Merge #292500: staging-next 2024-03-01

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -359,6 +359,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - A new hardening flag, `zerocallusedregs` was made available, corresponding to the gcc/clang option `-fzero-call-used-regs=used-gpr`.
 
+- A new hardening flag, `trivialautovarinit` was made available, corresponding to the gcc/clang option `-ftrivial-auto-var-init=pattern`.
+
 - New options were added to the dnsdist module to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
   The module can generate the DNSCrypt provider key pair, certificates and also performs their rotation automatically with no downtime.
 

pkgs/applications/audio/mpg123/default.nix

@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.4";
+  version = "1.32.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-WplmQzj7L3UbZi9A7iWATQydtrV13LXOdBxtxkIkoIo=";
+    hash = "sha256-r5CM32zbZUS5e8cGp5n3mJTmlGivWIG/RUoOu5Fx7WM=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";

pkgs/applications/editors/ed/sources.nix

@@ -23,10 +23,10 @@ in
 {
   ed = let
     pname = "ed";
-    version = "1.20";
+    version = "1.20.1";
     src = fetchurl {
       url = "mirror://gnu/ed/ed-${version}.tar.lz";
-      hash = "sha256-xgMN7+auFy8Wh5Btc1QFTHWmqRMK8xnU5zxQqRlZxaY=";
+      hash = "sha256-saRjspehQfmHbEsfzQFHf2Rc3tkhaAkOmjXbKvS6u8o=";
     };
   in import ./generic.nix {
     inherit pname version src meta;

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -34,10 +34,10 @@
       elpaBuild {
         pname = "activities";
         ename = "activities";
-        version = "0.4";
+        version = "0.5.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/activities-0.4.tar";
+          url = "https://elpa.gnu.org/packages/activities-0.5.1.tar";
-          sha256 = "0mmb7fslirb40n75m8zfib1999yndysm13lyj0mypn9ciy1mvm6l";
+          sha256 = "0ng9sgajcpal881s3kavkmz0fc38f2h207hpqj62cf14z7bsk0zk";
         };
         packageRequires = [ emacs persist ];
         meta = {
@@ -280,10 +280,10 @@
       elpaBuild {
         pname = "auctex";
         ename = "auctex";
-        version = "13.3.0";
+        version = "14.0.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/auctex-13.3.0.tar";
+          url = "https://elpa.gnu.org/packages/auctex-14.0.3.tar";
-          sha256 = "09yc9242xya2by8z72899li7zc9g23bb8j8m30kbvivynmdfhzkf";
+          sha256 = "1xk29nk3r7ilxk2vag3diacamqvlws7mbjk5a0iivz5y6fy7hmjc";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -415,10 +415,10 @@
       elpaBuild {
         pname = "beframe";
         ename = "beframe";
-        version = "1.0.0";
+        version = "1.0.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/beframe-1.0.0.tar";
+          url = "https://elpa.gnu.org/packages/beframe-1.0.1.tar";
-          sha256 = "0fw0nsdp78x194gkscwfyayq51yfb8r4k0q51ia1rnj43kxmmvr9";
+          sha256 = "0j4ks5i67ck1cid6whvwq564s94xb0q5fchb006wzbniy1inwcna";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -430,10 +430,10 @@
       elpaBuild {
         pname = "bicep-ts-mode";
         ename = "bicep-ts-mode";
-        version = "0.1.1";
+        version = "0.1.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/bicep-ts-mode-0.1.1.tar";
+          url = "https://elpa.gnu.org/packages/bicep-ts-mode-0.1.3.tar";
-          sha256 = "0yxn9vk8hbsx50ljjy2swn38cxw2nkvkyc6hqw3qxj014vaavxvn";
+          sha256 = "1di4pkk682kl46acdq44d1xykzqnvayhd84rwf71rj3q252di5a6";
         };
         packageRequires = [];
         meta = {
@@ -644,10 +644,10 @@
       elpaBuild {
         pname = "calibre";
         ename = "calibre";
-        version = "1.4.0";
+        version = "1.4.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/calibre-1.4.0.tar";
+          url = "https://elpa.gnu.org/packages/calibre-1.4.1.tar";
-          sha256 = "1p3sla0j9v1d42z2amwb3hk2gs80ld50nxm1bfi30vdh563cfz4q";
+          sha256 = "1wjz4d2hrhwcd9ljngygacxm28ddgwndp9krz5cxhjz2dkhs1pgb";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -659,10 +659,10 @@
       elpaBuild {
         pname = "cape";
         ename = "cape";
-        version = "1.2";
+        version = "1.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/cape-1.2.tar";
+          url = "https://elpa.gnu.org/packages/cape-1.3.tar";
-          sha256 = "0f18y40ajrkl5kc2r656lvi5vqkz7cpvyz0h6dwbc4dfhsa3cyfs";
+          sha256 = "1178f6js821zcmsc3zrlclnaf4sswgvzs2qazzi975dkcfqcn3vq";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -922,10 +922,10 @@
       elpaBuild {
         pname = "consult";
         ename = "consult";
-        version = "1.2";
+        version = "1.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/consult-1.2.tar";
+          url = "https://elpa.gnu.org/packages/consult-1.3.tar";
-          sha256 = "1dxnr5a1gj1gwmwagl9sd8bq2g9fw0gmldzz2jfg8dj3dw75rk71";
+          sha256 = "1qyqvc4rp0287lidpzhvi669ygjnqmlw8wq0hc0nks2703p283c8";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -933,6 +933,26 @@
           license = lib.licenses.free;
         };
       }) {};
+    consult-hoogle = callPackage ({ consult
+                                  , elpaBuild
+                                  , emacs
+                                  , fetchurl
+                                  , haskell-mode
+                                  , lib }:
+      elpaBuild {
+        pname = "consult-hoogle";
+        ename = "consult-hoogle";
+        version = "0.1.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/consult-hoogle-0.1.1.tar";
+          sha256 = "1bcl7h5ykcgrsfj27wkv9l9jvbj2bbkh0w9d60663m1bkp0p3y2r";
+        };
+        packageRequires = [ consult emacs haskell-mode ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/consult-hoogle.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     consult-recoll = callPackage ({ consult, elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "consult-recoll";
@@ -1132,10 +1152,10 @@
       elpaBuild {
         pname = "dape";
         ename = "dape";
-        version = "0.5.0";
+        version = "0.7.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/dape-0.5.0.tar";
+          url = "https://elpa.gnu.org/packages/dape-0.7.0.tar";
-          sha256 = "1pgrlgk1wf35afgfcbm256ikixk2r6rbkc05iwsr6x6l9y3h0v3w";
+          sha256 = "0fbafwmrs9dlv875vcg1c9gh0hqs1zpnyqxgkdvbrazww7ffn60g";
         };
         packageRequires = [ emacs jsonrpc ];
         meta = {
@@ -1192,10 +1212,10 @@
       elpaBuild {
         pname = "debbugs";
         ename = "debbugs";
-        version = "0.38";
+        version = "0.40";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/debbugs-0.38.tar";
+          url = "https://elpa.gnu.org/packages/debbugs-0.40.tar";
-          sha256 = "0cl6vcnlyanrl3qzhd31pw9qvij6g88cgifl3mwgw54bbagl9hh6";
+          sha256 = "0yfl9gd23xnfk3iwiq26brd7fg9ikhd201lw4awng0rdh0fddxwd";
         };
         packageRequires = [ emacs soap-client ];
         meta = {
@@ -1633,10 +1653,10 @@
       elpaBuild {
         pname = "eev";
         ename = "eev";
-        version = "20240115";
+        version = "20240205";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/eev-20240115.tar";
+          url = "https://elpa.gnu.org/packages/eev-20240205.tar";
-          sha256 = "0vlw88wjgzgl3wsa7k5p03qvj2yipvjsrjcrv8vjlvnm83pszskh";
+          sha256 = "06psmcf3yi7pincsbhjrcrml0wzwgmlv6xy2fbpg1sg8vlibbgi3";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1648,10 +1668,10 @@
       elpaBuild {
         pname = "ef-themes";
         ename = "ef-themes";
-        version = "1.5.0";
+        version = "1.5.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ef-themes-1.5.0.tar";
+          url = "https://elpa.gnu.org/packages/ef-themes-1.5.1.tar";
-          sha256 = "1jckhizsrlnkfrfal9ym214gb10kyfzws7vvmyxnpxn8pspiby4a";
+          sha256 = "00qh5b7kx0dlms7drnzj95mvgwfzg5h5m9prkbr8qi4ssx939gdw";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1768,10 +1788,10 @@
       elpaBuild {
         pname = "ellama";
         ename = "ellama";
-        version = "0.7.4";
+        version = "0.8.7";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ellama-0.7.4.tar";
+          url = "https://elpa.gnu.org/packages/ellama-0.8.7.tar";
-          sha256 = "0xpavi6kqrimgxyhpqlp1kkgisswkarm35s1b40938i70cyy3157";
+          sha256 = "0qmd7zrh026rjic26bdp9zinb7vkppdm14inwpwaashqxa5brwi5";
         };
         packageRequires = [ dash emacs llm spinner ];
         meta = {
@@ -1992,10 +2012,10 @@
       elpaBuild {
         pname = "excorporate";
         ename = "excorporate";
-        version = "1.1.1";
+        version = "1.1.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/excorporate-1.1.1.tar";
+          url = "https://elpa.gnu.org/packages/excorporate-1.1.2.tar";
-          sha256 = "06ilfkrlx6ca0qfqq3w1w07kdwak556i1wgf1875py2d5xkg4r90";
+          sha256 = "11w53idm7m20jhmwnj9wiqiv6fzydjrgy2s3mp36barlj3xq0l0z";
         };
         packageRequires = [
           cl-lib
@@ -2101,6 +2121,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    filechooser = callPackage ({ compat, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "filechooser";
+        ename = "filechooser";
+        version = "0.1.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/filechooser-0.1.2.tar";
+          sha256 = "0s0mdc851zd2hy8hfpbamiimbh7c788cyz8mxnwzkpmf6jlj6xdw";
+        };
+        packageRequires = [ compat emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/filechooser.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     filladapt = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "filladapt";
@@ -2519,10 +2554,10 @@
       elpaBuild {
         pname = "greader";
         ename = "greader";
-        version = "0.8.2";
+        version = "0.9.7";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/greader-0.8.2.tar";
+          url = "https://elpa.gnu.org/packages/greader-0.9.7.tar";
-          sha256 = "0cfdx4ybvdklsmxd2n10n8c0niw5k2d4cdnmm98ixadvh56bvflr";
+          sha256 = "08q2qfcwyxrnmjbzblgk16xhshhn2314swjs0kr5jrdijdgpfghh";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2691,10 +2726,10 @@
       elpaBuild {
         pname = "hyperbole";
         ename = "hyperbole";
-        version = "8.0.0";
+        version = "9.0.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/hyperbole-8.0.0.tar";
+          url = "https://elpa.gnu.org/packages/hyperbole-9.0.0.tar";
-          sha256 = "171x7jad62xd0n3xgs32dksyhn5abxj1kna0qgm65mm0v73hrv8d";
+          sha256 = "07kpyp3ggf4knakn18niy819l184apx4d9vbcwv57j8zyqgn4c3l";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2706,10 +2741,10 @@
       elpaBuild {
         pname = "ilist";
         ename = "ilist";
-        version = "0.1";
+        version = "0.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ilist-0.1.tar";
+          url = "https://elpa.gnu.org/packages/ilist-0.3.tar";
-          sha256 = "1ihh44276ivgykva805540nkkrqmc61lydv20l99si3amg07q9bh";
+          sha256 = "1gg77fnk2ky5z5153axszs43a9npb1xg56ik23rz45xl9hg7v8as";
         };
         packageRequires = [];
         meta = {
@@ -2921,10 +2956,10 @@
       elpaBuild {
         pname = "jinx";
         ename = "jinx";
-        version = "1.2";
+        version = "1.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/jinx-1.2.tar";
+          url = "https://elpa.gnu.org/packages/jinx-1.3.tar";
-          sha256 = "027r05123bmqwy4h9x8mlxn1m65jv759jqf1rh6gs92bi29slwy8";
+          sha256 = "0xlfw1sw92qf8bwpw9qnjhkz4ax6n7kcl72ypqm3swmj92jbgsg7";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -3121,10 +3156,10 @@
       elpaBuild {
         pname = "lex";
         ename = "lex";
-        version = "1.1";
+        version = "1.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/lex-1.1.tar";
+          url = "https://elpa.gnu.org/packages/lex-1.2.tar";
-          sha256 = "1i6ri3k2b2nginhnmwy67mdpv5p75jkxjfwbf42wymza8fxzwbb7";
+          sha256 = "03g5lm6gyh4k8l4iccdl9z0qinr46fkpqlwdw0gdfj9d0b782mbs";
         };
         packageRequires = [];
         meta = {
@@ -3151,10 +3186,10 @@
       elpaBuild {
         pname = "llm";
         ename = "llm";
-        version = "0.9.0";
+        version = "0.9.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/llm-0.9.0.tar";
+          url = "https://elpa.gnu.org/packages/llm-0.9.1.tar";
-          sha256 = "16sin4l2wgwvzx0a4bjksv2g93ayfcamvjfan6hmflfmc0sd5s7v";
+          sha256 = "0vib0zl41fsacc5d79f1l52j2vxnbqc37471b86cxw9rha0clr8m";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3466,10 +3501,10 @@
       elpaBuild {
         pname = "mmm-mode";
         ename = "mmm-mode";
-        version = "0.5.10";
+        version = "0.5.11";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/mmm-mode-0.5.10.tar";
+          url = "https://elpa.gnu.org/packages/mmm-mode-0.5.11.tar";
-          sha256 = "1ny9gm87qah4qy0iphw2nlhz2pfc87hzzsv58lrxl18gr69qhndi";
+          sha256 = "07pda4bvvcmdwkwh8dnfqgvhkdni2wjgps1094kn1j5c9j254741";
         };
         packageRequires = [ cl-lib emacs ];
         meta = {
@@ -3880,10 +3915,10 @@
       elpaBuild {
         pname = "org";
         ename = "org";
-        version = "9.6.17";
+        version = "9.6.19";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-9.6.17.tar";
+          url = "https://elpa.gnu.org/packages/org-9.6.19.tar";
-          sha256 = "1gnm9hja2p93l0h5dz86035jh37wkngw7kk4bpgbzjlv74wih1jb";
+          sha256 = "0ibgw0i7nsn589k0ynifwdp1f3ia6p8369myhjqgmwy392cwrcxg";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3921,6 +3956,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    org-jami-bot = callPackage ({ elpaBuild, emacs, fetchurl, jami-bot, lib }:
+      elpaBuild {
+        pname = "org-jami-bot";
+        ename = "org-jami-bot";
+        version = "0.0.5";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/org-jami-bot-0.0.5.tar";
+          sha256 = "0nh0sp1l8hn568n6j11nkl42rm6b3gbjwi3lsf6vanr0lzvrl58r";
+        };
+        packageRequires = [ emacs jami-bot ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/org-jami-bot.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     org-modern = callPackage ({ compat, elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "org-modern";
@@ -4071,16 +4121,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    pabbrev = callPackage ({ elpaBuild, fetchurl, lib }:
+    pabbrev = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "pabbrev";
         ename = "pabbrev";
-        version = "4.2.2";
+        version = "4.3.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/pabbrev-4.2.2.tar";
+          url = "https://elpa.gnu.org/packages/pabbrev-4.3.0.tar";
-          sha256 = "0iydz8yz866krxv1qv32k88w4464xpymh0wxgrxv6nvniwvhvd0s";
+          sha256 = "0a54ld80s0r9zrc2kd861p4ii3jzqhxykzcnvi64fhxxg3x2aggx";
         };
-        packageRequires = [];
+        packageRequires = [ emacs ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/pabbrev.html";
           license = lib.licenses.free;
@@ -4120,10 +4170,10 @@
       elpaBuild {
         pname = "parser-generator";
         ename = "parser-generator";
-        version = "0.2.0";
+        version = "0.2.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/parser-generator-0.2.0.tar";
+          url = "https://elpa.gnu.org/packages/parser-generator-0.2.1.tar";
-          sha256 = "1pp11qnm09w69vc1sl2629r0ymd2vhnaqj4d4ly1bbwxrwjl2nsv";
+          sha256 = "17kqkqz3d29pmn8ydw5kxs2fdgwqh0q31f13hdf1bnw009j24rl9";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4195,10 +4245,10 @@
       elpaBuild {
         pname = "phps-mode";
         ename = "phps-mode";
-        version = "0.4.47";
+        version = "0.4.48";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/phps-mode-0.4.47.tar";
+          url = "https://elpa.gnu.org/packages/phps-mode-0.4.48.tar";
-          sha256 = "08zyk00vwi3wrw9shlv1faxcall3xcqlg02hj3yb8cg4071dv922";
+          sha256 = "1nm1j0f77afmwhb5cavk60nn4ifnx5qaycdy0c7qj8w3vdhyn3da";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4521,6 +4571,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    rcirc-sqlite = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "rcirc-sqlite";
+        ename = "rcirc-sqlite";
+        version = "0.1.3";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/rcirc-sqlite-0.1.3.tar";
+          sha256 = "1pwxkw6dzwbg5g3rxilpp6iy3mzxgpn0mw59i3dcx25hdyizqhip";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/rcirc-sqlite.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     realgud = callPackage ({ elpaBuild
                            , emacs
                            , fetchurl
@@ -5500,10 +5565,10 @@
       elpaBuild {
         pname = "tempel";
         ename = "tempel";
-        version = "1.0";
+        version = "1.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tempel-1.0.tar";
+          url = "https://elpa.gnu.org/packages/tempel-1.1.tar";
-          sha256 = "0k9802fby7yh5kz6slkfzpyvfa0fvs3hcfni61l2bic8pfrdxwl7";
+          sha256 = "1780dgyfj569vxzzg8gqky9953fzw8x5kzy2l05vl7my06nyk46i";
         };
         packageRequires = [ compat emacs ];
         meta = {

pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -182,6 +182,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    base32 = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "base32";
+        ename = "base32";
+        version = "1.0";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/base32-1.0.tar";
+          sha256 = "02n227xwg621zh4na5lx8xh5q6zldq0hwwfzc4wkgfg2jb83n4g8";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/base32.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     bash-completion = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "bash-completion";
@@ -400,10 +415,10 @@
       elpaBuild {
         pname = "clojure-ts-mode";
         ename = "clojure-ts-mode";
-        version = "0.2.0";
+        version = "0.2.2";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/clojure-ts-mode-0.2.0.tar";
+          url = "https://elpa.nongnu.org/nongnu/clojure-ts-mode-0.2.2.tar";
-          sha256 = "1jb6n84pk2ybrihh1s472q77pmnn288p4bzvhga0sxxqg88ial2p";
+          sha256 = "19dskc53dx183kcb7p5qx41qsjsy1mqi46zrdfc1znl7rdknhvl7";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -727,10 +742,10 @@
       elpaBuild {
         pname = "elpher";
         ename = "elpher";
-        version = "3.5.0";
+        version = "3.5.1";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/elpher-3.5.0.tar";
+          url = "https://elpa.nongnu.org/nongnu/elpher-3.5.1.tar";
-          sha256 = "10b4s3anbm4afs5i7rkv9qm5f5y9lzyj9dzajb1x654df4l0m4w4";
+          sha256 = "0687npypihavghz9bjs8f6h10awjgjv5fdd11dmh43p1krhrga2w";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -910,10 +925,10 @@
       elpaBuild {
         pname = "evil-matchit";
         ename = "evil-matchit";
-        version = "3.0.2";
+        version = "3.0.4";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/evil-matchit-3.0.2.tar";
+          url = "https://elpa.nongnu.org/nongnu/evil-matchit-3.0.4.tar";
-          sha256 = "02sim8hkclkp7lzj3hybjky75lyvf452wc7hmbkx1rjb3cx9j5m5";
+          sha256 = "1bc14r8cl0sd4ygj5didhzh74alzafc6rjk9fm4zgylkbcxal8nl";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1049,6 +1064,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    flycheck = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "flycheck";
+        ename = "flycheck";
+        version = "34.1";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/flycheck-34.1.tar";
+          sha256 = "1yyvlhv45gvjmv1rja16j12gv2afiaf4r852mcw3l97h6f40h4x9";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/flycheck.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     flymake-guile = callPackage ({ elpaBuild
                                  , emacs
                                  , fetchurl
@@ -1662,10 +1692,10 @@
       elpaBuild {
         pname = "htmlize";
         ename = "htmlize";
-        version = "1.57";
+        version = "1.56";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/htmlize-1.57.tar";
+          url = "https://elpa.nongnu.org/nongnu/htmlize-1.56.tar";
-          sha256 = "1k4maqkcicvpl4yxkx6ha98x36ppcfdp2clcdg4fjx945yamx80s";
+          sha256 = "1xdy6lbqm75qlywbr08sbjfa20mphylswbjihk1iiblyj8gbp0p6";
         };
         packageRequires = [];
         meta = {
@@ -2075,10 +2105,10 @@
       elpaBuild {
         pname = "meow";
         ename = "meow";
-        version = "1.4.4";
+        version = "1.4.5";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/meow-1.4.4.tar";
+          url = "https://elpa.nongnu.org/nongnu/meow-1.4.5.tar";
-          sha256 = "013nmc0jcvwfh6s1l59kld8393ld4sy5icbah9hzd0chj6l72mgh";
+          sha256 = "0r1rmhmwgxl7q2rvjf8byc0ass00k3m87sn6sw9chip5cgd5g6gm";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2652,10 +2682,10 @@
       elpaBuild {
         pname = "racket-mode";
         ename = "racket-mode";
-        version = "1.0.20240130.151349";
+        version = "1.0.20240219.135847";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20240130.151349.tar";
+          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20240219.135847.tar";
-          sha256 = "0hbcnr4x1931c95hpgfdny92vk8m688p8yc0ng41yv1safa0w4pl";
+          sha256 = "06g1ci7kq8fxjh65qwwnh530xvvh6pr9ha52f7xmbjf56iifn1da";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2802,16 +2832,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    scad-mode = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+    scad-mode = callPackage ({ compat, elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "scad-mode";
         ename = "scad-mode";
-        version = "93.2";
+        version = "93.3";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/scad-mode-93.2.tar";
+          url = "https://elpa.nongnu.org/nongnu/scad-mode-93.3.tar";
-          sha256 = "0gp7ghmch5wkbby0avmlgj5kajiccbarjrx1szh9r3f3gi1ahawj";
+          sha256 = "0gh2s0hv8i100xsq656vfxy3586162dv1bz9gcj4aha3kk4ar3vk";
         };
-        packageRequires = [ emacs ];
+        packageRequires = [ compat emacs ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/scad-mode.html";
           license = lib.licenses.free;
@@ -3213,6 +3243,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    totp-auth = callPackage ({ base32, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "totp-auth";
+        ename = "totp-auth";
+        version = "1.0";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/totp-auth-1.0.tar";
+          sha256 = "0j5rr026n57crizrw4q4yi7q6psdw5qzfcby4slkrlz4yg58mpk3";
+        };
+        packageRequires = [ base32 emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/totp-auth.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     treeview = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "treeview";
@@ -3337,10 +3382,10 @@
       elpaBuild {
         pname = "visual-fill-column";
         ename = "visual-fill-column";
-        version = "2.5.1";
+        version = "2.6.0";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/visual-fill-column-2.5.1.tar";
+          url = "https://elpa.nongnu.org/nongnu/visual-fill-column-2.6.0.tar";
-          sha256 = "1q2cimrcr4knh716cdnhs8nspk08w8x7bsbhx69s9hpzgr7mjq58";
+          sha256 = "1gpjby6g9wq8p25q1a35hr56nfb4sbcdrf0bjxidh1diw5g5saw4";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3352,10 +3397,10 @@
       elpaBuild {
         pname = "web-mode";
         ename = "web-mode";
-        version = "17.3.17";
+        version = "17.3.18";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/web-mode-17.3.17.tar";
+          url = "https://elpa.nongnu.org/nongnu/web-mode-17.3.18.tar";
-          sha256 = "0a9qsffj2451ccb2gvimkwa0qp9m2n5m70zb6bzjndqgq18n7rfb";
+          sha256 = "18ylzq12gsayp3cmd8qjdqsnyiymjd95ffqs3xcyva6sl8d41hmy";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3515,10 +3560,10 @@
       elpaBuild {
         pname = "xah-fly-keys";
         ename = "xah-fly-keys";
-        version = "24.20.20240120121202";
+        version = "24.21.20240220095736";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-24.20.20240120121202.tar";
+          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-24.21.20240220095736.tar";
-          sha256 = "0v3qfn3jqq7jcbpxjajj8q51r71lf3pfmw5gddd38022szrw6ca6";
+          sha256 = "04ra1m9mwhz3zh0776gbzfn4kn0yxgbfbh1hq78r2zxggvpjfikv";
         };
         packageRequires = [ emacs ];
         meta = {

pkgs/applications/graphics/ImageMagick/default.nix

@@ -25,6 +25,7 @@
 , libwebpSupport ? !stdenv.hostPlatform.isMinGW, libwebp
 , libheifSupport ? true, libheif
 , potrace
+, coreutils
 , curl
 , ApplicationServices
 , Foundation
@@ -64,6 +65,10 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   configureFlags = [
+    # specify delegates explicitly otherwise `convert` will invoke the build
+    # coreutils for filetypes it doesn't natively support.
+    "MVDelegate=${lib.getExe' coreutils "mv"}"
+    "RMDelegate=${lib.getExe' coreutils "rm"}"
     "--with-frozenpaths"
     (lib.withFeatureAs (arch != null) "gcc-arch" arch)
     (lib.withFeature librsvgSupport "rsvg")

pkgs/applications/graphics/graphicsmagick/default.nix

@@ -1,6 +1,7 @@
 { lib, stdenv, fetchurl, bzip2, freetype, graphviz, ghostscript
 , libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
 , libwebp, quantumdepth ? 8, fixDarwinDylibNames, nukeReferences
+, coreutils
 , runCommand
 , graphicsmagick  # for passthru.tests
 }:
@@ -19,6 +20,9 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
+    # specify delegates explicitly otherwise `gm` will invoke the build
+    # coreutils for filetypes it doesn't natively support.
+    "MVDelegate=${lib.getExe' coreutils "mv"}"
     "--enable-shared"
     "--with-frozenpaths"
     "--with-quantum-depth=${toString quantumdepth}"

pkgs/applications/networking/taler/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, curl, gnunet, jansson, libgcrypt, libmicrohttpd_0_9_74
+{ lib, stdenv, fetchgit, curl, gnunet, jansson, libgcrypt, libmicrohttpd
 , qrencode, libsodium, libtool, libunistring, pkg-config, postgresql
 , autoreconfHook, python39, recutils, wget, jq, gettext, texinfo
 }:
@@ -36,7 +36,7 @@ let
     ];
     buildInputs = [
       libgcrypt
-      libmicrohttpd_0_9_74
+      libmicrohttpd
       jansson
       libsodium
       postgresql

pkgs/applications/terminal-emulators/xterm/default.nix

@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "389";
+  version = "390";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    hash = "sha256-HNV2PZTZNw/tENgE6DGgibKs4OenS29W71oWp2a9574=";
+    hash = "sha256-dRF8PMUXSgnEJe8QbmlATXL17wXgOl2gCq8VeS1vnA8=";
   };
 
   strictDeps = true;

pkgs/applications/version-management/git/default.nix

@@ -29,7 +29,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.43.1";
+  version = "2.43.2";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-IjTze0U/+ORnLCGtQNQcxzk8mo3N/mQL7HrFtTWPMNI=";
+    hash = "sha256-9hLBq8Y1V9UK04SYY/yRCWcBOfyZAeV0Rg7HbgURrbk=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";

pkgs/applications/version-management/mercurial/default.nix

@@ -23,11 +23,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.6.2";
+    version = "6.6.3";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-y0lNe+fdwvydMXHIiDCvnAKyHHU+PlET3vrJwDc7S2A=";
+      hash = "sha256-911qSnWCOht9cTpJZ+yi9Zb0ZuWPxrwG1yZCky/X4wc=";
     };
 
     format = "other";
@@ -37,7 +37,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-yOysqMrTWDx/ENcJng8Rm338NI9vpuBGH6Yq8B7+MFg=";
+      sha256 = "sha256-G5tzwoIGOgpVI35rYXDeelnBgTbAiq7BDcXCHQzqSrs=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;

pkgs/applications/video/avidemux/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, cmake, pkg-config
+{ stdenv, lib, fetchurl, fetchpatch, cmake, pkg-config
 , zlib, gettext, libvdpau, libva, libXv, sqlite
 , yasm, freetype, fontconfig, fribidi
 , makeWrapper, libXext, libGLU, qttools, qtbase, wrapQtAppsHook
@@ -37,6 +37,16 @@ stdenv.mkDerivation rec {
     ./bootstrap_logging.patch
   ];
 
+  postPatch = ''
+    cp ${fetchpatch {
+      # Backport fix for binutils-2.41.
+      name = "binutils-2.41.patch";
+      url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/effadce6c756247ea8bae32dc13bb3e6f464f0eb";
+      hash = "sha256-s9PcYbt0mFb2wvgMcFL1J+2OS6Sxyd2wYkGzLr2qd9M=";
+      stripLen = 1;
+    }} avidemux_core/ffmpeg_package/patches/
+  '';
+
   nativeBuildInputs =
     [ yasm cmake pkg-config makeWrapper ]
     ++ lib.optional withQT wrapQtAppsHook;

pkgs/applications/video/kodi/unwrapped.nix

@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, makeWrapper
+{ stdenv, lib, fetchFromGitHub
+, fetchpatch
+, autoconf, automake, libtool, makeWrapper
 , pkg-config, cmake, yasm, python3Packages
 , libxcrypt, libgcrypt, libgpg-error, libunistring
 , boost, avahi, lame
@@ -63,6 +65,14 @@ let
       rev     = "${version}-${rel}-Alpha1";
       sha256  = "sha256-EQHmmWnDw+/udKYq7Nrf00nL7I5XWUtmzdauDryfTII=";
     };
+    patches = [
+      # Backport fix for binutils-2.41.
+      (fetchpatch {
+        name = "binutils-2.41.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/effadce6c756247ea8bae32dc13bb3e6f464f0eb";
+        hash = "sha256-vlBUMJ1bORQHRNpuzc5iXsTWwS/CN5BmGIA8g7H7mJE=";
+      })
+    ];
     preConfigure = ''
       cp ${kodi_src}/tools/depends/target/ffmpeg/{CMakeLists.txt,*.cmake} .
       sed -i 's/ --cpu=''${CPU}//' CMakeLists.txt

pkgs/applications/video/mythtv/default.nix

@@ -28,6 +28,14 @@ mkDerivation rec {
       stripLen = 1;
       hash = "sha256-JfRME00YNNjl6SKs1HBa0wBa/lR/Rt3zbQtWhsC36JM=";
     })
+
+    # Bachport the build against binutils-2.41
+    (fetchpatch {
+      name = "binutils-2.41.patch";
+      url = "https://github.com/MythTV/mythtv/commit/f9f9bba62ee2743c816cb2b9634b6b4397e5e2e3.patch";
+      stripLen = 1;
+      hash = "sha256-IcXgBtfqPZ42inYFe7l8mWvKUV13S/YEQAHcOFaDivI=";
+    })
   ];
 
   setSourceRoot = "sourceRoot=$(echo */mythtv)";

pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh

@@ -7,5 +7,5 @@ for p in "${params[@]}"; do
 done
 
 if $needsTarget; then
-    extraBefore+=(-target @defaultTarget@)
+    extraBefore+=(-target @defaultTarget@ @march@)
 fi

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format trivialautovarinit zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -106,6 +106,10 @@ for flag in "${!hardeningEnableMap[@]}"; do
         hardeningCFlagsBefore+=('-fno-strict-overflow')
       fi
       ;;
+    trivialautovarinit)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling trivialautovarinit >&2; fi
+      hardeningCFlagsBefore+=('-ftrivial-auto-var-init=pattern')
+      ;;
     format)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
       hardeningCFlagsBefore+=('-Wformat' '-Wformat-security' '-Werror=format-security')

pkgs/build-support/cc-wrapper/default.nix

@@ -604,8 +604,11 @@ stdenv.mkDerivation {
     # Always add -march based on cpu in triple. Sometimes there is a
     # discrepency (x86_64 vs. x86-64), so we provide an "arch" arg in
     # that case.
+    #
+    # For clang, this is handled in add-clang-cc-cflags-before.sh
+
     # TODO: aarch64-darwin has mcpu incompatible with gcc
-    + optionalString ((targetPlatform ? gcc.arch) && (isClang || !(stdenv.isDarwin && stdenv.isAarch64)) &&
+    + optionalString ((targetPlatform ? gcc.arch) && !isClang && !(stdenv.isDarwin && stdenv.isAarch64) &&
                       isGccArchSupported targetPlatform.gcc.arch) ''
       echo "-march=${targetPlatform.gcc.arch}" >> $out/nix-support/cc-cflags-before
     ''
@@ -694,6 +697,10 @@ stdenv.mkDerivation {
     ## Needs to go after ^ because the for loop eats \n and makes this file an invalid script
     ##
     + optionalString isClang ''
+      # Escape twice: once for this script, once for the one it gets substituted into.
+      export march=${lib.escapeShellArg
+        (lib.optionalString (targetPlatform ? gcc.arch)
+          (lib.escapeShellArg "-march=${targetPlatform.gcc.arch}"))}
       export defaultTarget=${targetPlatform.config}
       substituteAll ${./add-clang-cc-cflags-before.sh} $out/nix-support/add-local-cc-cflags-before.sh
     ''

pkgs/build-support/rust/rustc-wrapper/default.nix

@@ -6,8 +6,27 @@ runCommand "${rustc-unwrapped.pname}-wrapper-${rustc-unwrapped.version}" {
   inherit (rustc-unwrapped) outputs;
 
   env = {
-    prog = "${rustc-unwrapped}/bin/rustc";
     sysroot = lib.optionalString (sysroot != null) "--sysroot ${sysroot}";
+
+    # Upstream rustc still assumes that musl = static[1].  The fix for
+    # this is to disable crt-static by default for non-static musl
+    # targets.
+    #
+    # Even though Cargo will build build.rs files for the build platform,
+    # cross-compiling _from_ musl appears to work fine, so we only need
+    # to do this when rustc's target platform is dynamically linked musl.
+    #
+    # [1]: https://github.com/rust-lang/compiler-team/issues/422
+    #
+    # WARNING: using defaultArgs is dangerous, as it will apply to all
+    # targets used by this compiler (host and target).  This means
+    # that it can't be used to set arguments that should only be
+    # applied to the target.  It's fine to do this for -crt-static,
+    # because rustc does not support +crt-static host platforms
+    # anyway.
+    defaultArgs = lib.optionalString
+      (with rustc-unwrapped.stdenv.targetPlatform; isMusl && !isStatic)
+      "-C target-feature=-crt-static";
   };
 
   passthru = {
@@ -22,9 +41,12 @@ runCommand "${rustc-unwrapped.pname}-wrapper-${rustc-unwrapped.version}" {
 } ''
   mkdir -p $out/bin
   ln -s ${rustc-unwrapped}/bin/* $out/bin
-  rm $out/bin/rustc
+  rm $out/bin/{rustc,rustdoc}
-  substituteAll ${./rustc-wrapper.sh} $out/bin/rustc
+  prog=${rustc-unwrapped}/bin/rustc extraFlagsVar=NIX_RUSTFLAGS \
-  chmod +x $out/bin/rustc
+      substituteAll ${./rustc-wrapper.sh} $out/bin/rustc
+  prog=${rustc-unwrapped}/bin/rustdoc extraFlagsVar=NIX_RUSTDOCFLAGS \
+      substituteAll ${./rustc-wrapper.sh} $out/bin/rustdoc
+  chmod +x $out/bin/{rustc,rustdoc}
   ${lib.concatMapStrings (output: "ln -s ${rustc-unwrapped.${output}} \$${output}\n")
     (lib.remove "out" rustc-unwrapped.outputs)}
 ''

pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh

@@ -13,8 +13,8 @@ for arg; do
     esac
 done
 
-extraBefore=("${defaultSysroot[@]}")
+extraBefore=(@defaultArgs@ "${defaultSysroot[@]}")
-extraAfter=($NIX_RUSTFLAGS)
+extraAfter=($@extraFlagsVar@)
 
 # Optionally print debug info.
 if (( "${NIX_DEBUG:-0}" >= 1 )); then

pkgs/by-name/bl/bluez/package.nix

@@ -113,7 +113,6 @@ stdenv.mkDerivation (finalAttrs: {
     pythonPath = with python3.pkgs; [
       dbus-python
       pygobject3
-      recursive-pth-loader
     ];
   in
   ''

pkgs/by-name/cm/cmake/package.nix

@@ -29,6 +29,7 @@
 , buildDocs ? !(isMinimalBuild || (uiToolkits == []))
 , darwin
 , libsForQt5
+, gitUpdater
 }:
 
 let
@@ -46,11 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.28.2";
+  version = "3.28.3";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-FGb4ctwcIm83PPj7pCMO0hao8Qi9VLR3tczf2eotEko=";
+    hash = "sha256-crdXDlyFk95qxKtDO3PqsYxfsyiIBGDIbOMmCBQa1cE=";
   };
 
   patches = [
@@ -177,6 +178,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = false; # fails
 
+  passthru.updateScript = gitUpdater {
+    url = "https://gitlab.kitware.com/cmake/cmake.git";
+    rev-prefix = "v";
+    ignoredVersions = "-"; # -rc1 and friends
+  };
+
   meta = {
     homepage = "https://cmake.org/";
     description = "Cross-platform, open-source build system generator";

pkgs/by-name/li/libedit/package.nix

@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchurl
+, ncurses
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libedit";
+  version = "20230828-3.1";
+
+  src = fetchurl {
+    url = "https://thrysoee.dk/editline/libedit-${finalAttrs.version}.tar.gz";
+    hash = "sha256-TugYK25WkpDn0fRPD3jayHFrNfZWt2Uo9pnGnJiBTa0=";
+  };
+
+  outputs = [ "out" "dev" "man" ];
+
+  patches = [
+    ./01-cygwin.patch
+  ];
+
+  propagatedBuildInputs = [
+    ncurses
+  ];
+
+  # GCC automatically include `stdc-predefs.h` while Clang does not do this by
+  # default. While Musl is ISO 10646 compliant, it does not define
+  # __STDC_ISO_10646__.
+  # This definition is in `stdc-predefs.h` -- that's why libedit builds just
+  # fine with GCC and Musl.
+  # There is a DR to fix this issue with Clang which is not merged yet.
+  # https://reviews.llvm.org/D137043
+  env.NIX_CFLAGS_COMPILE =
+    lib.optionalString (stdenv.targetPlatform.isMusl && stdenv.cc.isClang)
+      "-D__STDC_ISO_10646__=201103L";
+
+  postFixup = ''
+    find $out/lib -type f | \
+      grep '\.\(la\|pc\)''$' | \
+      xargs sed -i -e 's,-lncurses[a-z]*,-L${ncurses.out}/lib -lncursesw,g'
+  '';
+
+  meta = {
+    homepage = "http://www.thrysoee.dk/editline/";
+    description = "A port of the NetBSD Editline library (libedit)";
+    longDescription = ''
+       This is an autotool- and libtoolized port of the NetBSD Editline library
+       (libedit). This Berkeley-style licensed command line editor library
+       provides generic line editing, history, and tokenization functions,
+       similar to those found in GNU Readline.
+    '';
+    license = with lib.licenses; [ bsd3 ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/sc/scdoc/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scdoc";
-  version = "1.11.2-unstable-2023-03-08";
+  version = "1.11.3";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "scdoc";
-    rev = "afeda241f3f9b2c27e461f32d9c2a704ab82ef61";
+    rev = finalAttrs.version;
-    hash = "sha256-jIYygjUXP/6o5d9drlZjdr25KjEQx8oy4TaQwQEu8fM=";
+    hash = "sha256-MbLDhLn/JY6OcdOz9/mIPAQRp5TZ6IKuQ/FQ/R3wjGc=";
   };
 
   outputs = [ "out" "man" "dev" ];

pkgs/data/misc/tzdata/default.nix

@@ -46,8 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   doCheck = true;
-  # everything except for check_web, because that needs curl and wants to talk to https://validator.w3.org
+  # everything except for:
-  checkTarget = "check_back check_character_set check_white_space check_links check_name_lengths check_now check_slashed_abbrs check_sorted check_tables check_ziguard check_zishrink check_tzs";
+  # - check_web, because that needs curl and wants to talk to https://validator.w3.org
+  # - check_now, because that depends on the current time
+  checkTarget = "check_back check_character_set check_white_space check_links check_name_lengths check_slashed_abbrs check_sorted check_tables check_ziguard check_zishrink check_tzs";
 
   installFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "zic=${buildPackages.tzdata.bin}/bin/zic"

pkgs/development/compilers/dtc/default.nix

@@ -101,5 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl2Plus; # dtc itself is GPLv2, libfdt is dual GPL/BSD
     maintainers = [ maintainers.dezgeg ];
     platforms = platforms.unix;
+    mainProgram = "dtc";
   };
 })

pkgs/development/compilers/gcc/default.nix

@@ -408,7 +408,7 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
     isGNU = true;
     hardeningUnsupportedFlags = lib.optional is48 "stackprotector"
       ++ lib.optional (!atLeast11) "zerocallusedregs"
-      ++ lib.optional (!atLeast12) "fortify3"
+      ++ lib.optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
       ++ lib.optionals (langFortran) [ "fortify" "format" ];
   };
 

pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch

@@ -1,4 +1,4 @@
-From b10785c1be469319a09b10bc69db21159b0599ee Mon Sep 17 00:00:00 2001
+From 30908556fece379ffd7c0da96c774d8bd297e459 Mon Sep 17 00:00:00 2001
 From: Sergei Trofimovich <siarheit@google.com>
 Date: Fri, 22 Sep 2023 22:41:49 +0100
 Subject: [PATCH] gcc/file-prefix-map.cc: always mangle __FILE__ into invalid
@@ -14,9 +14,8 @@ Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
 
 For this reason we want to remove the occurrences of hashes in the
 expansion of `__FILE__`. `nuke-references` does it by replacing hashes
-by `eeeeee...` but those paths are also used for debug symbols. It is
+by `eeeeee...`. It is handy to be able to invert the transformation to
-handy to be able to invert the transformation to go back to the original
+go back to the original store path. The chosen solution is to make the
-store path for debuginfod servers. The chosen solution is to make the
 hash uppercase:
 - it does not trigger runtime references (except for all digit hashes,
   which are unlikely enough)
@@ -42,25 +41,27 @@ Tested as:
     ...
 
 Mangled successfully.
+
+To reverse the effect of the mangle use new `NIX_GCC_DONT_MANGLE_PREFIX_MAP`
+environment variable. It should not normally be needed.
 --- a/gcc/file-prefix-map.cc
 +++ b/gcc/file-prefix-map.cc
-@@ -60,6 +60,9 @@ add_prefix_map (file_prefix_map *&maps, const char *arg, const char *opt)
+@@ -65,7 +65,7 @@ add_prefix_map (file_prefix_map *&maps, const char *arg, const char *opt)
-   maps = map;
- }
- 
-+/* Forward declaration for a $NIX_STORE remap hack below. */
-+static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
-+
- /* Perform user-specified mapping of filename prefixes.  Return the
-    GC-allocated new name corresponding to FILENAME or FILENAME if no
     remapping was performed.  */
-@@ -76,7 +79,31 @@ remap_filename (file_prefix_map *maps, const char *filename)
+ 
+ static const char *
+-remap_filename (file_prefix_map *maps, const char *filename)
++remap_filename (file_prefix_map *maps, const char *filename, bool mangle_nix_store = false)
+ {
+   file_prefix_map *map;
+   char *s;
+@@ -76,7 +76,31 @@ remap_filename (file_prefix_map *maps, const char *filename)
      if (filename_ncmp (filename, map->old_prefix, map->old_len) == 0)
        break;
    if (!map)
 -    return filename;
 +    {
-+      if (maps == macro_prefix_maps)
++      if (mangle_nix_store && getenv("NIX_GCC_DONT_MANGLE_PREFIX_MAP") == NULL)
 +	{
 +	  /* Remap the 32 characters after $NIX_STORE/ to uppercase
 +	  *
@@ -76,7 +77,7 @@ Mangled successfully.
 +	    {
 +	       s = (char *) ggc_alloc_atomic (name_len + 1);
 +	       memcpy(s, name, name_len + 1);
-+	       for (int i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
++	       for (size_t i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
 +		 s[i] = TOUPPER(s[i]);
 +	       }
 +	       return s;
@@ -87,11 +88,12 @@ Mangled successfully.
    name = filename + map->old_len;
    name_len = strlen (name) + 1;
  
-@@ -90,7 +117,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -129,7 +153,7 @@ add_profile_prefix_map (const char *arg)
-    ignore it in DW_AT_producer (dwarf2out.cc).  */
+ const char *
- 
+ remap_macro_filename (const char *filename)
- /* Linked lists of file_prefix_map structures.  */
+ {
--static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
+-  return remap_filename (macro_prefix_maps, filename);
- static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
++  return remap_filename (macro_prefix_maps, filename, true);
- static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
+ }
  
+ /* Remap using -fdebug-prefix-map.  Return the GC-allocated new name

pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch

@@ -1,4 +1,4 @@
-From b10785c1be469319a09b10bc69db21159b0599ee Mon Sep 17 00:00:00 2001
+From e160a8cd4a704f4b7724df02b62394f677cc4198 Mon Sep 17 00:00:00 2001
 From: Sergei Trofimovich <siarheit@google.com>
 Date: Fri, 22 Sep 2023 22:41:49 +0100
 Subject: [PATCH] gcc/file-prefix-map.cc: always mangle __FILE__ into invalid
@@ -14,9 +14,8 @@ Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
 
 For this reason we want to remove the occurrences of hashes in the
 expansion of `__FILE__`. `nuke-references` does it by replacing hashes
-by `eeeeee...` but those paths are also used for debug symbols. It is
+by `eeeeee...`. It is handy to be able to invert the transformation to
-handy to be able to invert the transformation to go back to the original
+go back to the original store path. The chosen solution is to make the
-store path for debuginfod servers. The chosen solution is to make the
 hash uppercase:
 - it does not trigger runtime references (except for all digit hashes,
   which are unlikely enough)
@@ -42,23 +41,25 @@ Tested as:
     ...
 
 Mangled successfully.
+
+To reverse the effect of the mangle use new `NIX_GCC_DONT_MANGLE_PREFIX_MAP`
+environment variable. It should not normally be needed.
 --- a/gcc/file-prefix-map.cc
 +++ b/gcc/file-prefix-map.cc
-@@ -69,6 +69,9 @@ add_prefix_map (file_prefix_map *&maps, const char *arg, const char *opt)
+@@ -74,7 +74,7 @@ add_prefix_map (file_prefix_map *&maps, const char *arg, const char *opt)
-   maps = map;
- }
- 
-+/* Forward declaration for a $NIX_STORE remap hack below. */
-+static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
-+
- /* Perform user-specified mapping of filename prefixes.  Return the
-    GC-allocated new name corresponding to FILENAME or FILENAME if no
     remapping was performed.  */
-@@ -102,6 +105,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
+ 
+ static const char *
+-remap_filename (file_prefix_map *maps, const char *filename)
++remap_filename (file_prefix_map *maps, const char *filename, bool mangle_nix_store = false)
+ {
+   file_prefix_map *map;
+   char *s;
+@@ -102,6 +102,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
        break;
    if (!map)
      {
-+      if (maps == macro_prefix_maps)
++      if (mangle_nix_store && getenv("NIX_GCC_DONT_MANGLE_PREFIX_MAP") == NULL)
 +	{
 +	  /* Remap all fo $NIX_STORE/.{32} paths to uppercase
 +	   *
@@ -74,7 +75,7 @@ Mangled successfully.
 +	     {
 +		s = (char *) ggc_alloc_atomic (name_len + 1);
 +		memcpy(s, name, name_len + 1);
-+		for (int i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
++		for (size_t i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
 +		  s[i] = TOUPPER(s[i]);
 +		}
 +		if (realname != filename)
@@ -85,11 +86,12 @@ Mangled successfully.
        if (realname != filename)
  	free (const_cast <char *> (realname));
        return filename;
-@@ -124,7 +151,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -163,7 +187,7 @@ add_profile_prefix_map (const char *arg)
-    ignore it in DW_AT_producer (gen_command_line_string in opts.cc).  */
+ const char *
- 
+ remap_macro_filename (const char *filename)
- /* Linked lists of file_prefix_map structures.  */
+ {
--static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
+-  return remap_filename (macro_prefix_maps, filename);
- static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
++  return remap_filename (macro_prefix_maps, filename, true);
- static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
+ }
  
+ /* Remap using -fdebug-prefix-map.  Return the GC-allocated new name

pkgs/development/compilers/llvm/11/llvm/default.nix

@@ -212,6 +212,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let

pkgs/development/compilers/llvm/12/llvm/default.nix

@@ -202,6 +202,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let

pkgs/development/compilers/llvm/13/llvm/default.nix

@@ -164,6 +164,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let

pkgs/development/compilers/llvm/14/llvm/default.nix

@@ -168,6 +168,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let

pkgs/development/compilers/llvm/15/llvm/default.nix

@@ -300,6 +300,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let

pkgs/development/compilers/llvm/16/default.nix

@@ -149,6 +149,10 @@ in let
       inherit llvm_meta;
     };
 
+    mlir = callPackage ../common/mlir {
+      inherit llvm_meta;
+    };
+
     lldb = callPackage ../common/lldb.nix {
       src = callPackage ({ runCommand }: runCommand "lldb-src-${version}" {} ''
         mkdir -p "$out"

pkgs/development/compilers/llvm/16/llvm/default.nix

@@ -287,6 +287,8 @@ in
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let

pkgs/development/compilers/llvm/9/llvm/default.nix

@@ -203,6 +203,8 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let

pkgs/development/compilers/llvm/git/llvm/default.nix

@@ -290,6 +290,8 @@ stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeBuildType = if debugVersion then "Debug" else "Release";
 
   cmakeFlags = with stdenv; let

pkgs/development/compilers/rust/1_76.nix

@@ -19,8 +19,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.75.0";
+  rustcVersion = "1.76.0";
-  rustcSha256 = "sha256-W3OfRbydNB4tHFcNZdI3VZHiLC0j71uKN3EaA4arwIg=";
+  rustcSha256 = "sha256-nlz/Azp/DSJmgYmCrZDk0+Tvj47hcVd2xuJQc6E2wCE=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
@@ -34,24 +34,24 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.74.1";
+  bootstrapVersion = "1.75.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "b883b98372c91bc6aa9dc6ebb2b4e02e7dacbbc2ac1ebe55923dc37134df70a4";
+    i686-unknown-linux-gnu = "107b8d8825deab338f338b15f047829da6225bb34644790847e96f0957c6678f";
-    x86_64-unknown-linux-gnu = "d206888a2a9d55113940151ba16117ce2456d7de021bab18cfcb06dc48d3157c";
+    x86_64-unknown-linux-gnu = "473978b6f8ff216389f9e89315211c6b683cf95a966196e7914b46e8cf0d74f6";
-    x86_64-unknown-linux-musl = "5af3115a1f16431630f288821bd7f3be8cf7e08a7611b3c3bce3976774aa6cd2";
+    x86_64-unknown-linux-musl = "cc6ef41aa811ab34f946fe2b4338d1107daf08642125fd566386bf45563597de";
-    arm-unknown-linux-gnueabihf = "1dd7d835af4afe9adb7f785046c907090ace66f1c975cfe9e8886847310d8ec9";
+    arm-unknown-linux-gnueabihf = "985454b6c385cb461cc8a39d2d7d55dcf6c50495033fe5d28edcc717729d8ae9";
-    armv7-unknown-linux-gnueabihf = "a5038ae004bf86eed64ef67329f7ba047bb4d188663bfd260320d53a2fed33c4";
+    armv7-unknown-linux-gnueabihf = "bd876a75f72040d96be2fb882770b16b482ac0ab15d7e3ad24e6d25b7c74bcf7";
-    aarch64-unknown-linux-gnu = "0dbdfce647f3c7d9ff00a7aa5d6dbbd7010486f803a9749cff46189f5ecb438c";
+    aarch64-unknown-linux-gnu = "30828cd904fcfb47f1ac43627c7033c903889ea4aca538f53dcafbb3744a9a73";
-    aarch64-unknown-linux-musl = "02674b8e4311780464313c5773d43606fbf6880d5c4512930d59b6d5d369f0de";
+    aarch64-unknown-linux-musl = "26b5989525b7cf623f3868a37549736e0efe1142a08f191a97e29758cc640ac4";
-    x86_64-apple-darwin = "54e1ef01d73f6031fbee36bbecd9af4209eb682dea478696e8282ca64d5792e5";
+    x86_64-apple-darwin = "ad066e4dec7ae5948c4e7afe68e250c336a5ab3d655570bb119b3eba9cf22851";
-    aarch64-apple-darwin = "af6a982cbed85807fb8e5c4ba85b8a76162b58945f4787e0a7dec32e901e8b3b";
+    aarch64-apple-darwin = "878ecf81e059507dd2ab256f59629a4fb00171035d2a2f5638cb582d999373b1";
-    powerpc64le-unknown-linux-gnu = "bb1c9f0ab1016a2817afe8f72c03f8f1787fe44d0f9999669e0c1957a08e6213";
+    powerpc64le-unknown-linux-gnu = "2599cdfea5860b4efbceb7bca69845a96ac1c96aa50cf8261151e82280b397a0";
-    riscv64gc-unknown-linux-gnu = "86561a8d630f634fdd7cb5899d40027103c907d9763a32770b7e2fd57dbd8473";
+    riscv64gc-unknown-linux-gnu = "7f7b73d8924d7dd24dcb2ef0da257eb48d9aed658b00fe68e8f1ade0b1ce4511";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_75;
+  selectRustPackage = pkgs: pkgs.rust_1_76;
 
   rustcPatches = [ ];
 }

pkgs/development/compilers/rust/cargo.nix

@@ -24,42 +24,6 @@ rustPlatform.buildRustPackage.override {
     inherit (rustc.unwrapped) tests;
   };
 
-  # Upstream rustc still assumes that musl = static[1].  The fix for
-  # this is to disable crt-static by default for non-static musl
-  # targets.
-  #
-  # For every package apart from Cargo, we can fix this by just
-  # patching rustc to not have crt-static by default.  But Cargo is
-  # built with the upstream bootstrap binary for rustc, which we can't
-  # easily patch.  This means we need to find another way to make sure
-  # crt-static is not used during the build of pkgsMusl.cargo.
-  #
-  # By default, Cargo doesn't apply RUSTFLAGS when building build.rs
-  # if --target is passed, so the only good way to set -crt-static for
-  # build.rs files used in the Cargo build is to use the unstable
-  # -Zhost-config Cargo feature.  This allows us to specify flags that
-  # should be passed to rustc when building for the build platform.
-  # We also need to use -Ztarget-applies-to-host, because using
-  # -Zhost-config requires it.
-  #
-  # When doing this, we also have to specify the linker, or cargo
-  # won't pass a -C linker= argument to rustc.  This will make rustc
-  # try to use its default value of "cc", which won't be available
-  # when cross-compiling.
-  #
-  # [1]: https://github.com/rust-lang/compiler-team/issues/422
-  postPatch = lib.optionalString (with stdenv.buildPlatform; isMusl && !isStatic) ''
-    mkdir -p .cargo
-    cat <<EOF >> .cargo/config
-    [host]
-    rustflags = "-C target-feature=-crt-static"
-    linker = "${pkgsBuildHost.stdenv.cc}/bin/${pkgsBuildHost.stdenv.cc.targetPrefix}cc"
-    [unstable]
-    host-config = true
-    target-applies-to-host = true
-    EOF
-  '';
-
   # changes hash of vendor directory otherwise
   dontUpdateAutotoolsGnuConfigScripts = true;
 

pkgs/development/compilers/rust/rustc.nix

@@ -175,8 +175,7 @@ in stdenv.mkDerivation (finalAttrs: {
 
     python ./x.py --keep-stage=0 --stage=1 install library/std
     mkdir -v $out/bin $doc $man
-    ln -s ${rustc.unwrapped}/bin/rustc $out/bin
+    ln -s ${rustc.unwrapped}/bin/{rustc,rustdoc} $out/bin
-    makeWrapper ${rustc.unwrapped}/bin/rustdoc $out/bin/rustdoc --add-flags "--sysroot $out"
     ln -s ${rustc.unwrapped}/lib/rustlib/{manifest-rust-std-,}${stdenv.hostPlatform.rust.rustcTargetSpec} $out/lib/rustlib/
     echo rust-std-${stdenv.hostPlatform.rust.rustcTargetSpec} >> $out/lib/rustlib/components
     lndir ${rustc.doc} $doc
@@ -197,18 +196,6 @@ in stdenv.mkDerivation (finalAttrs: {
 
     # Useful debugging parameter
     # export VERBOSE=1
-  '' + lib.optionalString (stdenv.targetPlatform.isMusl && !stdenv.targetPlatform.isStatic) ''
-    # Upstream rustc still assumes that musl = static[1].  The fix for
-    # this is to disable crt-static by default for non-static musl
-    # targets.
-    #
-    # Even though Cargo will build build.rs files for the build platform,
-    # cross-compiling _from_ musl appears to work fine, so we only need
-    # to do this when rustc's target platform is dynamically linked musl.
-    #
-    # [1]: https://github.com/rust-lang/compiler-team/issues/422
-    substituteInPlace compiler/rustc_target/src/spec/base/linux_musl.rs \
-        --replace "base.crt_static_default = true" "base.crt_static_default = false"
   '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
     # See https://github.com/jemalloc/jemalloc/issues/1997
     # Using a value of 48 should work on both emulated and native x86_64-darwin.

pkgs/development/interpreters/python/catch_conflicts/catch_conflicts.py

@@ -57,7 +57,8 @@ def find_packages(store_path: Path, site_packages_path: str, parents: List[str])
         with open(propagated_build_inputs, "r") as f:
             build_inputs: List[str] = f.read().strip().split(" ")
             for build_input in build_inputs:
-                find_packages(Path(build_input), site_packages_path, parents + [build_input])
+                if build_input not in parents:
+                    find_packages(Path(build_input), site_packages_path, parents + [build_input])
 
 
 find_packages(out_path, site_packages_path, [f"this derivation: {out_path}"])

pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook-tests.nix

@@ -78,6 +78,15 @@ in {
       ];
     };
 
+  # multi-output derivation with dependency on itself must not crash
+  cyclic-dependencies =
+    generatePythonPackage {
+      pname = "cyclic-dependencies";
+      preFixup = ''
+        propagatedBuildInputs+=("$out")
+      '';
+    };
+
   # Simplest test case that should trigger a conflict
   catches-simple-conflict = let
     # this build must fail due to conflicts

pkgs/development/libraries/abseil-cpp/202401.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abseil-cpp";
-  version = "20240116.0";
+  version = "20240116.1";
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-cpp";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-HtJh2oYGx87bNT6Ll3WLeYPPxH1f9JwVqCXGErykGnE=";
+    hash = "sha256-D4E11bICKr3Z5RRah7QkfXVsXtuUg32FMmKpiOGjZDM=";
   };
 
   cmakeFlags = [

pkgs/development/libraries/avahi/default.nix

@@ -5,7 +5,6 @@
 , pkg-config
 , libdaemon
 , dbus
-, perlPackages
 , libpcap
 , expat
 , gettext
@@ -105,10 +104,7 @@ stdenv.mkDerivation rec {
     expat
     libiconv
     libevent
-  ] ++ (with perlPackages; [
+  ] ++ lib.optionals stdenv.isFreeBSD [
-    perl
-    XMLParser
-  ]) ++ lib.optionals stdenv.isFreeBSD [
     libpcap
   ] ++ lib.optionals gtk3Support [
     gtk3

pkgs/development/libraries/c-ares/default.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "c-ares";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchurl {
     url = "https://c-ares.org/download/${pname}-${version}.tar.gz";
-    hash = "sha256-vtWMTwKwCQgOvabCRnukaXIqxq679El9xEqD2MYZTlA=";
+    hash = "sha256-CnK+ZpWZVcQ+KvL70DQY6Cor1UZGBOyaYhR+N6zrQgs=";
   };
 
   outputs = [ "out" "dev" "man" ];

pkgs/development/libraries/catch2/3.nix

@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
     cmake
   ];
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   cmakeFlags = [
     "-DCATCH_DEVELOPMENT_BUILD=ON"
     "-DCATCH_BUILD_TESTING=${if doCheck then "ON" else "OFF"}"

pkgs/development/libraries/dav1d/default.nix

@@ -26,13 +26,13 @@ assert useVulkan -> withExamples;
 
 stdenv.mkDerivation rec {
   pname = "dav1d";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "videolan";
     repo = pname;
     rev = version;
-    hash = "sha256-c7Dur+0HpteI7KkR9oo3WynoH/FCRaBwZA7bJmPDJp8=";
+    hash = "sha256-NDv4ZlmrbRoecd0qj/sy+camn4uRTrvte4/84L6oUUg=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/ffmpeg/generic.nix

@@ -40,7 +40,7 @@
 , withDav1d ? withHeadlessDeps # AV1 decoder (focused on speed and correctness)
 , withDc1394 ? withFullDeps && !stdenv.isDarwin # IIDC-1394 grabbing (ieee 1394)
 , withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # libdrm support
-, withFdkAac ? withFullDeps && withUnfree # Fraunhofer FDK AAC de/encoder
+, withFdkAac ? withFullDeps && (!withGPL || withUnfree) # Fraunhofer FDK AAC de/encoder
 , withFlite ? withFullDeps # Voice Synthesis
 , withFontconfig ? withHeadlessDeps # Needed for drawtext filter
 , withFreetype ? withHeadlessDeps # Needed for drawtext filter
@@ -63,7 +63,8 @@
 , withOgg ? withHeadlessDeps # Ogg container used by vorbis & theora
 , withOpenal ? withFullDeps # OpenAL 1.1 capture support
 , withOpencl ? withFullDeps
-, withOpencoreAmrnb ? withFullDeps && withVersion3 # AMR-NB de/encoder & AMR-WB decoder
+, withOpencoreAmrnb ? withFullDeps && withVersion3 # AMR-NB de/encoder
+, withOpencoreAmrwb ? withFullDeps && withVersion3 # AMR-WB decoder
 , withOpengl ? false # OpenGL rendering
 , withOpenh264 ? withFullDeps # H.264/AVC encoder
 , withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
@@ -93,7 +94,7 @@
 , withVoAmrwbenc ? withFullDeps && withVersion3 # AMR-WB encoder
 , withVorbis ? withHeadlessDeps # Vorbis de/encoding, native encoder exists
 , withVpx ? withHeadlessDeps && stdenv.buildPlatform == stdenv.hostPlatform # VP8 & VP9 de/encoding
-, withVulkan ? withFullDeps && !stdenv.isDarwin
+, withVulkan ? withSmallDeps && !stdenv.isDarwin
 , withWebp ? withFullDeps # WebP encoder
 , withX264 ? withHeadlessDeps && withGPL # H.264/AVC encoder
 , withX265 ? withHeadlessDeps && withGPL # H.265/HEVC encoder
@@ -362,6 +363,14 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   patches = map (patch: fetchpatch patch) (extraPatches
+    ++ (lib.optional (lib.versionOlder version "6.1")
+      {
+        # Backport fix for binutils-2.41.
+        name = "binutils-2.41.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/effadce6c756247ea8bae32dc13bb3e6f464f0eb";
+        hash = "sha256-vlBUMJ1bORQHRNpuzc5iXsTWwS/CN5BmGIA8g7H7mJE=";
+      }
+    )
     ++ (lib.optional (lib.versionAtLeast finalAttrs.version "6" && lib.versionOlder finalAttrs.version "6.1")
       { # this can be removed post 6.1
         name = "fix_aacps_tablegen";
@@ -468,6 +477,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withBluray "libbluray")
     (enableFeature withBs2b "libbs2b")
     (enableFeature withBzlib "bzlib")
+    (enableFeature withCaca "libcaca")
     (enableFeature withCelt "libcelt")
     (enableFeature withChromaprint "chromaprint")
     (enableFeature withCuda "cuda")
@@ -478,6 +488,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withFdkAac "libfdk-aac")
     (enableFeature withFlite "libflite")
     (enableFeature withFontconfig "fontconfig")
+    (enableFeature withFontconfig "libfontconfig")
     (enableFeature withFreetype "libfreetype")
     (enableFeature withFrei0r "frei0r")
     (enableFeature withFribidi "libfribidi")
@@ -501,6 +512,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withOpenal "openal")
     (enableFeature withOpencl "opencl")
     (enableFeature withOpencoreAmrnb "libopencore-amrnb")
+    (enableFeature withOpencoreAmrwb "libopencore-amrwb")
     (enableFeature withOpengl "opengl")
     (enableFeature withOpenh264 "libopenh264")
     (enableFeature withOpenjpeg "libopenjpeg")
@@ -580,7 +592,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ]
   ++ optionals withCudaLLVM [ clang ];
 
-  buildInputs = optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast finalAttrs.version "6") then nv-codec-headers-12 else nv-codec-headers) ]
+  buildInputs = []
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
   ++ optionals withAribcaption [ libaribcaption ]
@@ -612,10 +624,11 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withModplug [ libmodplug ]
   ++ optionals withMp3lame [ lame ]
   ++ optionals withMysofa [ libmysofa ]
+  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast finalAttrs.version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withOgg [ libogg ]
   ++ optionals withOpenal [ openal ]
   ++ optionals withOpencl [ ocl-icd opencl-headers ]
-  ++ optionals withOpencoreAmrnb [ opencore-amr ]
+  ++ optionals (withOpencoreAmrnb || withOpencoreAmrwb) [ opencore-amr ]
   ++ optionals withOpengl [ libGL libGLU ]
   ++ optionals withOpenh264 [ openh264 ]
   ++ optionals withOpenjpeg [ openjpeg ]
@@ -707,6 +720,10 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = optionalString (stdenv.isLinux && withLib) ''
     addOpenGLRunpath ${placeholder "lib"}/lib/libavcodec.so
     addOpenGLRunpath ${placeholder "lib"}/lib/libavutil.so
+  ''
+  # https://trac.ffmpeg.org/ticket/10809
+  + optionalString (versionAtLeast version "5.0" && withVulkan) ''
+    patchelf $lib/lib/libavcodec.so --add-needed libvulkan.so --add-rpath ${lib.makeLibraryPath [ vulkan-loader ]}
   '';
 
   enableParallelBuilding = true;

pkgs/development/libraries/fmt/default.nix

@@ -67,7 +67,7 @@ in
   };
 
   fmt_10 = generic {
-    version = "10.1.1";
+    version = "10.2.1";
-    sha256 = "sha256-H9+1lEaHM12nzXSmo9m8S6527t+97e6necayyjCPm1A=";
+    sha256 = "sha256-pEltGLAHLZ3xypD/Ur4dWPWJ9BGVXwqQyKcDWVmC3co=";
   };
 }

pkgs/development/libraries/glib/default.nix

@@ -2,6 +2,7 @@
 , lib
 , stdenv
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@@ -63,6 +64,12 @@ stdenv.mkDerivation (finalAttrs: {
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch
   ] ++ [
+    (fetchpatch {
+      name = "GLib-against-PCRE2-10.43.patch";
+      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/cce3ae98a2c1966719daabff5a4ec6cf94a846f6.patch";
+      hash = "sha256-vgKzb5hQmFQGD8zxRrXnuX9Gpg/TeSrzehlOH2vA1xU=";
+    })
+
     ./glib-appinfo-watch.patch
     ./schema-override-variable.patch
 

pkgs/development/libraries/gnutls/default.nix

@@ -106,6 +106,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   buildInputs = [ lzo lzip libtasn1 libidn2 zlib gmp libunistring unbound gettext libiconv ]
     ++ lib.optional (withP11-kit) p11-kit
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers;

pkgs/development/libraries/grpc/default.nix

@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.61.1"; # N.B: if you change this, please update:
+  version = "1.62.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-vrLkiNnsW6IpZNGhs6iZgEhdlV9Qpg8PLMDG2BKY2wo=";
+    hash = "sha256-iqoxgo/oocO9gBq0o5bmZvre/EwRguMrWnmwvyLGLr8=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/gstreamer/core/setup-hook.sh

@@ -1,9 +1,8 @@
 addGstreamer1LibPath () {
     if test -d "$1/lib/gstreamer-1.0"
     then
-        export GST_PLUGIN_SYSTEM_PATH_1_0="${GST_PLUGIN_SYSTEM_PATH_1_0-}${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$1/lib/gstreamer-1.0"
+        addToSearchPath GST_PLUGIN_SYSTEM_PATH_1_0 "$1/lib/gstreamer-1.0"
     fi
 }
 
 addEnvHooks "$hostOffset" addGstreamer1LibPath
-

pkgs/development/libraries/gstreamer/good/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchurl
-, fetchpatch
+, substituteAll
 , meson
 , nasm
 , ninja
@@ -24,9 +24,10 @@
 , gdk-pixbuf
 , aalib
 , libcaca
-, libsoup
+, libsoup_3
 , libpulseaudio
 , libintl
+, libxml2
 , Cocoa
 , lame
 , mpg123
@@ -63,6 +64,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-JpWfz+v/9jfU6gjvQDFrrzG2G7dymCCwaE6ADDoUeLY=";
   };
 
+  patches = [
+    # dlopen libsoup_3 with an absolute path
+    (substituteAll {
+      src = ./souploader.diff;
+      nixLibSoup3Path = "${lib.getLib libsoup_3}/lib";
+    })
+  ];
+
   strictDeps = true;
 
   depsBuildBuild = [ pkg-config ];
@@ -102,8 +111,9 @@ stdenv.mkDerivation rec {
     gdk-pixbuf
     aalib
     libcaca
-    libsoup
+    libsoup_3
     libshout
+    libxml2
     lame
     mpg123
     twolame

pkgs/development/libraries/gstreamer/good/souploader.diff

@@ -0,0 +1,13 @@
+diff --git a/ext/soup/gstsouploader.c b/ext/soup/gstsouploader.c
+index 85048ce303..d7d818cf95 100644
+--- a/ext/soup/gstsouploader.c
++++ b/ext/soup/gstsouploader.c
+@@ -181,7 +181,7 @@ gst_soup_load_library (void)
+       GST_DEBUG ("LibSoup 2 found");
+     } else {
+       GST_DEBUG ("Trying all libsoups");
+-      libsoup_sonames[0] = LIBSOUP_3_SONAME;
++      libsoup_sonames[0] = "@nixLibSoup3Path@/" LIBSOUP_3_SONAME;
+       libsoup_sonames[1] = LIBSOUP_2_SONAME;
+     }
+ 

pkgs/development/libraries/imath/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "imath";
-  version = "3.1.10";
+  version = "3.1.11";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "imath";
     rev = "v${version}";
-    sha256 = "sha256-Of/F2FfSvVnhrafRqAyV/2VZpRtDN5Pg5AnUAgL3wiM=";
+    sha256 = "sha256-Cnl0BTXUzkDvgLSNXJbh5ATczBdbxiwbS4J9L6N8sKI=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch

@@ -1,4 +1,4 @@
-From 1cf6b108882669f1b20c18fb5f2d6dff0fc83296 Mon Sep 17 00:00:00 2001
+From eadfee17e7d3a1c1bb2a0ff8585772b40331ebd7 Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
 Date: Sat, 24 Dec 2022 15:31:51 +0100
 Subject: [PATCH 1/4] libbacktrace: avoid libtool wrapping tests
@@ -21,7 +21,7 @@ https://autotools.info/libtool/wrappers.html
  1 file changed, 23 insertions(+), 5 deletions(-)
 
 diff --git a/Makefile.am b/Makefile.am
-index c53cbae..6eab991 100644
+index 3d67909..06ccf3f 100644
 --- a/Makefile.am
 +++ b/Makefile.am
 @@ -107,6 +107,8 @@ check_DATA =
@@ -90,7 +90,7 @@ index c53cbae..6eab991 100644
  unittest_LDADD = libbacktrace.la
  
  BUILDTESTS += unittest
-@@ -253,7 +263,7 @@ if HAVE_OBJCOPY_DEBUGLINK
+@@ -254,7 +264,7 @@ if HAVE_OBJCOPY_DEBUGLINK
  
  b2test_SOURCES = $(btest_SOURCES)
  b2test_CFLAGS = $(libbacktrace_TEST_CFLAGS)
@@ -99,7 +99,7 @@ index c53cbae..6eab991 100644
  b2test_LDADD = libbacktrace_elf_for_test.la
  
  check_PROGRAMS += b2test
-@@ -263,7 +273,7 @@ if HAVE_DWZ
+@@ -264,7 +274,7 @@ if HAVE_DWZ
  
  b3test_SOURCES = $(btest_SOURCES)
  b3test_CFLAGS = $(libbacktrace_TEST_CFLAGS)
@@ -108,7 +108,7 @@ index c53cbae..6eab991 100644
  b3test_LDADD = libbacktrace_elf_for_test.la
  
  check_PROGRAMS += b3test
-@@ -276,6 +286,7 @@ endif HAVE_ELF
+@@ -278,6 +288,7 @@ endif HAVE_ELF
  
  btest_SOURCES = btest.c testlib.c
  btest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -O
@@ -116,7 +116,7 @@ index c53cbae..6eab991 100644
  btest_LDADD = libbacktrace.la
  
  BUILDTESTS += btest
-@@ -330,6 +341,7 @@ endif HAVE_DWZ
+@@ -332,6 +343,7 @@ endif HAVE_DWZ
  
  stest_SOURCES = stest.c
  stest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
@@ -124,7 +124,7 @@ index c53cbae..6eab991 100644
  stest_LDADD = libbacktrace.la
  
  BUILDTESTS += stest
-@@ -352,6 +364,7 @@ if HAVE_ELF
+@@ -354,6 +366,7 @@ if HAVE_ELF
  
  ztest_SOURCES = ztest.c testlib.c
  ztest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
@@ -132,7 +132,7 @@ index c53cbae..6eab991 100644
  ztest_LDADD = libbacktrace.la
  ztest_alloc_LDADD = libbacktrace_alloc.la
  
-@@ -371,6 +384,7 @@ BUILDTESTS += ztest_alloc
+@@ -373,6 +386,7 @@ BUILDTESTS += ztest_alloc
  
  zstdtest_SOURCES = zstdtest.c testlib.c
  zstdtest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
@@ -140,7 +140,7 @@ index c53cbae..6eab991 100644
  zstdtest_LDADD = libbacktrace.la
  zstdtest_alloc_LDADD = libbacktrace_alloc.la
  
-@@ -392,6 +406,7 @@ endif HAVE_ELF
+@@ -394,6 +408,7 @@ endif HAVE_ELF
  
  edtest_SOURCES = edtest.c edtest2_build.c testlib.c
  edtest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
@@ -148,7 +148,7 @@ index c53cbae..6eab991 100644
  edtest_LDADD = libbacktrace.la
  
  BUILDTESTS += edtest
-@@ -422,6 +437,7 @@ BUILDTESTS += ttest
+@@ -424,6 +439,7 @@ BUILDTESTS += ttest
  
  ttest_SOURCES = ttest.c testlib.c
  ttest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -pthread
@@ -156,7 +156,7 @@ index c53cbae..6eab991 100644
  ttest_LDADD = libbacktrace.la
  
  if USE_DSYMUTIL
-@@ -460,12 +476,12 @@ if HAVE_COMPRESSED_DEBUG
+@@ -472,12 +488,12 @@ if HAVE_COMPRESSED_DEBUG
  
  ctestg_SOURCES = btest.c testlib.c
  ctestg_CFLAGS = $(libbacktrace_TEST_CFLAGS)
@@ -171,7 +171,7 @@ index c53cbae..6eab991 100644
  ctesta_LDADD = libbacktrace.la
  
  BUILDTESTS += ctestg ctesta
-@@ -474,7 +490,7 @@ if HAVE_COMPRESSED_DEBUG_ZSTD
+@@ -486,7 +502,7 @@ if HAVE_COMPRESSED_DEBUG_ZSTD
  
  ctestzstd_SOURCES = btest.c testlib.c
  ctestzstd_CFLAGS = $(libbacktrace_TEST_CFLAGS)
@@ -180,7 +180,7 @@ index c53cbae..6eab991 100644
  ctestzstd_LDADD = libbacktrace.la
  
  BUILDTESTS += ctestzstd
-@@ -521,6 +537,7 @@ endif
+@@ -533,6 +549,7 @@ endif
  
  mtest_SOURCES = mtest.c testlib.c
  mtest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -O
@@ -188,7 +188,7 @@ index c53cbae..6eab991 100644
  mtest_LDADD = libbacktrace.la
  
  BUILDTESTS += mtest
-@@ -553,6 +570,7 @@ if HAVE_ELF
+@@ -565,6 +582,7 @@ if HAVE_ELF
  
  xztest_SOURCES = xztest.c testlib.c
  xztest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
@@ -197,5 +197,5 @@ index c53cbae..6eab991 100644
  
  xztest_alloc_SOURCES = $(xztest_SOURCES)
 -- 
-2.38.1
+2.43.1
 

pkgs/development/libraries/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch

@@ -1,4 +1,4 @@
-From f409ee343fe6cdc059bb411746f27a515aec66a8 Mon Sep 17 00:00:00 2001
+From 2ceaa9bc8a9a0c8a02806a92e19bd21b3fccf3a0 Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
 Date: Sat, 24 Dec 2022 16:46:18 +0100
 Subject: [PATCH 2/4] libbacktrace: Allow configuring debug dir
@@ -14,13 +14,13 @@ the path can be changed. The same flag is supported by gdb:
 
 https://github.com/bminor/binutils-gdb/blob/095f84c7e3cf85cd68c657c46b80be078f336bc9/gdb/configure.ac#L113-L115
 ---
- Makefile.am  | 11 ++++++-----
+ Makefile.am  | 13 +++++++------
  configure.ac |  8 ++++++++
  elf.c        |  4 ++--
- 3 files changed, 16 insertions(+), 7 deletions(-)
+ 3 files changed, 17 insertions(+), 8 deletions(-)
 
 diff --git a/Makefile.am b/Makefile.am
-index 6eab991..da443c1 100644
+index 06ccf3f..6304faa 100644
 --- a/Makefile.am
 +++ b/Makefile.am
 @@ -33,7 +33,8 @@ ACLOCAL_AMFLAGS = -I config
@@ -53,7 +53,7 @@ index 6eab991..da443c1 100644
  	$(SED) "s%$$SEARCH%$$REPLACE%" \
  		$< \
  		> $@.tmp
-@@ -468,7 +469,7 @@ endif HAVE_OBJCOPY_DEBUGLINK
+@@ -474,13 +475,13 @@ endif HAVE_OBJCOPY_DEBUGLINK
  
  %_buildid: %
  	./install-debuginfo-for-buildid.sh \
@@ -62,8 +62,15 @@ index 6eab991..da443c1 100644
  	  $<
  	$(OBJCOPY) --strip-debug $< $@
  
+ %_buildidfull: %
+ 	./install-debuginfo-for-buildid.sh \
+-	  "$(TEST_BUILD_ID_DIR)" \
++	  "$(TEST_DEBUG_DIR)/.build-id" \
+ 	  $<
+ 	$(OBJCOPY) --strip-all $< $@
+ 
 diff --git a/configure.ac b/configure.ac
-index 7f122cb..bb590ab 100644
+index 69304ea..aeb2ee9 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -67,6 +67,14 @@ AM_MAINTAINER_MODE
@@ -82,7 +89,7 @@ index 7f122cb..bb590ab 100644
  # the wrong, non-multilib-adjusted value will be used in multilibs.
  # As a side effect, we have to subst CFLAGS ourselves.
 diff --git a/elf.c b/elf.c
-index e82ecc5..8b1189c 100644
+index 3ef07bb..21fbe4f 100644
 --- a/elf.c
 +++ b/elf.c
 @@ -856,7 +856,7 @@ elf_readlink (struct backtrace_state *state, const char *filename,
@@ -104,5 +111,5 @@ index e82ecc5..8b1189c 100644
    const char * const suffix = ".debug";
    const size_t suffix_len = strlen (suffix);
 -- 
-2.38.1
+2.43.1
 

pkgs/development/libraries/libbacktrace/0003-libbacktrace-Support-multiple-build-id-directories.patch

@@ -1,4 +1,4 @@
-From de122af5382d8017cae63bdee946206c6c6c23ab Mon Sep 17 00:00:00 2001
+From 47c3503938c863d55c835463d8815b5fa4ab8326 Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
 Date: Sat, 24 Dec 2022 20:19:27 +0100
 Subject: [PATCH 3/4] libbacktrace: Support multiple build id directories
@@ -16,7 +16,7 @@ to debug data installed using distribution’s package manager.
  1 file changed, 36 insertions(+), 21 deletions(-)
 
 diff --git a/elf.c b/elf.c
-index 8b1189c..65c647a 100644
+index 21fbe4f..ccffa95 100644
 --- a/elf.c
 +++ b/elf.c
 @@ -865,12 +865,12 @@ elf_readlink (struct backtrace_state *state, const char *filename,
@@ -34,7 +34,7 @@ index 8b1189c..65c647a 100644
    const size_t prefix_len = strlen (prefix);
    const char * const suffix = ".debug";
    const size_t suffix_len = strlen (suffix);
-@@ -6936,27 +6936,42 @@ elf_add (struct backtrace_state *state, const char *filename, int descriptor,
+@@ -6947,27 +6947,42 @@ elf_add (struct backtrace_state *state, const char *filename, int descriptor,
    if (buildid_data != NULL)
      {
        int d;
@@ -53,9 +53,9 @@ index 8b1189c..65c647a 100644
 -	    elf_release_view (state, &debuglink_view, error_callback, data);
 -	  if (debugaltlink_view_valid)
 -	    elf_release_view (state, &debugaltlink_view, error_callback, data);
--	  ret = elf_add (state, "", d, NULL, 0, base_address, error_callback,
+-	  ret = elf_add (state, "", d, NULL, 0, base_address, opd,
--			 data, fileline_fn, found_sym, found_dwarf, NULL, 0,
+-			 error_callback, data, fileline_fn, found_sym,
--			 1, NULL, 0);
+-			 found_dwarf, NULL, 0, 1, NULL, 0);
 -	  if (ret < 0)
 -	    backtrace_close (d, error_callback, data);
 -	  else if (descriptor >= 0)
@@ -81,9 +81,9 @@ index 8b1189c..65c647a 100644
 +              elf_release_view (state, &debuglink_view, error_callback, data);
 +            if (debugaltlink_view_valid)
 +              elf_release_view (state, &debugaltlink_view, error_callback, data);
-+            ret = elf_add (state, "", d, NULL, 0, base_address, error_callback,
++            ret = elf_add (state, "", d, NULL, 0, base_address, opd,
-+                           data, fileline_fn, found_sym, found_dwarf, NULL, 0,
++                           error_callback, data, fileline_fn, found_sym,
-+                           1, NULL, 0);
++                           found_dwarf, NULL, 0, 1, NULL, 0);
 +            if (ret < 0)
 +              backtrace_close (d, error_callback, data);
 +            else if (descriptor >= 0)
@@ -97,5 +97,5 @@ index 8b1189c..65c647a 100644
  
    if (buildid_view_valid)
 -- 
-2.38.1
+2.43.1
 

pkgs/development/libraries/libbacktrace/0004-libbacktrace-Support-NIX_DEBUG_INFO_DIRS-environment.patch

@@ -1,4 +1,4 @@
-From a3b7510e4c9e7201a4301f2a45d8569b06354607 Mon Sep 17 00:00:00 2001
+From 884ef7c843be906d62e4240c2a0e885dcd5a5726 Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
 Date: Sat, 24 Dec 2022 20:30:22 +0100
 Subject: [PATCH 4/4] libbacktrace: Support NIX_DEBUG_INFO_DIRS environment
@@ -13,10 +13,10 @@ Let’s make debug data lookup work on NixOS just like in gdb.
  1 file changed, 9 insertions(+), 2 deletions(-)
 
 diff --git a/elf.c b/elf.c
-index 65c647a..5c8abc0 100644
+index ccffa95..e86950d 100644
 --- a/elf.c
 +++ b/elf.c
-@@ -6935,11 +6935,18 @@ elf_add (struct backtrace_state *state, const char *filename, int descriptor,
+@@ -6946,11 +6946,18 @@ elf_add (struct backtrace_state *state, const char *filename, int descriptor,
  
    if (buildid_data != NULL)
      {
@@ -38,5 +38,5 @@ index 65c647a..5c8abc0 100644
        debug_dir = strtok (debug_directories, ":");
        while (debug_dir != NULL)
 -- 
-2.38.1
+2.43.1
 

pkgs/development/libraries/libbacktrace/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "libbacktrace";
-  version = "unstable-2023-11-30";
+  version = "0-unstable-2024-03-02";
 
   src = fetchFromGitHub {
     owner = "ianlancetaylor";
     repo = "libbacktrace";
-    rev = "14818b7783eeb9a56c3f0fca78cefd3143f8c5f6";
+    rev = "28824f2cc9069e3fdc39d3702acdf753e35c41b4";
-    sha256 = "DQZQsqzeQ/0v87bfqs6sXqS2M5Tunc1OydTWRSB3PCw=";
+    sha256 = "1k1O1GT22hZAWPF8NYP0y4qe+e3pGfzT9Mz2TH+H/v4=";
   };
 
   patches = [

pkgs/development/libraries/libcbor/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , cmocka
 
@@ -14,28 +13,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "PJK";
     repo = "libcbor";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eE11hYPsOKqfoX8fx/oYfOAichhUe4mMpNQNVZ6vAUI=";
+    hash = "sha256-N1xYkZw/6lX/nX/TE6/pVuEFgSyDiUJ50msK42NrKwI=";
   };
 
   outputs = [ "out" "dev" ];
 
-  patches = [
-    # Pull fix pending upstream inclusion to support
-    # `CMAKE_INSTALL_INCLUDEDIR`:
-    #   https://github.com/PJK/libcbor/pull/297
-    (fetchpatch {
-      name = "includedir.patch";
-      url = "https://github.com/PJK/libcbor/commit/d00a63e6d6858a2ed6be9b431b42799ed2c99ad8.patch";
-      hash = "sha256-kBCSbAHOCGOs/4Yu6Vh0jcmzA/jYPkkPXPGPrptRfyk=";
-    })
-  ];
-
   strictDeps = true;
   nativeBuildInputs = [ cmake ];
 

pkgs/development/libraries/libedit/default.nix

@@ -1,43 +0,0 @@
-{ lib, stdenv, fetchurl, ncurses }:
-
-stdenv.mkDerivation rec {
-  pname = "libedit";
-  version = "20230828-3.1";
-
-  src = fetchurl {
-    url = "https://thrysoee.dk/editline/${pname}-${version}.tar.gz";
-    sha256 = "sha256-TugYK25WkpDn0fRPD3jayHFrNfZWt2Uo9pnGnJiBTa0=";
-  };
-
-  outputs = [ "out" "dev" ];
-
-  # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
-  # NROFF = "${groff}/bin/nroff";
-
-  # GCC automatically include `stdc-predefs.h` while Clang does not do
-  # this by default. While Musl is ISO 10646 compliant, doesn't define
-  # __STDC_ISO_10646__. This definition is in `stdc-predefs.h` that's
-  # why libedit builds just fine with GCC and Musl.
-  # There is a DR to fix this issue with Clang which is not merged
-  # yet.
-  # https://reviews.llvm.org/D137043
-  env.NIX_CFLAGS_COMPILE =
-    lib.optionalString (stdenv.targetPlatform.isMusl && stdenv.cc.isClang)
-      "-D__STDC_ISO_10646__=201103L";
-
-  patches = [ ./01-cygwin.patch ];
-
-  propagatedBuildInputs = [ ncurses ];
-
-  postInstall = ''
-    find $out/lib -type f | grep '\.\(la\|pc\)''$' | xargs sed -i \
-      -e 's,-lncurses[a-z]*,-L${ncurses.out}/lib -lncursesw,g'
-  '';
-
-  meta = with lib; {
-    homepage = "http://www.thrysoee.dk/editline/";
-    description = "A port of the NetBSD Editline library (libedit)";
-    license = licenses.bsd3;
-    platforms = platforms.all;
-  };
-}

pkgs/development/libraries/libffi/default.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.4.4";
+  version = "3.4.6";
 
   src = fetchurl {
     url = with finalAttrs; "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-1mxWrSWags8qnfxAizK/XaUjcVALhHRff7i2RXEt9nY=";
+    hash = "sha256-sN6p3yPIY6elDoJUQPPr/6vWXfFJcQjl1Dd0eEOJWk4=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -23,9 +23,6 @@ stdenv.mkDerivation (finalAttrs: {
   # cgit) that are needed here should be included directly in Nixpkgs as
   # files.
   patches = [
-    # Fix implicit function declarations (clang-16 build failure):
-    #     https://github.com/libffi/libffi/pull/764
-    ./fix-implicit-fun-decl.patch
   ];
 
   strictDeps = true;

pkgs/development/libraries/libffi/fix-implicit-fun-decl.patch

@@ -1,46 +0,0 @@
-https://github.com/libffi/libffi/commit/ce077e5565366171aa1b4438749b0922fce887a4.patch
-
-From ce077e5565366171aa1b4438749b0922fce887a4 Mon Sep 17 00:00:00 2001
-From: serge-sans-paille <serge.guelton@telecom-bretagne.eu>
-Date: Thu, 2 Feb 2023 14:46:29 +0000
-Subject: [PATCH] Forward declare open_temp_exec_file (#764)
-
-It's defined in closures.c and used in tramp.c.
-Also declare it as an hidden symbol, as it should be.
-
-Co-authored-by: serge-sans-paille <sguelton@mozilla.com>
----
- include/ffi_common.h | 4 ++++
- src/tramp.c          | 4 ++++
- 2 files changed, 8 insertions(+)
-
-diff --git a/include/ffi_common.h b/include/ffi_common.h
-index 2bd31b03d..c53a79493 100644
---- a/include/ffi_common.h
-+++ b/include/ffi_common.h
-@@ -128,6 +128,10 @@ void *ffi_data_to_code_pointer (void *data) FFI_HIDDEN;
-    static trampoline. */
- int ffi_tramp_is_present (void *closure) FFI_HIDDEN;
- 
-+/* Return a file descriptor of a temporary zero-sized file in a
-+   writable and executable filesystem. */
-+int open_temp_exec_file(void) FFI_HIDDEN;
-+
- /* Extended cif, used in callback from assembly routine */
- typedef struct
- {
-diff --git a/src/tramp.c b/src/tramp.c
-index 7e005b054..5f19b557f 100644
---- a/src/tramp.c
-+++ b/src/tramp.c
-@@ -39,6 +39,10 @@
- #ifdef __linux__
- #define _GNU_SOURCE 1
- #endif
-+
-+#include <ffi.h>
-+#include <ffi_common.h>
-+
- #include <stdio.h>
- #include <unistd.h>
- #include <stdlib.h>

pkgs/development/libraries/libheif/default.nix

@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, autoreconfHook
+, cmake
 , pkg-config
 , dav1d
 , rav1e
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libheif";
-  version = "1.15.2";
+  version = "1.17.6";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
@@ -30,12 +30,12 @@ stdenv.mkDerivation rec {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${version}";
-    sha256 = "sha256-VbMBZ17leGezng2FYKgiSq04Se0PT0a3WqjM6xZ3zS4=";
+    sha256 = "sha256-pp+PjV/pfExLqzFE61mxliOtVAYOePh1+i1pwZxDLAM=";
   };
 
   nativeBuildInputs = [
-    autoreconfHook
     pkg-config
+    cmake
   ];
 
   buildInputs = [
@@ -49,11 +49,15 @@ stdenv.mkDerivation rec {
     gdk-pixbuf
   ];
 
-  enableParallelBuilding = true;
-
   # Fix installation path for gdk-pixbuf module
   PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${placeholder "out"}/${gdk-pixbuf.moduleDir}";
 
+  # Wrong include path in .cmake.  It's a bit difficult to patch because of special characters.
+  postFixup = ''
+    sed '/^  INTERFACE_INCLUDE_DIRECTORIES/s|"[^"]*/include"|"${placeholder "dev"}/include"|' \
+      -i "$dev"/lib/cmake/libheif/libheif-config.cmake
+  '';
+
   passthru.tests = {
     inherit gimp imagemagick imlib2Full imv vips;
   };

pkgs/development/libraries/libmicrohttpd/0.9.77.nix

@@ -0,0 +1,10 @@
+{ callPackage, fetchurl }:
+
+callPackage ./generic.nix ( rec {
+  version = "0.9.77";
+
+  src = fetchurl {
+    url = "mirror://gnu/libmicrohttpd/libmicrohttpd-${version}.tar.gz";
+    hash = "sha256-nnAjoVESAGDSgGpupME8qZM+zk6s/FyUZNIO3dt2sKA=";
+  };
+})

pkgs/development/libraries/libnetfilter_conntrack/default.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   buildInputs = [ libmnl ];
   propagatedBuildInputs = [ libnfnetlink ];
   nativeBuildInputs = [ pkg-config ];

pkgs/development/libraries/libsecret/default.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
-  version = "0.21.3";
+  version = "0.21.4";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-mj4lcfEEgDXYAjj1LIdgEliEpDuvilgP7bclDBrQqec=";
+    hash = "sha256-Fj0I14O+bUq5qXnOtaT+y8HZZg08NBaMWBMBzVORKyA=";
   };
 
   depsBuildBuild = [

pkgs/development/libraries/mesa/backport-radeon-crash-fix.patch

@@ -0,0 +1,13 @@
+diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
+index 2e1d9c488e2..7979cad75fa 100644
+--- a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
++++ b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c
+@@ -729,7 +729,7 @@ bool radeon_bo_can_reclaim_slab(void *priv, struct pb_slab_entry *entry)
+ {
+    struct radeon_bo *bo = container_of(entry, struct radeon_bo, u.slab.entry);
+ 
+-   return radeon_bo_can_reclaim(NULL, &bo->base);
++   return radeon_bo_can_reclaim(priv, &bo->base);
+ }
+ 
+ static void radeon_bo_slab_destroy(void *winsys, struct pb_buffer_lean *_buf)

pkgs/development/libraries/mesa/default.nix

@@ -3,7 +3,7 @@
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
-, libelf, libvdpau
+, elfutils, libvdpau
 , libglvnd, libunwind, lm_sensors
 , vulkan-loader, glslang
 , galliumDrivers ?
@@ -81,8 +81,8 @@
 # nix build .#mesa .#pkgsi686Linux.mesa .#pkgsCross.aarch64-multiplatform.mesa .#pkgsMusl.mesa
 
 let
-  version = "24.0.1";
+  version = "24.0.2";
-  hash = "sha256-84cZKwjEccVFWQ3RIjCio0MkSAS1/oZv7GrqAuq1dhM=";
+  hash = "sha256-lOKKjtrQbY7SuD61PyU7nrWqYsMID5OXAuGzA5tWyeg=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
@@ -141,6 +141,11 @@ self = stdenv.mkDerivation {
 
   patches = [
     ./opencl.patch
+
+    # Backport crash fix for Radeon (legacy) kernel driver
+    # see https://gitlab.freedesktop.org/mesa/mesa/-/issues/10613
+    # FIXME: remove when merged upstream
+    ./backport-radeon-crash-fix.patch
   ];
 
   postPatch = ''
@@ -241,7 +246,7 @@ self = stdenv.mkDerivation {
   buildInputs = with xorg; [
     expat glslang llvmPackages.libllvm libglvnd xorgproto
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
-    libffi libvdpau libelf libXvMC
+    libffi libvdpau libXvMC
     libpthreadstubs openssl
     zstd
   ] ++ lib.optionals withLibunwind [
@@ -249,7 +254,7 @@ self = stdenv.mkDerivation {
   ] ++ [
     python3Packages.python # for shebang
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
+    ++ lib.optionals stdenv.isLinux [ elfutils libomxil-bellagio libva-minimal udev lm_sensors ]
     ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader

pkgs/development/libraries/nv-codec-headers/10_x.nix

@@ -1,22 +0,0 @@
-{ lib, stdenv, fetchgit }:
-
-stdenv.mkDerivation rec {
-  pname = "nv-codec-headers";
-  version = "10.0.26.2";
-
-  src = fetchgit {
-    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
-    rev = "n${version}";
-    sha256 = "0n5jlwjfv5irx1if1g0n52m279bw7ab6bd3jz2v4vwg9cdzbxx85";
-  };
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  meta = {
-    description = "FFmpeg version of headers for NVENC";
-    homepage = "https://ffmpeg.org/";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.MP2E ];
-    platforms = lib.platforms.all;
-  };
-}

pkgs/development/libraries/nv-codec-headers/11_x.nix

@@ -1,27 +0,0 @@
-{ stdenv
-, lib
-, fetchgit
-}:
-
-stdenv.mkDerivation rec {
-  pname = "nv-codec-headers";
-  version = "11.1.5.2";
-
-  src = fetchgit {
-    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
-    rev = "n${version}";
-    sha256 = "sha256-KzaqwpzISHB7tSTruynEOJmSlJnAFK2h7/cRI/zkNPk=";
-  };
-
-  makeFlags = [
-    "PREFIX=$(out)"
-  ];
-
-  meta = with lib; {
-    description = "FFmpeg version of headers for NVENC";
-    homepage = "https://git.videolan.org/?p=ffmpeg/nv-codec-headers.git";
-    license = licenses.mit;
-    maintainers = with maintainers; [ MP2E ];
-    platforms = platforms.all;
-  };
-}

pkgs/development/libraries/nv-codec-headers/12_x.nix

@@ -1,27 +0,0 @@
-{ stdenv
-, lib
-, fetchgit
-}:
-
-stdenv.mkDerivation rec {
-  pname = "nv-codec-headers";
-  version = "12.1.14.0";
-
-  src = fetchgit {
-    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
-    rev = "n${version}";
-    sha256 = "sha256-WJYuFmMGSW+B32LwE7oXv/IeTln6TNEeXSkquHh85Go=";
-  };
-
-  makeFlags = [
-    "PREFIX=$(out)"
-  ];
-
-  meta = with lib; {
-    description = "FFmpeg version of headers for NVENC";
-    homepage = "https://git.videolan.org/?p=ffmpeg/nv-codec-headers.git";
-    license = licenses.mit;
-    maintainers = with maintainers; [ MP2E ];
-    platforms = platforms.all;
-  };
-}

pkgs/development/libraries/nv-codec-headers/default.nix

@@ -1,22 +1,32 @@
-{ lib, stdenv, fetchgit }:
+{ lib
+, fetchgit
+, stdenvNoCC
+}:
 
-stdenv.mkDerivation rec {
+let
-  pname = "nv-codec-headers";
+  make-nv-codec-headers = (import ./make-nv-codec-headers.nix) {
-  version = "9.1.23.1";
+    inherit lib fetchgit stdenvNoCC;
-
-  src = fetchgit {
-    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
-    rev = "n${version}";
-    sha256 = "1xfvb3mhz6wfx9c732888xa82ivaig903lhvvrqqzs31qfznsplh";
   };
-
+in
-  makeFlags = [ "PREFIX=$(out)" ];
+{
-
+  nv-codec-headers-8 = make-nv-codec-headers {
-  meta = {
+    version = "8.2.15.2";
-    description = "FFmpeg version of headers for NVENC";
+    hash = "sha256-TKYT8vXqnUpq+M0grDeOR37n/ffqSWDYTrXIbl++BG4=";
-    homepage = "https://ffmpeg.org/";
+  };
-    license = lib.licenses.mit;
+  nv-codec-headers-9 = make-nv-codec-headers {
-    maintainers = [ lib.maintainers.MP2E ];
+    version = "9.1.23.1";
-    platforms = lib.platforms.all;
+    hash = "sha256-kF5tv8Nh6I9x3hvSAdKLakeBVEcIiXFY6o6bD+tY2/U=";
+  };
+  nv-codec-headers-10 = make-nv-codec-headers {
+    version = "10.0.26.2";
+    hash = "sha256-BfW+fmPp8U22+HK0ZZY6fKUjqigWvOBi6DmW7SSnslg=";
+  };
+  nv-codec-headers-11 = make-nv-codec-headers {
+    version = "11.1.5.2";
+    hash = "sha256-KzaqwpzISHB7tSTruynEOJmSlJnAFK2h7/cRI/zkNPk=";
+  };
+  nv-codec-headers-12 = make-nv-codec-headers {
+    version = "12.1.14.0";
+    hash = "sha256-WJYuFmMGSW+B32LwE7oXv/IeTln6TNEeXSkquHh85Go=";
   };
 }

pkgs/development/libraries/nv-codec-headers/make-nv-codec-headers.nix

@@ -0,0 +1,32 @@
+{ lib
+, stdenvNoCC
+, fetchgit
+}:
+
+{ pname ? "nv-codec-headers"
+, version
+, hash
+}:
+
+stdenvNoCC.mkDerivation {
+  inherit pname version;
+
+  src = fetchgit {
+    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
+    rev = "n${version}";
+    inherit hash;
+  };
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  meta = {
+    description = "FFmpeg version of headers for NVENC";
+    homepage = "https://ffmpeg.org/";
+    downloadPage = "https://git.videolan.org/?p=ffmpeg/nv-codec-headers.git";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
+  };
+}

pkgs/development/libraries/openjpeg/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
 , libdeflate, libpng, libtiff, zlib, lcms2, jpylyzer
 , jpipLibSupport ? false # JPIP library & executables
 , jpipServerSupport ? false, curl, fcgi # JPIP Server
@@ -12,32 +12,17 @@ in
 
 stdenv.mkDerivation rec {
   pname = "openjpeg";
-  version = "2.5.0";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "uclouvain";
     repo = "openjpeg";
     rev = "v${version}";
-    sha256 = "sha256-/0o3Fl6/jx5zu854TCqMyOz/8mnEyEC9lpZ6ij/tbHc=";
+    hash = "sha256-mQ9B3MJY2/bg0yY/7jUJrAXM6ozAHT5fmwES5Q1SGxw=";
   };
 
   outputs = [ "out" "dev" ];
 
-  patches = [
-    # modernise cmake files, also fixes them for multiple outputs
-    # https://github.com/uclouvain/openjpeg/pull/1424
-    (fetchpatch {
-      name = "uclouvain-openjpeg-pull-1424.patch";
-      url = "https://github.com/uclouvain/openjpeg/compare/52927287402a9f7353de8854c88f931051211e2f...9d4f70cfe99626f82f9c8dcbf45f07709e3511b2.patch";
-      sha256 = "sha256-CxVRt1u4HVOMUjWiZ2plmZC29t/zshCpSY+N4Wlrlvg=";
-    })
-    # fix cmake files cross compilation
-    (fetchpatch {
-      url = "https://github.com/uclouvain/openjpeg/commit/c6ceb84c221b5094f1e8a4c0c247dee3fb5074e8.patch";
-      sha256 = "sha256-gBUtmO/7RwSWEl7rc8HGr8gNtvNFdhjEwm0Dd51p5O8=";
-    })
-  ];
-
   cmakeFlags = [
     "-DCMAKE_INSTALL_NAME_DIR=\${CMAKE_INSTALL_PREFIX}/lib"
     "-DBUILD_SHARED_LIBS=ON"

pkgs/development/libraries/pcre2/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pcre2";
-  version = "10.42";
+  version = "10.43";
 
   src = fetchurl {
     url = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
-    hash = "sha256-jTbNjLbqKkwrs1j/ZBGwx4hjOipF2rvxrrS3AdG16EA=";
+    hash = "sha256-4qU5hP8LB9/bWuRIa7ubIcyo598kNAlsyb8bcow1C8s=";
   };
 
   configureFlags = [

pkgs/development/libraries/poppler/default.nix

@@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "poppler-${suffix}";
-  version = "24.01.0"; # beware: updates often break cups-filters build, check scribus too!
+  version = "24.02.0"; # beware: updates often break cups-filters build, check scribus too!
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://poppler.freedesktop.org/poppler-${version}.tar.xz";
-    hash = "sha256-x972k6ekkoMPSdSXqAzGuchctXsV6b4tLWFRU7ecrgg=";
+    hash = "sha256-GRh6P90F8z59YExHmcGD3lygEYZAyIs3DdzzE2NDIi4=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/xvidcore/default.nix

@@ -35,12 +35,17 @@ stdenv.mkDerivation rec {
     rm $out/lib/*.a
   '';
 
+  # Dependants of xvidcore don't know to look in bin for dependecies. Link them
+  # in lib so other depedants of xvidcore can find the dlls.
+  postFixup = lib.optionalString stdenv.hostPlatform.isMinGW ''
+    ln -s $out/bin/*.dll $out/lib
+  '';
+
   meta = with lib; {
     description = "MPEG-4 video codec for PC";
-    homepage    = "https://www.xvid.com/";
+    homepage = "https://www.xvid.com/";
-    license     = licenses.gpl2;
+    license = licenses.gpl2;
     maintainers = with maintainers; [ codyopel lovek323 ];
-    platforms   = platforms.all;
+    platforms = platforms.all;
   };
 }
-

pkgs/development/misc/resholve/oildev.nix

@@ -4,34 +4,17 @@
 , callPackage
 , fetchFromGitHub
 , makeWrapper
-, # re2c deps
-  autoreconfHook
 , # py-yajl deps
   git
 , # oil deps
-  file
+  pkgsBuildBuild
-, pkgsBuildBuild
+, re2c
+, file
 , six
 , typing
 }:
 
 rec {
-  re2c = stdenv.mkDerivation rec {
-    pname = "re2c";
-    version = "1.0.3";
-    sourceRoot = "${src.name}/re2c";
-    src = fetchFromGitHub {
-      owner = "skvadrik";
-      repo = "re2c";
-      rev = version;
-      sha256 = "0grx7nl9fwcn880v5ssjljhcb9c5p2a6xpwil7zxpmv0rwnr3yqi";
-    };
-    nativeBuildInputs = [ autoreconfHook ];
-    preCheck = ''
-      patchShebangs run_tests.sh
-    '';
-  };
-
   py-yajl = python27.pkgs.buildPythonPackage rec {
     pname = "oil-pyyajl-unstable";
     version = "2022-09-01";
@@ -103,7 +86,9 @@ rec {
       "--without-readline"
     ];
 
-    nativeBuildInputs = [ re2c file makeWrapper ];
+    depsBuildBuild = [ re2c ];
+
+    nativeBuildInputs = [ file makeWrapper ];
 
     propagatedBuildInputs = [ six typing py-yajl ];
 

pkgs/development/python-modules/aiobotocore/default.nix

@@ -13,6 +13,7 @@
 , setuptools
 , pytest-asyncio
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , wrapt
 }:
@@ -96,6 +97,10 @@ buildPythonPackage rec {
     "test_required_config_not_set"
     "test_sso_cred_fetcher_raises_helpful_message_on_unauthorized_exception"
     "test_sso_credential_fetcher_can_fetch_credentials"
+  ] ++ lib.optionals (pythonAtLeast "3.12.") [
+    # AttributeError: 'called_with' is not a valid assertion. Use a spec for the mock if 'called_with' is meant to be an attribute.
+    "test_max_rate_updated_on_success_response"
+    "test_max_rate_cant_exceed_20_percent_max"
   ];
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/aiocoap/default.nix

@@ -1,15 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
+, pythonAtLeast
-, pygments
 , pythonOlder
+
+# build-system
+, setuptools
+
+# optionals
+, cbor2
+, cbor-diag
+, cryptography
+, filelock
+, ge25519
+, dtlssocket
+, websockets
+, termcolor
+, pygments
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "aiocoap";
   version = "0.4.7";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -20,14 +36,52 @@ buildPythonPackage rec {
     hash = "sha256-4iwoPfmIwk+PlWUp60aqA5qZgzyj34pnZHf9uH5UhnY=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
-    pygments
+    setuptools
   ];
 
+  passthru.optional-dependencies = {
+    oscore = [
+      cbor2
+      cryptography
+      filelock
+      ge25519
+    ];
+    tinydtls = [
+      dtlssocket
+    ];
+    ws = [
+      websockets
+    ];
+    prettyprint = [
+      termcolor
+      cbor2
+      pygments
+      cbor-diag
+    ];
+  };
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
 
+  pytestFlagsArray = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/chrysn/aiocoap/issues/339
+    "--deselect=tests/test_server.py::TestServerTCP::test_big_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_empty_accept"
+    "--deselect=tests/test_server.py::TestServerTCP::test_error_resources"
+    "--deselect=tests/test_server.py::TestServerTCP::test_fast_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_js_accept"
+    "--deselect=tests/test_server.py::TestServerTCP::test_manualbig_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_nonexisting_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_replacing_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_root_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_slow_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_slowbig_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_spurious_resource"
+    "--deselect=tests/test_server.py::TestServerTCP::test_unacceptable_accept"
+  ];
+
   disabledTestPaths = [
     # Don't test the plugins
     "tests/test_tls.py"

pkgs/development/python-modules/aioquic/default.nix

@@ -3,6 +3,7 @@
 , certifi
 , cryptography
 , fetchPypi
+, fetchpatch
 , openssl
 , pylsqpack
 , pyopenssl
@@ -24,6 +25,13 @@ buildPythonPackage rec {
     hash = "sha256-cHlceJBTJthVwq5SQHIjSq5YbHibgSkuJy0CHpsEMKM=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/aiortc/aioquic/commit/e899593805e0b31325a1d347504eb8e6100fe87d.diff";
+      hash = "sha256-TTpIIWX/R4k2KxhsN17O9cRW/dN0AARYnju8JTht3D8=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];

pkgs/development/python-modules/aioswitcher/default.nix

@@ -8,6 +8,7 @@
 , pytest-resource-path
 , pytest-sugar
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , time-machine
 }:
@@ -52,6 +53,10 @@ buildPythonPackage rec {
     "test_schedule_parser_with_a_daily_recurring_enabled_schedule_data"
     "test_schedule_parser_with_a_partial_daily_recurring_enabled_schedule_data"
     "test_schedule_parser_with_a_non_recurring_enabled_schedule_data"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # ssertionError: Expected <'I' format requires 0 <= number <= 4294967295> to be equal to <argument out of range>, but was not.
+    "test_minutes_to_hexadecimal_seconds_with_a_negative_value_should_throw_an_error"
+    "test_current_timestamp_to_hexadecimal_with_errornous_value_should_throw_an_error"
   ];
 
   pythonImportsCheck = [

pkgs/development/python-modules/airly/default.nix

@@ -5,6 +5,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
@@ -21,6 +22,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ aiohttp ];
 
+  # aiounittest is not supported on 3.12
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
     aioresponses
     aiounittest

pkgs/development/python-modules/alarmdecoder/default.nix

@@ -23,6 +23,11 @@ buildPythonPackage rec {
     hash = "sha256-q2s+wngDKtWm5mxGHNAc63Ed6tiQD9gLHVoQZNWFB0w=";
   };
 
+  postPatch = ''
+    substituteInPlace test/test_{ad2,devices,messages}.py \
+      --replace-fail assertEquals assertEqual
+  '';
+
   propagatedBuildInputs = [
     pyftdi
     pyopenssl

pkgs/development/python-modules/amaranth-boards/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "amaranth-boards";
-  version = "unstable-2021-12-17";
+  version = "0-unstable-2023-12-13";
   format = "setuptools";
   # python setup.py --version
   realVersion = "0.1.dev202+g${lib.substring 0 7 src.rev}";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "amaranth-lang";
     repo = "amaranth-boards";
-    rev = "8e2615765e255144403431ca95c5cdf6c78eb638";
+    rev = "170675812b71ee722bcf8ccdb88409a9ad97ffe2";
-    sha256 = "3EOG8SO5xBNevshXMRrxKWoJUbeaVi8ckbkmqd6Tw70=";
+    hash = "sha256-dwZCKMJnEY9RjzkcJ9r3TEC7W+Wfi/P7Hjl4/d60/qo=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     description = "Board definitions for Amaranth HDL";
     homepage = "https://github.com/amaranth-lang/amaranth-boards";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ emily thoughtpolice ];
+    maintainers = with maintainers; [ emily thoughtpolice pbsds ];
   };
 }

pkgs/development/python-modules/amaranth-soc/default.nix

@@ -2,35 +2,34 @@
 , buildPythonPackage
 , fetchFromGitHub
 , amaranth
-, setuptools
+, pdm-backend
-, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "amaranth-soc";
-  version = "unstable-2023-09-15";
+  version = "0-unstable-2024-02-16";
-  format = "setuptools";
+  pyproject = true;
-  # python setup.py --version
+  # from `pdm show`
-  realVersion = "0.1.dev70+g${lib.substring 0 7 src.rev}";
+  realVersion = "0.1a1.dev1+g${lib.substring 0 7 src.rev}";
 
   src = fetchFromGitHub {
     owner = "amaranth-lang";
     repo = "amaranth-soc";
-    rev = "cce8a79a37498f4d5900be21a295ba77e51e6c9d";
+    rev = "9f46553aa4289e2a11788a73fade6410a371b162";
-    sha256 = "sha256-hfkJaqICuy3iSTwLM9lbUPvSMDBLW8GdxqswyAOsowo=";
+    hash = "sha256-ZllDSrZEu16jZtbQ7crQSj3XCbsthueXtaAvyf45dmY=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [ pdm-backend ];
-  propagatedBuildInputs = [ setuptools amaranth ];
+  propagatedBuildInputs = [ amaranth ];
 
   preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}"
+    export PDM_BUILD_SCM_VERSION="${realVersion}"
   '';
 
   meta = with lib; {
     description = "System on Chip toolkit for Amaranth HDL";
     homepage = "https://github.com/amaranth-lang/amaranth-soc";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ emily thoughtpolice ];
+    maintainers = with maintainers; [ emily thoughtpolice pbsds ];
   };
 }

pkgs/development/python-modules/amaranth/default.nix

@@ -19,15 +19,14 @@
 buildPythonPackage rec {
   pname = "amaranth";
   format = "pyproject";
-  # python -m setuptools_scm
+  version = "0.4.3";
-  version = "0.4.dev197+g${lib.substring 0 7 src.rev}";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "amaranth-lang";
     repo = "amaranth";
-    rev = "11d5bb19eb34463918c07dc5e2e0eac7dbf822b0";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-Ji5oYfF2hKSunAdAQTniv8Ajj6NE/bvW5cvadrGKa+U=";
+    hash = "sha256-03uAaD4aEMxu/T1D8Hb7XcWvZZuaCK5HmdOD9bx+ZIc=";
   };
 
   nativeBuildInputs = [
@@ -55,6 +54,6 @@ buildPythonPackage rec {
     description = "A modern hardware definition language and toolchain based on Python";
     homepage = "https://amaranth-lang.org/docs/amaranth";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ emily thoughtpolice ];
+    maintainers = with maintainers; [ emily thoughtpolice pbsds ];
   };
 }

pkgs/development/python-modules/arcam-fmj/default.nix

@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , pythonOlder
 , fetchFromGitHub
 , aiohttp
@@ -36,6 +37,18 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # stuck on EpollSelector.poll()
+    "test_power"
+    "test_multiple"
+    "test_invalid_command"
+    "test_state"
+    "test_silent_server_request"
+    "test_silent_server_disconnect"
+    "test_heartbeat"
+    "test_cancellation"
+  ];
+
   pythonImportsCheck = [
     "arcam.fmj"
     "arcam.fmj.client"

pkgs/development/python-modules/bcrypt/default.nix

@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "bcrypt";
-  version = "4.0.1";
+  version = "4.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J9N1kDrIJhz+QEf2cJ0W99GNObHskqr3KvmJVSplDr0=";
+    hash = "sha256-3zf1QY1PHNz/hF9g50egFTifpOY3A8kYMwhl4GrYAAc=";
   };
 
   cargoRoot = "src/_bcrypt";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-lDWX69YENZFMu7pyBmavUZaalGvFqbHSHfkwkzmDQaY=";
+    hash = "sha256-QYg1+DsZEdXB74vuS4SFvV0n5GXkuwHkOS9j1ogSTjA=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/bidict/default.nix

@@ -10,13 +10,14 @@
 , pytest-benchmark
 , sortedcollections
 , sortedcontainers
+, typing-extensions
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "bidict";
-  version = "0.22.1";
+  version = "0.23.1";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "jab";
     repo = "bidict";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mPBruasjQwErl5M91OBf71hArztdRVONOCnqos180DY=";
+    hash = "sha256-WE0YaRT4a/byvU2pzcByuf1DfMlOpYA9i0PPrKXsS+M=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +44,7 @@ buildPythonPackage rec {
     pytest-benchmark
     sortedcollections
     sortedcontainers
+    typing-extensions
   ];
 
   pythonImportsCheck = [ "bidict" ];

pkgs/development/python-modules/boto3/default.nix

@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , jmespath
+, pytest-xdist
 , pytestCheckHook
 , pythonOlder
 , pythonRelaxDepsHook
@@ -41,6 +42,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pytest-xdist
     pytestCheckHook
   ];
 

pkgs/development/python-modules/chameleon/default.nix

@@ -1,25 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  pname = "Chameleon";
+  pname = "chameleon";
-  version = "3.8.1";
+  version = "4.5.2";
+  pyproject = true;
 
-  # tests not included in pypi tarball
   src = fetchFromGitHub {
     owner = "malthe";
     repo = "chameleon";
-    rev = version;
+    rev = "refs/tags/${version}";
-    sha256 = "0nf8x4w2vh1a31wdb86nnvlic9xmr23j3in1f6fq4z6mv2jkwa87";
+    hash = "sha256-SVLKT6JeFUpF7gYkq3B7Lm9b9SG2qa6Ekp8i8xM0Xh0=";
   };
 
-  pythonImportsCheck = [ "chameleon" ];
+  build-system = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "chameleon"
+  ];
 
   meta = with lib; {
-    homepage = "https://chameleon.readthedocs.io/";
+    changelog = "https://github.com/malthe/chameleon/blob/${version}/CHANGES.rst";
     description = "Fast HTML/XML Template Compiler";
+    downloadPage = "https://github.com/malthe/chameleon";
+    homepage = "https://chameleon.readthedocs.io";
     license = licenses.bsd0;
     maintainers = with maintainers; [ domenkozar ];
   };

pkgs/development/python-modules/debugpy/default.nix

@@ -111,6 +111,8 @@ buildPythonPackage rec {
     # testsuite gets stuck at this one
     "test_attach_pid_client"
   ];
+  # TODO? https://github.com/NixOS/nixpkgs/issues/262000
+  doCheck = !stdenv.isLinux;
 
   pythonImportsCheck = [
     "debugpy"

pkgs/development/python-modules/django/4.nix

@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch2
 , pythonOlder
 , substituteAll
 
@@ -60,6 +61,12 @@ buildPythonPackage rec {
     # make sure the tests don't remove packages from our pythonpath
     # and disable failing tests
     ./django_4_tests.patch
+
+    (fetchpatch2 {
+      # fix test on 3.12; https://github.com/django/django/pull/17843
+      url = "https://github.com/django/django/commit/bc8471f0aac8f0c215b9471b594d159783bac19b.patch";
+      hash = "sha256-g1T9b73rmQ0uk1lB+iQy1XwK3Qin3mf5wpRsyYISJaw=";
+    })
   ] ++ lib.optionals withGdal [
     (substituteAll {
       src = ./django_4_set_geos_gdal_lib.patch;