZ/5iEkyIjRO9FECV1bN4k/YHv4/7I125BUr9+fE=";
+    hash = "sha256-EoFCRAWia8LAaLdoBW0ByndzIAjSvQ7bJFh0SZ/FKtY=";
   };
 
   nativeBuildInputs = [ cmake perl ];

pkgs/development/libraries/qt-6/modules/qtwebengine.nix

@@ -204,7 +204,7 @@ qtModule {
   ] ++ lib.optionals enableProprietaryCodecs [
     "-DQT_FEATURE_webengine_proprietary_codecs=ON"
   ] ++ lib.optionals stdenv.isDarwin [
-    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.targetPlatform.darwinSdkVersion}"
+    "-DCMAKE_OSX_DEPLOYMENT_TARGET=${stdenv.hostPlatform.darwinSdkVersion}"
   ];
 
   propagatedBuildInputs = [

pkgs/development/libraries/s2n-tls/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Kq4jl/ss+Xf5/zv18QWuIyXZDyz8mk3av4mdRoQrvJY=";
+    hash = "sha256-E3Giiu8xiTCSAPkbxOaVL/LXZWjhAS1M/n//Pe5eOKg=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/science/math/openblas/default.nix

@@ -6,14 +6,14 @@
 # Multi-threaded applications must not call a threaded OpenBLAS
 # (the only exception is when an application uses OpenMP as its
 # *only* form of multi-threading). See
-#     https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
-#     https://github.com/xianyi/OpenBLAS/issues/2543
+#     https://github.com/OpenMathLib/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+#     https://github.com/OpenMathLib/OpenBLAS/issues/2543
 # This flag builds a single-threaded OpenBLAS using the flags
 # stated in thre.
 , singleThreaded ? false
 , buildPackages
 # Select a specific optimization target (other than the default)
-# See https://github.com/xianyi/OpenBLAS/blob/develop/TargetList.txt
+# See https://github.com/OpenMathLib/OpenBLAS/blob/develop/TargetList.txt
 , target ? null
 # Select whether DYNAMIC_ARCH is enabled or not.
 , dynamicArch ? null
@@ -30,6 +30,7 @@
 , octave
 , opencv
 , python3
+, openmp ? null
 }:
 
 let blas64_ = blas64; in
@@ -141,15 +142,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.25";
+  version = "0.3.26";
 
   outputs = [ "out" "dev" ];
 
   src = fetchFromGitHub {
-    owner = "xianyi";
+    owner = "OpenMathLib";
     repo = "OpenBLAS";
     rev = "v${version}";
-    hash = "sha256-eY/R7gLDOls3csuwZkUS+x+v3GeL3dCsOD+4STxDpCg=";
+    hash = "sha256-AA3+x3SXkcg3g7bROZYLpWAbxnRedmQBZPe+rBJKxJ8=";
   };
 
   postPatch = ''
@@ -179,6 +180,8 @@ stdenv.mkDerivation rec {
     which
   ];
 
+  buildInputs = lib.optional (stdenv.cc.isClang && config.USE_OPENMP) openmp;
+
   depsBuildBuild = [
     buildPackages.gfortran
     buildPackages.stdenv.cc
@@ -206,10 +209,12 @@ stdenv.mkDerivation rec {
         else stdenv.hostPlatform != stdenv.buildPlatform;
     # This disables automatic build job count detection (which honours neither enableParallelBuilding nor NIX_BUILD_CORES)
     # and uses the main make invocation's job count, falling back to 1 if no parallelism is used.
-    # https://github.com/xianyi/OpenBLAS/blob/v0.3.20/getarch.c#L1781-L1792
+    # https://github.com/OpenMathLib/OpenBLAS/blob/v0.3.20/getarch.c#L1781-L1792
     MAKE_NB_JOBS = 0;
-  } // (lib.optionalAttrs singleThreaded {
-    # As described on https://github.com/xianyi/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
+  } // (lib.optionalAttrs stdenv.cc.isClang {
+    LDFLAGS = "-L${lib.getLib buildPackages.gfortran.cc}/lib"; # contains `libgfortran.so`; building with clang needs this, gcc has it implicit
+  }) // (lib.optionalAttrs singleThreaded {
+    # As described on https://github.com/OpenMathLib/OpenBLAS/wiki/Faq/4bded95e8dc8aadc70ce65267d1093ca7bdefc4c#multi-threaded
     USE_THREAD = false;
     USE_LOCKING = true; # available with openblas >= 0.3.7
     USE_OPENMP = false; # openblas will refuse building with both USE_OPENMP=1 and USE_THREAD=0
@@ -220,7 +225,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # Write pkgconfig aliases. Upstream report:
-    # https://github.com/xianyi/OpenBLAS/issues/1740
+    # https://github.com/OpenMathLib/OpenBLAS/issues/1740
     for alias in blas cblas lapack; do
       cat <<EOF > $out/lib/pkgconfig/$alias.pc
 Name: $alias
@@ -257,7 +262,7 @@ EOF
   meta = with lib; {
     description = "Basic Linear Algebra Subprograms";
     license = licenses.bsd3;
-    homepage = "https://github.com/xianyi/OpenBLAS";
+    homepage = "https://github.com/OpenMathLib/OpenBLAS";
     platforms = attrNames configs;
     maintainers = with maintainers; [ ttuegel ];
   };