Merge #224806: staging-next 2023-04-05

2023-04-12 13:18:37 +02:00 · 2023-04-12 13:18:37 +02:00 · 2a3291834f
commit 2a3291834f
parent 930839445b d0bb9ed674
326 changed files with 3783 additions and 2529 deletions
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -16,8 +16,12 @@ In addition to numerous new and upgraded packages, this release has the followin
    It's recommended to use `nixos-rebuild boot` and `reboot`, rather than `nixos-rebuild switch` - since in some rare cases
    the switch of a live system might fail.

+  - glibc: 2.35 -\> 2.37
+
 - Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed.

+- GNOME has been upgraded to version 44. Please see the [release notes](https://release.gnome.org/44/) for details.
+
 - KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.

 - `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.
@ -232,7 +236,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `vim_configurable` has been renamed to `vim-full` to avoid confusion: `vim-full`'s build-time features are configurable, but both `vim` and `vim-full` are _customizable_ (in the sense of user configuration, like vimrc).

- Pantheon now defaults to Mutter 42 and GNOME settings daemon 42, all Pantheon packages are now tracking elementary OS 7 updates.
+- Pantheon now defaults to Mutter 43 and GNOME settings daemon 43, all Pantheon packages are now tracking elementary OS 7 updates.

 - The module for the application firewall `opensnitch` got the ability to configure rules. Available as [services.opensnitch.rules](#opt-services.opensnitch.rules)

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -279,6 +279,7 @@
  ./security/doas.nix
  ./security/duosec.nix
  ./security/google_oslogin.nix
+  ./security/ipa.nix
  ./security/lock-kernel-modules.nix
  ./security/misc.nix
  ./security/oath.nix
--- a/nixos/modules/security/ipa.nix
+++ b/nixos/modules/security/ipa.nix
@ -0,0 +1,258 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.security.ipa;
+  pyBool = x:
+    if x
+    then "True"
+    else "False";
+
+  ldapConf = pkgs.writeText "ldap.conf" ''
+    # Turning this off breaks GSSAPI used with krb5 when rdns = false
+    SASL_NOCANON    on
+
+    URI ldaps://${cfg.server}
+    BASE ${cfg.basedn}
+    TLS_CACERT /etc/ipa/ca.crt
+  '';
+  nssDb =
+    pkgs.runCommand "ipa-nssdb"
+    {
+      nativeBuildInputs = [pkgs.nss.tools];
+    } ''
+      mkdir -p $out
+      certutil -d $out -N --empty-password
+      certutil -d $out -A --empty-password -n "${cfg.realm} IPA CA" -t CT,C,C -i ${cfg.certificate}
+    '';
+in {
+  options = {
+    security.ipa = {
+      enable = mkEnableOption (lib.mdDoc "FreeIPA domain integration");
+
+      certificate = mkOption {
+        type = types.package;
+        description = lib.mdDoc ''
+          IPA server CA certificate.
+
+          Use `nix-prefetch-url http://$server/ipa/config/ca.crt` to
+          obtain the file and the hash.
+        '';
+        example = literalExpression ''
+          pkgs.fetchurl {
+            url = http://ipa.example.com/ipa/config/ca.crt;
+            sha256 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+          };
+        '';
+      };
+
+      domain = mkOption {
+        type = types.str;
+        example = "example.com";
+        description = lib.mdDoc "Domain of the IPA server.";
+      };
+
+      realm = mkOption {
+        type = types.str;
+        example = "EXAMPLE.COM";
+        description = lib.mdDoc "Kerberos realm.";
+      };
+
+      server = mkOption {
+        type = types.str;
+        example = "ipa.example.com";
+        description = lib.mdDoc "IPA Server hostname.";
+      };
+
+      basedn = mkOption {
+        type = types.str;
+        example = "dc=example,dc=com";
+        description = lib.mdDoc "Base DN to use when performing LDAP operations.";
+      };
+
+      offlinePasswords = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Whether to store offline passwords when the server is down.";
+      };
+
+      cacheCredentials = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Whether to cache credentials.";
+      };
+
+      ifpAllowedUids = mkOption {
+        type = types.listOf types.string;
+        default = ["root"];
+        description = lib.mdDoc "A list of users allowed to access the ifp dbus interface.";
+      };
+
+      dyndns = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = lib.mdDoc "Whether to enable FreeIPA automatic hostname updates.";
+        };
+
+        interface = mkOption {
+          type = types.str;
+          example = "eth0";
+          default = "*";
+          description = lib.mdDoc "Network interface to perform hostname updates through.";
+        };
+      };
+
+      chromiumSupport = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Whether to whitelist the FreeIPA domain in Chromium.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !config.krb5.enable;
+        message = "krb5 must be disabled through `krb5.enable` for FreeIPA integration to work.";
+      }
+      {
+        assertion = !config.users.ldap.enable;
+        message = "ldap must be disabled through `users.ldap.enable` for FreeIPA integration to work.";
+      }
+    ];
+
+    environment.systemPackages = with pkgs; [krb5Full freeipa];
+
+    environment.etc = {
+      "ipa/default.conf".text = ''
+        [global]
+        basedn = ${cfg.basedn}
+        realm = ${cfg.realm}
+        domain = ${cfg.domain}
+        server = ${cfg.server}
+        host = ${config.networking.hostName}
+        xmlrpc_uri = https://${cfg.server}/ipa/xml
+        enable_ra = True
+      '';
+
+      "ipa/nssdb".source = nssDb;
+
+      "krb5.conf".text = ''
+        [libdefaults]
+         default_realm = ${cfg.realm}
+         dns_lookup_realm = false
+         dns_lookup_kdc = true
+         rdns = false
+         ticket_lifetime = 24h
+         forwardable = true
+         udp_preference_limit = 0
+
+        [realms]
+         ${cfg.realm} = {
+          kdc = ${cfg.server}:88
+          master_kdc = ${cfg.server}:88
+          admin_server = ${cfg.server}:749
+          default_domain = ${cfg.domain}
+          pkinit_anchors = FILE:/etc/ipa/ca.crt
+        }
+
+        [domain_realm]
+         .${cfg.domain} = ${cfg.realm}
+         ${cfg.domain} = ${cfg.realm}
+         ${cfg.server} = ${cfg.realm}
+
+        [dbmodules]
+          ${cfg.realm} = {
+            db_library = ${pkgs.freeipa}/lib/krb5/plugins/kdb/ipadb.so
+          }
+      '';
+
+      "openldap/ldap.conf".source = ldapConf;
+    };
+
+    environment.etc."chromium/policies/managed/freeipa.json" = mkIf cfg.chromiumSupport {
+      text = ''
+        { "AuthServerWhitelist": "*.${cfg.domain}" }
+      '';
+    };
+
+    system.activationScripts.ipa = stringAfter ["etc"] ''
+      # libcurl requires a hard copy of the certificate
+      if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
+        rm -f /etc/ipa/ca.crt
+        cp ${cfg.certificate} /etc/ipa/ca.crt
+      fi
+
+      if [ ! -f /etc/krb5.keytab ]; then
+        cat <<EOF
+
+          In order to complete FreeIPA integration, please join the domain by completing the following steps:
+          1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm}
+          2. Join the domain and obtain the keytab file: ipa-join
+          3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/
+          4. Restart sssd systemd service: sudo systemctl restart sssd
+
+      EOF
+      fi
+    '';
+
+    services.sssd.config = ''
+      [domain/${cfg.domain}]
+      id_provider = ipa
+      auth_provider = ipa
+      access_provider = ipa
+      chpass_provider = ipa
+
+      ipa_domain = ${cfg.domain}
+      ipa_server = _srv_, ${cfg.server}
+      ipa_hostname = ${config.networking.hostName}.${cfg.domain}
+
+      cache_credentials = ${pyBool cfg.cacheCredentials}
+      krb5_store_password_if_offline = ${pyBool cfg.offlinePasswords}
+      ${optionalString ((toLower cfg.domain) != (toLower cfg.realm))
+        "krb5_realm = ${cfg.realm}"}
+
+      dyndns_update = ${pyBool cfg.dyndns.enable}
+      dyndns_iface = ${cfg.dyndns.interface}
+
+      ldap_tls_cacert = /etc/ipa/ca.crt
+      ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber, lock:nsaccountlock
+
+      [sssd]
+      debug_level = 65510
+      services = nss, sudo, pam, ssh, ifp
+      domains = ${cfg.domain}
+
+      [nss]
+      homedir_substring = /home
+
+      [pam]
+      pam_pwd_expiration_warning = 3
+      pam_verbosity = 3
+
+      [sudo]
+      debug_level = 65510
+
+      [autofs]
+
+      [ssh]
+
+      [pac]
+
+      [ifp]
+      user_attributes = +mail, +telephoneNumber, +givenname, +sn, +lock
+      allowed_uids = ${concatStringsSep ", " cfg.ifpAllowedUids}
+    '';
+
+    services.ntp.servers = singleton cfg.server;
+    services.sssd.enable = true;
+    services.ntp.enable = true;
+
+    security.pki.certificateFiles = singleton cfg.certificate;
+  };
+}
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@ -85,7 +85,8 @@ in rec {
      stdenv
      subversion
      tarball
-      vim;
+      vim
+      tests-stdenv-gcc-stageCompare;
  };

  tested = let
@ -135,6 +136,7 @@ in rec {
        "nixos.tests.proxy"
        "nixos.tests.simple"
        "nixpkgs.jdk"
+        "nixpkgs.tests-stdenv-gcc-stageCompare"
      ])
    ];
  };
--- a/nixos/tests/gnome-xorg.nix
+++ b/nixos/tests/gnome-xorg.nix
@ -24,7 +24,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
      services.xserver.desktopManager.gnome.enable = true;
      services.xserver.desktopManager.gnome.debug = true;
      services.xserver.displayManager.defaultSession = "gnome-xorg";
-      programs.gnome-terminal.enable = true;

      systemd.user.services = {
        "org.gnome.Shell@x11" = {
@ -61,10 +60,10 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
    # False when startup is done
    startingUp = su "${gdbus} ${eval} Main.layoutManager._startingUp";

-    # Start gnome-terminal
-    gnomeTerminalCommand = su "gnome-terminal";
+    # Start Console
+    launchConsole = su "${bus} gapplication launch org.gnome.Console";

-    # Hopefully gnome-terminal's wm class
+    # Hopefully Console's wm class
    wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
  in ''
      with subtest("Login to GNOME Xorg with GDM"):
@ -82,13 +81,17 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
              "${startingUp} | grep -q 'true,..false'"
          )

-      with subtest("Open Gnome Terminal"):
+      with subtest("Open Console"):
+          # Close the Activities view so that Shell can correctly track the focused window.
+          machine.send_key("esc")
+
          machine.succeed(
-              "${gnomeTerminalCommand}"
+              "${launchConsole}"
          )
-          # correct output should be (true, '"Gnome-terminal"')
+          # correct output should be (true, '"kgx"')
+          # For some reason, this deviates from Wayland.
          machine.wait_until_succeeds(
-              "${wmClass} | grep -q  'true,...Gnome-terminal'"
+              "${wmClass} | grep -q  'true,...kgx'"
          )
          machine.sleep(20)
          machine.screenshot("screen")
--- a/nixos/tests/gnome.nix
+++ b/nixos/tests/gnome.nix
@ -22,14 +22,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {

      services.xserver.desktopManager.gnome.enable = true;
      services.xserver.desktopManager.gnome.debug = true;
-      programs.gnome-terminal.enable = true;
-
-      environment.systemPackages = [
-        (pkgs.makeAutostartItem {
-          name = "org.gnome.Terminal";
-          package = pkgs.gnome.gnome-terminal;
-        })
-      ];

      systemd.user.services = {
        "org.gnome.Shell@wayland" = {
@ -64,10 +56,10 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
    # False when startup is done
    startingUp = su "${gdbus} ${eval} Main.layoutManager._startingUp";

-    # Start gnome-terminal
-    gnomeTerminalCommand = su "${bus} gnome-terminal";
+    # Start Console
+    launchConsole = su "${bus} gapplication launch org.gnome.Console";

-    # Hopefully gnome-terminal's wm class
+    # Hopefully Console's wm class
    wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
  in ''
      with subtest("Login to GNOME with GDM"):
@ -86,10 +78,16 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
              "${startingUp} | grep -q 'true,..false'"
          )

-      with subtest("Open Gnome Terminal"):
-          # correct output should be (true, '"gnome-terminal-server"')
+      with subtest("Open Console"):
+          # Close the Activities view so that Shell can correctly track the focused window.
+          machine.send_key("esc")
+
+          machine.succeed(
+              "${launchConsole}"
+          )
+          # correct output should be (true, '"org.gnome.Console"')
          machine.wait_until_succeeds(
-              "${wmClass} | grep -q 'gnome-terminal-server'"
+              "${wmClass} | grep -q 'true,...org.gnome.Console'"
          )
          machine.sleep(20)
          machine.screenshot("screen")
--- a/pkgs/applications/audio/alsa-scarlett-gui/default.nix
+++ b/pkgs/applications/audio/alsa-scarlett-gui/default.nix
@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-wzBOPTs8PTHzu5RpKwKhx552E7QnDx2Zn4OFaes8Q2I=";
  };

+  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+
  makeFlags = [ "DESTDIR=\${out}" "PREFIX=''" ];
  sourceRoot = "source/src";
  nativeBuildInputs = [ pkg-config wrapGAppsHook4 ];
--- a/pkgs/applications/audio/mousai/default.nix
+++ b/pkgs/applications/audio/mousai/default.nix
@ -1,76 +1,66 @@
 { lib
-, python3
+, stdenv
 , fetchFromGitHub
-, substituteAll
 , appstream-glib
+, dbus
 , desktop-file-utils
-, gettext
 , glib
+, glib-networking
 , gobject-introspection
 , gst_all_1
 , gtk4
 , libadwaita
-, librsvg
+, libpulseaudio
+, libsoup_3
 , meson
 , ninja
 , pkg-config
-, pulseaudio
+, rustPlatform
 , wrapGAppsHook4
 }:

-python3.pkgs.buildPythonApplication rec {
+stdenv.mkDerivation rec {
  pname = "mousai";
-  version = "0.6.6";
-
-  format = "other";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "SeaDve";
    repo = "Mousai";
    rev = "v${version}";
-    sha256 = "sha256-nCbFVFg+nVF8BOBfdzQVgdTRXR5UF18PJFC266yTFwg=";
+    hash = "sha256-dL+ZBv97T0sN7mPoOKsp5f6Dl9aarBYm2RRUfOclb+s=";
  };

-  patches = [
-    (substituteAll {
-      src = ./paths.patch;
-      pactl = "${lib.getBin pulseaudio}/bin/pactl";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace build-aux/meson/postinstall.py \
-      --replace gtk-update-icon-cache gtk4-update-icon-cache
-
-    patchShebangs build-aux/meson
-  '';
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-qAtMpYVZwyay1KGYlH40T0HambrWh4CaZnwjvqev44g=";
+  };

  nativeBuildInputs = [
    appstream-glib
    desktop-file-utils
-    gettext
-    glib
-    gobject-introspection
-    gtk4
    meson
    ninja
    pkg-config
    wrapGAppsHook4
-  ];
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);

  buildInputs = [
+    dbus
    gst_all_1.gstreamer
    gst_all_1.gst-plugins-base
    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    glib
+    glib-networking
    gtk4
    libadwaita
-    librsvg
-    pulseaudio
-  ];
-
-  propagatedBuildInputs = with python3.pkgs; [
-    pygobject3
-    requests
+    libpulseaudio
+    libsoup_3
  ];

  meta = with lib; {
@ -78,5 +68,6 @@ python3.pkgs.buildPythonApplication rec {
    homepage = "https://github.com/SeaDve/Mousai";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ dotlambda ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@ -3,7 +3,7 @@
 , fetchurl
 , makeWrapper
 , pkg-config
-, perl
+, libOnly ? false # whether to build only the library
 , withAlsa ? stdenv.hostPlatform.isLinux
 , alsa-lib
 , withPulse ? stdenv.hostPlatform.isLinux
@ -14,29 +14,36 @@
 , withJack ? stdenv.hostPlatform.isUnix
 , jack
 , withConplay ? !stdenv.hostPlatform.isWindows
+, perl
 }:

+assert withConplay -> !libOnly;
+
 stdenv.mkDerivation rec {
-  pname = "mpg123";
+  pname = "${lib.optionalString libOnly "lib"}mpg123";
  version = "1.31.2";

  src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
+    url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
    sha256 = "sha256-sX8ikF4x9DtrQB399qce0Ru30Fb2jbRJ1wufmug5x94=";
  };

-  outputs = [ "out" ] ++ lib.optionals withConplay [ "conplay" ];
+  outputs = [ "out" ] ++ lib.optional withConplay "conplay";

-  nativeBuildInputs = lib.optionals withConplay [ makeWrapper ]
-    ++ lib.optionals (withPulse || withJack) [ pkg-config ];
+  nativeBuildInputs = lib.optionals (!libOnly) (
+    lib.optionals withConplay [ makeWrapper ]
+    ++ lib.optionals (withPulse || withJack) [ pkg-config ]
+  );

-  buildInputs = lib.optionals withConplay [ perl ]
+  buildInputs = lib.optionals (!libOnly) (
+    lib.optionals withConplay [ perl ]
    ++ lib.optionals withAlsa [ alsa-lib ]
    ++ lib.optionals withPulse [ libpulseaudio ]
    ++ lib.optionals withCoreAudio [ AudioUnit AudioToolbox ]
-    ++ lib.optionals withJack [ jack ];
+    ++ lib.optionals withJack [ jack ]
+  );

-  configureFlags = [
+  configureFlags = lib.optionals (!libOnly) [
    "--with-audio=${lib.strings.concatStringsSep "," (
      lib.optional withJack "jack"
      ++ lib.optional withPulse "pulse"
--- a/pkgs/applications/audio/soundux/default.nix
+++ b/pkgs/applications/audio/soundux/default.nix
@ -107,6 +107,8 @@ stdenv.mkDerivation rec {
    ln -s ${semver-cpp} lib/semver
  '';

+  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+
  # Somehow some of the install destination paths in the build system still
  # gets transformed to point to /var/empty/share, even though they are at least
  # relative to the nix output directory with our earlier patching.
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@ -1,12 +1,11 @@
-{ lib, stdenv, fetchurl, lzip
-}:
+{ lib, stdenv, fetchurl, lzip }:

 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.

-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
  pname = "ed";
  version = "1.19";

@ -17,11 +16,14 @@ stdenv.mkDerivation (rec {

  nativeBuildInputs = [ lzip ];

-  doCheck = true; # not cross;
+  configureFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  doCheck = true;

  meta = {
    description = "An implementation of the standard Unix editor";
-
    longDescription = ''
      GNU ed is a line-oriented text editor.  It is used to create,
      display, modify and otherwise manipulate text files, both
@ -32,17 +34,9 @@ stdenv.mkDerivation (rec {
      available.  For most purposes, however, it is superseded by
      full-screen editors such as GNU Emacs or GNU Moe.
    '';
-
    license = lib.licenses.gpl3Plus;
-
    homepage = "https://www.gnu.org/software/ed/";
-
    maintainers = [ ];
    platforms = lib.platforms.unix;
  };
-} // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
-  # This may be moved above during a stdenv rebuild.
-  preConfigure = ''
-    configureFlagsArray+=("CC=$CC")
-  '';
-})
+}
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@ -62,9 +62,17 @@ assert withXwidgets -> withGTK3 && webkitgtk != null;
 assert withTreeSitter -> tree-sitter != null;


+let
+  libGccJitLibraryPaths = [
+    "${lib.getLib libgccjit}/lib/gcc"
+    "${lib.getLib stdenv.cc.libc}/lib"
+  ] ++ lib.optionals (stdenv.cc?cc.libgcc) [
+    "${lib.getLib stdenv.cc.cc.libgcc}/lib"
+  ];
+in
 (if withMacport then llvmPackages_6.stdenv else stdenv).mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
  NATIVE_FULL_AOT = "1";
-  LIBRARY_PATH = "${lib.getLib stdenv.cc.libc}/lib";
+  LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
 } // {
  pname = pname + lib.optionalString ( !withX && !withNS && !withMacport && !withGTK2 && !withGTK3 ) "-nox";
  inherit version;
@ -75,17 +83,15 @@ assert withTreeSitter -> tree-sitter != null;
            then ./native-comp-driver-options-28.patch
            else ./native-comp-driver-options.patch;
      backendPath = (lib.concatStringsSep " "
-        (builtins.map (x: ''"-B${x}"'') [
+        (builtins.map (x: ''"-B${x}"'') ([
          # Paths necessary so the JIT compiler finds its libraries:
          "${lib.getLib libgccjit}/lib"
-          "${lib.getLib libgccjit}/lib/gcc"
-          "${lib.getLib stdenv.cc.libc}/lib"
-
+        ] ++ libGccJitLibraryPaths ++ [
          # Executable paths necessary for compilation (ld, as):
          "${lib.getBin stdenv.cc.cc}/bin"
          "${lib.getBin stdenv.cc.bintools}/bin"
          "${lib.getBin stdenv.cc.bintools.bintools}/bin"
-        ]));
+        ])));
    })
  ];

--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@ -5,7 +5,6 @@
 , desktop-file-utils
 , editorconfig-core-c
 , fetchurl
-, fetchpatch
 , flatpak
 , gnome
 , libgit2-glib
@ -18,6 +17,7 @@
 , json-glib
 , jsonrpc-glib
 , libadwaita
+, libdex
 , libpanel
 , libpeas
 , libportal-gtk4
@ -33,7 +33,7 @@
 , template-glib
 , vala
 , vte-gtk4
-, webkitgtk_5_0
+, webkitgtk_6_0
 , wrapGAppsHook4
 , dbus
 , xvfb-run
@ -41,13 +41,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-builder";
-  version = "43.6";
+  version = "44.1";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "m08hPdloyVL75CJoUPXJVk3f1XimoPiT06K2rhmjd6k=";
+    sha256 = "+Tmn+VtLbh0EvY20vpygtnsqp2W4bGP03yP9s6ftzz4=";
  };

  patches = [
@ -92,6 +92,7 @@ stdenv.mkDerivation rec {
    json-glib
    jsonrpc-glib
    libadwaita
+    libdex
    libpanel
    libxml2
    ostree
@ -101,7 +102,7 @@ stdenv.mkDerivation rec {
    sysprof
    template-glib
    vala
-    webkitgtk_5_0
+    webkitgtk_6_0
  ];

  nativeCheckInputs = [
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,15 +1,16 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1403";
+  version = "9.0.1441";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-z+zLRO0yqWu/l3eOzD7pmUvmqhmkH5W9z7wE9QWlsG0=";
+    hash = "sha256-tGWOIXx4gNMg0CB4ytUrj9bQLXw+4pl2lfgGR81+EJk=";
  };

  enableParallelBuilding = true;
+  enableParallelInstalling = false;

  hardeningDisable = [ "fortify" ];

--- a/pkgs/applications/graphics/gnome-photos/default.nix
+++ b/pkgs/applications/graphics/gnome-photos/default.nix
@ -35,27 +35,17 @@

 stdenv.mkDerivation rec {
  pname = "gnome-photos";
-  version = "43.0";
+  version = "44.0";

  outputs = [ "out" "installedTests" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "x6x0WNUz8p2VUBHHS3YiTXnqMbzBLp1tDOe2w3BNCOE=";
+    sha256 = "544hA5fTxigJxs1VIdpuzLShHd6lvyr4YypH9Npcgp4=";
  };

  patches = [
    ./installed-tests-path.patch
-
-    # Support babel 0.1.100
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gnome-photos/-/commit/64c6f733a44bac5b7f08445a686c000681f93f5f.patch";
-      hash = "sha256-iB5qCcDEH8pEX42ypEGJ9QMJWE8VXirv5JfdC1jP218=";
-    })
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gnome-photos/-/commit/9db32c3508a8c5d357a053d5f8278c34b4df18f3.patch";
-      hash = "sha256-iz6gSu5rUBZ3Ki5GSRVuLcwX0LRQvJT17XmXQ7WJSmI=";
-    })
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -1,5 +1,6 @@
 { lib
 , fetchFromGitLab
+, fetchpatch
 , desktop-file-utils
 , gettext
 , glib
@ -7,7 +8,7 @@
 , gtk4
 , libadwaita
 , libnotify
-, webkitgtk_5_0
+, webkitgtk_6_0
 , meson
 , ninja
 , pkg-config
@ -29,6 +30,18 @@ python3.pkgs.buildPythonApplication rec {
    hash = "sha256-DxW9uefY6Fks3qSUeLMp3BB85SfLgzwBr4KO9do2y2o=";
  };

+  patches = [
+    # https://gitlab.com/valos/Komikku/-/merge_requests/208
+    (fetchpatch {
+      url = "https://gitlab.com/valos/Komikku/-/commit/c9a09817acd767a7cb4ceea9b212fffd798eae61.patch";
+      hash = "sha256-McjQApLY7OKbdelrTeh3aRw90B6T9V5FtLL5Y62BmGA=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/valos/Komikku/-/commit/bda93631420f6a69a50be0068f259d60b9558930.patch";
+      hash = "sha256-Xu+IaQKf0I99a2uh97j8xSlGYSJHuNPMy/zZtWRxLaM=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
@ -45,7 +58,7 @@ python3.pkgs.buildPythonApplication rec {
    gtk4
    libadwaita
    libnotify
-    webkitgtk_5_0
+    webkitgtk_6_0
    gobject-introspection
  ];

--- a/pkgs/applications/misc/feedbackd/default.nix
+++ b/pkgs/applications/misc/feedbackd/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch2
 , docbook-xsl-nons
 , docutils
 , gi-docgen
@ -43,6 +44,13 @@ stdenv.mkDerivation rec {
    fetchSubmodules = true;
  };

+  patches = [
+    (fetchpatch2 {
+      url = "https://source.puri.sm/Librem5/feedbackd/-/merge_requests/109.patch";
+      hash = "sha256-z3Ud6P2GHYOaGA2vJDD3Sz47+M8p0VcYZ5gbYcGydMk=";
+    })
+  ];
+
  depsBuildBuild = [
    pkg-config
  ];
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@ -1,21 +1,64 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, check, dbus, xvfb-run, glib, gtk, gettext, libiconv, json_c, libintl
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch2
+, meson
+, ninja
+, pkg-config
+, check
+, dbus
+, xvfb-run
+, glib
+, gtk
+, gettext
+, libiconv
+, json-glib
+, libintl
 }:

 stdenv.mkDerivation rec {
  pname = "girara";
-  version = "0.3.7";
+  version = "0.3.9";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://git.pwmt.org/pwmt/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-QTQiE/jnRSWPHbKMu2zMJ6YwCaXgAb95G74BzkNtTbc=";
+    hash = "sha256-DoqYykR/N17BHQ90GoLvAYluQ3odWPwUGRTacN6BiWU=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config gettext check dbus ];
-  buildInputs = [ libintl libiconv json_c ];
-  propagatedBuildInputs = [ glib gtk ];
-  nativeCheckInputs = [ xvfb-run ];
+  patches = [
+    # Fix memory management bug revealed by GLib 2.76.
+    # https://git.pwmt.org/pwmt/girara/-/issues/17
+    (fetchpatch2 {
+      url = "https://git.pwmt.org/pwmt/girara/-/commit/6926cc1234853ccf3010a1e2625aafcf462ed60e.patch";
+      hash = "sha256-uayT6ikXtaBPxhZFyskShug3Tbvy2a9qimLRwdiAsic=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    check
+    dbus
+  ];
+
+  buildInputs = [
+    libintl
+    libiconv
+    json-glib
+  ];
+
+  propagatedBuildInputs = [
+    glib
+    gtk
+  ];
+
+  nativeCheckInputs = [
+    xvfb-run
+  ];

  doCheck = !stdenv.isDarwin;

--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@ -34,13 +34,13 @@

 buildPythonApplication rec {
  pname = "orca";
-  version = "43.1";
+  version = "44.0";

  format = "other";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "9ljgSc4WknO4Q0aBBCTW9QkpHwXX7MOnegPZEqo+aEA=";
+    sha256 = "e8WX7AvBtnQgC2L995XUuulkemNxfXVN9hWHzCUFAs4=";
  };

  patches = [
--- a/pkgs/applications/networking/instant-messengers/tangram/default.nix
+++ b/pkgs/applications/networking/instant-messengers/tangram/default.nix
@ -18,7 +18,7 @@
 , ninja
 , pkg-config
 , python3
-, webkitgtk_5_0
+, webkitgtk_6_0
 , blueprint-compiler
 , wrapGAppsHook
 }:
@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
    gsettings-desktop-schemas
    gtk4
    libadwaita
-    webkitgtk_5_0
+    webkitgtk_6_0
  ] ++ (with gst_all_1; [
    gstreamer
    gst-libav
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -1,7 +1,6 @@
 { lib
 , fetchFromGitHub
 , fetchpatch
-, fetchurl
 , callPackage
 , pkg-config
 , cmake
@ -71,13 +70,6 @@ let
      cxxStandard = "20";
    };
  };
-  glibmm = glibmm_2_68.overrideAttrs (_: {
-    version = "2.76.0";
-    src = fetchurl {
-      url = "mirror://gnome/sources/glibmm/2.76/glibmm-2.76.0.tar.xz";
-      sha256 = "sha256-hjfYDOq9lP3dbkiXCggqJkVY1KuCaE4V/8h+fvNGKrI=";
-    };
-  });
 in
 stdenv.mkDerivation rec {
  pname = "telegram-desktop";
@ -147,7 +139,7 @@ stdenv.mkDerivation rec {
    range-v3
    tl-expected
    hunspell
-    glibmm
+    glibmm_2_68
    webkitgtk_4_1
    jemalloc
    rnnoise
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@ -44,11 +44,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution";
-  version = "3.46.4";
+  version = "3.48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "eghCMc7SRaNLcT141Dp3Zgyso79S5qT1AwpqCAxpez0=";
+    sha256 = "LYRygZWJ6S78zk8tw70STpPTedMwCXj2mpZTxZKmDvY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/abiword/default.nix
+++ b/pkgs/applications/office/abiword/default.nix
@ -1,6 +1,22 @@
-{ lib, stdenv, fetchurl, pkg-config, gtk3, fribidi
-, libpng, popt, libgsf, enchant, wv, librsvg, bzip2, libjpeg, perl
-, boost, libxslt, goffice, wrapGAppsHook, gnome
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, gtk3
+, fribidi
+, libpng
+, popt
+, libgsf
+, enchant
+, wv
+, librsvg
+, bzip2
+, libjpeg
+, perl
+, boost
+, libxslt
+, goffice
+, wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
@ -12,15 +28,30 @@ stdenv.mkDerivation rec {
    hash = "sha256-ElckfplwUI1tFFbT4zDNGQnEtCsl4PChvDJSbW86IbQ=";
  };

-  enableParallelBuilding = true;
-
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook
+  ];

  buildInputs = [
-    gtk3 librsvg bzip2 fribidi libpng popt
-    libgsf enchant wv libjpeg perl boost libxslt goffice gnome.adwaita-icon-theme
+    gtk3
+    librsvg
+    bzip2
+    fribidi
+    libpng
+    popt
+    libgsf
+    enchant
+    wv
+    libjpeg
+    perl
+    boost
+    libxslt
+    goffice
  ];

+  enableParallelBuilding = true;
+
  meta = with lib; {
    description = "Word processing program, similar to Microsoft Word";
    homepage = "https://www.abisource.com/";
--- a/pkgs/applications/office/iotas/default.nix
+++ b/pkgs/applications/office/iotas/default.nix
@ -14,7 +14,7 @@
 , libsecret
 , libadwaita
 , gtksourceview5
-, webkitgtk_5_0
+, webkitgtk_6_0
 }:

 python3.pkgs.buildPythonApplication rec {
@ -47,7 +47,7 @@ python3.pkgs.buildPythonApplication rec {
    libsecret
    libadwaita
    gtksourceview5
-    webkitgtk_5_0
+    webkitgtk_6_0
  ];

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@ -60,8 +60,6 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "sha256-4liPfNJ2JGniz8Os4Np+XSXCJBHND13XLPWDy3Gc/F8=";

-  auditable = true; # TODO: remove when this is the default
-
  nativeBuildInputs = [
    cmake
    installShellFiles
--- a/pkgs/applications/terminal-emulators/gnome-console/default.nix
+++ b/pkgs/applications/terminal-emulators/gnome-console/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-console";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-console/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "uWQkhaN6cOgswQVTsOJoF1a6Nh/15MvzGC8VAjH+qZ4=";
+    sha256 = "0cGv1eyNK9+Eo9sCmwSiQy7Me80kLCp0X+mYakKJiEQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -79,7 +79,8 @@
 }:

 let
-  inherit (darwin.apple_sdk_11_0.frameworks) AVFoundation CoreFoundation CoreMedia Cocoa CoreAudio MediaPlayer;
+  inherit (darwin.apple_sdk_11_0.frameworks)
+    AVFoundation CoreFoundation CoreMedia Cocoa CoreAudio MediaPlayer Accelerate;
  luaEnv = lua.withPackages (ps: with ps; [ luasocket ]);
 in stdenv.mkDerivation (self: {
  pname = "mpv";
@ -182,7 +183,7 @@ in stdenv.mkDerivation (self: {
    ++ lib.optionals zimgSupport        [ zimg ]
    ++ lib.optionals stdenv.isLinux     [ nv-codec-headers ]
    ++ lib.optionals stdenv.isDarwin    [ libiconv ]
-    ++ lib.optionals stdenv.isDarwin    [ CoreFoundation Cocoa CoreAudio MediaPlayer ]
+    ++ lib.optionals stdenv.isDarwin    [ CoreFoundation Cocoa CoreAudio MediaPlayer Accelerate ]
    ++ lib.optionals (stdenv.isDarwin && swiftSupport) [ AVFoundation CoreMedia ];

  postBuild = lib.optionalString stdenv.isDarwin ''
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@ -20,13 +20,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "pitivi";
-  version = "2022.06";
+  version = "2023.03";

  format = "other";

  src = fetchurl {
    url = "mirror://gnome/sources/pitivi/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Uz0448bSEcK9DpXiuWsPCDO98NXUd6zgffYRWDUGyDg=";
+    sha256 = "PX1OFEeavqMPvF613BKgxwErxqW2huw6mQxo8YpBS/M=";
  };

  patches = [
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -117,6 +117,15 @@ stdenv.mkDerivation rec {
      sha256 = "sha256-oC+bRjEHixv1QEFO9XAm4HHOwoiT+NkhknKGPydnZ5E=";
      revert = true;
    })
+    # glibc >=2.37 compat, see https://lore.kernel.org/qemu-devel/20230110174901.2580297-1-berrange@redhat.com/
+    (fetchpatch {
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/9f0246539ae84a5e21efd1cc4516fc343f08115a.patch";
+      sha256 = "sha256-1iWOWkLH0WP1Hk23fmrRVdX7YZWUXOvWRMTt8QM93BI=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/6003159ce18faad4e1bc7bf9c85669019cd4950e.patch";
+      sha256 = "sha256-DKGCbR+VDIFLp6FhER78gyJ3Rn1dD47pMtkcIIMd0B8=";
+    })
  ]
  ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;

--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -46,6 +46,8 @@ while (( "$n" < "$nParams" )); do
        -nostdinc) cInclude=0 cxxInclude=0 ;;
        -nostdinc++) cxxInclude=0 ;;
        -nostdlib) cxxLibrary=0 ;;
+        -x*-header) dontLink=1 ;; # both `-x c-header` and `-xc-header` are accepted by clang
+        -xc++*) isCxx=1 ;;        # both `-xc++` and `-x c++` are accepted by clang
        -x)
            case "$p2" in
                *-header) dontLink=1 ;;
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -17,9 +17,42 @@
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}
 , libcxx ? null
+, grossHackForStagingNext ? false
+
+# Whether or not to add `-B` and `-L` to `nix-support/cc-{c,ld}flags`
+, useCcForLibs ?
+
+  # Always add these flags for Clang, because in order to compile (most
+  # software) it needs libraries that are shipped and compiled with gcc.
+  if isClang then true
+
+  # Never add these flags for a build!=host cross-compiler or a host!=target
+  # ("cross-built-native") compiler; currently nixpkgs has a special build
+  # path for these (`crossStageStatic`).  Hopefully at some point that build
+  # path will be merged with this one and this conditional will be removed.
+  else if (with stdenvNoCC; buildPlatform != hostPlatform || hostPlatform != targetPlatform) then false
+
+  # Never add these flags when wrapping the bootstrapFiles' compiler; it has a
+  # /usr/-like layout with everything smashed into a single outpath, so it has
+  # no trouble finding its own libraries.
+  else if (cc.passthru.isFromBootstrapFiles or false) then false
+
+  # Add these flags when wrapping `xgcc` (the first compiler that nixpkgs builds)
+  else if (cc.passthru.isXgcc or false) then true
+
+  # Add these flags when wrapping `stdenv.cc`
+  else if (cc.stdenv.cc.cc.passthru.isXgcc or false) then true
+
+  # Do not add these flags in any other situation.  This is `false` mainly to
+  # prevent these flags from being added when wrapping *old* versions of gcc
+  # (e.g. `gcc6Stdenv`), since they will cause the old gcc to get `-B` and
+  # `-L` flags pointing at the new gcc's libstdc++ headers.  Example failure:
+  # https://hydra.nixos.org/build/213125495
+  else false
+
+# the derivation at which the `-B` and `-L` flags added by `useCcForLibs` will point
 , gccForLibs ? if useCcForLibs then cc else null
-# same as `gccForLibs`, but generalized beyond clang
-, useCcForLibs ? isClang
+, tmpDropB ? false # temporary hack; see PR #225846
 }:

 with lib;
@ -226,12 +259,10 @@ stdenv.mkDerivation {
        ln -s ${targetPrefix}clang++ $out/bin/${targetPrefix}c++
      fi

-      if [ -e $ccPath/cpp ]; then
-        wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
-    '' + lib.optionalString (hostPlatform != targetPlatform) ''
-      elif [ -e $ccPath/${targetPrefix}cpp ]; then
+      if [ -e $ccPath/${targetPrefix}cpp ]; then
        wrap ${targetPrefix}cpp $wrapper $ccPath/${targetPrefix}cpp
-    '' + ''
+      elif [ -e $ccPath/cpp ]; then
+        wrap ${targetPrefix}cpp $wrapper $ccPath/cpp
      fi
    ''

@ -305,9 +336,11 @@ stdenv.mkDerivation {
    ##
    ## GCC libs for non-GCC support
    ##
-    + optionalString useGccForLibs ''
+    + optionalString (useGccForLibs && !tmpDropB) ''

      echo "-B${gccForLibs}/lib/gcc/${targetPlatform.config}/${gccForLibs.version}" >> $out/nix-support/cc-cflags
+    ''
+    + optionalString useGccForLibs ''
      echo "-L${gccForLibs}/lib/gcc/${targetPlatform.config}/${gccForLibs.version}" >> $out/nix-support/cc-ldflags
      echo "-L${gccForLibs.lib}/${targetPlatform.config}/lib" >> $out/nix-support/cc-ldflags
    ''
@ -323,7 +356,7 @@ stdenv.mkDerivation {
                      && targetPlatform.isLinux
                      && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
                      && !(stdenv.targetPlatform.useLLVM or false)
-                      && gccForLibs != null) ''
+                      && gccForLibs != null) (''
      echo "--gcc-toolchain=${gccForLibs}" >> $out/nix-support/cc-cflags

      # Pull in 'cc.out' target to get 'libstdc++fs.a'. It should be in
@ -331,6 +364,11 @@ stdenv.mkDerivation {
      # TODO(trofi): remove once gcc is fixed to move libraries to .lib output.
      echo "-L${gccForLibs}/${optionalString (targetPlatform != hostPlatform) "/${targetPlatform.config}"}/lib" >> $out/nix-support/cc-ldflags
    ''
+    # this ensures that when clang passes -lgcc_s to lld (as it does
+    # when building e.g. firefox), lld is able to find libgcc_s.so
+    + lib.optionalString (gccForLibs?libgcc) ''
+      echo "-L${gccForLibs.libgcc}/lib" >> $out/nix-support/cc-ldflags
+    '')

    ##
    ## General libc support
@ -373,7 +411,11 @@ stdenv.mkDerivation {
      touch "$out/nix-support/libcxx-cxxflags"
      touch "$out/nix-support/libcxx-ldflags"
    ''
-    + optionalString (libcxx == null && (useGccForLibs && gccForLibs.langCC or false)) ''
+    # Adding -isystem flags should be done only for clang; gcc
+    # already knows how to find its own libstdc++, and adding
+    # additional -isystem flags will confuse gfortran (see
+    # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
+    + optionalString (libcxx == null && (if grossHackForStagingNext then isClang else true) && (useGccForLibs && gccForLibs.langCC or false)) ''
      for dir in ${gccForLibs}${lib.optionalString (hostPlatform != targetPlatform) "/${targetPlatform.config}"}/include/c++/*; do
        echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
      done
--- a/pkgs/build-support/emacs/wrapper.nix
+++ b/pkgs/build-support/emacs/wrapper.nix
@ -67,10 +67,12 @@ runCommand
    # Store all paths we want to add to emacs here, so that we only need to add
    # one path to the load lists
    deps = runCommand "emacs-packages-deps"
-      {
+      ({
        inherit explicitRequires lndir emacs;
        nativeBuildInputs = lib.optional nativeComp gcc;
-      }
+      } // lib.optionalAttrs nativeComp {
+        inherit (emacs) LIBRARY_PATH;
+      })
      ''
        findInputsOld() {
          local pkg="$1"; shift
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@ -105,7 +105,7 @@ let
      runHook postConfigure
    '';

-    buildPhase = args.modBuildPhase or ''
+    buildPhase = args.modBuildPhase or (''
      runHook preBuild
    '' + lib.optionalString deleteVendor ''
      if [ ! -d vendor ]; then
@ -133,7 +133,7 @@ let
      mkdir -p vendor

      runHook postBuild
-    '';
+    '');

    installPhase = args.modInstallPhase or ''
      runHook preInstall
@ -176,7 +176,7 @@ let
    GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
    inherit CGO_ENABLED enableParallelBuilding;

-    configurePhase = args.configurePhase or ''
+    configurePhase = args.configurePhase or (''
      runHook preConfigure

      export GOCACHE=$TMPDIR/go-cache
@ -200,9 +200,9 @@ let
      fi

      runHook postConfigure
-    '';
+    '');

-    buildPhase = args.buildPhase or ''
+    buildPhase = args.buildPhase or (''
      runHook preBuild

      exclude='\(/_\|examples\|Godeps\|testdata'
@ -282,7 +282,7 @@ let
      )
    '' + ''
      runHook postBuild
-    '';
+    '');

    doCheck = args.doCheck or true;
    checkPhase = args.checkPhase or ''
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@ -99,7 +99,7 @@ let

    GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);

-    configurePhase = args.configurePhase or ''
+    configurePhase = args.configurePhase or (''
      runHook preConfigure

      # Extract the source
@ -141,7 +141,7 @@ let
      fi

      runHook postConfigure
-    '';
+    '');

    renameImports = args.renameImports or (
      let
@ -151,7 +151,7 @@ let
        renames = p: lib.concatMapStringsSep "\n" (rename p.goPackagePath) p.goPackageAliases;
      in lib.concatMapStringsSep "\n" renames inputsWithAliases);

-    buildPhase = args.buildPhase or ''
+    buildPhase = args.buildPhase or (''
      runHook preBuild

      runHook renameImports
@ -235,7 +235,7 @@ let
      )
    '' + ''
      runHook postBuild
-    '';
+    '');

    doCheck = args.doCheck or false;
    checkPhase = args.checkPhase or ''
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@ -45,7 +45,7 @@
 , buildFeatures ? [ ]
 , checkFeatures ? buildFeatures
 , useNextest ? false
-, auditable ? false # TODO: change to true
+, auditable ? true

 , depsExtraArgs ? {}

--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@ -62,6 +62,10 @@ in stdenv.mkDerivation ({
    export CARGO_HOME=$(mktemp -d cargo-home.XXX)
    CARGO_CONFIG=$(mktemp cargo-config.XXXX)

+    # https://blog.rust-lang.org/2023/03/09/Rust-1.68.0.html#cargos-sparse-protocol
+    # planned to become the default in 1.70
+    export CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
+
    if [[ -n "$NIX_CRATES_INDEX" ]]; then
    cat >$CARGO_HOME/config.toml <<EOF
    [source.crates-io]
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@ -76,37 +76,14 @@ in {
        # inputs do not cause us to find the wrong `diff`.
        diff = "${lib.getBin buildPackages.diffutils}/bin/diff";

-        # We want to specify the correct crt-static flag for both
-        # the build and host platforms. This is important when the wanted
-        # value for crt-static does not match the defaults in the rustc target,
-        # like for pkgsMusl or pkgsCross.musl64; Upstream rustc still assumes
-        # that musl = static[1].
-        #
-        # By default, Cargo doesn't apply RUSTFLAGS when building build.rs
-        # if --target is passed, so the only good way to set crt-static for
-        # build.rs files is to use the unstable -Zhost-config Cargo feature.
-        # This allows us to specify flags that should be passed to rustc
-        # when building for the build platform. We also need to use
-        # -Ztarget-applies-to-host, because using -Zhost-config requires it.
-        #
-        # When doing this, we also have to specify the linker, or cargo
-        # won't pass a -C linker= argument to rustc.  This will make rustc
-        # try to use its default value of "cc", which won't be available
-        # when cross-compiling.
-        #
-        # [1]: https://github.com/rust-lang/compiler-team/issues/422
        cargoConfig = ''
-          [host]
+          [target."${rust.toRustTarget stdenv.buildPlatform}"]
          "linker" = "${ccForBuild}"
-          "rustflags" = [ "-C", "target-feature=${if stdenv.buildPlatform.isStatic then "+" else "-"}crt-static" ]
-
-          [target."${shortTarget}"]
-          "linker" = "${ccForHost}"
+          ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
+            [target."${shortTarget}"]
+            "linker" = "${ccForHost}"
+          ''}
          "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
-
-          [unstable]
-          host-config = true
-          target-applies-to-host = true
        '';
      };
    } ./cargo-setup-hook.sh) {};
--- a/pkgs/build-support/rust/import-cargo-lock.nix
+++ b/pkgs/build-support/rust/import-cargo-lock.nix
@ -10,6 +10,15 @@
  # Allow `builtins.fetchGit` to be used to not require hashes for git dependencies
 , allowBuiltinFetchGit ? false

+  # Additional registries to pull sources from
+  #   { "https://<registry index URL>" = "https://<registry download URL>"; }
+  # where:
+  # - "index URL" is the "index" value of the configuration entry for that registry
+  #   https://doc.rust-lang.org/cargo/reference/registries.html#using-an-alternate-registry
+  # - "download URL" is the "dl" value of its associated index configuration
+  #   https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
+, extraRegistries ? {}
+
  # Hashes for git dependencies.
 , outputHashes ? {}
 } @ args:
@ -80,7 +89,7 @@ let

  # We can't use the existing fetchCrate function, since it uses a
  # recursive hash of the unpacked crate.
-  fetchCrate = pkg:
+  fetchCrate = pkg: downloadUrl:
    let
      checksum = pkg.checksum or parsedLockFile.metadata."checksum ${pkg.name} ${pkg.version} (${pkg.source})";
    in
@ -89,10 +98,14 @@ let
    '';
    fetchurl {
      name = "crate-${pkg.name}-${pkg.version}.tar.gz";
-      url = "https://crates.io/api/v1/crates/${pkg.name}/${pkg.version}/download";
+      url = "${downloadUrl}/${pkg.name}/${pkg.version}/download";
      sha256 = checksum;
    };

+  registries = {
+    "https://github.com/rust-lang/crates.io-index" = "https://crates.io/api/v1/crates";
+  } // extraRegistries;
+
  # Replaces values inherited by workspace members.
  replaceWorkspaceValues = writers.writePython3 "replace-workspace-values"
    { libraries = with python3Packages; [ tomli tomli-w ]; flakeIgnore = [ "E501" ]; }
@ -102,10 +115,11 @@ let
  mkCrate = pkg:
    let
      gitParts = parseGit pkg.source;
+      registryIndexUrl = lib.removePrefix "registry+" pkg.source;
    in
-      if pkg.source == "registry+https://github.com/rust-lang/crates.io-index" then
+      if lib.hasPrefix "registry+" pkg.source && builtins.hasAttr registryIndexUrl registries then
      let
-        crateTarball = fetchCrate pkg;
+        crateTarball = fetchCrate pkg registries.${registryIndexUrl};
      in runCommand "${pkg.name}-${pkg.version}" {} ''
        mkdir $out
        tar xf "${crateTarball}" -C $out --strip-components=1
@ -213,15 +227,24 @@ let
    }

    cat > $out/.cargo/config <<EOF
-    [source.crates-io]
-    replace-with = "vendored-sources"
+[source.crates-io]
+replace-with = "vendored-sources"

-    [source.vendored-sources]
-    directory = "cargo-vendor-dir"
-    EOF
+[source.vendored-sources]
+directory = "cargo-vendor-dir"
+EOF

    declare -A keysSeen

+    for registry in ${toString (builtins.attrNames extraRegistries)}; do
+      cat >> $out/.cargo/config <<EOF
+
+[source."$registry"]
+registry = "$registry"
+replace-with = "vendored-sources"
+EOF
+    done
+
    for crate in ${toString depCrates}; do
      # Link the crate directory, removing the output path hash from the destination.
      ln -s "$crate" $out/$(basename "$crate" | cut -c 34-)
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -149,9 +149,11 @@ rec {
          echo -n "$text" > "$target"
        fi

-        eval "$checkPhase"
+        if [ -n "$executable" ]; then
+          chmod +x "$target"
+        fi

-        (test -n "$executable" && chmod +x "$target") || true
+        eval "$checkPhase"
      '';

  /*
@ -412,7 +414,10 @@ rec {
        mkdir -p "$(dirname "$file")"
        cat $files > "$file"

-        (test -n "$executable" && chmod +x "$file") || true
+        if [ -n "$executable" ]; then
+          chmod +x "$file"
+        fi
+
        eval "$checkPhase"
      '';

--- a/pkgs/build-support/trivial-builders/test/write-shell-script.nix
+++ b/pkgs/build-support/trivial-builders/test/write-shell-script.nix
@ -0,0 +1,14 @@
+{ lib, writeShellScript }: let
+  output = "hello";
+in (writeShellScript "test-script" ''
+  echo ${lib.escapeShellArg output}
+'').overrideAttrs (old: {
+  checkPhase = old.checkPhase or "" + ''
+    expected=${lib.escapeShellArg output}
+    got=$("$target")
+    if [[ "$got" != "$expected" ]]; then
+      echo "wrong output: expected $expected, got $got"
+      exit 1
+    fi
+  '';
+})
--- a/pkgs/data/documentation/gnome-user-docs/default.nix
+++ b/pkgs/data/documentation/gnome-user-docs/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-user-docs";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-user-docs/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "NgcWDv/W+R4lqHmLV977IJndcLj+5Ofi8g8mN6woyu4=";
+    sha256 = "z2zX65xBSd2Tlm9x+huQevyPZR7MOvVOEIW89K0hsb0=";
  };

  nativeBuildInputs = [
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "iana-etc";
-  version = "20221107";
+  version = "20230316";

  src = fetchzip {
    url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-vucC9MfpCCPyST21n09QDrj3z3MzKdBGo/ONUQvuxxQ=";
+    sha256 = "sha256-5acFYPSwevEw5tZNbQDpui3stWuMdnhaKHqC8lhnsOY=";
  };

  installPhase = ''
--- a/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch
+++ b/pkgs/data/misc/tzdata/0001-Add-exe-extension-for-MS-Windows-binaries.patch
@ -2,7 +2,7 @@ diff --git a/Makefile b/Makefile
 index a9a989e..4da737b 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -579,8 +579,8 @@ install:	all $(DATA) $(REDO) $(MANS)
+@@ -606,8 +606,8 @@ install:	all $(DATA) $(REDO) $(MANS)
 			-t '$(DESTDIR)$(TZDEFAULT)'
 		cp -f $(TABDATA) '$(DESTDIR)$(TZDIR)/.'
 		cp tzselect '$(DESTDIR)$(BINDIR)/.'
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@ -2,16 +2,16 @@

 stdenv.mkDerivation rec {
  pname = "tzdata";
-  version = "2022g";
+  version = "2023c";

  srcs = [
    (fetchurl {
      url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-RJHbgoGulKhNk55Ce92D3DifJnZNJ9mlxS14LBZ2RHg=";
+      hash = "sha256-P1ELXRtK6bs45IWqMCp3azF/s2N722QExK33tsrdllw=";
    })
    (fetchurl {
      url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-lhC7C5ZW/0BMNhpB8yhtpTBktUadhPAMnLIxTIYU2nQ=";
+      hash = "sha256-RtF/K7Ga1zKQ8DogMAYVLg+g17EeW3FGfEqCOBGyFOc=";
    })
  ];

@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
    "AR=${stdenv.cc.targetPrefix}ar"
  ] ++ lib.optionals stdenv.hostPlatform.isWindows [
    "CFLAGS+=-DHAVE_DIRECT_H"
+    "CFLAGS+=-DHAVE_SETENV=0"
    "CFLAGS+=-DHAVE_SYMLINK=0"
    "CFLAGS+=-DRESERVE_STD_EXT_IDS"
  ];
--- a/pkgs/desktops/gnome/apps/ghex/default.nix
+++ b/pkgs/desktops/gnome/apps/ghex/default.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "ghex";
-  version = "43.1";
+  version = "44.0";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/ghex/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "pUuUPv5CAQqcEuTc2ts3e/NslMOAB3i4Uww6g0QJ3Mc=";
+    sha256 = "WKpHz9vtEoCjwTGVHBokWWEpQEoLDTR6Pb//tv9oOXY=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-boxes/default.nix
@ -20,8 +20,6 @@
 , libsoup_3
 , libosinfo
 , systemd
-, tracker
-, tracker-miners
 , vala
 , libcap
 , yajl
@ -38,7 +36,6 @@
 , libarchive
 , acl
 , libgudev
-, libsecret
 , libcap_ng
 , numactl
 , libapparmor
@ -51,11 +48,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-boxes";
-  version = "43.3";
+  version = "44.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "7tu69YDZuC20vmV7k7zuXzioe3hScPxJVcC/OGIs7ZM=";
+    sha256 = "OJcGDWlvf6LZEudywnYdvlNDOrXxnr+kvE6Jc4X6ulM=";
  };

  patches = [
@ -105,7 +102,6 @@ stdenv.mkDerivation rec {
    libhandy
    libosinfo
    librsvg
-    libsecret
    libsoup_3
    libusb1
    libvirt
@ -115,8 +111,6 @@ stdenv.mkDerivation rec {
    spice-gtk
    spice-protocol
    systemd
-    tracker
-    tracker-miners
    vte
    webkitgtk_4_1
    yajl
--- a/pkgs/desktops/gnome/apps/gnome-calendar/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-calendar/default.nix
@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-calendar";
-  version = "43.1";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "r6X8ZuL2kVU8x9UX2yNjz/LWLNG130VeX09xMxOdIfI=";
+    sha256 = "lqzXTL9FZSk0UVzDRHo7iV6TP4YyTKkkNvZ93WPDqAI=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/apps/gnome-characters/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-characters/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -11,7 +10,6 @@
 , gtk4
 , pango
 , wrapGAppsHook4
-, python3
 , desktop-file-utils
 , gobject-introspection
 , gjs
@ -23,27 +21,19 @@

 stdenv.mkDerivation rec {
  pname = "gnome-characters";
-  version = "43.1";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-characters/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sj4V2VCXizY8gaRyYe4aO0fbPGaX7haf8hPuplcqeEE=";
+    sha256 = "BbFcAozBkK75LmCS/YT6jV8kSODpB2RGo1ZvOggf9Qs=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-characters/-/commit/3e28a6ad668e2239b14f2e05bc477ec1bfb210ba.patch";
-      sha256 = "sha256-2N4eewknhOXBABs6BPA5/YuqZMT8dyXW857iamrrtuA=";
-    })
-  ];
-
  nativeBuildInputs = [
    gettext
    gobject-introspection
    meson
    ninja
    pkg-config
-    python3
    desktop-file-utils
    wrapGAppsHook4
  ];
@ -60,11 +50,6 @@ stdenv.mkDerivation rec {
    pango
  ];

-  postPatch = ''
-    chmod +x meson_post_install.py # patchShebangs requires executable file
-    patchShebangs meson_post_install.py
-  '';
-
  dontWrapGApps = true;

  postFixup = ''
--- a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
@ -27,11 +27,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-clocks";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-clocks/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sHQ7cNAIgKo7zcx/fzTIwihiV7XIFzfU+YG8jE9PmB0=";
+    sha256 = "F9epc2XLjxoCOh1491AfM1Mhf6dXfXOv59DKHjtPODg=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/apps/gnome-connections/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-connections/default.nix
@ -7,7 +7,6 @@
 , vala
 , gettext
 , itstool
-, python3
 , appstream-glib
 , desktop-file-utils
 , wrapGAppsHook
@ -23,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-connections";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-hdrYL5PAsvYJ/o7H7N7scGAKVWEq/A4/AndMJaC7MJ8=";
+    hash = "sha256-NMemu/7Jqaz6nC0tukslFDHNcYdPjwVcX/JvJvQkQZk=";
  };

  nativeBuildInputs = [
@ -37,7 +36,6 @@ stdenv.mkDerivation rec {
    vala
    gettext
    itstool
-    python3
    appstream-glib
    desktop-file-utils
    glib # glib-compile-resources
@ -54,11 +52,6 @@ stdenv.mkDerivation rec {
    gtk-frdp
  ];

-  postPatch = ''
-    chmod +x build-aux/meson/postinstall.py
-    patchShebangs build-aux/meson/postinstall.py
-  '';
-
  passthru = {
    updateScript = gnome.updateScript {
      packageName = pname;
--- a/pkgs/desktops/gnome/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , gettext
@ -28,11 +27,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-maps";
-  version = "43.4";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-zlLVW6T2fYlu8tmZczc6iYZql7t0pLQCS23iZzx/8e8=";
+    sha256 = "sha256-YAPrc92f0mm0qRvtm/A+6askDFEk7tq/KL4io/77pZU=";
  };

  doCheck = true;
@ -66,14 +65,6 @@ stdenv.mkDerivation rec {
    libsoup_3
  ];

-  patches = [
-    (fetchpatch {
-      name = "timeTest.patch";
-      url = "https://gitlab.gnome.org/GNOME/gnome-maps/-/commit/bec3d2f26de1b3a8c8b7e603f6d6a46c853426fa.diff";
-      sha256 = "sha256-7/ogIDG0piZOPaCPX4nUA3jHI7RGTd2KMZsp8z0XLcc=";
-    })
-  ];
-
  postPatch = ''
    # The .service file isn't wrapped with the correct environment
    # so misses GIR files when started. By re-pointing from the gjs
--- a/pkgs/desktops/gnome/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-music/default.nix
@ -23,20 +23,20 @@
 , itstool
 , gnome
 , gst_all_1
-, libsoup
+, libsoup_3
 , libadwaita
 , gsettings-desktop-schemas
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "gnome-music";
-  version = "42.1";
+  version = "44.0";

  format = "other";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "x3R/pqhrVrGK1v+VD/kB5Z7n+sEcaLKmcnr4bq7tgnA=";
+    sha256 = "m9GqyVcuYkcgJKaVDYOubyhr4zzZx3fz1E+hbQOPHVE=";
  };

  nativeBuildInputs = [
@ -64,7 +64,7 @@ python3.pkgs.buildPythonApplication rec {
    grilo
    grilo-plugins
    libnotify
-    libsoup
+    libsoup_3
    libadwaita
    gsettings-desktop-schemas
    tracker
--- a/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-text-editor/default.nix
@ -11,6 +11,7 @@
 , wrapGAppsHook4
 , ninja
 , gnome
+, cairo
 , enchant
 , icu
 , itstool
@ -24,11 +25,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-text-editor";
-  version = "43.2";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-text-editor/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-MwRcehI/qife5+ubqabybxsXGMWg52M30Hmg1MkA4UY=";
+    sha256 = "sha256-9nvDeAc0/6gV/MTF2qe1VdJORZ+B6itUjmqFwWEqMco=";
  };

  nativeBuildInputs = [
@ -44,6 +45,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
+    cairo
    enchant
    icu
    glib
--- a/pkgs/desktops/gnome/apps/gnome-weather/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-weather/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-weather";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-weather/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "LxERf3VVK/G7ngHwHPs8L82mo/aQcP/gUZoHYVMrjyY=";
+    sha256 = "aw04rHhQQWmd9iiSbjXbe1/6CG7g1pNMIioZxrmSO68=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix
+++ b/pkgs/desktops/gnome/core/adwaita-icon-theme/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "adwaita-icon-theme";
-  version = "43";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "LjrHfTKmqlVUFV3zfo8KDdVPxaZf1yHojVBflw2jLsY=";
+    sha256 = "SInFYBu/7NJdgLo0IgnQqTbc9pHuVr1uykzeNh8aZkw=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/baobab/default.nix
+++ b/pkgs/desktops/gnome/core/baobab/default.nix
@ -7,7 +7,6 @@
 , meson
 , ninja
 , pkg-config
-, python3
 , gtk4
 , libadwaita
 , glib
@ -19,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "baobab";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "UsaGQRj1aX9aVzaILc2ifbIuciC8SSg43uzGmSRs2yY=";
+    sha256 = "hFtju5Ej10VoyBJsVxu8dCc0g/+SAXmizx7du++hv8A=";
  };

  nativeBuildInputs = [
@ -35,7 +34,6 @@ stdenv.mkDerivation rec {
    meson
    ninja
    pkg-config
-    python3
    vala
    wrapGAppsHook4
    # Prevents “error: Package `libadwaita-1' not found in specified Vala API
@ -52,12 +50,6 @@ stdenv.mkDerivation rec {

  doCheck = true;

-  postPatch = ''
-    # https://gitlab.gnome.org/GNOME/baobab/-/merge_requests/40
-    substituteInPlace build-aux/post-install.py \
-      --replace "gtk-update-icon-cache" "gtk4-update-icon-cache"
-  '';
-
  passthru = {
    updateScript = gnome.updateScript {
      packageName = pname;
--- a/pkgs/desktops/gnome/core/eog/default.nix
+++ b/pkgs/desktops/gnome/core/eog/default.nix
@ -31,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "eog";
-  version = "43.2";
+  version = "44.0";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-nc/c5VhakOK7HPV+N3yx6xLUG9m8ubus31BrwbE1Tvk=";
+    sha256 = "sha256-QdhfqwXEMImNv9hH5I4fW0k13Dy87lRudZqQftpnEFQ=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@ -4,18 +4,16 @@
 , ninja
 , gettext
 , fetchurl
-, fetchpatch
 , pkg-config
-, gtk3
+, gtk4
 , glib
 , icu
-, wrapGAppsHook
+, wrapGAppsHook4
 , gnome
-, libportal-gtk3
+, libportal-gtk4
 , libxml2
-, libxslt
 , itstool
-, webkitgtk_4_1
+, webkitgtk_6_0
 , libsoup_3
 , glib-networking
 , libsecret
@ -23,55 +21,42 @@
 , libarchive
 , p11-kit
 , sqlite
-, gcr
+, gcr_4
 , isocodes
 , desktop-file-utils
 , nettle
 , gdk-pixbuf
 , gst_all_1
 , json-glib
-, libdazzle
-, libhandy
+, libadwaita
 , buildPackages
 , withPantheon ? false
+, pantheon
 }:

 stdenv.mkDerivation rec {
  pname = "epiphany";
-  version = "43.1";
+  version = "44.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "6G6tJ8uZgoFRUGZN478g+vN193uAZbArMRgMZba767Q=";
+    sha256 = "u60o/HJzqGa5teXdVoa9BIQww/C+7UwIJgtNCN2P+Fs=";
  };

-  patches = lib.optionals withPantheon [
-    # Pantheon specific patches for epiphany
-    # https://github.com/elementary/browser
-    #
-    # Patch to unlink nav buttons
-    # https://github.com/elementary/browser/pull/18
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/elementary/browser/cc17559a7ac6effe593712b4f3d0bbefde6e3b62/navigation-buttons.patch";
-      sha256 = "sha256-G1/JUjn/8DyO9sgL/5Kq205KbTOs4EMi4Vf3cJ8FHXU=";
-    })
-  ];
-
  nativeBuildInputs = [
    desktop-file-utils
    gettext
    itstool
-    libxslt
    meson
    ninja
    pkg-config
-    wrapGAppsHook
+    wrapGAppsHook4
    buildPackages.glib
-    buildPackages.gtk3
+    buildPackages.gtk4
  ];

  buildInputs = [
-    gcr
+    gcr_4
    gdk-pixbuf
    glib
    glib-networking
@ -82,13 +67,12 @@ stdenv.mkDerivation rec {
    gst_all_1.gst-plugins-good
    gst_all_1.gst-plugins-ugly
    gst_all_1.gstreamer
-    gtk3
+    gtk4
    icu
    isocodes
    json-glib
-    libdazzle
-    libhandy
-    libportal-gtk3
+    libadwaita
+    libportal-gtk4
    libarchive
    libsecret
    libsoup_3
@ -96,12 +80,16 @@ stdenv.mkDerivation rec {
    nettle
    p11-kit
    sqlite
-    webkitgtk_4_1
+    webkitgtk_6_0
+  ] ++ lib.optionals withPantheon [
+    pantheon.granite7
  ];

  # Tests need an X display
  mesonFlags = [
    "-Dunit_tests=disabled"
+  ] ++ lib.optionals withPantheon [
+    "-Dgranite=enabled"
  ];

  passthru = {
--- a/pkgs/desktops/gnome/core/evince/default.nix
+++ b/pkgs/desktops/gnome/core/evince/default.nix
@ -7,6 +7,7 @@
 , gettext
 , libxml2
 , appstream
+, desktop-file-utils
 , glib
 , gtk3
 , pango
@ -42,17 +43,18 @@

 stdenv.mkDerivation rec {
  pname = "evince";
-  version = "43.1";
+  version = "44.1";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evince/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "bXXKYrc7+7YA9xigmBA9xrgT+QULlZS+kp4ptFidIzU=";
+    sha256 = "Fa/TuxX/s4/sqzTCM1CVCtJwqwOoW5TjM9ndfuanQxQ=";
  };

  nativeBuildInputs = [
    appstream
+    desktop-file-utils
    gettext
    gobject-introspection
    gi-docgen
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@ -31,7 +31,7 @@
 , openldap
 , enableOAuth2 ? stdenv.isLinux
 , webkitgtk_4_1
-, webkitgtk_5_0
+, webkitgtk_6_0
 , libaccounts-glib
 , json-glib
 , glib
@ -50,13 +50,13 @@

 stdenv.mkDerivation rec {
  pname = "evolution-data-server";
-  version = "3.46.4";
+  version = "3.48.0";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "pZslQUXFn6zXx7U4LbeNxfDtH2pum4/n1edZWfk8DMg=";
+    sha256 = "DyX3MzHt9TkJvkD0ErKoaTknAydRdhYwPzIt4VcIPDU=";
  };

  patches = [
@ -111,7 +111,7 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals withGtk4 [
    gtk4
  ] ++ lib.optionals (withGtk4 && enableOAuth2) [
-    webkitgtk_5_0
+    webkitgtk_6_0
  ];

  propagatedBuildInputs = [
--- a/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
+++ b/pkgs/desktops/gnome/core/evolution-data-server/hardcode-gsettings.patch
@ -1,8 +1,8 @@
 diff --git a/src/addressbook/libebook/e-book-client.c b/src/addressbook/libebook/e-book-client.c
-index 7888e69..27215e4 100644
+index bd479d8..bd049b3 100644
 --- a/src/addressbook/libebook/e-book-client.c
 +++ b/src/addressbook/libebook/e-book-client.c
-@@ -1983,7 +1983,18 @@ e_book_client_get_self (ESourceRegistry *registry,
+@@ -1997,7 +1997,18 @@ e_book_client_get_self (ESourceRegistry *registry,
 
 	*out_client = book_client;
 
@ -22,7 +22,7 @@ index 7888e69..27215e4 100644
 	uid = g_settings_get_string (settings, SELF_UID_KEY);
 	g_object_unref (settings);
 
-@@ -2051,7 +2062,18 @@ e_book_client_set_self (EBookClient *client,
+@@ -2065,7 +2076,18 @@ e_book_client_set_self (EBookClient *client,
 	g_return_val_if_fail (
 		e_contact_get_const (contact, E_CONTACT_UID) != NULL, FALSE);
 
@ -42,7 +42,7 @@ index 7888e69..27215e4 100644
 	g_settings_set_string (
 		settings, SELF_UID_KEY,
 		e_contact_get_const (contact, E_CONTACT_UID));
-@@ -2087,8 +2109,18 @@ e_book_client_is_self (EContact *contact)
+@@ -2101,8 +2123,18 @@ e_book_client_is_self (EContact *contact)
 	 * unfortunately the API doesn't allow that.
 	 */
 	g_mutex_lock (&mutex);
@ -64,7 +64,7 @@ index 7888e69..27215e4 100644
 	g_mutex_unlock (&mutex);
 
 diff --git a/src/addressbook/libebook/e-book.c b/src/addressbook/libebook/e-book.c
-index 8dfff6d..fb4434b 100644
+index e85a56b..59d3fe2 100644
 --- a/src/addressbook/libebook/e-book.c
 +++ b/src/addressbook/libebook/e-book.c
@@ -2587,7 +2587,18 @@ e_book_get_self (ESourceRegistry *registry,
@ -128,10 +128,10 @@ index 8dfff6d..fb4434b 100644
 	g_object_unref (settings);
 
 diff --git a/src/addressbook/libedata-book/e-book-meta-backend.c b/src/addressbook/libedata-book/e-book-meta-backend.c
-index d3f130e..bc820e9 100644
+index 127dcd1..5fa62f6 100644
 --- a/src/addressbook/libedata-book/e-book-meta-backend.c
 +++ b/src/addressbook/libedata-book/e-book-meta-backend.c
-@@ -135,7 +135,18 @@ ebmb_is_power_saver_enabled (void)
+@@ -136,7 +136,18 @@ ebmb_is_power_saver_enabled (void)
 	GSettings *settings;
 	gboolean enabled = FALSE;
 
@ -176,10 +176,10 @@ index 42f3457..b4926af 100644
 	cbc->priv->update_alarms_id = 0;
 	cbc->priv->alarm_enabled = FALSE;
 diff --git a/src/calendar/libecal/e-reminder-watcher.c b/src/calendar/libecal/e-reminder-watcher.c
-index 52095a4..184b657 100644
+index 5087de1..5c24b87 100644
 --- a/src/calendar/libecal/e-reminder-watcher.c
 +++ b/src/calendar/libecal/e-reminder-watcher.c
-@@ -2555,7 +2555,19 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
+@@ -2578,7 +2578,19 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
 
 	watcher->priv = e_reminder_watcher_get_instance_private (watcher);
 	watcher->priv->cancellable = g_cancellable_new ();
@ -298,10 +298,10 @@ index e61160c..b6553a4 100644
 		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
 	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index 28755e2..da8c40c 100644
+index 95918a0..a7fc669 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
-@@ -5593,7 +5593,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
+@@ -5591,7 +5591,18 @@ camel_imapx_server_skip_old_flags_update (CamelStore *store)
 	if (!skip_old_flags_update) {
 		GSettings *eds_settings;
 
@ -322,10 +322,10 @@ index 28755e2..da8c40c 100644
 		if (g_settings_get_boolean (eds_settings, "limit-operations-in-power-saver-mode")) {
 			GPowerProfileMonitor *power_monitor;
 diff --git a/src/camel/providers/smtp/camel-smtp-transport.c b/src/camel/providers/smtp/camel-smtp-transport.c
-index f535ad6..918975d 100644
+index effaf06..1b2a003 100644
 --- a/src/camel/providers/smtp/camel-smtp-transport.c
 +++ b/src/camel/providers/smtp/camel-smtp-transport.c
-@@ -1458,7 +1458,18 @@ smtp_helo (CamelSmtpTransport *transport,
+@@ -1462,7 +1462,18 @@ smtp_helo (CamelSmtpTransport *transport,
 		transport->authtypes = NULL;
 	}
 
@ -370,7 +370,7 @@ index 188f276..939f89b 100644
 		settings, "network-monitor-gio-name",
 		object, "gio-name",
 diff --git a/src/libedataserver/e-oauth2-service-google.c b/src/libedataserver/e-oauth2-service-google.c
-index f215388..501222e 100644
+index ec08afe..7b31227 100644
 --- a/src/libedataserver/e-oauth2-service-google.c
 +++ b/src/libedataserver/e-oauth2-service-google.c
@@ -71,7 +71,18 @@ eos_google_read_settings (EOAuth2Service *service,
@ -394,7 +394,7 @@ index f215388..501222e 100644
 		g_object_unref (settings);
 
 diff --git a/src/libedataserver/e-oauth2-service-outlook.c b/src/libedataserver/e-oauth2-service-outlook.c
-index 9cff0d0..4c9a203 100644
+index 7633e93..2328048 100644
 --- a/src/libedataserver/e-oauth2-service-outlook.c
 +++ b/src/libedataserver/e-oauth2-service-outlook.c
@@ -71,7 +71,18 @@ eos_outlook_read_settings (EOAuth2Service *service,
@ -418,7 +418,7 @@ index 9cff0d0..4c9a203 100644
 		g_object_unref (settings);
 
 diff --git a/src/libedataserver/e-oauth2-service-yahoo.c b/src/libedataserver/e-oauth2-service-yahoo.c
-index 8e4ee81..cc94026 100644
+index 3bb1071..199e822 100644
 --- a/src/libedataserver/e-oauth2-service-yahoo.c
 +++ b/src/libedataserver/e-oauth2-service-yahoo.c
@@ -67,7 +67,18 @@ eos_yahoo_read_settings (EOAuth2Service *service,
@ -442,7 +442,7 @@ index 8e4ee81..cc94026 100644
 		g_object_unref (settings);
 
 diff --git a/src/libedataserver/e-oauth2-service.c b/src/libedataserver/e-oauth2-service.c
-index b0c2410..ca915e0 100644
+index 7eca355..795d822 100644
 --- a/src/libedataserver/e-oauth2-service.c
 +++ b/src/libedataserver/e-oauth2-service.c
@@ -94,7 +94,18 @@ eos_default_guess_can_process (EOAuth2Service *service,
--- a/pkgs/desktops/gnome/core/gdm/default.nix
+++ b/pkgs/desktops/gnome/core/gdm/default.nix
@ -4,7 +4,6 @@
 , substituteAll
 , meson
 , ninja
-, python3
 , rsync
 , pkg-config
 , glib
@ -44,13 +43,13 @@ in

 stdenv.mkDerivation rec {
  pname = "gdm";
-  version = "43.0";
+  version = "44.0";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gdm/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "lNcNbtffWfp/3k/QL+0RaFk6itzhD87hE8FI1Ss5IpQ=";
+    sha256 = "ziCwoiHb+M3gBktQH9jzj3ODkVKFfEU1M36wnMUvf2w=";
  };

  mesonFlags = [
@ -71,7 +70,6 @@ stdenv.mkDerivation rec {
    meson
    ninja
    pkg-config
-    python3
    rsync
    gobject-introspection
  ];
@ -126,8 +124,6 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
-    patchShebangs build-aux/meson_post_install.py
-
    # Upstream checks some common paths to find an `X` binary. We already know it.
    echo #!/bin/sh > build-aux/find-x-server.sh
    echo "echo ${lib.getBin xorg.xorgserver}/bin/X" >> build-aux/find-x-server.sh
--- a/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-backgrounds/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-backgrounds";
-  version = "43.1";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-backgrounds/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "jkWcrTinV0aDpV5ed2kOZYxvn+ruycuCA5qyW6K8oF0=";
+    sha256 = "SoOTs4cTXypqQkoaDDrJTgdCtiuCNaCSPJKfUeBL4E4=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/gnome-calculator/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
@ -25,11 +25,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-calculator";
-  version = "43.0.1";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-calculator/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "AsEt7Tz1BT0XU32V7GlYf0uRmJnXcm7O7NtLR/+xyQ8=";
+    sha256 = "FOdjMp+IMJp+FSeA1XNhtUMQDjI5BrNOBlX9wxW3EEM=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
@ -13,6 +13,7 @@
 , libportal-gtk4
 , gnome-desktop
 , gnome-online-accounts
+, qrencode
 , wrapGAppsHook4
 , folks
 , libxml2
@ -26,11 +27,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-contacts";
-  version = "43.1";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Ug3IjJAce4/n4SoBOhQlz+2R8vhAhIWitJ+SxnWZACA=";
+    sha256 = "fdEWO8HwavY4La5AFcQ0Q+4sEpKBKPyZ/USSktDee+0=";
  };

  nativeBuildInputs = [
@ -57,6 +58,7 @@ stdenv.mkDerivation rec {
    libadwaita
    libxml2
    gnome-online-accounts
+    qrencode
  ];

  doCheck = true;
--- a/pkgs/desktops/gnome/core/gnome-control-center/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-control-center/default.nix
@ -64,11 +64,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-control-center";
-  version = "43.4.1";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-AA+XBRroJHJJOSsB+/uiCv7lZiZxlscNVEChisBY2Z4=";
+    sha256 = "sha256-vb+rTPI9BXNAltsfn2+sfu0/y52jK/Sx8m7ToE5avGY=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-disk-utility/default.nix
@ -27,11 +27,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-disk-utility";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-disk-utility/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-evypgFprkttpM91+/OxK+DhsAbvB+HHi2uTe9+GSosU=";
+    sha256 = "sha256-AgMQl4ls2zfYcXpYI/k+NyPU385/3EACyd/LFrfno+8=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-font-viewer/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-font-viewer";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-font-viewer/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "gca/+wbVMyNG4A6uyuwb3P1hfFHf2VvNBY1sdsdt0rk=";
+    sha256 = "oVEd8wsijMLvEXXdnSuTQ46pEuJZE0BLJjzz1Fe7n5c=";
  };

  doCheck = true;
--- a/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-initial-setup/default.nix
@ -27,7 +27,7 @@
 , networkmanager
 , pango
 , polkit
-, webkitgtk_5_0
+, webkitgtk_6_0
 , systemd
 , libadwaita
 , libnma-gtk4
@ -38,11 +38,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-initial-setup";
-  version = "43.2";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "I9eWOlTUlZRQTQ6s2FCWyvtfhvHnSljgQGdbbnmK5pg=";
+    sha256 = "WTz8bcj4KphnG5TANbl9vojvVucIeAsq0dIyTk0Eu/8=";
  };

  patches = [
@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
    networkmanager
    pango
    polkit
-    webkitgtk_5_0
+    webkitgtk_6_0
  ];

  mesonFlags = [
--- a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix
@ -30,11 +30,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-remote-desktop";
-  version = "43.3";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-EdRR0f3kTxgJ6/Ya/0vqX570/cAjWaiWR/bp59RUKaw=";
+    hash = "sha256-9+UIjBj9sIaQrgNL92oa6tWafc0Xsm4ffJl1SAUQoP0=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/gnome-session/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-session/default.nix
@ -31,13 +31,13 @@
 stdenv.mkDerivation rec {
  pname = "gnome-session";
  # Also bump ./ctl.nix when bumping major version.
-  version = "43.0";
+  version = "44.0";

  outputs = [ "out" "sessions" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-session/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "P7mUlQE4XIwUYY548XjZUt+YrYyRCA9MXhVoxzk64fI=";
+    sha256 = "zPgpqWUmE16en5F1JlFdNqUJK9+jFvNzfdjFpSTb8sY=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/43/default.nix
@ -37,17 +37,17 @@
 , python3
 , tzdata
 , nss
-, gcr
+, gcr_4
 , gnome-session-ctl
 }:

 stdenv.mkDerivation rec {
  pname = "gnome-settings-daemon";
-  version = "42.2";
+  version = "43.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-settings-daemon/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "nESXFKqOwSccDbUTffNFgZWUPwXM0KyJNdkzl3cLqwA=";
+    sha256 = "NRO7JPxvgYFmciOmSgZ1NP3M879mMmqUA9OLDw1gE9A=";
  };

  patches = [
@ -61,13 +61,6 @@ stdenv.mkDerivation rec {
      src = ./fix-paths.patch;
      inherit tzdata;
    })
-
-    # Use geocode-glib_2 dependency
-    # https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/merge_requests/300
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/commit/03739474621e579e10b72577960ff94b4001e7ff.patch";
-      sha256 = "W4uD4ChNPZSsmQfmfmmXFA2Sm1RDkV7MqG8DmT4qeCY=";
-    })
  ];

  nativeBuildInputs = [
@ -106,7 +99,7 @@ stdenv.mkDerivation rec {
    systemd
    libgudev
    libwacom
-    gcr
+    gcr_4
  ];

  mesonFlags = [
@ -119,7 +112,7 @@ stdenv.mkDerivation rec {
  env.NIX_CFLAGS_COMPILE = "-DG_DISABLE_CAST_CHECKS";

  postPatch = ''
-    for f in gnome-settings-daemon/codegen.py plugins/power/gsd-power-constants-update.pl meson_post_install.py; do
+    for f in gnome-settings-daemon/codegen.py plugins/power/gsd-power-constants-update.pl; do
      chmod +x $f
      patchShebangs $f
    done
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/43/fix-paths.patch
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/43/fix-paths.patch
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/default.nix
@ -42,11 +42,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-settings-daemon";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-settings-daemon/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "NRO7JPxvgYFmciOmSgZ1NP3M879mMmqUA9OLDw1gE9A=";
+    sha256 = "tBetocE0KozymDfs8t7Jvc23VCNbGhYbZDXD0R8hCZk=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/gnome-settings-daemon/global-backlight-helper.patch
+++ b/pkgs/desktops/gnome/core/gnome-settings-daemon/global-backlight-helper.patch
@ -1,26 +0,0 @@
-diff --git a/plugins/power/gsd-backlight.c b/plugins/power/gsd-backlight.c
-index d7d10fd2..5619d6ad 100644
--- a/plugins/power/gsd-backlight.c
-+++ b/plugins/power/gsd-backlight.c
-@@ -358,7 +358,7 @@ gsd_backlight_run_set_helper (GsdBacklight *backlight, GTask *task)
-                 proc = g_subprocess_new (G_SUBPROCESS_FLAGS_STDOUT_SILENCE,
-                                          &error,
-                                          "pkexec",
-                                         LIBEXECDIR "/gsd-backlight-helper",
-+                                         "/run/current-system/sw/bin/gnome-settings-daemon/gsd-backlight-helper",
-                                          g_udev_device_get_sysfs_path (backlight->udev_device),
-                                          data->value_str, NULL);
-         } else {
-diff --git a/plugins/power/org.gnome.settings-daemon.plugins.power.policy.in.in b/plugins/power/org.gnome.settings-daemon.plugins.power.policy.in.in
-index f16300f8..79d6bd17 100644
--- a/plugins/power/org.gnome.settings-daemon.plugins.power.policy.in.in
-+++ b/plugins/power/org.gnome.settings-daemon.plugins.power.policy.in.in
-@@ -25,7 +25,7 @@
-       <allow_inactive>no</allow_inactive>
-       <allow_active>yes</allow_active>
-     </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">@libexecdir@/gsd-backlight-helper</annotate>
-+    <annotate key="org.freedesktop.policykit.exec.path">/run/current-system/sw/bin/gnome-settings-daemon/gsd-backlight-helper</annotate>
-   </action>
-
- </policyconfig>
--- a/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell-extensions/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extensions";
-  version = "43.1";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "rd4EvZRqExE1V+TDTIkLvpB3UFpqPwdV8XvqHG5KLRc=";
+    sha256 = "jDRecvMaHjf1UGPgsVmXMBsBGU7WmHcv2HrrUMuxAas=";
  };

  patches = [
@ -40,23 +40,23 @@ stdenv.mkDerivation rec {
  ];

  preFixup = ''
-    # The meson build doesn't compile the schemas.
-    # Fixup adapted from export-zips.sh in the source.
+    # Since we do not install the schemas to central location,
+    # let’s link them to where extensions installed
+    # through the extension portal would look for them.
+    # Adapted from export-zips.sh in the source.

    extensiondir=$out/share/gnome-shell/extensions
    schemadir=${glib.makeSchemaPath "$out" "$name"}

-    glib-compile-schemas $schemadir
-
    for f in $extensiondir/*; do
-      name=`basename ''${f%%@*}`
-      uuid=$name@gnome-shell-extensions.gcampax.github.com
+      name=$(basename "''${f%%@*}")
      schema=$schemadir/org.gnome.shell.extensions.$name.gschema.xml
+      schemas_compiled=$schemadir/gschemas.compiled

-      if [ -f $schema ]; then
-        mkdir $f/schemas
-        ln -s $schema $f/schemas;
-        glib-compile-schemas $f/schemas
+      if [[ -f $schema ]]; then
+        mkdir "$f/schemas"
+        ln -s "$schema" "$f/schemas"
+        ln -s "$schemas_compiled" "$f/schemas"
      fi
    done
  '';
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@ -36,7 +36,7 @@
 , gdm
 , upower
 , ibus
-, libnma
+, libnma-gtk4
 , libgnomekbd
 , gnome-desktop
 , gsettings-desktop-schemas
@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gnome-shell";
-  version = "43.3";
+  version = "44.0";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Sf+NBfVfpPHCLwXQOFhSzrQpprY4DBuoRh5ipG1MBx4=";
+    sha256 = "MxCtwd1OIQmY1Z84cbwx9+BJFUKNnO2IwqZrKwXWwAo=";
  };

  patches = [
@ -104,6 +104,14 @@ stdenv.mkDerivation rec {
      url = "https://src.fedoraproject.org/rpms/gnome-shell/raw/9a647c460b651aaec0b8a21f046cc289c1999416/f/0001-gdm-Work-around-failing-fingerprint-auth.patch";
      sha256 = "pFvZli3TilUt6YwdZztpB8Xq7O60XfuWUuPMMVSpqLw=";
    })
+
+    # Logout/reboot/poweroff timeout leaves the session in a broken state
+    # https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6506
+    # Should be part of 44.1
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/5766d4111ac065b37417bedcc1b998ab6bee5514.patch";
+      sha256 = "d9oEzRnVbaFeCaBFhfLnW/Z8FzyQ7J8L7eAQe91133k=";
+    })
  ];

  nativeBuildInputs = [
@ -164,7 +172,7 @@ stdenv.mkDerivation rec {

    # not declared at build time, but typelib is needed at runtime
    libgweather
-    libnma
+    libnma-gtk4

    # for gnome-extension tool
    bash-completion
@ -177,6 +185,7 @@ stdenv.mkDerivation rec {

  mesonFlags = [
    "-Dgtk_doc=true"
+    "-Dtests=false"
  ];

  postPatch = ''
@ -185,6 +194,13 @@ stdenv.mkDerivation rec {
    # We can generate it ourselves.
    rm -f man/gnome-shell.1
    rm data/theme/gnome-shell.css
+
+    # Build fails with -Dgtk_doc=true
+    # https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6486
+    # element include: XInclude error : could not load xxx, and no fallback was found
+    substituteInPlace docs/reference/shell/shell-docs.sgml \
+      --replace '<xi:include href="xml/shell-embedded-window.xml"/>' ' ' \
+      --replace '<xi:include href="xml/shell-gtk-embed.xml"/>' ' '
  '';

  postInstall = ''
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@ -45,11 +45,11 @@ in

 stdenv.mkDerivation rec {
  pname = "gnome-software";
-  version = "43.4";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "6d8GDrq1n0lpfV7yYw7DbeYEVBadwZGvYNNINyCq2z4=";
+    sha256 = "YZcZ+VKeC7Ha0w+tu3gNex2ZlAptsfcd9RvHNzQYMK8=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-system-monitor/default.nix
@ -23,11 +23,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-system-monitor";
-  version = "42.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-system-monitor/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "EyOdIgMiAaIr0pgzxXW2hIFnANLeFooVMCI1d8XAddw=";
+    sha256 = "wrq37dupKCfEyN5EKT5+PITJ5QdvMZhYh/+Jac7EXm4=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/gnome-system-monitor/fix-paths.patch
+++ b/pkgs/desktops/gnome/core/gnome-system-monitor/fix-paths.patch
@ -1,13 +1,12 @@
 diff --git a/src/gsm_pkexec.cpp b/src/gsm_pkexec.cpp
-index 868969ba..51eb93b5 100644
+index 5e1edf2f..717d7bf1 100644
 --- a/src/gsm_pkexec.cpp
 +++ b/src/gsm_pkexec.cpp
-@@ -33,6 +33,7 @@ gboolean gsm_pkexec_create_root_password_dialog(const char *command)
+@@ -36,5 +36,6 @@ gsm_pkexec_create_root_password_dialog (const char *command)
 gboolean
- procman_has_pkexec(void)
+ procman_has_pkexec (void)
 {
-    return g_file_test("/usr/bin/pkexec", G_FILE_TEST_EXISTS);
-+    return g_file_test("/run/wrappers/bin/pkexec", G_FILE_TEST_EXISTS)
-+        || g_file_test("/usr/bin/pkexec", G_FILE_TEST_EXISTS);
+-  return g_file_test ("/usr/bin/pkexec", G_FILE_TEST_EXISTS);
+  return g_file_test ("/run/wrappers/bin/pkexec", G_FILE_TEST_EXISTS)
+      || g_file_test ("/usr/bin/pkexec", G_FILE_TEST_EXISTS);
 }
- 
--- a/pkgs/desktops/gnome/core/gnome-terminal/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-terminal/default.nix
@ -1,14 +1,13 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , meson
 , ninja
 , pkg-config
 , python3
 , libxml2
 , gnome
-, nix-update-script
+, gitUpdater
 , nautilus
 , glib
 , gtk4
@ -30,25 +29,16 @@

 stdenv.mkDerivation rec {
  pname = "gnome-terminal";
-  version = "3.47.0";
+  version = "3.48.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "GNOME";
    repo = "gnome-terminal";
    rev = version;
-    sha256 = "sha256-CriI1DtDBeujaz0HtXCyzoGxnas7NmD6EMQ+gLph3E4=";
+    sha256 = "sha256-Co0RnDprY1eJhXdOzs43nniXzpaFtBpnr13StMDw4+8=";
  };

-  patches = [
-    # Fix Nautilus extension build.
-    # https://gitlab.gnome.org/GNOME/gnome-terminal/-/issues/7916
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-terminal/-/commit/614ea99b16fb09e10341fc6ccf5e115ac3f93caf.patch";
-      sha256 = "K7JHPfXywF3QSjSjyUnNZ11/ed+QXHQ47i135QBMIR8=";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
@ -87,11 +77,14 @@ stdenv.mkDerivation rec {
    patchShebangs \
      data/icons/meson_updateiconcache.py \
      data/meson_desktopfile.py \
+      data/meson_metainfofile.py \
      src/meson_compileschemas.py
  '';

  passthru = {
-    updateScript = nix-update-script { };
+    updateScript = gitUpdater {
+      odd-unstable = true;
+    };

    tests = {
      test = nixosTests.terminal-emulators.gnome-terminal;
--- a/pkgs/desktops/gnome/core/gnome-tour/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-tour/default.nix
@ -11,7 +11,7 @@
 , gdk-pixbuf
 , desktop-file-utils
 , appstream-glib
-, wrapGAppsHook
+, wrapGAppsHook4
 , python3
 , gnome
 , libadwaita
@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-tour";
-  version = "43.0";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-E1HkGWJ/vXx3GTKm7xrYDAvy5oKMSUigYgaJhN2zzIg=";
+    hash = "sha256-Bt52d90cWQ0OozoDLJzPTDfGK8ViFbgjyHnkLuYwwrY=";
  };

  cargoVendorDir = "vendor";
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
    python3
    rustPlatform.cargoSetupHook
    rustc
-    wrapGAppsHook
+    wrapGAppsHook4
  ];

  buildInputs = [
--- a/pkgs/desktops/gnome/core/mutter/42/fix-paths.patch
+++ b/pkgs/desktops/gnome/core/mutter/42/fix-paths.patch
@ -1,13 +0,0 @@
-diff --git a/src/core/util.c b/src/core/util.c
-index 57b73747d..f424cc81c 100644
--- a/src/core/util.c
-+++ b/src/core/util.c
-@@ -636,7 +636,7 @@ meta_show_dialog (const char *type,
- 
-   args = g_ptr_array_new ();
- 
-  append_argument (args, "zenity");
-+  append_argument (args, "@zenity@/bin/zenity");
-   append_argument (args, type);
- 
-   if (display)
--- a/pkgs/desktops/gnome/core/mutter/43/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/43/default.nix
@ -1,18 +1,18 @@
 { fetchurl
-, fetchpatch
-, substituteAll
 , runCommand
 , lib
+, fetchpatch
 , stdenv
 , pkg-config
 , gnome
 , gettext
 , gobject-introspection
 , cairo
+, colord
+, lcms2
 , pango
 , json-glib
 , libstartup_notification
-, zenity
 , libcanberra
 , ninja
 , xvfb-run
@ -38,6 +38,7 @@
 , xorgserver
 , python3
 , wrapGAppsHook
+, gi-docgen
 , sysprof
 , libsysprof-capture
 , desktop-file-utils
@ -47,15 +48,15 @@
 , wayland-protocols
 }:

-let self = stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mutter";
-  version = "42.7";
+  version = "43.4";

-  outputs = [ "out" "dev" "man" ];
+  outputs = [ "out" "dev" "man" "devdoc" ];

  src = fetchurl {
-    url = "mirror://gnome/sources/mutter/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "OwmmsHDRMHwD2EMorIS0+m1jmfk4MEo4wpTxso3yipM=";
+    url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
+    sha256 = "FiU2cxEaLsyW/I0tFfrdobVU0B3CioMEE11J1rqHsUA=";
  };

  patches = [
@ -66,10 +67,13 @@ let self = stdenv.mkDerivation rec {
      sha256 = "/npUE3idMSTVlFptsDpZmGWjZ/d2gqruVlJKq4eF4xU=";
    })

-    (substituteAll {
-      src = ./fix-paths.patch;
-      inherit zenity;
-    })
+    # GLib 2.76 switches from using its own slice allocator to using the system malloc instead.
+    # This makes dragging window between workspace in multitasking view crashes Pantheon's Gala.
+    # Inspiration https://github.com/mate-desktop/mate-desktop/pull/538
+    # Backtrace https://github.com/elementary/gala/issues/1580
+    # Upstream report https://gitlab.gnome.org/GNOME/mutter/-/issues/2495
+    # The patch will not apply on 44.0+, make sure this is fixed when trying to clean this up.
+    ./glib-2-76-gala-crash.patch
  ];

  mesonFlags = [
@ -81,6 +85,7 @@ let self = stdenv.mkDerivation rec {
    # This should be auto detected, but it looks like it manages a false
    # positive.
    "-Dxwayland_initfd=disabled"
+    "-Ddocs=true"
  ];

  propagatedBuildInputs = [
@ -102,6 +107,7 @@ let self = stdenv.mkDerivation rec {
    pkg-config
    python3
    wrapGAppsHook
+    gi-docgen
    xorgserver
  ];

@ -123,6 +129,8 @@ let self = stdenv.mkDerivation rec {
    libxkbcommon
    libxkbfile
    libXdamage
+    colord
+    lcms2
    pango
    pipewire
    sysprof # for D-Bus interfaces
@ -140,16 +148,24 @@ let self = stdenv.mkDerivation rec {
    ${glib.dev}/bin/glib-compile-schemas "$out/share/glib-2.0/schemas"
  '';

+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    # TODO: Move this into a directory devhelp can find.
+    moveToOutput "share/mutter-11/doc" "$devdoc"
+  '';
+
  # Install udev files into our own tree.
  PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";

+  separateDebugInfo = true;
+
  passthru = {
-    libdir = "${self}/lib/mutter-10";
+    libdir = "${finalAttrs.finalPackage}/lib/mutter-11";

    tests = {
      libdirExists = runCommand "mutter-libdir-exists" {} ''
-        if [[ ! -d ${self.libdir} ]]; then
-          echo "passthru.libdir should contain a directory, “${self.libdir}” is not one."
+        if [[ ! -d ${finalAttrs.finalPackage.libdir} ]]; then
+          echo "passthru.libdir should contain a directory, “${finalAttrs.finalPackage.libdir}” is not one."
          exit 1
        fi
        touch $out
@ -164,5 +180,4 @@ let self = stdenv.mkDerivation rec {
    maintainers = teams.pantheon.members;
    platforms = platforms.linux;
  };
-};
-in self
+})
--- a/pkgs/desktops/gnome/core/mutter/43/glib-2-76-gala-crash.patch
+++ b/pkgs/desktops/gnome/core/mutter/43/glib-2-76-gala-crash.patch
@ -0,0 +1,25 @@
+diff --git a/clutter/clutter/clutter-actor.c b/clutter/clutter/clutter-actor.c
+index d34c8f59f..8835a6a33 100644
+--- a/clutter/clutter/clutter-actor.c
+++ b/clutter/clutter/clutter-actor.c
+@@ -12304,7 +12304,7 @@ clutter_actor_run_actions (ClutterActor       *self,
+                            ClutterEventPhase   phase)
+ {
+   ClutterActorPrivate *priv;
+-  const GList *actions, *l;
+  const GList *actions, *l, *next;
+   gboolean retval = CLUTTER_EVENT_PROPAGATE;
+ 
+   priv = self->priv;
+@@ -12313,9 +12313,10 @@ clutter_actor_run_actions (ClutterActor       *self,
+ 
+   actions = _clutter_meta_group_peek_metas (priv->actions);
+ 
+-  for (l = actions; l; l = l->next)
+  for (l = actions; l; l = next)
+     {
+       ClutterAction *action = l->data;
+      next = l->next;
+       ClutterEventPhase action_phase;
+ 
+       action_phase = clutter_action_get_phase (action);
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@ -1,7 +1,6 @@
 { fetchurl
 , runCommand
 , lib
-, fetchpatch
 , stdenv
 , pkg-config
 , gnome
@ -16,28 +15,44 @@
 , libcanberra
 , ninja
 , xvfb-run
-, xkeyboard_config
 , libxcvt
-, libxkbfile
+, libICE
+, libX11
+, libXcomposite
+, libXcursor
 , libXdamage
-, libxkbcommon
+, libXext
+, libXfixes
+, libXi
 , libXtst
+, libxkbfile
+, xkeyboard_config
+, libxkbcommon
+, libXrender
+, libxcb
+, libXrandr
+, libXinerama
+, libXau
 , libinput
 , libdrm
 , gsettings-desktop-schemas
 , glib
-, gtk3
+, atk
+, gtk4
+, fribidi
+, harfbuzz
 , gnome-desktop
 , pipewire
 , libgudev
 , libwacom
+, libSM
 , xwayland
 , mesa
 , meson
 , gnome-settings-daemon
 , xorgserver
 , python3
-, wrapGAppsHook
+, wrapGAppsHook4
 , gi-docgen
 , sysprof
 , libsysprof-capture
@ -50,34 +65,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mutter";
-  version = "43.3";
+  version = "44.0";

  outputs = [ "out" "dev" "man" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    sha256 = "Z75IINmycMnDxl44lHvwUtLC/xiunnBCHUklnvrACn0=";
+    sha256 = "chSwfhNYnvfB31U8ftEaAnmOQ62mwiiRP056Zm7vusQ=";
  };

-  patches = [
-    # Fix build with separate sysprof.
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2572
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/285a5a4d54ca83b136b787ce5ebf1d774f9499d5.patch";
-      sha256 = "/npUE3idMSTVlFptsDpZmGWjZ/d2gqruVlJKq4eF4xU=";
-    })
-
-    # Fix focus regression.
-    # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2848
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/mutter/-/commit/12ce58dba4f96f6a948c1d166646d263253e3ee0.patch";
-      sha256 = "CGu11aLFs8VEt8NiIkih+cXZzU82oxY6Ko9QRKOkM98=";
-    })
-  ];
-
  mesonFlags = [
    "-Degl_device=true"
    "-Dinstalled_tests=false" # TODO: enable these
+    "-Dtests=false"
    "-Dwayland_eglstream=true"
    "-Dprofiler=true"
    "-Dxwayland_path=${xwayland}/bin/Xwayland"
@ -90,7 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
  propagatedBuildInputs = [
    # required for pkg-config to detect mutter-clutter
    json-glib
-    libXtst
    libcap_ng
    graphene
  ];
@ -105,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
    xvfb-run
    pkg-config
    python3
-    wrapGAppsHook
+    wrapGAppsHook4
    gi-docgen
    xorgserver
  ];
@ -118,25 +117,44 @@ stdenv.mkDerivation (finalAttrs: {
    gnome-settings-daemon
    gobject-introspection
    gsettings-desktop-schemas
-    gtk3
+    atk
+    fribidi
+    harfbuzz
    libcanberra
    libdrm
    libgudev
    libinput
    libstartup_notification
    libwacom
-    libxkbcommon
-    libxkbfile
-    libXdamage
+    libSM
    colord
    lcms2
    pango
    pipewire
    sysprof # for D-Bus interfaces
    libsysprof-capture
-    xkeyboard_config
    xwayland
    wayland-protocols
+  ] ++ [
+    # X11 client
+    gtk4
+    libICE
+    libX11
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXtst
+    libxkbfile
+    xkeyboard_config
+    libxkbcommon
+    libXrender
+    libxcb
+    libXrandr
+    libXinerama
+    libXau
  ];

  postPatch = ''
@ -150,7 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
  postFixup = ''
    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
    # TODO: Move this into a directory devhelp can find.
-    moveToOutput "share/mutter-11/doc" "$devdoc"
+    moveToOutput "share/mutter-12/doc" "$devdoc"
  '';

  # Install udev files into our own tree.
@ -159,7 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
  separateDebugInfo = true;

  passthru = {
-    libdir = "${finalAttrs.finalPackage}/lib/mutter-11";
+    libdir = "${finalAttrs.finalPackage}/lib/mutter-12";

    tests = {
      libdirExists = runCommand "mutter-libdir-exists" {} ''
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@ -38,13 +38,13 @@

 stdenv.mkDerivation rec {
  pname = "nautilus";
-  version = "43.2";
+  version = "44.0";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "qGqap6RVURsCnOSaHYtGWcPDVbXYHXNgu00N5jev7eA=";
+    sha256 = "V7meu44rnBUS04HlMJYYjAh7M0ENbFLYeie9YO52rH8=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/rygel/default.nix
+++ b/pkgs/desktops/gnome/core/rygel/default.nix
@ -28,14 +28,14 @@

 stdenv.mkDerivation rec {
  pname = "rygel";
-  version = "0.42.1";
+  version = "0.42.2";

  # TODO: split out lib
  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "BfMrbray/j8dg8Vp3QKnRnfN5nyTpb3O6JXiPr+omD0=";
+    sha256 = "FYHjkw9dOv4XSHLJawoc014UJ5VCUffnMs5iZlOBioc=";
  };

  patches = [
--- a/pkgs/desktops/gnome/core/simple-scan/default.nix
+++ b/pkgs/desktops/gnome/core/simple-scan/default.nix
@ -25,11 +25,11 @@

 stdenv.mkDerivation rec {
  pname = "simple-scan";
-  version = "42.5";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-BfXfpOniBu+p1ATJhh3XxEIJF5PnNMQXGXOZFyUOQFA=";
+    sha256 = "sha256-Obhw/Ub0R/dH6uzC3yYEnvdzGFCZ8OE8Z1ZWJk3ZjpU=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/zenity/default.nix
+++ b/pkgs/desktops/gnome/core/zenity/default.nix
@ -6,26 +6,22 @@
 , pkg-config
 , libxml2
 , gnome
-, gtk3
+, gtk4
 , gettext
-, libX11
+, libadwaita
 , itstool
-, wrapGAppsHook
+, wrapGAppsHook4
 }:

 stdenv.mkDerivation rec {
  pname = "zenity";
-  version = "3.44.0";
+  version = "3.91.0";

  src = fetchurl {
    url = "mirror://gnome/sources/zenity/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "wVWCMB7ZC51CzlIdvM+ZqYnyLxIEG91SecZjbamev2U=";
+    sha256 = "N2GeCYAwgXj9vPaDItmaB7MzbBwLuY7ysyycsQkCI5k=";
  };

-  patches = [
-    ./fix-icon-install.patch
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
@ -33,12 +29,12 @@ stdenv.mkDerivation rec {
    gettext
    itstool
    libxml2
-    wrapGAppsHook
+    wrapGAppsHook4
  ];

  buildInputs = [
-    gtk3
-    libX11
+    gtk4
+    libadwaita
  ];

  passthru = {
@ -51,6 +47,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Tool to display dialogs from the commandline and shell scripts";
    homepage = "https://wiki.gnome.org/Projects/Zenity";
+    license = licenses.lgpl21Plus;
    platforms = platforms.unix;
    maintainers = teams.gnome.members;
  };
--- a/pkgs/desktops/gnome/core/zenity/fix-icon-install.patch
+++ b/pkgs/desktops/gnome/core/zenity/fix-icon-install.patch
@ -1,12 +0,0 @@
-diff --git a/data/meson.build b/data/meson.build
-index 339b3cff..aca65efd 100644
--- a/data/meson.build
-+++ b/data/meson.build
-@@ -9,5 +9,6 @@ install_data(
-     'zenity-text.png',
-     'zenity-scale.png',
-     'zenity-entry.png',
-    'zenity-notification.png']
-+    'zenity-notification.png'],
-+  install_dir: zenity_prefix / get_option('datadir') / 'icons/hicolor/48x48/apps',
-   )
--- a/pkgs/desktops/gnome/default.nix
+++ b/pkgs/desktops/gnome/default.nix
@ -75,8 +75,8 @@ lib.makeScope pkgs.newScope (self: with self; {

  gnome-settings-daemon = callPackage ./core/gnome-settings-daemon { };

-  # Using 42 to match Mutter used in Pantheon
-  gnome-settings-daemon42 = callPackage ./core/gnome-settings-daemon/42 { };
+  # Using 43 to match Mutter used in Pantheon
+  gnome-settings-daemon43 = callPackage ./core/gnome-settings-daemon/43 { };

  gnome-software = callPackage ./core/gnome-software { };

@ -97,7 +97,7 @@ lib.makeScope pkgs.newScope (self: with self; {
  mutter = callPackage ./core/mutter { };

  # Needed for elementary's gala, wingpanel and greeter until support for higher versions is provided
-  mutter42 = callPackage ./core/mutter/42 { };
+  mutter43 = callPackage ./core/mutter/43 { };

  nautilus = callPackage ./core/nautilus { };

@ -272,5 +272,7 @@ lib.makeScope pkgs.newScope (self: with self; {
  gnome-devel-docs = throw "The ‘gnome.gnome-devel-docs’ package was removed as it is outdated and no longer relevant."; # added 2022-10-26

  mutter338 = throw "The ‘gnome.mutter338’ package was removed as it is no longer needed by Pantheon."; # added 2023-02-22
+  mutter42 = throw "The ‘gnome.mutter42’ package was removed as it is no longer needed by Pantheon."; # added 2023-03-23
  gnome-settings-daemon338 = throw "The ‘gnome.gnome-settings-daemon338’ package was removed as it is no longer needed by Pantheon."; # added 2023-02-22
+  gnome-settings-daemon42 = throw "The ‘gnome.gnome-settings-daemon42’ package was removed as it is no longer needed by Pantheon."; # added 2023-03-23
 }
--- a/pkgs/desktops/gnome/games/atomix/default.nix
+++ b/pkgs/desktops/gnome/games/atomix/default.nix
@ -1,33 +1,43 @@
-{ lib, stdenv, fetchurl, fetchpatch
-, meson, ninja, pkg-config, wrapGAppsHook, python3
-, gettext, gnome, glib, gtk3, libgnome-games-support, gdk-pixbuf }:
+{ lib
+, stdenv
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook
+, python3
+, gettext
+, gnome
+, glib
+, gtk3
+, libgnome-games-support
+, gdk-pixbuf
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "atomix";
-  version = "3.34.0";
+  version = "44.0";

  src = fetchurl {
-    url = "mirror://gnome/sources/atomix/${lib.versions.majorMinor version}/atomix-${version}.tar.xz";
-    sha256 = "0h909a4mccf160hi0aimyicqhq2b0gk1dmqp7qwf87qghfrw6m00";
+    url = "mirror://gnome/sources/atomix/${lib.versions.major finalAttrs.version}/atomix-${finalAttrs.version}.tar.xz";
+    sha256 = "yISTF2iNh9pzTJBjA1YxBSAH8qh5m2xsyRUmWIC1X7Q=";
  };

-  patches = [
-    # Pull upstream fix for -fno-common toolchains like gcc-10:
-    #  https://gitlab.gnome.org/GNOME/atomix/-/merge_requests/2
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://gitlab.gnome.org/GNOME/atomix/-/commit/be7f44f1945a569494d46c60eaf6e7b39b2bb48b.patch";
-      sha256 = "0nrwl6kb1als9mxd5s0la45z63xwshqlnxqjaax32w8yrl6kz7l8";
-    })
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    wrapGAppsHook
+    python3
  ];

-  nativeBuildInputs = [ meson ninja pkg-config gettext wrapGAppsHook python3 ];
-  buildInputs = [ glib gtk3 gdk-pixbuf libgnome-games-support gnome.adwaita-icon-theme ];
-
-  # When building with clang ceil() is not inlined:
-  # ld: src/libatomix.a.p/canvas_helper.c.o: undefined reference to symbol 'ceil@@GLIBC_2.2.5'
-  #  https://gitlab.gnome.org/GNOME/atomix/-/merge_requests/3
-  NIX_LDFLAGS = "-lm";
+  buildInputs = [
+    glib
+    gtk3
+    gdk-pixbuf
+    libgnome-games-support
+  ];

  postPatch = ''
    chmod +x meson_post_install.py
@ -36,8 +46,8 @@ stdenv.mkDerivation rec {

  passthru = {
    updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "gnome.${pname}";
+      packageName = "atomix";
+      attrPath = "gnome.atomix";
    };
  };

@ -48,4 +58,4 @@ stdenv.mkDerivation rec {
    maintainers = teams.gnome.members;
    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/desktops/gnome/games/gnome-chess/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-chess/default.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-chess";
-  version = "43.1";
+  version = "43.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-chess/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "c08JLZX8YECe6so0J7WkjLm1mdoRmVEZ2FuqmWU+ApI=";
+    sha256 = "NIUI+PbnRRwHNE/6egmpkM8dKIO8z1M0CdvgKSaNSfI=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-sudoku/default.nix
@ -20,11 +20,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-sudoku";
-  version = "43.1";
+  version = "44.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-sudoku/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "we6/QJPzNrSJ+5HHMO2mcdpo7vZeYZehKYqVRseImZ8=";
+    sha256 = "ZRjZIzpG1+E4Bax4dme6RwGUjZ7UGke4h5f826Q7j7o=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/games/hitori/default.nix
+++ b/pkgs/desktops/gnome/games/hitori/default.nix
@ -16,13 +16,13 @@
 , desktop-file-utils
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "hitori";
-  version = "3.38.4";
+  version = "44.0";

  src = fetchurl {
-    url = "mirror://gnome/sources/hitori/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "iZPMkfuSN4jjieA+wqp4dtFcErrZIEz2Wy/6DtOSL30=";
+    url = "mirror://gnome/sources/hitori/${lib.versions.major finalAttrs.version}/hitori-${finalAttrs.version}.tar.xz";
+    sha256 = "QicL1PlSXRgNMVG9ckUzXcXPJIqYTgL2j/kw2nmeWDs=";
  };

  nativeBuildInputs = [
@ -50,8 +50,8 @@ stdenv.mkDerivation rec {

  passthru = {
    updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "gnome.${pname}";
+      packageName = "hitori";
+      attrPath = "gnome.hitori";
    };
  };

@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
    homepage = "https://wiki.gnome.org/Apps/Hitori";
    description = "GTK application to generate and let you play games of Hitori";
    maintainers = teams.gnome.members;
-    license = licenses.gpl2;
+    license = licenses.gpl3Plus;
    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/desktops/gnome/misc/gnome-autoar/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-autoar/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-autoar";
-  version = "0.4.3";
+  version = "0.4.4";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-autoar/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "e98HiVU0lqvdw8ljsM5zY4BcDALAJf7d68qsx4cknog=";
+    sha256 = "wK++MzvPPLFEGh9XTMjsexuBl3eRRdTt7uKJb9rPw8I=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/misc/gnome-panel/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-panel/default.nix
@ -14,7 +14,6 @@
 , gtk3
 , itstool
 , libgweather
-, libsoup
 , libwnck
 , libxml2
 , pkg-config
@ -25,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-panel";
-  version = "3.46.0";
+  version = "3.47.1";

  outputs = [ "out" "dev" "man" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-zsehG3DFJLXo121Nfk2DXuYHq9outC9N92GeYusGrrE=";
+    hash = "sha256-2PbixllmjHffgsPdlboE/O+MQMIo4sImBfmhepFh7IM=";
  };

  patches = [
@ -77,7 +76,6 @@ stdenv.mkDerivation rec {
    gnome-menus
    gtk3
    libgweather
-    libsoup
    libwnck
    polkit
    systemd
--- a/pkgs/desktops/gnome/misc/gpaste/default.nix
+++ b/pkgs/desktops/gnome/misc/gpaste/default.nix
@ -1,8 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, appstream-glib
-, clutter
 , gjs
 , glib
 , gobject-introspection
@ -21,14 +19,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "43.1";
+  version = "44.0";
  pname = "gpaste";

  src = fetchFromGitHub {
    owner = "Keruspe";
    repo = "GPaste";
    rev = "v${version}";
-    sha256 = "sha256-wOxhaYWX76jSur3uh75vDfAedbiLh2ikoMuobCZx3jE=";
+    sha256 = "sha256-mYbyu3IIF6pQz1oEqEWLe7jdR99M3LxiMiRR9x7qFh8=";
  };

  patches = [
@ -47,7 +45,6 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs = [
-    appstream-glib
    gobject-introspection
    meson
    ninja
@ -58,7 +55,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    clutter # required by mutter-clutter
    gjs
    glib
    gtk3
@ -70,7 +66,6 @@ stdenv.mkDerivation rec {
  ];

  mesonFlags = [
-    "-Dgcr3=false" # Build with gcr4
    "-Dcontrol-center-keybindings-dir=${placeholder "out"}/share/gnome-control-center/keybindings"
    "-Ddbus-services-dir=${placeholder "out"}/share/dbus-1/services"
    "-Dsystemd-user-unit-dir=${placeholder "out"}/etc/systemd/user"
--- a/pkgs/desktops/pantheon/default.nix
+++ b/pkgs/desktops/pantheon/default.nix
@ -40,10 +40,10 @@ lib.makeScope pkgs.newScope (self: with self; {

  maintainers = lib.teams.pantheon.members;

-  mutter = pkgs.gnome.mutter42;
+  mutter = pkgs.gnome.mutter43;

-  # Using 42 to match Mutter used in Pantheon
-  gnome-settings-daemon = pkgs.gnome.gnome-settings-daemon42;
+  # Using 43 to match Mutter used in Pantheon
+  gnome-settings-daemon = pkgs.gnome.gnome-settings-daemon43;

  elementary-gsettings-schemas = callPackage ./desktop/elementary-gsettings-schemas { };

--- a/Show more
+++ b/Show more