Merge pull request #257792 from NixOS/staging-next

staging-next 2023-09-28

maintainers/team-list.nix

@@ -350,6 +350,7 @@ with lib.maintainers; {
       mic92
       zowoq
       qbit
+      mfrw
     ];
     githubTeams = [
       "golang"

nixos/doc/manual/development/settings-options.section.md

@@ -58,7 +58,7 @@ have a predefined type and string generator already declared under
     and returning a set with YAML-specific attributes `type` and
     `generate` as specified [below](#pkgs-formats-result).
 
-`pkgs.formats.ini` { *`listsAsDuplicateKeys`* ? false, *`listToValue`* ? null, \... }
+`pkgs.formats.ini` { *`listsAsDuplicateKeys`* ? false, *`listToValue`* ? null, \.\.\. }
 
 :   A function taking an attribute set with values
 

nixos/doc/manual/release-notes/rl-1509.section.md

@@ -2,7 +2,7 @@
 
 In addition to numerous new and upgraded packages, this release has the following highlights:
 
-- The [Haskell](http://haskell.org/) packages infrastructure has been re-designed from the ground up ("Haskell NG"). NixOS now distributes the latest version of every single package registered on [Hackage](http://hackage.haskell.org/) \-- well in excess of 8,000 Haskell packages. Detailed instructions on how to use that infrastructure can be found in the [User's Guide to the Haskell Infrastructure](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure). Users migrating from an earlier release may find helpful information below, in the list of backwards-incompatible changes. Furthermore, we distribute 51(!) additional Haskell package sets that provide every single [LTS Haskell](http://www.stackage.org/) release since version 0.0 as well as the most recent [Stackage Nightly](http://www.stackage.org/) snapshot. The announcement ["Full Stackage Support in Nixpkgs"](https://nixos.org/nix-dev/2015-September/018138.html) gives additional details.
+- The [Haskell](http://haskell.org/) packages infrastructure has been re-designed from the ground up ("Haskell NG"). NixOS now distributes the latest version of every single package registered on [Hackage](http://hackage.haskell.org/) -- well in excess of 8,000 Haskell packages. Detailed instructions on how to use that infrastructure can be found in the [User's Guide to the Haskell Infrastructure](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure). Users migrating from an earlier release may find helpful information below, in the list of backwards-incompatible changes. Furthermore, we distribute 51(!) additional Haskell package sets that provide every single [LTS Haskell](http://www.stackage.org/) release since version 0.0 as well as the most recent [Stackage Nightly](http://www.stackage.org/) snapshot. The announcement ["Full Stackage Support in Nixpkgs"](https://nixos.org/nix-dev/2015-September/018138.html) gives additional details.
 
 - Nix has been updated to version 1.10, which among other improvements enables cryptographic signatures on binary caches for improved security.
 
@@ -178,7 +178,7 @@ The new option `system.stateVersion` ensures that certain configuration changes
 
 - Nix now requires binary caches to be cryptographically signed. If you have unsigned binary caches that you want to continue to use, you should set `nix.requireSignedBinaryCaches = false`.
 
-- Steam now doesn't need root rights to work. Instead of using `*-steam-chrootenv`, you should now just run `steam`. `steamChrootEnv` package was renamed to `steam`, and old `steam` package \-- to `steamOriginal`.
+- Steam now doesn't need root rights to work. Instead of using `*-steam-chrootenv`, you should now just run `steam`. `steamChrootEnv` package was renamed to `steam`, and old `steam` package -- to `steamOriginal`.
 
 - CMPlayer has been renamed to bomi upstream. Package `cmplayer` was accordingly renamed to `bomi`
 

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -4,6 +4,8 @@
 
 - FoundationDB now defaults to major version 7.
 
+- PostgreSQL now defaults to major version 15.
+
 - Support for WiFi6 (IEEE 802.11ax) and WPA3-SAE-PK was enabled in the `hostapd` package, along with a significant rework of the hostapd module.
 
 - LXD now supports virtual machine instances to complement the existing container support
@@ -24,6 +26,8 @@
   - `root` and `wheel` are not given the ability to set (or preserve)
     arbitrary environment variables.
 
+- [glibc](https://www.gnu.org/software/libc/) has been updated from version 2.37 to 2.38, see [the release notes](https://sourceware.org/glibc/wiki/Release/2.38) for what was changed.
+
 [`sudo-rs`]: https://github.com/memorysafety/sudo-rs/
 
 - All [ROCm](https://rocm.docs.amd.com/en/latest/) packages have been updated to 5.7.0.
@@ -444,6 +448,8 @@ The module update takes care of the new config syntax and the data itself (user
 
   If you use this feature, updates to CoreDNS may require updating `vendorHash` by following these steps again.
 
+- `ffmpeg` default upgraded from `ffmpeg_5` to `ffmpeg_6`.
+
 - `fusuma` now enables the following plugins: [appmatcher](https://github.com/iberianpig/fusuma-plugin-appmatcher), [keypress](https://github.com/iberianpig/fusuma-plugin-keypress), [sendkey](https://github.com/iberianpig/fusuma-plugin-sendkey), [tap](https://github.com/iberianpig/fusuma-plugin-tap) and [wmctrl](https://github.com/iberianpig/fusuma-plugin-wmctrl).
 
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}

nixos/modules/services/databases/postgresql.nix

@@ -458,7 +458,8 @@ in
 
     services.postgresql.package = let
         mkThrow = ver: throw "postgresql_${ver} was removed, please upgrade your postgresql version.";
-        base = if versionAtLeast config.system.stateVersion "22.05" then pkgs.postgresql_14
+        base = if versionAtLeast config.system.stateVersion "23.11" then pkgs.postgresql_15
+            else if versionAtLeast config.system.stateVersion "22.05" then pkgs.postgresql_14
             else if versionAtLeast config.system.stateVersion "21.11" then pkgs.postgresql_13
             else if versionAtLeast config.system.stateVersion "20.03" then pkgs.postgresql_11
             else if versionAtLeast config.system.stateVersion "17.09" then mkThrow "9_6"

nixos/modules/services/mail/mailman.nix

@@ -592,7 +592,7 @@ in {
           # Since the mailman-web settings.py obstinately creates a logs
           # dir in the cwd, change to the (writable) runtime directory before
           # starting uwsgi.
-          ExecStart = "${pkgs.coreutils}/bin/env -C $RUNTIME_DIRECTORY ${pkgs.uwsgi.override { plugins = ["python3"]; }}/bin/uwsgi --json ${uwsgiConfigFile}";
+          ExecStart = "${pkgs.coreutils}/bin/env -C $RUNTIME_DIRECTORY ${pkgs.uwsgi.override { plugins = ["python3"]; python3 = webEnv.python; }}/bin/uwsgi --json ${uwsgiConfigFile}";
           User = cfg.webUser;
           Group = "mailman";
           RuntimeDirectory = "mailman-uwsgi";

nixos/tests/systemd.nix

@@ -76,6 +76,17 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     # wait for user services
     machine.wait_for_unit("default.target", "alice")
 
+    with subtest("systemctl edit suggests --runtime"):
+        # --runtime is suggested when using `systemctl edit`
+        ret, out = machine.execute("systemctl edit testservice1.service 2>&1")
+        assert ret == 1
+        assert out.rstrip("\n") == "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead."
+        # editing w/o `--runtime` is possible for user-services, however
+        # it's not possible because we're not in a tty when grepping
+        # (i.e. hacky way to ensure that the error from above doesn't appear here).
+        _, out = machine.execute("systemctl --user edit testservice2.service 2>&1")
+        assert out.rstrip("\n") == "Cannot edit units if not on a tty."
+
     # Regression test for https://github.com/NixOS/nixpkgs/issues/105049
     with subtest("systemd reads timezone database in /etc/zoneinfo"):
         timer = machine.succeed("TZ=UTC systemctl show --property=TimersCalendar oncalendar-test.timer")

pkgs/applications/audio/ams-lv2/default.nix

@@ -15,6 +15,12 @@ stdenv.mkDerivation  rec {
   nativeBuildInputs = [ pkg-config wafHook python3 ];
   buildInputs = [ cairo fftw gtkmm2 lv2 lvtk ];
 
+  postPatch = ''
+    # U was removed in python 3.11 because it had no effect
+    substituteInPlace waflib/*.py \
+      --replace "m='rU" "m='r"
+  '';
+
   meta = with lib; {
     description = "An LV2 port of the internal modules found in Alsa Modular Synth";
     homepage = "https://github.com/blablack/ams-lv2";

pkgs/applications/audio/mamba/default.nix

@@ -37,5 +37,8 @@ stdenv.mkDerivation rec {
     license = licenses.bsd0;
     maintainers = with maintainers; [ magnetophon orivej ];
     platforms = platforms.linux;
+    # 2023-08-19, `-Werror=format-security` fails for xputty
+    # reported as https://github.com/brummer10/libxputty/issues/12
+    broken = true;
   };
 }

pkgs/applications/audio/mbrola/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, stdenvNoCC, lib, symlinkJoin, fetchFromGitHub }:
+{ stdenv, lib, fetchFromGitHub, runCommandLocal }:
 
 let
   pname = "mbrola";
@@ -12,26 +12,14 @@ let
     homepage = "https://github.com/numediart/MBROLA";
   };
 
-  voices = stdenvNoCC.mkDerivation {
-    pname = "${pname}-voices";
-    inherit version;
-
-    src = fetchFromGitHub {
+  # Very big (0.65 G) so kept as a fixed-output derivation to limit "duplicates".
+  voices = fetchFromGitHub {
     owner = "numediart";
     repo = "MBROLA-voices";
     rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";  # using latest commit
     sha256 = "1w0y2xjp9rndwdjagp2wxh656mdm3d6w9cs411g27rjyfy1205a0";
-    };
-
-    dontBuild = true;
-    installPhase = ''
-      runHook preInstall
-      install -d $out/share/mbrola/voices
-      cp -R $src/data/* $out/share/mbrola/voices/
-      runHook postInstall
-    '';
-    dontFixup = true;
 
+    name = "${pname}-voices-${version}";
     meta = meta // {
       description = "Speech synthesizer based on the concatenation of diphones (voice files)";
       homepage = "https://github.com/numediart/MBROLA-voices";
@@ -65,8 +53,14 @@ let
   };
 
 in
-symlinkJoin {
+  runCommandLocal
+    "${pname}-${version}"
+    {
       inherit pname version meta;
-  name = "${pname}-${version}";
-  paths = [ bin voices ];
     }
+    ''
+      mkdir -p "$out/share/mbrola"
+      ln -s '${voices}/data' "$out/share/mbrola/voices"
+      ln -s '${bin}/bin' "$out/"
+    ''
+

pkgs/applications/blockchains/atomic-swap/default.nix

@@ -1,7 +1,9 @@
-{ lib, buildGoModule, fetchFromGitHub, nix-update-script, makeWrapper, monero-cli }:
+{ lib, buildGo120Module, fetchFromGitHub, nix-update-script, makeWrapper, monero-cli }:
+
 let
   pname = "atomic-swap";
   version = "0.4.2";
+  buildGoModule = buildGo120Module;
 in
 buildGoModule {
   inherit pname version;

pkgs/applications/misc/haxor-news/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, python3 }:
+{ lib, fetchFromGitHub, fetchPypi, python3 }:
 
 
 let
@@ -18,7 +18,8 @@ let
       # Use click 7
       click = super.click.overridePythonAttrs (old: rec {
         version = "7.1.2";
-        src = old.src.override {
+        src = fetchPypi {
+          pname = "click";
           inherit version;
           hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
         };

pkgs/applications/networking/instant-messengers/matrix-dl/default.nix

@@ -1,8 +1,12 @@
-{ lib, python3Packages, fetchFromGitHub }:
+{ lib
+, python3Packages
+, fetchFromGitHub
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "matrix-dl";
   version = "unstable-2020-07-14";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "rubo77";
@@ -11,6 +15,10 @@ python3Packages.buildPythonApplication rec {
     sha256 = "1l8nh8z7kz24v0wcy3ll3w6in2yxwa1yz8lyc3x0blz37d8ss4ql";
   };
 
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     matrix-client
   ];

pkgs/applications/networking/remote/freerdp/default.nix

@@ -8,7 +8,7 @@
 , alsa-lib
 , faac
 , faad2
-, ffmpeg
+, ffmpeg_5 # Depends on deprecated libav features
 , glib
 , openh264
 , openssl
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
     cairo
     cups
     faad2
-    ffmpeg
+    ffmpeg_5
     glib
     gst-plugins-base
     gst-plugins-good

pkgs/applications/office/paperless-ngx/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , buildNpmPackage
 , nixosTests
 , gettext
@@ -19,13 +20,13 @@
 }:
 
 let
-  version = "1.17.2";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/0Ml3NRTghqNykB1RZfqDW9TtENnSRM7wqG7Vn4Kl04=";
+    hash = "sha256-Kl8AUfHfEiEy40qeDI8x2rxdXcj01mpitw7T/96ibQQ=";
   };
 
   # Use specific package versions required by paperless-ngx
@@ -51,7 +52,7 @@ let
     pname = "paperless-ngx-frontend";
     inherit version src;
 
-    npmDepsHash = "sha256-6EvC9Ka8gl0eRgJtHooB3yQNVGYzuH/WRga4AtzQ0EY=";
+    npmDepsHash = "sha256-5Q9NtIO7k/6AiF9Er10HhmEBFyQOP9CiTkTZglUeChg=";
 
     nativeBuildInputs = [
       python3
@@ -91,6 +92,16 @@ python.pkgs.buildPythonApplication rec {
 
   inherit version src;
 
+  patches = [
+    # https://github.com/paperless-ngx/paperless-ngx/pull/4146
+    (fetchpatch {
+      name = "fix-tests-for-python311.patch";
+      url = "https://github.com/paperless-ngx/paperless-ngx/commit/73f6c0a056e3859061339e295f57213fd4239b2d.patch";
+      hash = "sha256-sZcRug5T4cw5ppKpGYrrfz9RxtYxnkeNOlXcMgdWT0E=";
+    })
+  ];
+
+
   nativeBuildInputs = [
     gettext
   ];

pkgs/applications/radio/direwolf/default.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xmz64m02knbrpasfij4rrq53ksxna5idxwgabcw4n2b1ig7pyx5";
   };
 
+  patches = [ ./fix-strlcpy-usage.patch ];
+
   nativeBuildInputs = [ cmake ];
 
   strictDeps = true;

pkgs/applications/radio/direwolf/fix-strlcpy-usage.patch

@@ -0,0 +1,89 @@
+strlcpy is now part of glibc, so there's absolutely no reason for a custom implementation, especially
+one with printf debugging. Hence, removing all of that.
+
+See also https://hydra.nixos.org/build/230546596
+See glibc commit 454a20c8756c9c1d55419153255fc7692b3d2199
+
+diff --git a/external/misc/strlcpy.c b/external/misc/strlcpy.c
+index ff18800..b1cb443 100644
+--- a/external/misc/strlcpy.c
++++ b/external/misc/strlcpy.c
+@@ -56,65 +56,3 @@
+ 
+ #include "textcolor.h"
+ 
+-/*
+- * Copy src to string dst of size siz.  At most siz-1 characters
+- * will be copied.  Always NUL terminates (unless siz == 0).
+- * Returns strlen(src); if retval >= siz, truncation occurred.
+- */
+-
+-#if DEBUG_STRL
+-size_t strlcpy_debug(char *__restrict__ dst, const char *__restrict__ src, size_t siz, const char *file, const char *func, int line)
+-#else
+-size_t strlcpy_debug(char *__restrict__ dst, const char *__restrict__ src, size_t siz)
+-#endif
+-{
+-	char *d = dst;
+-	const char *s = src;
+-	size_t n = siz;
+-	size_t retval;
+-
+-#if DEBUG_STRL
+-	if (dst == NULL) {
+-		text_color_set (DW_COLOR_ERROR);
+-		dw_printf ("ERROR: strlcpy dst is NULL.  (%s %s %d)\n", file, func, line);
+-		return (0);
+-	}
+-	if (src == NULL) {
+-		text_color_set (DW_COLOR_ERROR);
+-		dw_printf ("ERROR: strlcpy src is NULL.  (%s %s %d)\n", file, func, line);
+-		return (0);
+-	}
+-	if (siz == 1 || siz == 4) {
+-		text_color_set (DW_COLOR_ERROR);
+-		dw_printf ("Suspicious strlcpy siz.  Is it using sizeof a pointer variable?  (%s %s %d)\n", file, func, line);
+-	}
+-#endif
+-
+-	/* Copy as many bytes as will fit */
+-	if (n != 0 && --n != 0) {
+-		do {
+-			if ((*d++ = *s++) == 0)
+-				break;
+-		} while (--n != 0);
+-	}
+-
+-	/* Not enough room in dst, add NUL and traverse rest of src */
+-	if (n == 0) {
+-		if (siz != 0)
+-			*d = '\0';		/* NUL-terminate dst */
+-		while (*s++)
+-			;
+-	}
+-
+-	retval = s - src - 1;	/* count does not include NUL */
+-
+-#if DEBUG_STRL
+-	if (retval >= siz) {
+-		text_color_set (DW_COLOR_ERROR);
+-		dw_printf ("WARNING: strlcpy result length %d exceeds maximum length %d.  (%s %s %d)\n",
+-				(int)retval, (int)(siz-1), file, func, line);
+-	}
+-#endif
+-	return (retval);
+-}
+-
+diff --git a/src/direwolf.h b/src/direwolf.h
+index efc329b..22eb748 100644
+--- a/src/direwolf.h
++++ b/src/direwolf.h
+@@ -294,7 +294,7 @@ char *strcasestr(const char *S, const char *FIND);
+ #define HAVE_STRLCPY 1
+ 
+ 
+-#define DEBUG_STRL 1
++#define DEBUG_STRL 0
+ 
+ #if DEBUG_STRL
+ 

pkgs/applications/science/chemistry/apbs/default.nix

@@ -65,6 +65,10 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace CMakeLists.txt \
       --replace "include(ImportFETK)" "" \
       --replace 'import_fetk(''${FETK_VERSION})' ""
+
+    # U was removed in python 3.11 because it had no effect
+    substituteInPlace tools/manip/inputgen.py \
+      --replace '"rU"' '"r"'
   '';
 
   nativeBuildInputs = [

pkgs/applications/science/math/sage/sage-src.nix

@@ -110,6 +110,13 @@ stdenv.mkDerivation rec {
       url = "https://github.com/sagemath/sage/commit/d88bc3815c0901bfdeaa3e4a31107c084199f614.diff";
       sha256 = "sha256-dXaEwk2wXxmx02sCw4Vu9mF0ZrydhFD4LRwNAiQsPgM=";
     })
+
+    # https://github.com/sagemath/sage/pull/36279, landed in 10.2.beta4
+    (fetchpatch {
+       name = "matplotlib-3.8-upgrade.patch";
+       url = "https://github.com/sagemath/sage/commit/0fcf88935908440930c5f79202155aca4ad57518.diff";
+       sha256 = "sha256-mvqAHaTCXsxPv901L8HSTnrfghfXYdq0wfLoP/cYQZI=";
+    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;

pkgs/applications/science/math/sage/sagelib.nix

@@ -78,6 +78,7 @@
 , sphinx
 , sympy
 , typing-extensions
+, nbclassic
 }:
 
 assert (!blas.isILP64) && (!lapack.isILP64);
@@ -181,6 +182,8 @@ buildPythonPackage rec {
     sphinx
     sympy
     typing-extensions
+
+    nbclassic
   ];
 
   preBuild = ''

pkgs/applications/science/misc/root/default.nix

@@ -2,6 +2,7 @@
 , lib
 , callPackage
 , fetchurl
+, fetchpatch
 , makeWrapper
 , cmake
 , coreutils
@@ -109,6 +110,18 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./sw_vers.patch
+    # glibc >=2.38 already has strlcat implemented.
+    # merged upstream, remove on next package bump.
+    (fetchpatch {
+      url = "https://github.com/root-project/root/commit/8fb0e35446ed67c9d56639b4708c8f05459b7f84.patch";
+      hash = "sha256-7EabmYanqlQsYSQsi+S9eWs1v1pY6MncopL420Y3D4w=";
+    })
+  ] ++ lib.optionals (python.pkgs.pythonAtLeast "3.11") [
+    # Fix build against Python 3.11
+    (fetchpatch {
+      url = "https://github.com/root-project/root/commit/484deb056dacf768aba4954073b41105c431bffc.patch";
+      hash = "sha256-4qur2e3SxMIPgOg4IjlvuULR2BObuP7xdvs+LmNT2/s=";
+    })
   ];
 
   preConfigure = ''

pkgs/applications/science/robotics/qgroundcontrol/default.nix

@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   pname = "qgroundcontrol";
   version = "4.2.8";
 
-  qtInputs = [
+  propagatedBuildInputs = [
     qtbase qtcharts qtlocation qtserialport qtsvg qtquickcontrols2
     qtgraphicaleffects qtspeech qtx11extras
   ];
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     wayland
   ];
 
-  buildInputs = [ SDL2 ] ++ gstInputs ++ qtInputs;
+  buildInputs = [ SDL2 ] ++ gstInputs ++ propagatedBuildInputs;
   nativeBuildInputs = [ pkg-config qmake qttools wrapQtAppsHook ];
 
   preConfigure = ''

pkgs/applications/video/catt/default.nix

@@ -1,55 +1,32 @@
 { lib
-, fetchFromGitHub
 , fetchPypi
+, fetchpatch
 , python3
 }:
 
-let
-  py = python3.override {
-    packageOverrides = self: super: {
-      # Upstream is pinning releases incl. dependencies of their dependencies
-      zeroconf = super.zeroconf.overridePythonAttrs (oldAttrs: rec {
-        version = "0.31.0";
-        src = fetchFromGitHub {
-          owner = "jstasiak";
-          repo = "python-zeroconf";
-          rev = version;
-          hash = "sha256-8pYbIkPsg16VelwqpYSzqfAJaCU37lun+XZ/crzCDZU=";
-        };
-      });
-
-      click = super.click.overridePythonAttrs (oldAttrs: rec {
-        version = "7.1.2";
-        src = oldAttrs.src.override {
-          inherit version;
-          hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
-        };
-        disabledTests = [ "test_bytes_args" ]; # https://github.com/pallets/click/commit/6e05e1fa1c2804
-      });
-
-      pychromecast = super.pychromecast.overridePythonAttrs (oldAttrs: rec {
-        version = "9.2.0";
-        src = oldAttrs.src.override {
-          inherit version;
-          hash = "sha256-bTRZNXXPd1Zd9Hr0x13UfGplgx7BiowQtTZ7LxwXLwo=";
-        };
-      });
-    };
-  };
-in
-with py.pkgs;
-
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "catt";
-  version = "0.12.7";
-  format = "setuptools";
+  version = "0.12.11";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Q9ePWRLwuuTG+oPKFg7xn1gj4uAVlXUxegWdyH3Yd90=";
+    hash = "sha256-0bqYYfWwF7yYoAbjZPhi/f4CLcL89imWGYaMi5Bwhtc=";
   };
 
-  propagatedBuildInputs = [
+  patches = [
+    (fetchpatch {
+      # set explicit build-system
+      url = "https://github.com/skorokithakis/catt/commit/08e7870a239e85badd30982556adc2aa8a8e4fc1.patch";
+      hash = "sha256-QH5uN3zQNVPP6Th2LHdDBF53WxwMhoyhhQUAZOeHh4k=";
+    })
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
     click
     ifaddr
     pychromecast

pkgs/applications/virtualization/kvmtool/default.nix

@@ -10,6 +10,8 @@ stdenv.mkDerivation {
     sha256 = "sha256-wpc5DfHnui0lBVH4uOq6a7pXVUZStjNLRvauu6QpRvE=";
   };
 
+  patches = [ ./strlcpy-glibc-2.38-fix.patch ];
+
   buildInputs = lib.optionals stdenv.hostPlatform.isAarch64 [ dtc ];
 
   enableParallelBuilding = true;

pkgs/applications/virtualization/kvmtool/strlcpy-glibc-2.38-fix.patch

@@ -0,0 +1,25 @@
+Manually tell the compiler that strlcpy exists. The `try-build` function seems
+somewhat broken, i.e. any code that I try to pass to it doesn't link because of an
+"undefined reference to main" error (and some more quoting issues with newlines being
+swalloed).
+
+Because both musl and glibc seemt o support strlcpy nowadays, I decided to just skip the
+possibly broken feature-check and hardcode that it exists.
+
+diff --git a/Makefile b/Makefile
+index ed2414b..37be9cd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -239,10 +239,8 @@ endif
+ # On a given system, some libs may link statically, some may not; so, check
+ # both and only build those that link!
+ 
+-ifeq ($(call try-build,$(SOURCE_STRLCPY),$(CFLAGS),$(LDFLAGS)),y)
+-	CFLAGS_DYNOPT	+= -DHAVE_STRLCPY
+-	CFLAGS_STATOPT	+= -DHAVE_STRLCPY
+-endif
++CFLAGS_DYNOPT	+= -DHAVE_STRLCPY
++CFLAGS_STATOPT	+= -DHAVE_STRLCPY
+ 
+ ifeq ($(call try-build,$(SOURCE_BFD),$(CFLAGS),$(LDFLAGS) -lbfd -static),y)
+ 	CFLAGS_STATOPT	+= -DCONFIG_HAS_BFD

pkgs/applications/window-managers/cosmic/applets/default.nix

@@ -0,0 +1,62 @@
+{ lib, stdenv, fetchFromGitHub, rust, rustPlatform
+, cargo, just, pkg-config, util-linuxMinimal
+, dbus, glib, libxkbcommon, pulseaudio, wayland
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "cosmic-applets";
+  version = "unstable-2023-10-04";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-applets";
+    rev = "fefaea9b63548b1baa5e64521b860234ee46339a";
+    hash = "sha256-I+18NCKLH/3QajYpZRPYmCUxkbptAjuEHfKtnZVOlH4=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-/6KUCH1CwMHd5YEMOpAdVeAxpjl9JvrzDA4Xnbd1D9k=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-pVWK+dODQxNej5jWyb5wX/insoiXkX8NFBDkDEejVV0=";
+      "cosmic-config-0.1.0" = "sha256-pUDuRHX46fbcPw19s5DEsPyJdb/Bem/lJg+3NEO/WX0=";
+      "cosmic-dbus-networkmanager-0.1.0" = "sha256-eWqB+zRCfJYdrcPE8Ey+WgzPBJltN0zRiutzgdtWsDA=";
+      "cosmic-notifications-config-0.1.0" = "sha256-KnPQdrMpzA05v4bt0Fz9fbcKdC0cSU60Hv7wqrthIaw=";
+      "cosmic-panel-config-0.1.0" = "sha256-H3QuiP7Og69wm9yCX/uoSG0aQ3B/61q9Sdj+rW4KZMU=";
+      "cosmic-time-0.3.0" = "sha256-JiTwbJSml8azelBr6b3cBvJsuAL1hmHtuHx2TJupEzE=";
+      "smithay-client-toolkit-0.17.0" = "sha256-v3FxzDypxSfbEU50+oDoqrGWPm+S+kDZQq//3Q4DDRU=";
+      "softbuffer-0.2.0" = "sha256-VD2GmxC58z7Qfu/L+sfENE+T8L40mvUKKSfgLmCTmjY=";
+      "xdg-shell-wrapper-config-0.1.0" = "sha256-Otxp8D5dNZl70K1ZIBswGj6K5soGVbVim7gutUHkBvw=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config util-linuxMinimal ];
+  buildInputs = [ dbus glib libxkbcommon pulseaudio wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set" "prefix" (placeholder "out")
+    "--set" "target" "${rust.lib.toRustTargetSpecShort stdenv.hostPlatform}/release"
+  ];
+
+  # Force linking to libwayland-client, which is always dlopen()ed.
+  "CARGO_TARGET_${rust.toRustTargetForUseInEnvVars stdenv.hostPlatform}_RUSTFLAGS" =
+    map (a: "-C link-arg=${a}") [
+      "-Wl,--push-state,--no-as-needed"
+      "-lwayland-client"
+      "-Wl,--pop-state"
+    ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-applets";
+    description = "Applets for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ qyliss ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/window-managers/cosmic/comp/default.nix

@@ -0,0 +1,61 @@
+{ lib, rustPlatform, fetchFromGitHub, makeBinaryWrapper, pkg-config
+, libinput, libglvnd, libxkbcommon, mesa, seatd, udev, wayland, xorg
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "cosmic-comp";
+  version = "unstable-2023-10-04";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-comp";
+    rev = "a3ac6c42b6913193b76e481d9a60f775f67aa858";
+    hash = "sha256-nPQx3Pkd9WAq9ooLs8K8UI1rCHYwJlu88SP2PbC/avU=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "calloop-0.12.2" = "sha256-d/LB65l1DEC/5Kk8yvenTQYfIFBs99XqXn4tAM2mfHI=";
+      "cosmic-config-0.1.0" = "sha256-0HKv0/UHZMpSGF54aCip9PbwfWiWMSMHZpiipM6Qrf0=";
+      "cosmic-protocols-0.1.0" = "sha256-oBE/69A4haCN6Etih6B8SlbSnKg1bEocI6Rvf9IegLE=";
+      "id_tree-1.8.0" = "sha256-uKdKHRfPGt3vagOjhnri3aYY5ar7O3rp2/ivTfM2jT0=";
+      "smithay-0.3.0" = "sha256-7oOVAoEl+X09e0+V1eR5GviodntMbineEO8Igk2+BM0=";
+      "smithay-egui-0.1.0" = "sha256-FcSoKCwYk3okwQURiQlDUcfk9m/Ne6pSblGAzHDaVHg=";
+      "softbuffer-0.2.0" = "sha256-VD2GmxC58z7Qfu/L+sfENE+T8L40mvUKKSfgLmCTmjY=";
+      "taffy-0.3.11" = "sha256-Py9D8+L9G+sBkHPtlenOdugH5nQKTXa+XdKArOg5+qU=";
+    };
+  };
+
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ makeBinaryWrapper pkg-config ];
+  buildInputs = [ libglvnd libinput libxkbcommon mesa seatd udev wayland ];
+
+  # Force linking to libEGL, which is always dlopen()ed, and to
+  # libwayland-client, which is always dlopen()ed except by the
+  # obscure winit backend.
+  RUSTFLAGS = map (a: "-C link-arg=${a}") [
+    "-Wl,--push-state,--no-as-needed"
+    "-lEGL"
+    "-lwayland-client"
+    "-Wl,--pop-state"
+  ];
+
+  # These libraries are only used by the X11 backend, which will not
+  # be the common case, so just make them available, don't link them.
+  postInstall = ''
+    wrapProgram $out/bin/cosmic-comp \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
+        xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr
+      ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-comp";
+    description = "Compositor for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ qyliss ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/window-managers/cosmic/panel/default.nix

@@ -0,0 +1,54 @@
+{ lib, stdenv, fetchFromGitHub, cargo, just, pkg-config, rust, rustPlatform
+, libglvnd, libxkbcommon, wayland
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "cosmic-panel";
+  version = "unstable-2023-09-22";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-panel";
+    rev = "df55f44f504c1cee9377cb331c1fb9d95ca83967";
+    hash = "sha256-qf1ITvP6PPATZ6jvlc0UuCes1UYMseY4Wr57/5xRZPE=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "cosmic-client-toolkit-0.1.0" = "sha256-pVWK+dODQxNej5jWyb5wX/insoiXkX8NFBDkDEejVV0=";
+      "cosmic-config-0.1.0" = "sha256-XsFfQzR1gn8Je5lbd6PmSgz/T7XAFTVnR1G6pUY+eX4=";
+      "cosmic-notifications-util-0.1.0" = "sha256-wRUPovWJucsrKGhjHXku/4UoZf9ih9+Wpbs0sLN+oCI=";
+      "launch-pad-0.1.0" = "sha256-gFtUtrD/cUVpLxPvg6iLxxAK97LTlvI4uLxo06UYIU4=";
+      "smithay-0.3.0" = "sha256-hulj6zr4h8A9RElQyrJBy3lvYMd7COe3uDaFMMaWNrM=";
+      "smithay-client-toolkit-0.17.0" = "sha256-13fXDYqO/701tzoOk8ujHtzgzzz1N6GGbcHUrsNhQ0U=";
+      "xdg-shell-wrapper-0.1.0" = "sha256-VCiDjvcCsb02LMo7UpEROV6lzX2DYf4Ix9zfEDO2pUg=";
+    };
+  };
+
+  nativeBuildInputs = [ just pkg-config ];
+  buildInputs = [ libglvnd libxkbcommon wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set" "prefix" (placeholder "out")
+    "--set" "bin-src" "target/${rust.lib.toRustTargetSpecShort stdenv.hostPlatform}/release/cosmic-panel"
+  ];
+
+  # Force linking to libEGL, which is always dlopen()ed.
+  "CARGO_TARGET_${rust.toRustTargetForUseInEnvVars stdenv.hostPlatform}_RUSTFLAGS" =
+    map (a: "-C link-arg=${a}") [
+      "-Wl,--push-state,--no-as-needed"
+      "-lEGL"
+      "-Wl,--pop-state"
+    ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-panel";
+    description = "Panel for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ qyliss ];
+    platforms = platforms.linux;
+  };
+}

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -31,7 +31,6 @@ cxxLibrary=1
 cInclude=1
 
 expandResponseParams "$@"
-linkType=$(checkLinkType "${params[@]}")
 
 declare -ag positionalArgs=()
 declare -i n=0
@@ -175,6 +174,7 @@ extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_
 extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
 
 if [ "$dontLink" != 1 ]; then
+    linkType=$(checkLinkType $NIX_LDFLAGS_BEFORE_@suffixSalt@ "${params[@]}" ${NIX_CFLAGS_LINK_@suffixSalt@:-} $NIX_LDFLAGS_@suffixSalt@)
 
     # Add the flags that should only be passed to the compiler when
     # linking.

pkgs/build-support/cc-wrapper/default.nix

@@ -469,6 +469,7 @@ stdenv.mkDerivation {
     ''
     + optionalString (libcxx.isLLVM or false) ''
       echo "-isystem ${lib.getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
+      echo "-isystem ${lib.getDev libcxx.cxxabi}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
       echo "-l${libcxx.cxxabi.libName}" >> $out/nix-support/libcxx-ldflags
     ''

pkgs/build-support/rust/build-rust-package/default.nix

@@ -62,7 +62,6 @@
 assert cargoVendorDir == null && cargoLock == null
     -> !(args ? cargoSha256 && args.cargoSha256 != null) && !(args ? cargoHash && args.cargoHash != null)
     -> throw "cargoSha256, cargoHash, cargoVendorDir, or cargoLock must be set";
-assert buildType == "release" || buildType == "debug";
 
 let
 
@@ -83,14 +82,9 @@ let
   targetIsJSON = lib.hasSuffix ".json" target;
   useSysroot = targetIsJSON && !__internal_dontAddSysroot;
 
-  # see https://github.com/rust-lang/cargo/blob/964a16a28e234a3d397b2a7031d4ab4a428b1391/src/cargo/core/compiler/compile_kind.rs#L151-L168
-  # the "${}" is needed to transform the path into a /nix/store path before baseNameOf
-  shortTarget = if targetIsJSON then
-      (lib.removeSuffix ".json" (builtins.baseNameOf "${target}"))
-    else target;
-
   sysroot = callPackage ./sysroot { } {
-    inherit target shortTarget;
+    inherit target;
+    shortTarget = rust.lib.toRustTargetSpecShort stdenv.hostPlatform;
     RUSTFLAGS = args.RUSTFLAGS or "";
     originalCargoToml = src + /Cargo.toml; # profile info is later extracted
   };

pkgs/build-support/rust/hooks/cargo-build-hook.sh

@@ -17,7 +17,7 @@ cargoBuildHook() {
     fi
 
     if [ "${cargoBuildType}" != "debug" ]; then
-        cargoBuildProfileFlag="--${cargoBuildType}"
+        cargoBuildProfileFlag="--profile ${cargoBuildType}"
     fi
 
     if [ -n "${cargoBuildNoDefaultFeatures-}" ]; then
@@ -30,13 +30,8 @@ cargoBuildHook() {
 
     (
     set -x
-    env \
-      "CC_@rustBuildPlatform@=@ccForBuild@" \
-      "CXX_@rustBuildPlatform@=@cxxForBuild@" \
-      "CC_@rustTargetPlatform@=@ccForHost@" \
-      "CXX_@rustTargetPlatform@=@cxxForHost@" \
-      cargo build -j $NIX_BUILD_CORES \
-        --target @rustTargetPlatformSpec@ \
+    @setEnv@ cargo build -j $NIX_BUILD_CORES \
+        --target @rustHostPlatformSpec@ \
         --frozen \
         ${cargoBuildProfileFlag} \
         ${cargoBuildNoDefaultFeaturesFlag} \

pkgs/build-support/rust/hooks/cargo-check-hook.sh

@@ -17,7 +17,7 @@ cargoCheckHook() {
     fi
 
     if [ "${cargoCheckType}" != "debug" ]; then
-        cargoCheckProfileFlag="--${cargoCheckType}"
+        cargoCheckProfileFlag="--profile ${cargoCheckType}"
     fi
 
     if [ -n "${cargoCheckNoDefaultFeatures-}" ]; then
@@ -29,7 +29,7 @@ cargoCheckHook() {
     fi
 
     argstr="${cargoCheckProfileFlag} ${cargoCheckNoDefaultFeaturesFlag} ${cargoCheckFeaturesFlag}
-        --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}"
+        --target @rustHostPlatformSpec@ --frozen ${cargoTestFlags}"
 
     (
         set -x

pkgs/build-support/rust/hooks/cargo-install-hook.sh

@@ -1,7 +1,7 @@
 cargoInstallPostBuildHook() {
     echo "Executing cargoInstallPostBuildHook"
 
-    releaseDir=target/@shortTarget@/$cargoBuildType
+    releaseDir=target/@targetSubdirectory@/$cargoBuildType
     tmpDir="${releaseDir}-tmp";
 
     mkdir -p $tmpDir
@@ -21,7 +21,7 @@ cargoInstallHook() {
 
     # rename the output dir to a architecture independent one
 
-    releaseDir=target/@shortTarget@/$cargoBuildType
+    releaseDir=target/@targetSubdirectory@/$cargoBuildType
     tmpDir="${releaseDir}-tmp";
 
     mapfile -t targets < <(find "$NIX_BUILD_TOP" -type d | grep "${tmpDir}$")

pkgs/build-support/rust/hooks/cargo-nextest-hook.sh

@@ -17,7 +17,7 @@ cargoNextestHook() {
     fi
 
     if [ "${cargoCheckType}" != "debug" ]; then
-        cargoCheckProfileFlag="--${cargoCheckType}"
+        cargoCheckProfileFlag="--cargo-profile ${cargoCheckType}"
     fi
 
     if [ -n "${cargoCheckNoDefaultFeatures-}" ]; then
@@ -29,7 +29,7 @@ cargoNextestHook() {
     fi
 
     argstr="${cargoCheckProfileFlag} ${cargoCheckNoDefaultFeaturesFlag} ${cargoCheckFeaturesFlag}
-        --target @rustTargetPlatformSpec@ --frozen ${cargoTestFlags}"
+        --target @rustHostPlatformSpec@ --frozen ${cargoTestFlags}"
 
     (
         set -x

pkgs/build-support/rust/hooks/default.nix

@@ -9,32 +9,20 @@
 , rust
 , rustc
 , stdenv
-, target ? rust.toRustTargetSpec stdenv.hostPlatform
+
+# This confusingly-named parameter indicates the *subdirectory of
+# `target/` from which to copy the build artifacts.  It is derived
+# from a stdenv platform (or a JSON file).
+, target ? rust.lib.toRustTargetSpecShort stdenv.hostPlatform
 }:
 
-let
-  targetIsJSON = lib.hasSuffix ".json" target;
-
-  # see https://github.com/rust-lang/cargo/blob/964a16a28e234a3d397b2a7031d4ab4a428b1391/src/cargo/core/compiler/compile_kind.rs#L151-L168
-  # the "${}" is needed to transform the path into a /nix/store path before baseNameOf
-  shortTarget = if targetIsJSON then
-      (lib.removeSuffix ".json" (builtins.baseNameOf "${target}"))
-    else target;
-  ccForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc";
-  cxxForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}c++";
-  ccForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
-  cxxForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
-  rustBuildPlatform = rust.toRustTarget stdenv.buildPlatform;
-  rustTargetPlatform = rust.toRustTarget stdenv.hostPlatform;
-  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
-in {
+{
   cargoBuildHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-build-hook.sh";
       propagatedBuildInputs = [ cargo ];
       substitutions = {
-        inherit ccForBuild ccForHost cxxForBuild cxxForHost
-          rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
+        inherit (rust.envVars) rustHostPlatformSpec setEnv;
       };
     } ./cargo-build-hook.sh) {};
 
@@ -43,7 +31,7 @@ in {
       name = "cargo-check-hook.sh";
       propagatedBuildInputs = [ cargo ];
       substitutions = {
-        inherit rustTargetPlatformSpec;
+        inherit (rust.envVars) rustHostPlatformSpec;
       };
     } ./cargo-check-hook.sh) {};
 
@@ -52,7 +40,7 @@ in {
       name = "cargo-install-hook.sh";
       propagatedBuildInputs = [ ];
       substitutions = {
-        inherit shortTarget;
+        targetSubdirectory = target;
       };
     } ./cargo-install-hook.sh) {};
 
@@ -61,7 +49,7 @@ in {
       name = "cargo-nextest-hook.sh";
       propagatedBuildInputs = [ cargo cargo-nextest ];
       substitutions = {
-        inherit rustTargetPlatformSpec;
+        inherit (rust.envVars) rustHostPlatformSpec;
       };
     } ./cargo-nextest-hook.sh) {};
 
@@ -78,23 +66,26 @@ in {
 
         cargoConfig = ''
           [target."${rust.toRustTarget stdenv.buildPlatform}"]
-          "linker" = "${ccForBuild}"
+          "linker" = "${rust.envVars.ccForBuild}"
           ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
-            [target."${shortTarget}"]
-            "linker" = "${ccForHost}"
+            [target."${rust.toRustTarget stdenv.hostPlatform}"]
+            "linker" = "${rust.envVars.ccForHost}"
           ''}
           "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
         '';
       };
     } ./cargo-setup-hook.sh) {};
 
-  maturinBuildHook = callPackage ({ }:
+  maturinBuildHook = callPackage ({ pkgsHostTarget }:
     makeSetupHook {
       name = "maturin-build-hook.sh";
-      propagatedBuildInputs = [ cargo maturin rustc ];
+      propagatedBuildInputs = [
+        pkgsHostTarget.maturin
+        pkgsHostTarget.cargo
+        pkgsHostTarget.rustc
+      ];
       substitutions = {
-        inherit ccForBuild ccForHost cxxForBuild cxxForHost
-          rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
+        inherit (rust.envVars) rustTargetPlatformSpec setEnv;
       };
     } ./maturin-build-hook.sh) {};
 

pkgs/build-support/rust/hooks/maturin-build-hook.sh

@@ -9,12 +9,7 @@ maturinBuildHook() {
 
     (
     set -x
-    env \
-      "CC_@rustBuildPlatform@=@ccForBuild@" \
-      "CXX_@rustBuildPlatform@=@cxxForBuild@" \
-      "CC_@rustTargetPlatform@=@ccForHost@" \
-      "CXX_@rustTargetPlatform@=@cxxForHost@" \
-      maturin build \
+    @setEnv@ maturin build \
         --jobs=$NIX_BUILD_CORES \
         --frozen \
         --target @rustTargetPlatformSpec@ \

pkgs/build-support/rust/lib/default.nix

@@ -1,4 +1,8 @@
-{ lib }:
+{ lib
+, stdenv
+, buildPackages
+, targetPackages
+}:
 
 rec {
   # https://doc.rust-lang.org/reference/conditional-compilation.html#target_arch
@@ -59,8 +63,88 @@ rec {
     then builtins.toFile (toRustTarget platform + ".json") (builtins.toJSON platform.rustc.platform)
     else toRustTarget platform;
 
+  # Returns the name of the rust target if it is standard, or the
+  # basename of the file containing the custom target spec, without
+  # the .json extension.
+  #
+  # This is the name used by Cargo for target subdirectories.
+  toRustTargetSpecShort = platform:
+    lib.removeSuffix ".json"
+      (baseNameOf "${toRustTargetSpec platform}");
+
+  # When used as part of an environment variable name, triples are
+  # uppercased and have all hyphens replaced by underscores:
+  #
+  # https://github.com/rust-lang/cargo/pull/9169
+  # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
+  #
+  toRustTargetForUseInEnvVars = platform:
+    lib.strings.replaceStrings ["-"] ["_"]
+      (lib.strings.toUpper
+        (toRustTargetSpecShort platform));
+
   # Returns true if the target is no_std
   # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
   IsNoStdTarget = platform: let rustTarget = toRustTarget platform; in
     builtins.any (t: lib.hasInfix t rustTarget) ["-none" "nvptx" "switch" "-uefi"];
+
+  # These environment variables must be set when using `cargo-c` and
+  # several other tools which do not deal well with cross
+  # compilation.  The symptom of the problem they fix is errors due
+  # to buildPlatform CFLAGS being passed to the
+  # hostPlatform-targeted compiler -- for example, `-m64` being
+  # passed on a build=x86_64/host=aarch64 compilation.
+  envVars = let
+    ccForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc";
+    cxxForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}c++";
+    ccForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
+    cxxForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
+
+    # Unfortunately we must use the dangerous `targetPackages` here
+    # because hooks are artificially phase-shifted one slot earlier
+    # (they go in nativeBuildInputs, so the hostPlatform looks like
+    # a targetPlatform to them).
+    ccForTarget = "${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc";
+    cxxForTarget = "${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++";
+
+    rustBuildPlatform = toRustTarget stdenv.buildPlatform;
+    rustBuildPlatformSpec = toRustTargetSpec stdenv.buildPlatform;
+    rustHostPlatform = toRustTarget stdenv.hostPlatform;
+    rustHostPlatformSpec = toRustTargetSpec stdenv.hostPlatform;
+    rustTargetPlatform = toRustTarget stdenv.targetPlatform;
+    rustTargetPlatformSpec = toRustTargetSpec stdenv.targetPlatform;
+  in {
+    inherit
+      ccForBuild  cxxForBuild  rustBuildPlatform   rustBuildPlatformSpec
+      ccForHost   cxxForHost   rustHostPlatform    rustHostPlatformSpec
+      ccForTarget cxxForTarget rustTargetPlatform  rustTargetPlatformSpec;
+
+    # Prefix this onto a command invocation in order to set the
+    # variables needed by cargo.
+    #
+    setEnv = ''
+    env \
+    ''
+    # Due to a bug in how splicing and targetPackages works, in
+    # situations where targetPackages is irrelevant
+    # targetPackages.stdenv.cc is often simply wrong.  We must omit
+    # the following lines when rustTargetPlatform collides with
+    # rustHostPlatform.
+    + lib.optionalString (rustTargetPlatform != rustHostPlatform) ''
+      "CC_${toRustTargetForUseInEnvVars stdenv.targetPlatform}=${ccForTarget}" \
+      "CXX_${toRustTargetForUseInEnvVars stdenv.targetPlatform}=${cxxForTarget}" \
+      "CARGO_TARGET_${toRustTargetForUseInEnvVars stdenv.targetPlatform}_LINKER=${ccForTarget}" \
+    '' + ''
+      "CC_${toRustTargetForUseInEnvVars stdenv.hostPlatform}=${ccForHost}" \
+      "CXX_${toRustTargetForUseInEnvVars stdenv.hostPlatform}=${cxxForHost}" \
+      "CARGO_TARGET_${toRustTargetForUseInEnvVars stdenv.hostPlatform}_LINKER=${ccForHost}" \
+    '' + ''
+      "CC_${toRustTargetForUseInEnvVars stdenv.buildPlatform}=${ccForBuild}" \
+      "CXX_${toRustTargetForUseInEnvVars stdenv.buildPlatform}=${cxxForBuild}" \
+      "CARGO_TARGET_${toRustTargetForUseInEnvVars stdenv.buildPlatform}_LINKER=${ccForBuild}" \
+      "CARGO_BUILD_TARGET=${rustBuildPlatform}" \
+      "HOST_CC=${buildPackages.stdenv.cc}/bin/cc" \
+      "HOST_CXX=${buildPackages.stdenv.cc}/bin/c++" \
+    '';
+  };
 }

pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh

@@ -193,8 +193,23 @@ makeCWrapper() {
 
 addFlags() {
     local n flag before after var
+
+    # Disable file globbing, since bash will otherwise try to find
+    # filenames matching the the value to be prefixed/suffixed if
+    # it contains characters considered wildcards, such as `?` and
+    # `*`. We want the value as is, except we also want to split
+    # it on on the separator; hence we can't quote it.
+    local reenableGlob=0
+    if [[ ! -o noglob ]]; then
+        reenableGlob=1
+    fi
+    set -o noglob
     # shellcheck disable=SC2086
     before=($1) after=($2)
+    if (( reenableGlob )); then
+        set +o noglob
+    fi
+
     var="argv_tmp"
     printf '%s\n' "char **$var = calloc(${#before[@]} + argc + ${#after[@]} + 1, sizeof(*$var));"
     printf '%s\n' "assert($var != NULL);"

pkgs/development/compilers/gcc/default.nix

@@ -311,17 +311,15 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
         libc = if libcCross != null then libcCross else stdenv.cc.libc;
       in
         (
-        '' echo "fixing the \`GLIBC_DYNAMIC_LINKER'${lib.optionalString atLeast6 ", \\`UCLIBC_DYNAMIC_LINKER',"} and \`${if atLeast6 then "MUSL" else "UCLIBC"}_DYNAMIC_LINKER' macros..."
+        '' echo "fixing the {GLIBC,UCLIBC,MUSL}_DYNAMIC_LINKER macros..."
            for header in "gcc/config/"*-gnu.h "gcc/config/"*"/"*.h
            do
              grep -q ${lib.optionalString (!atLeast6) "LIBC"}_DYNAMIC_LINKER "$header" || continue
-             echo "  fixing \`$header'..."
+             echo "  fixing $header..."
              sed -i "$header" \
-                 -e 's|define[[:blank:]]*\([UCG]\+\)LIBC_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define \1LIBC_DYNAMIC_LINKER\2 "${libc.out}\3"|g'${lib.optionalString atLeast6 " \\"}
-        '' + lib.optionalString atLeast6 ''
-${""}                -e 's|define[[:blank:]]*MUSL_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define MUSL_DYNAMIC_LINKER\1 "${libc.out}\2"|g'
-        '' + ''
-${""}          done
+                 -e 's|define[[:blank:]]*\([UCG]\+\)LIBC_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define \1LIBC_DYNAMIC_LINKER\2 "${libc.out}\3"|g' \
+                 -e 's|define[[:blank:]]*MUSL_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define MUSL_DYNAMIC_LINKER\1 "${libc.out}\2"|g'
+             done
         '' + lib.optionalString (atLeast6 && targetPlatform.libc == "musl") ''
            sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
         ''
@@ -329,9 +327,7 @@ ${""}          done
     ))
       + lib.optionalString (atLeast7 && targetPlatform.isAvr) (''
             makeFlagsArray+=(
-          '' + (lib.optionalString atLeast10 ''
                '-s' # workaround for hitting hydra log limit
-          '') + ''
                'LIMITS_H_TEST=false'
             )
           '');

pkgs/development/compilers/go/1.20.nix

@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.20.8";
+  version = "1.20.10";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-ONcXFPpSeflyQEUZVtjkfjwbal3ny4QTeUnWK13TGC4=";
+    hash = "sha256-ctL1GAXEcVAGbBA3VMdf3bLBnUjJIZ+jPR5GaWyEHbs=";
   };
 
   strictDeps = true;

pkgs/development/compilers/go/1.21.nix

@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.21.1";
+  version = "1.21.3";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-v6Nr916aHpy725q8+dFwfkeb06B4gKiuNWTK7lcRy5k=";
+    hash = "sha256-GG8rb4yLcE5paCGwmrIEGlwe4T3LwxVqE63PdZMe5Ig=";
   };
 
   strictDeps = true;

pkgs/development/compilers/llvm/15/llvm/default.nix

@@ -227,6 +227,8 @@ in stdenv.mkDerivation (rec {
       --replace "PassBuilderCallbacksTest.cpp" ""
     rm unittests/IR/PassBuilderCallbacksTest.cpp
     rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
+    # timing-based tests are trouble
+    rm utils/lit/tests/googletest-timeout.py
   '' + optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \

pkgs/development/compilers/llvm/16/default.nix

@@ -255,14 +255,6 @@ in let
         [ "-rtlib=compiler-rt"
           "-Wno-unused-command-line-argument"
           "-B${targetLlvmLibraries.compiler-rt}/lib"
-
-          # Combat "__cxxabi_config.h not found". Maybe this could be fixed by
-          # copying these headers into libcxx? Note that building libcxx
-          # outside of monorepo isn't supported anymore, might be related to
-          # https://github.com/llvm/llvm-project/issues/55632
-          # ("16.0.3 libcxx, libcxxabi: circular build dependencies")
-          # Looks like the machinery changed in https://reviews.llvm.org/D120727.
-          "-I${lib.getDev targetLlvmLibraries.libcxx.cxxabi}/include/c++/v1"
         ]
         ++ lib.optional (!stdenv.targetPlatform.isWasm) "--unwindlib=libunwind"
         ++ lib.optional

pkgs/development/compilers/llvm/16/llvm/default.nix

@@ -221,6 +221,8 @@ in
       --replace "PassBuilderCallbacksTest.cpp" ""
     rm unittests/IR/PassBuilderCallbacksTest.cpp
     rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
+    # timing-based tests are trouble
+    rm utils/lit/tests/googletest-timeout.py
   '' + optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \

pkgs/development/compilers/openjdk/12.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, bash, pkg-config, autoconf, cpio, file, which, unzip
-, zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
+, zip, perl, cups, freetype, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap, fetchpatch
 , setJavaClassPath
@@ -27,7 +27,7 @@ let
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];
     buildInputs = [
-      cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
+      cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
       libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
@@ -67,7 +67,6 @@ let
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
       "--with-freetype=system"
-      "--with-harfbuzz=system"
       "--with-libjpeg=system"
       "--with-giflib=system"
       "--with-libpng=system"
@@ -96,6 +95,12 @@ let
 
     buildFlags = [ "all" ];
 
+    postBuild = ''
+      cd build/linux*
+      make images
+      cd -
+    '';
+
     installPhase = ''
       mkdir -p $out/lib
 

pkgs/development/compilers/openjdk/13.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, bash, pkg-config, autoconf, cpio, file, which, unzip
-, zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
+, zip, perl, cups, freetype, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama
 , libXcursor, libXrandr, fontconfig, openjdk13-bootstrap, fetchpatch
 , setJavaClassPath
@@ -27,7 +27,7 @@ let
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];
     buildInputs = [
-      cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
+      cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
       libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
@@ -72,7 +72,6 @@ let
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
       "--with-freetype=system"
-      "--with-harfbuzz=system"
       "--with-libjpeg=system"
       "--with-giflib=system"
       "--with-libpng=system"
@@ -101,6 +100,12 @@ let
 
     buildFlags = [ "all" ];
 
+    postBuild = ''
+      cd build/linux*
+      make images
+      cd -
+    '';
+
     installPhase = ''
       mkdir -p $out/lib
 
@@ -161,7 +166,7 @@ let
 
     disallowedReferences = [ openjdk-bootstrap ];
 
-    meta = import ./meta.nix lib version;
+    meta = (import ./meta.nix lib version) // { broken = true; };
 
     passthru = {
       architecture = "";

pkgs/development/compilers/openjdk/14.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, bash, pkg-config, autoconf, cpio, file, which, unzip
-, zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
+, zip, perl, cups, freetype, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama
 , libXcursor, libXrandr, fontconfig, openjdk14-bootstrap
 , setJavaClassPath
@@ -27,7 +27,7 @@ let
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];
     buildInputs = [
-      cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
+      cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
       libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
@@ -67,7 +67,6 @@ let
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
       "--with-freetype=system"
-      "--with-harfbuzz=system"
       "--with-libjpeg=system"
       "--with-giflib=system"
       "--with-libpng=system"
@@ -96,6 +95,12 @@ let
 
     buildFlags = [ "all" ];
 
+    postBuild = ''
+      cd build/linux*
+      make images
+      cd -
+    '';
+
     installPhase = ''
       mkdir -p $out/lib
 
@@ -157,7 +162,7 @@ let
 
     disallowedReferences = [ openjdk-bootstrap ];
 
-    meta = import ./meta.nix lib version;
+    meta = (import ./meta.nix lib version) // { broken = true; };
 
     passthru = {
       architecture = "";

pkgs/development/compilers/openjdk/15.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, bash, pkg-config, autoconf, cpio, file, which, unzip
-, zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
+, zip, perl, cups, freetype, alsa-lib, libjpeg, giflib, libpng, zlib, lcms2
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama
 , libXcursor, libXrandr, fontconfig, openjdk15-bootstrap
 , setJavaClassPath
@@ -30,7 +30,7 @@ let
 
     nativeBuildInputs = [ pkg-config autoconf unzip zip file which ];
     buildInputs = [
-      cpio perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
+      cpio perl zlib cups freetype alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
       libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
@@ -70,15 +70,13 @@ let
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
       "--with-freetype=system"
-      "--with-harfbuzz=system"
       "--with-libjpeg=system"
       "--with-giflib=system"
       "--with-libpng=system"
       "--with-zlib=system"
       "--with-lcms=system"
       "--with-stdc++lib=dynamic"
-    ] ++ lib.optional stdenv.isx86_64 "--with-jvm-features=zgc"
-      ++ lib.optional headless "--enable-headless-only"
+    ] ++ lib.optional headless "--enable-headless-only"
       ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
 
     separateDebugInfo = true;
@@ -99,6 +97,12 @@ let
 
     buildFlags = [ "all" ];
 
+    postBuild = ''
+      cd build/linux*
+      make images
+      cd -
+    '';
+
     installPhase = ''
       mkdir -p $out/lib
 

pkgs/development/compilers/openjdk/16.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, fetchFromGitHub, bash, pkg-config, autoconf, cpio
-, file, which, unzip, zip, perl, cups, freetype, harfbuzz, alsa-lib, libjpeg, giflib
+, file, which, unzip, zip, perl, cups, freetype, alsa-lib, libjpeg, giflib
 , libpng, zlib, lcms2, libX11, libICE, libXrender, libXext, libXt, libXtst
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk16-bootstrap
 , setJavaClassPath
@@ -31,7 +31,7 @@ let
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];
     buildInputs = [
-      cpio file which zip perl zlib cups freetype harfbuzz alsa-lib libjpeg giflib
+      cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
       libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
       libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
     ] ++ lib.optionals (!headless && enableGnome2) [
@@ -74,15 +74,13 @@ let
       "--enable-unlimited-crypto"
       "--with-native-debug-symbols=internal"
       "--with-freetype=system"
-      "--with-harfbuzz=system"
       "--with-libjpeg=system"
       "--with-giflib=system"
       "--with-libpng=system"
       "--with-zlib=system"
       "--with-lcms=system"
       "--with-stdc++lib=dynamic"
-    ] ++ lib.optional stdenv.isx86_64 "--with-jvm-features=zgc"
-      ++ lib.optional headless "--enable-headless-only"
+    ] ++ lib.optional headless "--enable-headless-only"
       ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
 
     separateDebugInfo = true;
@@ -103,6 +101,12 @@ let
 
     buildFlags = [ "all" ];
 
+    postBuild = ''
+      cd build/linux*
+      make images
+      cd -
+    '';
+
     installPhase = ''
       mkdir -p $out/lib
 

pkgs/development/compilers/openjdk/17.nix

@@ -98,8 +98,7 @@ let
       "--with-zlib=system"
       "--with-lcms=system"
       "--with-stdc++lib=dynamic"
-    ] ++ lib.optional stdenv.isx86_64 "--with-jvm-features=zgc"
-      ++ lib.optional headless "--enable-headless-only"
+    ] ++ lib.optional headless "--enable-headless-only"
       ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
 
     separateDebugInfo = true;

pkgs/development/compilers/openjdk/18.nix

@@ -88,8 +88,7 @@ let
       "--with-zlib=system"
       "--with-lcms=system"
       "--with-stdc++lib=dynamic"
-    ] ++ lib.optional stdenv.isx86_64 "--with-jvm-features=zgc"
-      ++ lib.optional headless "--enable-headless-only"
+    ] ++ lib.optional headless "--enable-headless-only"
       ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
 
     separateDebugInfo = true;
@@ -110,6 +109,12 @@ let
 
     buildFlags = [ "images" ];
 
+    postBuild = ''
+      cd build/linux*
+      make images
+      cd -
+    '';
+
     installPhase = ''
       mkdir -p $out/lib
 

pkgs/development/compilers/openjdk/19.nix

@@ -98,8 +98,7 @@ let
       "--with-zlib=system"
       "--with-lcms=system"
       "--with-stdc++lib=dynamic"
-    ] ++ lib.optional stdenv.isx86_64 "--with-jvm-features=zgc"
-      ++ lib.optional headless "--enable-headless-only"
+    ] ++ lib.optional headless "--enable-headless-only"
       ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
 
     separateDebugInfo = true;

pkgs/development/compilers/openjdk/20.nix

@@ -98,8 +98,7 @@ let
       "--with-zlib=system"
       "--with-lcms=system"
       "--with-stdc++lib=dynamic"
-    ] ++ lib.optional stdenv.isx86_64 "--with-jvm-features=zgc"
-      ++ lib.optional headless "--enable-headless-only"
+    ] ++ lib.optional headless "--enable-headless-only"
       ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
 
     separateDebugInfo = true;

pkgs/development/compilers/rust/1_72.nix

@@ -11,6 +11,7 @@
 
 { stdenv, lib
 , buildPackages
+, targetPackages
 , newScope, callPackage
 , CoreFoundation, Security, SystemConfiguration
 , pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
@@ -19,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.72.0";
-  rustcSha256 = "sha256-6p1hu7UddrbqaBFW9p8OBZa1lyLwRBSwHG4QC0tb46E=";
+  rustcVersion = "1.72.1";
+  rustcSha256 = "sha256-f0iEX2pSzbtdY/sFKP1fUg60QydbVfmOMoFZ+GVo+JU=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };

pkgs/development/compilers/rust/default.nix

@@ -13,6 +13,7 @@
 }:
 { stdenv, lib
 , buildPackages
+, targetPackages
 , newScope, callPackage
 , CoreFoundation, Security, SystemConfiguration
 , pkgsBuildBuild
@@ -21,7 +22,7 @@
 
 let
   # Use `import` to make sure no packages sneak in here.
-  lib' = import ../../../build-support/rust/lib { inherit lib; };
+  lib' = import ../../../build-support/rust/lib { inherit lib stdenv buildPackages targetPackages; };
   # Allow faster cross compiler generation by reusing Build artifacts
   fastCross = (stdenv.buildPlatform == stdenv.hostPlatform) && (stdenv.hostPlatform != stdenv.targetPlatform);
 in
@@ -29,7 +30,7 @@ in
   lib = lib';
 
   # Backwards compat before `lib` was factored out.
-  inherit (lib') toTargetArch toTargetOs toRustTarget toRustTargetSpec IsNoStdTarget;
+  inherit (lib') toTargetArch toTargetOs toRustTarget toRustTargetSpec IsNoStdTarget toRustTargetForUseInEnvVars envVars;
 
   # This just contains tools for now. But it would conceivably contain
   # libraries too, say if we picked some default/recommended versions to build

pkgs/development/compilers/swift/foundation/default.nix

@@ -5,6 +5,7 @@
 
 { lib
 , stdenv
+, fetchpatch
 , callPackage
 , cmake
 , ninja
@@ -23,6 +24,15 @@ in stdenv.mkDerivation {
   inherit (sources) version;
   src = sources.swift-corelibs-foundation;
 
+  patches = [
+    # from https://github.com/apple/swift-corelibs-foundation/pull/4811
+    # fix build with glibc >=2.38
+    (fetchpatch {
+      url = "https://github.com/apple/swift-corelibs-foundation/commit/47260803a108c6e0d639adcebeed3ac6a76e8bcd.patch";
+      hash = "sha256-1JUSQW86IHKkBZqxvpk0P8zcSKntzOTNlMoGBfgeT4c=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ninja swift ];

pkgs/development/compilers/vala/setup-hook.sh

@@ -7,6 +7,15 @@ make_vala_find_vapi_files() {
 
 addEnvHooks "$hostOffset" make_vala_find_vapi_files
 
+disable_incompabile_pointer_conversion_warning() {
+    # Work around incompatible function pointer conversion errors with clang 16
+    # by setting ``-Wno-incompatible-function-pointer-types` in an env hook.
+    # See https://gitlab.gnome.org/GNOME/vala/-/issues/1413.
+    NIX_CFLAGS_COMPILE+=" -Wno-incompatible-function-pointer-types"
+}
+
+addEnvHooks "$hostOffset" disable_incompabile_pointer_conversion_warning
+
 _multioutMoveVapiDirs() {
   moveToOutput share/vala/vapi "${!outputDev}"
   moveToOutput share/vala-@apiVersion@/vapi "${!outputDev}"

pkgs/development/interpreters/guile/2.2.nix

@@ -34,9 +34,9 @@ builder rec {
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = [
-    buildPackages.stdenv.cc
-  ]
+  depsBuildBuild = if stdenv.buildPlatform.isDarwin
+    then [ buildPackages.darwin.apple_sdk_11_0.stdenv.cc ]
+    else [ buildPackages.stdenv.cc ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile_2_2;
   nativeBuildInputs = [

pkgs/development/interpreters/guile/3.0.nix

@@ -36,9 +36,10 @@ builder rec {
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = [
-    buildPackages.stdenv.cc
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+  depsBuildBuild = if stdenv.buildPlatform.isDarwin
+    then [ buildPackages.darwin.apple_sdk_11_0.stdenv.cc ]
+    else [ buildPackages.stdenv.cc ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile_3_0;
   nativeBuildInputs = [
     makeWrapper

pkgs/development/interpreters/python/cpython/default.nix

@@ -303,9 +303,12 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     ./3.8/0001-On-all-posix-systems-not-just-Darwin-set-LDSHARED-if.patch
     # Use sysconfigdata to find headers. Fixes cross-compilation of extension modules.
     ./3.7/fix-finding-headers-when-cross-compiling.patch
-  ] ++ optionals stdenv.hostPlatform.isLoongArch64 [
+  ] ++ optionals (pythonOlder "3.12") [
     # https://github.com/python/cpython/issues/90656
     ./loongarch-support.patch
+  ] ++ optionals (pythonAtLeast "3.11" && pythonOlder "3.13") [
+    # backport fix for https://github.com/python/cpython/issues/95855
+    ./platform-triplet-detection.patch
   ] ++ optionals (stdenv.hostPlatform.isMinGW) (let
     # https://src.fedoraproject.org/rpms/mingw-python3
     mingw-patch = fetchgit {

pkgs/development/interpreters/python/cpython/platform-triplet-detection.patch

@@ -0,0 +1,295 @@
+diff --git a/configure.ac b/configure.ac
+index ba768aea93..621ac166bd 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -936,125 +936,192 @@ cat > conftest.c <<EOF
+ #if defined(__ANDROID__)
+     # Android is not a multiarch system.
+ #elif defined(__linux__)
++# include <features.h>
++# if defined(__UCLIBC__)
++#  error uclibc not supported
++# elif defined(__dietlibc__)
++#  error dietlibc not supported
++# elif defined(__GLIBC__)
++#  define LIBC gnu
++#  define LIBC_X32 gnux32
++#  if defined(__ARM_PCS_VFP)
++#   define LIBC_ARM gnueabihf
++#  else
++#   define LIBC_ARM gnueabi
++#  endif
++#  if defined(__loongarch__)
++#   if defined(__loongarch_soft_float)
++#    define LIBC_LA gnusf
++#   elif defined(__loongarch_single_float)
++#    define LIBC_LA gnuf32
++#   elif defined(__loongarch_double_float)
++#    define LIBC_LA gnu
++#   else
++#    error unknown loongarch floating-point base abi
++#   endif
++#  endif
++#  if defined(_MIPS_SIM)
++#   if defined(__mips_hard_float)
++#    if _MIPS_SIM == _ABIO32
++#     define LIBC_MIPS gnu
++#    elif _MIPS_SIM == _ABIN32
++#     define LIBC_MIPS gnuabin32
++#    elif _MIPS_SIM == _ABI64
++#     define LIBC_MIPS gnuabi64
++#    else
++#     error unknown mips sim value
++#    endif
++#   else
++#    if _MIPS_SIM == _ABIO32
++#     define LIBC_MIPS gnusf
++#    elif _MIPS_SIM == _ABIN32
++#     define LIBC_MIPS gnuabin32sf
++#    elif _MIPS_SIM == _ABI64
++#     define LIBC_MIPS gnuabi64sf
++#    else
++#     error unknown mips sim value
++#    endif
++#   endif
++#  endif
++#  if defined(__SPE__)
++#   define LIBC_PPC gnuspe
++#  else
++#   define LIBC_PPC gnu
++#  endif
++# else
++#  include <stdarg.h>
++#  ifdef __DEFINED_va_list
++#   define LIBC musl
++#   define LIBC_X32 muslx32
++#   if defined(__ARM_PCS_VFP)
++#    define LIBC_ARM musleabihf
++#   else
++#    define LIBC_ARM musleabi
++#   endif
++#   if defined(__loongarch__)
++#    if defined(__loongarch_soft_float)
++#     define LIBC_LA muslsf
++#    elif defined(__loongarch_single_float)
++#     define LIBC_LA muslf32
++#    elif defined(__loongarch_double_float)
++#     define LIBC_LA musl
++#    else
++#     error unknown loongarch floating-point base abi
++#    endif
++#   endif
++#   if defined(_MIPS_SIM)
++#    if defined(__mips_hard_float)
++#     if _MIPS_SIM == _ABIO32
++#      define LIBC_MIPS musl
++#     elif _MIPS_SIM == _ABIN32
++#      define LIBC_MIPS musln32
++#     elif _MIPS_SIM == _ABI64
++#      define LIBC_MIPS musl
++#     else
++#      error unknown mips sim value
++#     endif
++#    else
++#     if _MIPS_SIM == _ABIO32
++#      define LIBC_MIPS muslsf
++#     elif _MIPS_SIM == _ABIN32
++#      define LIBC_MIPS musln32sf
++#     elif _MIPS_SIM == _ABI64
++#      define LIBC_MIPS muslsf
++#     else
++#      error unknown mips sim value
++#     endif
++#    endif
++#   endif
++#   if defined(_SOFT_FLOAT) || defined(__NO_FPRS__)
++#    define LIBC_PPC muslsf
++#   else
++#    define LIBC_PPC musl
++#   endif
++#  else
++#   error unknown libc
++#  endif
++# endif
+ # if defined(__x86_64__) && defined(__LP64__)
+-        x86_64-linux-gnu
++        x86_64-linux-LIBC
+ # elif defined(__x86_64__) && defined(__ILP32__)
+-        x86_64-linux-gnux32
++        x86_64-linux-LIBC_X32
+ # elif defined(__i386__)
+-        i386-linux-gnu
++        i386-linux-LIBC
+ # elif defined(__aarch64__) && defined(__AARCH64EL__)
+ #  if defined(__ILP32__)
+-        aarch64_ilp32-linux-gnu
++        aarch64_ilp32-linux-LIBC
+ #  else
+-        aarch64-linux-gnu
++        aarch64-linux-LIBC
+ #  endif
+ # elif defined(__aarch64__) && defined(__AARCH64EB__)
+ #  if defined(__ILP32__)
+-        aarch64_be_ilp32-linux-gnu
++        aarch64_be_ilp32-linux-LIBC
+ #  else
+-        aarch64_be-linux-gnu
++        aarch64_be-linux-LIBC
+ #  endif
+ # elif defined(__alpha__)
+-        alpha-linux-gnu
+-# elif defined(__ARM_EABI__) && defined(__ARM_PCS_VFP)
++        alpha-linux-LIBC
++# elif defined(__ARM_EABI__)
+ #  if defined(__ARMEL__)
+-        arm-linux-gnueabihf
++        arm-linux-LIBC_ARM
+ #  else
+-        armeb-linux-gnueabihf
+-#  endif
+-# elif defined(__ARM_EABI__) && !defined(__ARM_PCS_VFP)
+-#  if defined(__ARMEL__)
+-        arm-linux-gnueabi
+-#  else
+-        armeb-linux-gnueabi
++        armeb-linux-LIBC_ARM
+ #  endif
+ # elif defined(__hppa__)
+-        hppa-linux-gnu
++        hppa-linux-LIBC
+ # elif defined(__ia64__)
+-        ia64-linux-gnu
+-# elif defined(__loongarch__)
+-#  if defined(__loongarch_lp64)
+-#   if defined(__loongarch_soft_float)
+-        loongarch64-linux-gnusf
+-#   elif defined(__loongarch_single_float)
+-        loongarch64-linux-gnuf32
+-#   elif defined(__loongarch_double_float)
+-        loongarch64-linux-gnu
++        ia64-linux-LIBC
++# elif defined(__loongarch__) && defined(__loongarch_lp64)
++        loongarch64-linux-LIBC_LA
++# elif defined(__m68k__) && !defined(__mcoldfire__)
++        m68k-linux-LIBC
++# elif defined(__mips__)
++#  if defined(__mips_isa_rev) && (__mips_isa_rev >=6)
++#   if defined(_MIPSEL) && defined(__mips64)
++        mipsisa64r6el-linux-LIBC_MIPS
++#   elif defined(_MIPSEL)
++        mipsisa32r6el-linux-LIBC_MIPS
++#   elif defined(__mips64)
++        mipsisa64r6-linux-LIBC_MIPS
+ #   else
+-#    error unknown platform triplet
++        mipsisa32r6-linux-LIBC_MIPS
+ #   endif
+ #  else
+-#   error unknown platform triplet
+-#  endif
+-# elif defined(__m68k__) && !defined(__mcoldfire__)
+-        m68k-linux-gnu
+-# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6) && defined(_MIPSEL)
+-#  if _MIPS_SIM == _ABIO32
+-        mipsisa32r6el-linux-gnu
+-#  elif _MIPS_SIM == _ABIN32
+-        mipsisa64r6el-linux-gnuabin32
+-#  elif _MIPS_SIM == _ABI64
+-        mipsisa64r6el-linux-gnuabi64
+-#  else
+-#   error unknown platform triplet
+-#  endif
+-# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6)
+-#  if _MIPS_SIM == _ABIO32
+-        mipsisa32r6-linux-gnu
+-#  elif _MIPS_SIM == _ABIN32
+-        mipsisa64r6-linux-gnuabin32
+-#  elif _MIPS_SIM == _ABI64
+-        mipsisa64r6-linux-gnuabi64
+-#  else
+-#   error unknown platform triplet
+-#  endif
+-# elif defined(__mips_hard_float) && defined(_MIPSEL)
+-#  if _MIPS_SIM == _ABIO32
+-        mipsel-linux-gnu
+-#  elif _MIPS_SIM == _ABIN32
+-        mips64el-linux-gnuabin32
+-#  elif _MIPS_SIM == _ABI64
+-        mips64el-linux-gnuabi64
+-#  else
+-#   error unknown platform triplet
+-#  endif
+-# elif defined(__mips_hard_float)
+-#  if _MIPS_SIM == _ABIO32
+-        mips-linux-gnu
+-#  elif _MIPS_SIM == _ABIN32
+-        mips64-linux-gnuabin32
+-#  elif _MIPS_SIM == _ABI64
+-        mips64-linux-gnuabi64
+-#  else
+-#   error unknown platform triplet
++#   if defined(_MIPSEL) && defined(__mips64)
++        mips64el-linux-LIBC_MIPS
++#   elif defined(_MIPSEL)
++        mipsel-linux-LIBC_MIPS
++#   elif defined(__mips64)
++        mips64-linux-LIBC_MIPS
++#   else
++        mips-linux-LIBC_MIPS
++#   endif
+ #  endif
+ # elif defined(__or1k__)
+-        or1k-linux-gnu
+-# elif defined(__powerpc__) && defined(__SPE__)
+-        powerpc-linux-gnuspe
++        or1k-linux-LIBC
+ # elif defined(__powerpc64__)
+ #  if defined(__LITTLE_ENDIAN__)
+-        powerpc64le-linux-gnu
++        powerpc64le-linux-LIBC
+ #  else
+-        powerpc64-linux-gnu
++        powerpc64-linux-LIBC
+ #  endif
+ # elif defined(__powerpc__)
+-        powerpc-linux-gnu
++        powerpc-linux-LIBC_PPC
+ # elif defined(__s390x__)
+-        s390x-linux-gnu
++        s390x-linux-LIBC
+ # elif defined(__s390__)
+-        s390-linux-gnu
++        s390-linux-LIBC
+ # elif defined(__sh__) && defined(__LITTLE_ENDIAN__)
+-        sh4-linux-gnu
++        sh4-linux-LIBC
+ # elif defined(__sparc__) && defined(__arch64__)
+-        sparc64-linux-gnu
++        sparc64-linux-LIBC
+ # elif defined(__sparc__)
+-        sparc-linux-gnu
++        sparc-linux-LIBC
+ # elif defined(__riscv)
+ #  if __riscv_xlen == 32
+-        riscv32-linux-gnu
++        riscv32-linux-LIBC
+ #  elif __riscv_xlen == 64
+-        riscv64-linux-gnu
++        riscv64-linux-LIBC
+ #  else
+ #   error unknown platform triplet
+ #  endif
+@@ -1102,12 +1169,7 @@ cat > conftest.c <<EOF
+ EOF
+ 
+ if $CPP $CPPFLAGS conftest.c >conftest.out 2>/dev/null; then
+-  PLATFORM_TRIPLET=`grep -v '^#' conftest.out | grep -v '^ *$' | tr -d ' 	'`
+-  case "$build_os" in
+-  linux-musl*)
+-    PLATFORM_TRIPLET=`echo "$PLATFORM_TRIPLET" | sed 's/linux-gnu/linux-musl/'`
+-    ;;
+-  esac
++  PLATFORM_TRIPLET=`grep -v '^#' conftest.out | grep -v '^ *$' | grep -v typedef | tr -d ' 	'`
+   AC_MSG_RESULT([$PLATFORM_TRIPLET])
+ else
+   AC_MSG_RESULT([none])

pkgs/development/interpreters/python/default.nix

@@ -20,20 +20,20 @@
       sourceVersion = {
         major = "3";
         minor = "10";
-        patch = "12";
+        patch = "13";
         suffix = "";
       };
-      hash = "sha256-r7dL8ZEw56R9EDEsj154TyTgUnmB6raOIFRs+4ZYMLg=";
+      hash = "sha256-XIiEhmhkDT4VKzW0U27xwjsspL0slX7x7LsFP1cd0/Y=";
     };
 
     python311 = {
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "4";
+        patch = "5";
         suffix = "";
       };
-      hash = "sha256-Lw5AnfKrV6qfxMvd+5dq9E5OVb9vYZ7ua8XCKXJkp/Y=";
+      hash = "sha256-hc0S6c8dbVpF8X96/hzr5+5ijTKCKBxJLoat9jbe+j8=";
     };
   };
 
@@ -139,7 +139,7 @@ in {
     enableOptimizations = false;
     enableLTO = false;
     mimetypesSupport = false;
-  } // sources.python310)).overrideAttrs(old: {
+  } // sources.python311)).overrideAttrs(old: {
     # TODO(@Artturin): Add this to the main cpython expr
     strictDeps = true;
     pname = "python3-minimal";

pkgs/development/interpreters/ruby/rubygems/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.19";
+  version = "3.4.20";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-+ZYpS9UOB16qCjhrKwFGBn43t3KNOv/QIrLKIPAywWs=";
+    hash = "sha256-9jKKef7KPnSYgKb3zf1LaulFBJuDpY6pWOJHSpG6Hzs=";
   };
 
   patches = [

pkgs/development/interpreters/tcl/generic.nix

@@ -62,7 +62,10 @@ let
         libdir = "lib/${libPrefix}";
         tclPackageHook = callPackage ({ buildPackages }: makeSetupHook {
           name = "tcl-package-hook";
-          propagatedBuildInputs = [ buildPackages.makeWrapper ];
+          propagatedBuildInputs = [ buildPackages.makeBinaryWrapper ];
+          meta = {
+            inherit (meta) maintainers platforms;
+          };
         } ./tcl-package-hook.sh) {};
         # verify that Tcl's clock library can access tzdata
         tests.tzdata = runCommand "${pname}-test-tzdata" {} ''

pkgs/development/libraries/aubio/default.nix

@@ -18,6 +18,13 @@ stdenv.mkDerivation rec {
   dontAddWafCrossFlags = true;
   wafFlags = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "--disable-tests";
 
+  postPatch = ''
+    # U was removed in python 3.11 because it had no effect
+    substituteInPlace waflib/*.py \
+      --replace "m='rU" "m='r" \
+      --replace "'rU'" "'r'"
+  '';
+
   meta = with lib; {
     description = "Library for audio labelling";
     homepage = "https://aubio.org/";

pkgs/development/libraries/aws-c-sdkutils/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-sdkutils";
-  version = "0.1.11";
+  version = "0.1.12";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-sdkutils";
     rev = "v${version}";
-    sha256 = "sha256-xwPMuaaKzypxJK9mTKD4tJZjzl19pu60seGtS2QFjgI=";
+    sha256 = "sha256-4YuOC90FBcuNYGBsqw3wKYNGkg3MssezvR8bu6BNGeM=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/dbus/default.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dbus";
-  version = "1.14.8";
+  version = "1.14.10";
 
   src = fetchurl {
     url = "https://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.xz";
-    sha256 = "sha256-pr1brFzxnww8WUva4lZaCVaWmApoOg7zfLYhLgk73jU=";
+    sha256 = "sha256-uh8h0r2dM52i1KqHgMCd8y/qh5mLc9ok9Jq53x42pQ8=";
   };
 
   patches = lib.optional stdenv.isSunOS ./implement-getgrouplist.patch;

pkgs/development/libraries/freetype/default.nix

@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
-  version = "2.13.1";
+  version = "2.13.2";
 
   src = let inherit (finalAttrs) pname version; in fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-6mfjsBmxEE0WZ6onT13DB9jL1gazmbwy3zCKd/GlZL8=";
+    sha256 = "sha256-EpkcTlXFBt1/m3ZZM+Yv0r4uBtQhUF15UKEy5PG7SE0=";
   };
 
   propagatedBuildInputs = [ zlib bzip2 brotli libpng ]; # needed when linking against freetype
@@ -101,6 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
       fonts.
     '';
     homepage = "https://www.freetype.org/";
+    changelog = "https://gitlab.freedesktop.org/freetype/freetype/-/raw/VER-${builtins.replaceStrings ["."] ["-"] finalAttrs.version}/docs/CHANGES";
     license = licenses.gpl2Plus; # or the FreeType License (BSD + advertising clause)
     platforms = platforms.all;
     pkgConfigModules = [ "freetype2" ];

pkgs/development/libraries/glibc/common.nix

@@ -43,9 +43,9 @@
 } @ args:
 
 let
-  version = "2.37";
-  patchSuffix = "-8";
-  sha256 = "sha256-Ilfv8RGhgV109GhW2q9AsBnB5VMVbGnUi6DL/Bu5GkM=";
+  version = "2.38";
+  patchSuffix = "-23";
+  sha256 = "sha256-+4KZiZiyspllRnvBtp0VLpwwfSzzAcnq+0VVt3DvP9I=";
 in
 
 assert withLinuxHeaders -> linuxHeaders != null;
@@ -59,14 +59,14 @@ stdenv.mkDerivation ({
   patches =
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
-          $ git fetch --all -p && git checkout origin/release/2.36/master && git describe
-          glibc-2.37-8-g590d0e089b
-          $ git show --minimal --reverse glibc-2.37.. | gzip -9n --rsyncable - > 2.37-master.patch.gz
+          $ git fetch --all -p && git checkout origin/release/2.38/master && git describe
+          glibc-2.38-23-g0e1ef6779a
+          $ git show --minimal --reverse glibc-2.38.. | gzip -9n --rsyncable - > 2.38-master.patch.gz
 
          To compare the archive contents zdiff can be used.
-          $ zdiff -u 2.37-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.37-master.patch.gz
+          $ zdiff -u 2.38-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.38-master.patch.gz
        */
-      ./2.37-master.patch.gz
+      ./2.38-master.patch.gz
 
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
@@ -89,10 +89,11 @@ stdenv.mkDerivation ({
 
       ./0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch
 
-      /* Patch derived from archlinux (at the time of adding they're at 2.37),
-         https://github.com/archlinux/svntogit-packages/blob/packages/glibc/trunk/reenable_DT_HASH.patch
+      /* Patch derived from archlinux,
+         https://gitlab.archlinux.org/archlinux/packaging/packages/glibc/-/blob/e54d98e2d1aae4930ecad9404ef12234922d9dfd/reenable_DT_HASH.patch
 
-        See https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991 for context.
+         See also https://github.com/ValveSoftware/Proton/issues/6051
+         & https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991
       */
       ./reenable_DT_HASH.patch
     ]
@@ -135,6 +136,7 @@ stdenv.mkDerivation ({
       "--enable-bind-now"
       (lib.withFeatureAs withLinuxHeaders "headers" "${linuxHeaders}/include")
       (lib.enableFeature profilingLibraries "profile")
+      "--enable-fortify-source"
     ] ++ lib.optionals (stdenv.hostPlatform.isx86 || stdenv.hostPlatform.isAarch64) [
       # This feature is currently supported on
       # i386, x86_64 and x32 with binutils 2.29 or later,
@@ -159,7 +161,7 @@ stdenv.mkDerivation ({
       "libc_cv_as_needed=no"
     ]
     ++ lib.optional withGd "--with-gd"
-    ++ lib.optional (!withLibcrypt) "--disable-crypt";
+    ++ lib.optional withLibcrypt "--enable-crypt";
 
   makeFlags = (args.makeFlags or []) ++ [
     "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"

pkgs/development/libraries/glibc/reenable_DT_HASH.patch

@@ -1,145 +1,28 @@
-From e47de5cb2d4dbecb58f569ed241e8e95c568f03c Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Fri, 29 Apr 2022 16:37:51 +0200
-Subject: [PATCH] Do not use --hash-style=both for building glibc shared
- objects
+From 31915e55f9c34f6137ab1c5ac002375a2d5d4589 Mon Sep 17 00:00:00 2001
+From: Frederik Schwan <frederik.schwan@linux.com>
+Date: Fri, 4 Aug 2023 15:19:57 +0200
+Subject: [PATCH] force --hash-style=both to keep compatibility with old niche
+ software
 
-The comment indicates that --hash-style=both was used to maintain
-compatibility with static dlopen, but we had many internal ABI
-changes since then, so this compatiblity does not add value anymore.
-
-Reviewed-by: Carlos O'Donell <carlos@redhat.com>
 ---
- Makeconfig     |  9 +++++++++
- Makerules      |  7 +++++++
- config.make.in |  1 +
- configure      | 28 ++++++++++++++++++++++++++++
- configure.ac   | 16 ++++++++++++++++
- 5 files changed, 61 insertions(+)
+ Makeconfig | 4 ++++
+ 1 file changed, 4 insertions(+)
 
-diff --git b/Makeconfig a/Makeconfig
-index 760f14e92f..0aa5fb0099 100644
---- b/Makeconfig
-+++ a/Makeconfig
-@@ -362,6 +362,15 @@ relro-LDFLAGS = -Wl,-z,relro
+diff --git a/Makeconfig b/Makeconfig
+index 77d7fd14df..2ae67c4beb 100644
+--- a/Makeconfig
++++ b/Makeconfig
+@@ -378,6 +378,10 @@ relro-LDFLAGS = -Wl,-z,relro
  LDFLAGS.so += $(relro-LDFLAGS)
  LDFLAGS-rtld += $(relro-LDFLAGS)
  
-+ifeq (yes,$(have-hash-style))
-+# For the time being we unconditionally use 'both'.  At some time we
-+# should declare statically linked code as 'out of luck' and compile
-+# with --hash-style=gnu only.
 +hashstyle-LDFLAGS = -Wl,--hash-style=both
 +LDFLAGS.so += $(hashstyle-LDFLAGS)
 +LDFLAGS-rtld += $(hashstyle-LDFLAGS)
-+endif
 +
- ifeq (no,$(build-pie-default))
- pie-default = $(no-pie-ccflag)
- else # build-pie-default
-diff --git b/Makerules a/Makerules
-index 354528b8c7..428464f092 100644
---- b/Makerules
-+++ a/Makerules
-@@ -557,6 +557,13 @@ $(common-objpfx)shlib.lds: $(common-objpfx)config.make $(..)Makerules
- 		  -Wl,--verbose 2>/dev/null | \
- 	  sed > $@T \
- 	      -e '/^=========/,/^=========/!d;/^=========/d' \
-+	      $(if $(filter yes,$(have-hash-style)), \
-+		   -e 's/^.*\.gnu\.hash[ 	]*:.*$$/  .note.ABI-tag : { *(.note.ABI-tag) } &/' \
-+		   -e '/^[ 	]*\.hash[ 	]*:.*$$/{h;d;}' \
-+		   -e '/DATA_SEGMENT_ALIGN/{H;g}' \
-+		, \
-+		   -e 's/^.*\.hash[ 	]*:.*$$/  .note.ABI-tag : { *(.note.ABI-tag) } &/' \
-+	       ) \
- 	      -e 's/^.*\*(\.dynbss).*$$/& \
- 		 PROVIDE(__start___libc_freeres_ptrs = .); \
- 		 *(__libc_freeres_ptrs) \
-diff --git b/config.make.in a/config.make.in
-index fff4c78dd0..bf728c71c0 100644
---- b/config.make.in
-+++ a/config.make.in
-@@ -70,6 +70,7 @@ have-libcap = @have_libcap@
- have-cc-with-libunwind = @libc_cv_cc_with_libunwind@
- fno-unit-at-a-time = @fno_unit_at_a_time@
- bind-now = @bindnow@
-+have-hash-style = @libc_cv_hashstyle@
- use-default-link = @use_default_link@
- have-cxx-thread_local = @libc_cv_cxx_thread_local@
- have-loop-to-function = @libc_cv_cc_loop_to_function@
-diff --git b/configure a/configure
-index 716dc041b6..5a730dc5fc 100755
---- b/configure
-+++ a/configure
-@@ -622,6 +622,7 @@ libc_cv_cc_nofma
- libc_cv_mtls_dialect_gnu2
- fno_unit_at_a_time
- libc_cv_has_glob_dat
-+libc_cv_hashstyle
- libc_cv_fpie
- libc_cv_z_execstack
- ASFLAGS_config
-@@ -6193,6 +6194,33 @@ $as_echo "$libc_cv_fpie" >&6; }
- 
- 
- 
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for --hash-style option" >&5
-+$as_echo_n "checking for --hash-style option... " >&6; }
-+if ${libc_cv_hashstyle+:} false; then :
-+  $as_echo_n "(cached) " >&6
-+else
-+  cat > conftest.c <<EOF
-+int _start (void) { return 42; }
-+EOF
-+if { ac_try='${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
-+			    -fPIC -shared -o conftest.so conftest.c
-+			    -Wl,--hash-style=both -nostdlib 1>&5'
-+  { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
-+  (eval $ac_try) 2>&5
-+  ac_status=$?
-+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-+  test $ac_status = 0; }; }
-+then
-+  libc_cv_hashstyle=yes
-+else
-+  libc_cv_hashstyle=no
-+fi
-+rm -f conftest*
-+fi
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $libc_cv_hashstyle" >&5
-+$as_echo "$libc_cv_hashstyle" >&6; }
-+
-+
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GLOB_DAT reloc" >&5
- $as_echo_n "checking for GLOB_DAT reloc... " >&6; }
- if ${libc_cv_has_glob_dat+:} false; then :
-diff --git b/configure.ac a/configure.ac
-index d08ad4d64e..a045f6608e 100644
---- b/configure.ac
-+++ a/configure.ac
-@@ -1360,6 +1360,22 @@ LIBC_TRY_CC_OPTION([-fpie], [libc_cv_fpie=yes], [libc_cv_fpie=no])
- 
- AC_SUBST(libc_cv_fpie)
- 
-+AC_CACHE_CHECK(for --hash-style option,
-+	       libc_cv_hashstyle, [dnl
-+cat > conftest.c <<EOF
-+int _start (void) { return 42; }
-+EOF
-+if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
-+			    -fPIC -shared -o conftest.so conftest.c
-+			    -Wl,--hash-style=both -nostdlib 1>&AS_MESSAGE_LOG_FD])
-+then
-+  libc_cv_hashstyle=yes
-+else
-+  libc_cv_hashstyle=no
-+fi
-+rm -f conftest*])
-+AC_SUBST(libc_cv_hashstyle)
-+
- AC_CACHE_CHECK(for GLOB_DAT reloc,
- 	       libc_cv_has_glob_dat, [dnl
- cat > conftest.c <<EOF
+ # Linker options to enable and disable DT_RELR.
+ ifeq ($(have-dt-relr),yes)
+ dt-relr-ldflag = -Wl,-z,pack-relative-relocs
 -- 
-2.37.1
+2.41.0
 

pkgs/development/libraries/gstreamer/bad/default.nix

@@ -109,13 +109,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.22.5";
+  version = "1.22.6";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-5k51za/X/y/H/DToVbBrHj7SJ8wG+jeNF7vNdngMM4w=";
+    hash = "sha256-tAKc0pCKCJxV8dkCpWXQB0lclbFELYOEhdxH+xLfcTc=";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/base/default.nix

@@ -45,7 +45,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.22.5";
+  version = "1.22.6";
 
   outputs = [ "out" "dev" ];
 
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-7dQzi0XCapryjA01qrlkoCTDiEum9SDYQo3wQhLIyTo=";
+    hash = "sha256-UPK00XwC7v5DC776jFzRNLG+eKU8D2DpURNtls9J/Us=";
   };
 
   strictDeps = true;

pkgs/development/libraries/gstreamer/core/default.nix

@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.22.5";
+  version = "1.22.6";
 
   outputs = [
     "bin"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-RAjXkw84GAnoWReswZcS8XMmG6hb3yDFVnsqIbEZO2E=";
+    hash = "sha256-9QDmz93/VZCPk3cR/CaghA3iih6exJYhwLbxrb2PgY4=";
   };
 
   depsBuildBuild = [

pkgs/development/libraries/gstreamer/devtools/default.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.22.5";
+  version = "1.22.6";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-Kt0VGapu6wHVRMuUKTaI7jvCB59rymB1v1wj0AoJIb4=";
+    hash = "sha256-iShWDvrxYTfDAoXnGHCOXQurB3frTvgSfgJ04SDT2Gs=";
   };
 
   outputs = [

pkgs/development/libraries/gstreamer/ges/default.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.22.5";
+  version = "1.22.6";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-vM3TvWHYaCmxbODiBtthsz95SsF5JCP558xl110aMbU=";
+    hash = "sha256-dI1CNnLFl/h24TCAT7mEhI9bS4nv14pQbLF/dkZ5UwE=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/good/default.nix

@@ -52,26 +52,15 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch32);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.22.5";
+  version = "1.22.6";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-tnsxMTpUxpKbgpadQdPP3y9Y21c/tfSR5rul2ErqB3g=";
+    hash = "sha256-s7B/4/HOf+k6qb5yF4ZgRFSPNcSneSKA7sfhCKMvmBc=";
   };
 
-  # TODO: Patch is conditional to spare rebuilds during the current staging-next cycle and should be removed during the next bump
-  patches = lib.optionals qt5Support [
-    # Needed until https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5083 is merged and released
-    (fetchpatch {
-      name = "gst-plugins-good-fix-qt5-without-viv-fb.patch";
-      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/03d8ef0b7c6e70eb936de0514831c1aafc763dcf.diff";
-      hash = "sha256-17XU/W/TMPg5669O1EBXByAN/VwFu/0idTg5ze3M/D4=";
-      stripLen = 2;
-    })
-  ];
-
   strictDeps = true;
 
   depsBuildBuild = [ pkg-config ];
@@ -90,6 +79,7 @@ stdenv.mkDerivation rec {
     hotdoc
   ] ++ lib.optionals qt5Support (with qt5; [
     qtbase
+    qttools
   ]) ++ lib.optionals qt6Support (with qt6; [
     qtbase
     qttools

pkgs/development/libraries/gstreamer/libav/default.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.22.5";
+  version = "1.22.6";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-hYPwwfT8sB7tEfoePCESZUOovXOe1Pwdsx91alqwHZo=";
+    hash = "sha256-d4nmQIOIol8jy/lIz8XGIw1zW7zYt/N/SgHJ40ih46c=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/gstreamer/rtsp-server/default.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.22.5";
+  version = "1.22.6";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-80PrVJZOvU2MBxvl7srVhvKP6wFW4DbgaxSNDn/rscA=";
+    hash = "sha256-CuM6i1BEO2LxFYGpGB6Qa0HNOHey15nb6nKRLD7aS7M=";
   };
 
   outputs = [

pkgs/development/libraries/gstreamer/ugly/default.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.22.5";
+  version = "1.22.6";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-JoBHOyGBWPGEZ8rD4cUCkbf/TgcQ3TUKWeqsvCnAmlQ=";
+    hash = "sha256-PjFFTJjLL39tLTVezrkzqJL6Dx3Am8NsmryTDY4pykg=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/vaapi/default.nix

@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.22.5";
+  version = "1.22.6";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-qaVQJnyVhN8OjHBDTTBHbo/QAYtzPBwe4z3q9CK9sks=";
+    hash = "sha256-2bovwmvvmMeOmCxZn1hdRru2X+Ei2onC16tB9GilLHs=";
   };
 
   outputs = [

pkgs/development/libraries/jemalloc/default.nix

@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
   ;
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-error=array-bounds";
+  env.NIX_LDFLAGS = lib.optionalString (stdenv.cc.libcxx != null) "-l${stdenv.cc.libcxx.cxxabi.libName}";
 
   doCheck = true;
 

pkgs/development/libraries/kerberos/krb5.nix

@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "${type}krb5";
-  version = "1.20.1";
+  version = "1.20.2";
 
   src = fetchurl {
     url = "https://kerberos.org/dist/krb5/${lib.versions.majorMinor version}/krb5-${version}.tar.gz";
-    sha256 = "sha256-cErtSbGetacXizSyhzYg7CmdsIdS1qhXT5XUGHmriFE=";
+    sha256 = "sha256-fY1ofUKu01DCUly2mk/DqnkWlNpnYdzMHELC7neWtd0=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libarchive/default.nix

@@ -23,36 +23,31 @@
 , cmake
 , nix
 , samba
-, buildPackages
 }:
 
-let
-  autoreconfHook = buildPackages.autoreconfHook269;
-in
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.6.2";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wQbA6vlXH8pnpY7LJLkjrRFEBpcaPR1SqxnK71UVwxg=";
+    hash = "sha256-p2JgJ/rvqaQ6yyXSh+ehScUH565ud5bQncl+lOnsWfc=";
   };
 
-  outputs = [ "out" "lib" "dev" ];
-
   patches = [
-    # fixes static linking; upstream in releases after 3.6.2
-    # https://github.com/libarchive/libarchive/pull/1825 merged upstream
-    (assert finalAttrs.version == "3.6.2"; fetchpatch {
-      name = "001-only-add-iconv-to-pc-file-if-needed.patch";
-      url = "https://github.com/libarchive/libarchive/commit/1f35c466aaa9444335a1b854b0b7223b0d2346c2.patch";
-      hash = "sha256-lb+zwWSH6/MLUIROvu9I/hUjSbb2jOWO755WC/r+lbY=";
+    # Pull fix for test failure on 32-bit systems:
+    (fetchpatch {
+      name = "32-bit-tests-fix.patch";
+      url = "https://github.com/libarchive/libarchive/commit/3bd918d92f8c34ba12de9c6604d96f9e262a59fc.patch";
+      hash = "sha256-RM3xFM6S2DkM5DJ0kAba8eLzEXuY5/7AaU06maHJ6rM=";
     })
   ];
 
+  outputs = [ "out" "lib" "dev" ];
+
   postPatch = let
     skipTestPaths = [
       # test won't work in nix sandbox

pkgs/development/libraries/libdovi/default.nix

@@ -28,19 +28,19 @@ rustPlatform.buildRustPackage rec {
 
   buildPhase = ''
     runHook preBuild
-    cargo cbuild -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cbuild -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
     runHook postBuild
   '';
 
   installPhase = ''
     runHook preInstall
-    cargo cinstall -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cinstall -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
     runHook postInstall
   '';
 
   checkPhase = ''
     runHook preCheck
-    cargo ctest -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo ctest -j $NIX_BUILD_CORES --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
     runHook postCheck
   '';
 

pkgs/development/libraries/libdrm/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.115";
+  version = "2.4.116";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-VUz7/gVCvds5G04+Bb+7/D4oK5Vb1WIY0hwGFkgfZes=";
+    sha256 = "sha256-RsU/QHNeo9JtYUKX8VX2ExpRBiSiQnT2VPZGnKkFM5o=";
   };
 
   outputs = [ "out" "dev" "bin" ];

pkgs/development/libraries/libdv/default.nix

@@ -9,9 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "1fl96f2xh2slkv1i1ix7kqk576a0ak1d33cylm0mbhm96d0761d3";
   };
 
-  # This fixes an undefined symbol: _sched_setscheduler error on compile.
-  # See the apple docs: http://cl.ly/2HeF bottom of the "Finding Imported Symbols" section
-  LDFLAGS = lib.optionalString stdenv.isDarwin "-undefined dynamic_lookup";
+  # Disable priority scheduling on Darwin because it doesn’t support sched_setscheduler.
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace encodedv/dvconnect.c \
+      --replace '#ifdef _SC_PRIORITY_SCHEDULING' '#if 0'
+  '';
 
   configureFlags = [
     "--disable-asm"

pkgs/development/libraries/libimagequant/default.nix

@@ -26,13 +26,13 @@ rustPlatform.buildRustPackage rec {
 
   postBuild = ''
     pushd imagequant-sys
-    cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
     popd
   '';
 
   postInstall = ''
     pushd imagequant-sys
-    cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    ${rust.envVars.setEnv} cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
     popd
   '';
 

pkgs/development/libraries/libredwg/default.nix

@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
   in ''
     # avoid git dependency
     cp ${printVersion} build-aux/git-version-gen
+    # failing to build otherwise since glibc-2.38
+    sed '1i#include <string.h>' -i programs/dwg2SVG.c
   '';
 
   preConfigure = lib.optionalString (stdenv.isDarwin && enablePython) ''

pkgs/development/libraries/libsoup/3.x.nix

@@ -81,6 +81,7 @@ stdenv.mkDerivation rec {
 
   # HSTS tests fail.
   doCheck = false;
+  separateDebugInfo = true;
 
   postPatch = ''
     patchShebangs libsoup/

pkgs/development/libraries/libsoup/default.nix

@@ -72,6 +72,7 @@ stdenv.mkDerivation rec {
   env.NIX_CFLAGS_COMPILE = "-lpthread";
 
   doCheck = false; # ERROR:../tests/socket-test.c:37:do_unconnected_socket_test: assertion failed (res == SOUP_STATUS_OK): (2 == 200)
+  separateDebugInfo = true;
 
   postPatch = ''
     # fixes finding vapigen when cross-compiling

pkgs/development/libraries/libvpx/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, yasm
+{ lib, stdenv, fetchFromGitHub, perl, yasm
 , vp8DecoderSupport ? true # VP8 decoder
 , vp8EncoderSupport ? true # VP8 encoder
 , vp9DecoderSupport ? true # VP9 decoder
@@ -75,27 +75,15 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "webmproject";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IH+ZWbBUlU5fbciYe+dNGnTFFCte2BXxAlLcvmzdAeY=";
+    hash = "sha256-KTbzZ5/qCH+bCvatYZhFiWcT+L2duD40E2w/BUaRorQ=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://www.openwall.com/lists/oss-security/2023/09/28/5
-      name = "CVE-2023-5217.patch";
-      url = "https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590.patch";
-      hash = "sha256-1hHUd/dNGm8dmdYYN60j1aOgC2pdIIq7vqJZ7mTXfps=";
-      includes = [
-        "vp8/encoder/onyx_if.c"
-      ];
-    })
-  ];
-
   postPatch = ''
     patchShebangs --build \
       build/make/*.sh \

pkgs/development/libraries/mesa/default.nix

@@ -86,8 +86,8 @@
 */
 
 let
-  version = "23.1.7";
-  hash = "sha256-QJZB6t8O0cd5R5em9aCwGVtVgLKCFm5exWKca82mrNM=";
+  version = "23.1.9";
+  hash = "sha256-KVuifCgUbtCSFOjOea+hZZ7fnRQt7MPJH4BFUtZPdRA=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule

pkgs/development/libraries/nghttp2/default.nix

@@ -32,11 +32,11 @@ assert enableJemalloc -> enableApp;
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.54.0";
+  version = "1.57.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-nZ0esJm0kvr6Gtn31pZZU3WP3vmtDPZaTQvcI3OAPa0=";
+    sha256 = "sha256-xjdnfLrESU6q+LDgOGFzFGhFgw76/+To3JL7O0KOWtI=";
   };
 
   outputs = [ "out" "dev" "lib" "doc" "man" ];

pkgs/development/libraries/openssl/default.nix

@@ -255,8 +255,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.10";
-    sha256 = "sha256-F2HU9bE6ECi5tvPUuOF/6wztyTcPav5h1xk9LNzoMyM=";
+    version = "3.0.11";
+    sha256 = "sha256-s0JdO7SiIY0Gl+tB9/wM3t4BbtGcpJ0Wi3jo2UeIf1U=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch