Merge branch 'master' into haskell-updates

2024-01-01 14:02:05 +01:00 · 2024-01-01 14:02:05 +01:00 · f963570024
commit f963570024
parent 258151d138 5c376752ae
59 changed files with 14780 additions and 167 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -16786,6 +16786,12 @@
    }];
    name = "Shane Sveller";
  };
+  shard7 = {
+    email = "sh7user@gmail.com";
+    github = "shard77";
+    githubId = 106669955;
+    name = "Léon Gessner";
+  };
  shardy = {
    email = "shardul@baral.ca";
    github = "shardulbee";
--- a/pkgs/applications/audio/miniaudicle/default.nix
+++ b/pkgs/applications/audio/miniaudicle/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "miniaudicle";
-  version = "1.5.0.7";
+  version = "1.5.2.0";

  src = fetchFromGitHub {
    owner = "ccrma";
    repo = "miniAudicle";
    rev = "chuck-${finalAttrs.version}";
-    hash = "sha256-CqsajNLcOp7CS5RsVabWM6APnNh4alSKb2/eoZ7F4Ao=";
+    hash = "sha256-jpPF2Qx/6tiotsj92m1XmxsEUgtm5029ijpu3O8B9qM=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/editors/codux/default.nix
+++ b/pkgs/applications/editors/codux/default.nix
@ -5,11 +5,11 @@

 let
  pname = "codux";
-  version = "15.16.2";
+  version = "15.17.2";

  src = fetchurl {
    url = "https://github.com/wixplosives/codux-versions/releases/download/${version}/Codux-${version}.x86_64.AppImage";
-    sha256 = "sha256-GKn8T3MEh+MnOqUnxruTqbnfxUcjGh6EAt+6LHTNCiY=";
+    sha256 = "sha256-6y3c9SbRxGhfND0bsMh0yYs7Dy8B23VSjj4qQ/2eBos=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
--- a/pkgs/applications/editors/gedit/default.nix
+++ b/pkgs/applications/editors/gedit/default.nix
@ -8,18 +8,17 @@
 , gtk3
 , gtk-mac-integration
 , glib
-, amtk
 , tepl
+, libgedit-amtk
+, libgedit-gtksourceview
 , libpeas
 , libxml2
-, gtksourceview4
 , gsettings-desktop-schemas
 , wrapGAppsHook
 , gtk-doc
 , gobject-introspection
 , docbook-xsl-nons
 , ninja
-, libsoup
 , gnome
 , gspell
 , perl
@ -30,13 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "gedit";
-  version = "44.2";
+  version = "46.1";

  outputs = [ "out" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gedit/${lib.versions.major version}/gedit-${version}.tar.xz";
-    sha256 = "O7sbN3XUwnfa9UqqtEsOuDpOsfCfA5GAAEHJ5WiT7BE=";
+    sha256 = "oabjfwQXZd/3InofVXi29J+q8Bax4X6GnK9b+5TGqk4=";
  };

  patches = [
@ -64,15 +63,14 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    amtk
    tepl
    glib
    gsettings-desktop-schemas
    gspell
    gtk3
-    gtksourceview4
+    libgedit-amtk
+    libgedit-gtksourceview
    libpeas
-    libsoup
  ] ++ lib.optionals stdenv.isDarwin [
    gtk-mac-integration
  ];
@ -96,7 +94,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://wiki.gnome.org/Apps/Gedit";
    description = "Former GNOME text editor";
-    maintainers = [ ];
+    maintainers = with maintainers; [ bobby285271 ];
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
    mainProgram = "gedit";
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@ -8,10 +8,10 @@
 , wrapGAppsHook
 , gsettings-desktop-schemas
 , gspell
-, gtksourceview4
+, libgedit-amtk
+, libgedit-gtksourceview
 , libgee
 , tepl
-, amtk
 , gnome
 , glib
 , pkg-config
@ -21,12 +21,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.44.0";
+  version = "3.46.0";
  pname = "gnome-latex";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "iL1TQL0ox+0Bx5ZqOgBzK72QJ3PfWsZZvmrRGAap50Q=";
+    sha256 = "1nVVY5sqFaiuvVTzNTVORP40MxQ648s8ynqOJvgRKto=";
  };

  nativeBuildInputs = [
@ -41,12 +41,12 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    amtk
    gnome.adwaita-icon-theme
    glib
    gsettings-desktop-schemas
    gspell
-    gtksourceview4
+    libgedit-amtk
+    libgedit-gtksourceview
    libgee
    libxml2
    tepl
@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://wiki.gnome.org/Apps/GNOME-LaTeX";
    description = "A LaTeX editor for the GNOME desktop";
-    maintainers = [ maintainers.manveru ];
+    maintainers = with maintainers; [ manveru bobby285271 ];
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    mainProgram = "gnome-latex";
--- a/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
+++ b/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "twitch-tui";
-  version = "2.6.0";
+  version = "2.6.2";

  src = fetchFromGitHub {
    owner = "Xithrius";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-UPcJHuqDnyg2U3aNtd44dqt2iC2iLkR4wzsOjAByISw=";
+    hash = "sha256-q7Z7a/Mfi6djUGK0xvhD0WznxQlDyejZtaq9rSlNz8g=";
  };

-  cargoHash = "sha256-HFBCLYjrDAPU2EZ1NQ+A0mAFo5jvj79Ghge6+D1PBAg=";
+  cargoHash = "sha256-utnwDqQe0PScRXUD/mC6/uSX8cjBHLbRsO0GcVntPKk=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@ -60,6 +60,8 @@ stdenv.mkDerivation rec {
    gst-plugins-bad
  ]);

+  enableParallelBuilding = true;
+
  pythonPath = with python3Packages; [
    pygobject3
    pycairo
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@ -1,62 +1,119 @@
 { lib
-, stdenv
-, fetchurl
-, autoPatchelfHook
-, dpkg
-, wrapGAppsHook
-, alsa-lib
-, gtk3
-, mesa
-, nspr
-, nss
-, systemd
+
+, fetchFromGitHub
+, buildNpmPackage
 , nix-update-script
+, electron
+, writeShellScriptBin
+, makeWrapper
+, copyDesktopItems
+, makeDesktopItem
+, pkg-config
+, pixman
+, cairo
+, pango
+, npm-lockfile-fix
 }:

-stdenv.mkDerivation rec {
+buildNpmPackage rec {
  pname = "bruno";
  version = "1.5.1";

-  src = fetchurl {
-    url = "https://github.com/usebruno/bruno/releases/download/v${version}/bruno_${version}_amd64_linux.deb";
-    hash = "sha256-kJfS3yORwvh7rMGgDV5Bn2L7+7ZMa8ZBpRI1P5y+ShQ=";
+  src = fetchFromGitHub {
+    owner = "usebruno";
+    repo = "bruno";
+    rev = "v${version}";
+    hash = "sha256-GgXnsPEUurPHrijf966x5ldp+1lDrgS1iBinU+EkdYU=b";
+
+    postFetch = ''
+      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
+    '';
  };

-  nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook ];
+  npmDepsHash = "sha256-R5dEL4QbwCSE9+HHCXlf/pYLmjCaD15tmdSSLbZgmt0=";

-  buildInputs = [
-    alsa-lib
-    gtk3
-    mesa
-    nspr
-    nss
+  nativeBuildInputs = [
+    (writeShellScriptBin "phantomjs" "echo 2.1.1")
+    makeWrapper
+    copyDesktopItems
+    pkg-config
  ];

-  runtimeDependencies = [ (lib.getLib systemd) ];
+  buildInputs = [
+    pixman
+    cairo
+    pango
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "bruno";
+      desktopName = "Bruno";
+      exec = "bruno %U";
+      icon = "bruno";
+      comment = "Opensource API Client for Exploring and Testing APIs";
+      categories = [ "Development" ];
+      startupWMClass = "Bruno";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace scripts/build-electron.sh \
+      --replace 'if [ "$1" == "snap" ]; then' 'exit 0; if [ "$1" == "snap" ]; then'
+  '';
+
+  ELECTRON_SKIP_BINARY_DOWNLOAD=1;
+
+  dontNpmBuild = true;
+  postBuild = ''
+    npm run build --workspace=packages/bruno-graphql-docs
+    npm run build --workspace=packages/bruno-app
+    npm run build --workspace=packages/bruno-query
+
+    bash scripts/build-electron.sh
+
+    pushd packages/bruno-electron
+
+    npm exec electron-builder -- \
+      --dir \
+      -c.electronDist=${electron}/libexec/electron \
+      -c.electronVersion=${electron.version} \
+      -c.npmRebuild=false
+
+    popd
+  '';
+
+  npmPackFlags = [ "--ignore-scripts" ];

  installPhase = ''
    runHook preInstall
-    mkdir -p "$out/bin"
-    cp -R opt $out
-    cp -R "usr/share" "$out/share"
-    ln -s "$out/opt/Bruno/bruno" "$out/bin/bruno"
-    chmod -R g-w "$out"
-    runHook postInstall
-  '';

-  postFixup = ''
-    substituteInPlace "$out/share/applications/bruno.desktop" \
-      --replace "/opt/Bruno/bruno" "$out/bin/bruno"
+    mkdir -p $out/opt/bruno $out/bin
+
+    cp -r packages/bruno-electron/dist/linux-unpacked/{locales,resources{,.pak}} $out/opt/bruno
+
+    makeWrapper ${lib.getExe electron} $out/bin/bruno \
+      --add-flags $out/opt/bruno/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+
+    for s in 16 32 48 64 128 256 512 1024; do
+      size=${"$"}{s}x$s
+      install -Dm644 $src/packages/bruno-electron/resources/icons/png/$size.png $out/share/icons/hicolor/$size/apps/bruno.png
+    done
+
+    runHook postInstall
  '';

  passthru.updateScript = nix-update-script { };

  meta = with lib; {
-    description = "Open-source IDE For exploring and testing APIs";
+    description = "Open-source IDE For exploring and testing APIs.";
    homepage = "https://www.usebruno.com";
+    inherit (electron.meta) platforms;
    license = licenses.mit;
    maintainers = with maintainers; [ water-sucks lucasew kashw2 ];
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    mainProgram = "bruno";
  };
 }
--- a/pkgs/development/libraries/amtk/default.nix
+++ b/pkgs/development/libraries/amtk/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
-, fetchurl
+, fetchFromGitHub
+, glib
 , gtk3
 , meson
 , mesonEmulatorHook
@ -9,20 +10,22 @@
 , gobject-introspection
 , gtk-doc
 , docbook-xsl-nons
-, gnome
+, gitUpdater
 , dbus
 , xvfb-run
 }:

 stdenv.mkDerivation rec {
-  pname = "amtk";
-  version = "5.6.1";
+  pname = "libgedit-amtk";
+  version = "5.8.0";

  outputs = [ "out" "dev" "devdoc" ];

-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1QEVuFyHKqwpaTS17nJqP6FWxvWtltJ+Dt0Kpa0XMig=";
+  src = fetchFromGitHub {
+    owner = "gedit-technology";
+    repo = "libgedit-amtk";
+    rev = version;
+    hash = "sha256-U77/KMZw9k9ukebCXVXAsCa4uJaTgw9irfZ/l0303kk=";
  };

  strictDeps = true;
@ -30,7 +33,6 @@ stdenv.mkDerivation rec {
    meson
    ninja
    pkg-config
-    dbus
    gobject-introspection
    gtk-doc
    docbook-xsl-nons
@ -38,27 +40,36 @@ stdenv.mkDerivation rec {
    mesonEmulatorHook
  ];

-  buildInputs = [
+  propagatedBuildInputs = [
+    # Required by libgedit-amtk-5.pc
+    glib
    gtk3
  ];

+  nativeCheckInputs = [
+    dbus # For dbus-run-session
+  ];
+
  doCheck = stdenv.isLinux;
  checkPhase = ''
+    runHook preCheck
+
    export NO_AT_BRIDGE=1
    ${xvfb-run}/bin/xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
      --config-file=${dbus}/share/dbus-1/session.conf \
      meson test --print-errorlogs
+
+    runHook postCheck
  '';

-  passthru.updateScript = gnome.updateScript {
-    packageName = pname;
-    versionPolicy = "none";
+  passthru.updateScript = gitUpdater {
+    odd-unstable = true;
  };

  meta = with lib; {
-    homepage = "https://wiki.gnome.org/Projects/Amtk";
+    homepage = "https://github.com/gedit-technology/libgedit-amtk";
    description = "Actions, Menus and Toolbars Kit for GTK applications";
-    maintainers = [ maintainers.manveru ];
+    maintainers = with maintainers; [ manveru bobby285271 ];
    license = licenses.lgpl21Plus;
    platforms = platforms.linux;
  };
--- a/pkgs/by-name/li/libgedit-gtksourceview/nix-share-path.patch
+++ b/pkgs/by-name/li/libgedit-gtksourceview/nix-share-path.patch
@ -0,0 +1,11 @@
+--- a/gtksourceview/gtksourceutils.c
+++ b/gtksourceview/gtksourceutils.c
+@@ -232,6 +232,8 @@
+ 							 NULL));
+ 	}
+ 
+	g_ptr_array_add (dirs, g_build_filename (DATADIR, GSV_DATA_SUBDIR, basename, NULL));
+
+ 	g_ptr_array_add (dirs, NULL);
+ 
+ 	return (gchar **) g_ptr_array_free (dirs, FALSE);
--- a/pkgs/by-name/li/libgedit-gtksourceview/package.nix
+++ b/pkgs/by-name/li/libgedit-gtksourceview/package.nix
@ -0,0 +1,69 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, docbook-xsl-nons
+, gobject-introspection
+, gtk-doc
+, meson
+, ninja
+, pkg-config
+, libxml2
+, glib
+, gtk3
+, shared-mime-info
+, gitUpdater
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libgedit-gtksourceview";
+  version = "299.0.5";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitHub {
+    owner = "gedit-technology";
+    repo = "libgedit-gtksourceview";
+    rev = finalAttrs.version;
+    hash = "sha256-PQ7cpul9h1JzywDWm9YyD95B1ONSdUUk0EQJMEGoRN0=";
+  };
+
+  patches = [
+    # By default, the library loads syntaxes from XDG_DATA_DIRS and user directory
+    # but not from its own datadr (it assumes it will be in XDG_DATA_DIRS).
+    # Since this is not generally true with Nix, let’s add $out/share unconditionally.
+    ./nix-share-path.patch
+  ];
+
+  nativeBuildInputs = [
+    docbook-xsl-nons
+    gobject-introspection
+    gtk-doc
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    libxml2
+  ];
+
+  propagatedBuildInputs = [
+    # Required by libgedit-gtksourceview-300.pc
+    glib
+    gtk3
+    # Used by gtk_source_language_manager_guess_language
+    shared-mime-info
+  ];
+
+  passthru.updateScript = gitUpdater {
+    odd-unstable = true;
+  };
+
+  meta = with lib; {
+    description = "Source code editing widget for GTK";
+    homepage = "https://github.com/gedit-technology/libgedit-gtksourceview";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ bobby285271 ];
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/by-name/np/npm-lockfile-fix/package.nix
+++ b/pkgs/by-name/np/npm-lockfile-fix/package.nix
@ -0,0 +1,33 @@
+{ lib
+, python3
+, fetchFromGitHub
+, nix-update-script
+}:
+
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "npm-lockfile-fix";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jeslie0";
+    repo = "npm-lockfile-fix";
+    rev = "v${version}";
+    hash = "sha256-0EGPCPmCf6bxbso3aHCeJ1XBOpYp3jtMXv8LGdwrsbs=";
+  };
+
+  propagatedBuildInputs = [
+    python3.pkgs.requests
+  ];
+
+  doCheck = false; # no tests
+
+  passthru.updateScript = nix-update-script {};
+
+  meta = with lib; {
+    description = "Add missing integrity and resolved fields to a package-lock.json file";
+    mainProgram = "npm-lockfile-fix";
+    license = lib.licenses.mit;
+    maintainers = [ maintainers.lucasew ];
+  };
+}
--- a/pkgs/by-name/vc/vcpkg/package.nix
+++ b/pkgs/by-name/vc/vcpkg/package.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "vcpkg";
-  version = "2023.10.19";
+  version = "2023.12.12";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "vcpkg";
    rev = finalAttrs.version;
-    hash = "sha256-u+4vyOphnowoaZgfkCbzF7Q4tuz2GN1bHylaKw352Lc=";
+    hash = "sha256-WNQJ19bgb55MBnz87Ho9BEHDjD7INLDevfW6lCwV/4U=";
  };

  installPhase = let
--- a/pkgs/development/libraries/libayatana-common/default.nix
+++ b/pkgs/development/libraries/libayatana-common/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libayatana-common";
-  version = "0.9.9";
+  version = "0.9.10";

  src = fetchFromGitHub {
    owner = "AyatanaIndicators";
    repo = "libayatana-common";
    rev = finalAttrs.version;
-    hash = "sha256-IBLJPgi+dKZKbR0Yjr2aNjCdpY+PE1k9QLSsk++6Wqo=";
+    hash = "sha256-qi3xsnZjqSz3I7O+xPxDnI91qDIA0XFJ3tCQQF84vIg=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/tepl/default.nix
+++ b/pkgs/development/libraries/tepl/default.nix
@ -1,14 +1,15 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchurl
 , meson
 , mesonEmulatorHook
 , ninja
-, amtk
 , gnome
 , gobject-introspection
 , gtk3
-, gtksourceview4
 , icu
+, libgedit-amtk
+, libgedit-gtksourceview
 , pkg-config
 , gtk-doc
 , docbook-xsl-nons
@ -16,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "tepl";
-  version = "6.4.0";
+  version = "6.8.0";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "XlayBmnQzwX6HWS1jIw0LFkVgSLcUYEA0JPVnfm4cyE=";
+    sha256 = "Rubl8b/bxS5ZVvBq3VdenHaXxnPVPTgD3+do9JC1YPA=";
  };

  strictDeps = true;
@ -42,9 +43,9 @@ stdenv.mkDerivation rec {
  ];

  propagatedBuildInputs = [
-    amtk
-    gtksourceview4
    gtk3
+    libgedit-amtk
+    libgedit-gtksourceview
  ];

  doCheck = false;
@ -62,7 +63,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://wiki.gnome.org/Projects/Tepl";
    description = "Text editor product line";
-    maintainers = [ maintainers.manveru ];
+    maintainers = with maintainers; [ manveru bobby285271 ];
    license = licenses.lgpl3Plus;
    platforms = platforms.linux;
  };
--- a/pkgs/development/python-modules/habluetooth/default.nix
+++ b/pkgs/development/python-modules/habluetooth/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "habluetooth";
-  version = "2.0.0";
+  version = "2.0.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "Bluetooth-Devices";
    repo = "habluetooth";
    rev = "refs/tags/v${version}";
-    hash = "sha256-JoSvI6L/hs6lZ1R3MEq1mPiJJf7JQahFd3d+PLqN2lw=";
+    hash = "sha256-vUq3WVo9dAt4Q/oid9ixLwI6v6jCavRU9FZYR6t6TzI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/jupyter-server-terminals/default.nix
+++ b/pkgs/development/python-modules/jupyter-server-terminals/default.nix
@ -16,14 +16,14 @@

 let self = buildPythonPackage rec {
  pname = "jupyter-server-terminals";
-  version = "0.5.0";
+  version = "0.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jupyter-server";
    repo = "jupyter_server_terminals";
    rev = "refs/tags/v${version}";
-    hash = "sha256-RT4rBSSDuIr3d8+hmbiF7rMn94Yr7ekocWeXww0tKlA=";
+    hash = "sha256-d++WnroL9nq/G8K5nMl98pXYNpXgdWRfCNoIbVoiD7U=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/lightgbm/default.nix
+++ b/pkgs/development/python-modules/lightgbm/default.nix
@ -1,4 +1,5 @@
 { lib
+, config
 , stdenv
 , buildPythonPackage
 , fetchPypi
@ -14,27 +15,37 @@
 , llvmPackages
 , numpy
 , scipy
-, scikit-learn
 , pythonOlder

+# optionals
+, cffi
+, dask
+, pandas
+, pyarrow
+, scikit-learn
+
 # optionals: gpu
 , boost
-, cudatoolkit
 , ocl-icd
 , opencl-headers
-, gpuSupport ? stdenv.isLinux
+, gpuSupport ? stdenv.isLinux && !cudaSupport
+, cudaSupport ? config.cudaSupport
+, cudaPackages
 }:

+assert gpuSupport -> cudaSupport != true;
+assert cudaSupport -> gpuSupport != true;
+
 buildPythonPackage rec {
  pname = "lightgbm";
-  version = "4.1.0";
-  format = "pyproject";
+  version = "4.2.0";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vuWd0mmpOwk/LGENSmaDp+qHxj0+o1xiISPOLAILKrw=";
+    hash = "sha256-ik0FHfKrIhiZihb3cS6EPunpbYsJ/7/MGFM9oSfg2gI=";
  };

  nativeBuildInputs = [
@ -43,6 +54,8 @@ buildPythonPackage rec {
    pathspec
    pyproject-metadata
    scikit-build-core
+  ] ++ lib.optionals cudaSupport [
+    cudaPackages.cuda_nvcc
  ];

  dontUseCmakeConfigure = true;
@ -51,23 +64,47 @@ buildPythonPackage rec {
    llvmPackages.openmp
  ]) ++ (lib.optionals gpuSupport [
    boost
-    cudatoolkit
    ocl-icd
    opencl-headers
-  ]);
+  ]) ++ lib.optionals cudaSupport [
+    cudaPackages.cuda_nvcc
+    cudaPackages.cuda_cudart
+  ];

  propagatedBuildInputs = [
    numpy
    scipy
-    scikit-learn
  ];

-  pypaBuildFlags = lib.optionalString gpuSupport "--config-setting=cmake.define.USE_CUDA=ON";
+  pypaBuildFlags = lib.optionals gpuSupport [
+    "--config-setting=cmake.define.USE_GPU=ON"
+  ] ++ lib.optionals cudaSupport [
+    "--config-setting=cmake.define.USE_CUDA=ON"
+  ];

  postConfigure = ''
    export HOME=$(mktemp -d)
  '';

+  passthru.optional-dependencies = {
+    arrow = [
+      cffi
+      pyarrow
+    ];
+    dask = [
+      dask
+      pandas
+    ] ++ dask.optional-dependencies.array
+      ++ dask.optional-dependencies.dataframe
+      ++ dask.optional-dependencies.distributed;
+    pandas = [
+      pandas
+    ];
+    scikit-learn = [
+      scikit-learn
+    ];
+  };
+
  # The pypi package doesn't distribute the tests from the GitHub
  # repository. It contains c++ tests which don't seem to wired up to
  # `make check`.
--- a/pkgs/development/python-modules/nbconvert/default.nix
+++ b/pkgs/development/python-modules/nbconvert/default.nix
@ -32,14 +32,14 @@ let
  };
 in buildPythonPackage rec {
  pname = "nbconvert";
-  version = "7.13.0";
+  version = "7.13.1";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-xvYchvylsovRf0+aMIJI5Z+itUkZ4VifbMNXXF3+wr0=";
+    hash = "sha256-Lcgmfb3+7c4tzTTJ4/G1GvGPQ8sQVUnRxaGBiewjuoU=";
  };

  # Add $out/share/jupyter to the list of paths that are used to search for
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@ -19,13 +19,14 @@
 , pillow

 # tests
+, fpdf2
 , pytestCheckHook
 , pytest-timeout
 }:

 buildPythonPackage rec {
  pname = "pypdf";
-  version = "3.16.0";
+  version = "3.17.4";
  format = "pyproject";

  src = fetchFromGitHub {
@ -34,7 +35,7 @@ buildPythonPackage rec {
    rev = "refs/tags/${version}";
    # fetch sample files used in tests
    fetchSubmodules = true;
-    hash = "sha256-vE5ujknMpufBuwWqtjkLegTRe4eDAvBVPCVM6It2pHQ=";
+    hash = "sha256-2FKTBN1VZX0LGiDEghix4DBt1gO9NRNB/lAUefu5EUA=";
  };

  outputs = [
@ -75,6 +76,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    (fpdf2.overridePythonAttrs { doCheck = false; })  # avoid reference loop
    pytestCheckHook
    pytest-timeout
  ] ++ passthru.optional-dependencies.full;
--- a/pkgs/development/python-modules/pyschlage/default.nix
+++ b/pkgs/development/python-modules/pyschlage/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pyschlage";
-  version = "2023.12.0";
+  version = "2023.12.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "dknowles2";
    repo = "pyschlage";
    rev = "refs/tags/${version}";
-    hash = "sha256-arodPjiigEx90W8ycneD8Ho6SLQaB9FfFtdV74fZp2w=";
+    hash = "sha256-RWM/76uqljWgKBWsMvGTggJllX0Qa9QaMM0hJbCvZgQ=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/scikit-survival/default.nix
+++ b/pkgs/development/python-modules/scikit-survival/default.nix
@ -17,12 +17,12 @@

 buildPythonPackage rec {
  pname = "scikit-survival";
-  version = "0.22.1";
+  version = "0.22.2";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Ft0Hg5iF9Sb9VSOsFMgfAvc4Nsam216kzt5Xv2iykv8=";
+    hash = "sha256-DpyGdQwN4VgGYmdREJlPB6NWiVWu8Ur4ExbysxADMr8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sensorpush-ble/default.nix
+++ b/pkgs/development/python-modules/sensorpush-ble/default.nix
@ -1,4 +1,5 @@
 { lib
+, bluetooth-data-tools
 , bluetooth-sensor-state-data
 , buildPythonPackage
 , fetchFromGitHub
@ -11,36 +12,37 @@

 buildPythonPackage rec {
  pname = "sensorpush-ble";
-  version = "1.5.5";
-  format = "pyproject";
+  version = "1.6.1";
+  pyproject = true;

  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "sensorpush-ble";
    rev = "refs/tags/v${version}";
-    hash = "sha256-17Yzpbcy/r+GlkLktgghehfAEboZHMbB/Dze1no4I80=";
+    hash = "sha256-g0UFEkTPpKqx5+hrM+bM6iQrG8EaMcFN01JdHEVH9VQ=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=sensorpush_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
  nativeBuildInputs = [
    poetry-core
  ];

  propagatedBuildInputs = [
+    bluetooth-data-tools
    bluetooth-sensor-state-data
    home-assistant-bluetooth
    sensor-state-data
  ];

  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+    pytestCheckHook  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=sensorpush_ble --cov-report=term-missing:skip-covered" ""
-  '';

  pythonImportsCheck = [
    "sensorpush_ble"
--- a/pkgs/development/python-modules/vacuum-map-parser-base/default.nix
+++ b/pkgs/development/python-modules/vacuum-map-parser-base/default.nix
@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, poetry-core
+, pillow
+}:
+
+buildPythonPackage rec {
+  pname = "vacuum-map-parser-base";
+  version = "0.1.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.11";
+
+  src = fetchFromGitHub {
+    owner = "PiotrMachowski";
+    repo = "Python-package-${pname}";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-moCWUPzn9stxehVEnjqpx8ILYhxzuy8QG+uxR53rCew=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  propagatedBuildInputs = [ pillow ];
+
+  # No tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "vacuum_map_parser_base" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/PiotrMachowski/Python-package-vacuum-map-parser-base";
+    description = "Common code for vacuum map parsers";
+    changelog = "https://github.com/PiotrMachowski/Python-package-vacuum-map-parser-base/releases/tag/v${version}";
+    maintainers = with maintainers; [ jamiemagee ];
+    license = licenses.asl20;
+  };
+}
--- a/pkgs/development/python-modules/vacuum-map-parser-roborock/default.nix
+++ b/pkgs/development/python-modules/vacuum-map-parser-roborock/default.nix
@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, poetry-core
+, pillow
+, vacuum-map-parser-base
+}:
+
+buildPythonPackage rec {
+  pname = "vacuum-map-parser-roborock";
+  version = "0.1.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.11";
+
+  src = fetchFromGitHub {
+    owner = "PiotrMachowski";
+    repo = "Python-package-${pname}";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cZNmoqzU73iF965abFeM6qgEVmg6j2kIQHDhj1MYQpE=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  propagatedBuildInputs = [
+    pillow
+    vacuum-map-parser-base
+  ];
+
+  # No tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "vacuum_map_parser_roborock" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/PiotrMachowski/Python-package-vacuum-map-parser-roborock";
+    description = "Functionalities for Roborock vacuum map parsing";
+    changelog = "https://github.com/PiotrMachowski/Python-package-vacuum-map-parser-roborock/releases/tag/v${version}";
+    maintainers = with maintainers; [ jamiemagee ];
+    license = licenses.asl20;
+  };
+}
--- a/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix
@ -1,4 +1,4 @@
-{ writeText, bazel, runLocal, bazelTest, distDir }:
+{ writeText, bazel, runLocal, bazelTest, distDir, extraBazelArgs ? ""}:

 # Tests that certain executables are available in bazel-executed bash shells.

@ -35,7 +35,7 @@ let
    inherit workspaceDir;

    bazelScript = ''
-      ${bazel}/bin/bazel build :tool_usage --distdir=${distDir}
+      ${bazel}/bin/bazel build :tool_usage --distdir=${distDir} ${extraBazelArgs}
      cp bazel-bin/output.txt $out
      echo "Testing content" && [ "$(cat $out | wc -l)" == "2" ] && echo "OK"
    '';
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/MODULE.bazel.lock
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/MODULE.bazel.lock
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/bazel-repository-cache.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/bazel-repository-cache.nix
@ -0,0 +1,139 @@
+{ lib
+, rnix-hashes
+, runCommand
+, fetchurl
+  # The path to the right MODULE.bazel.lock
+, lockfile
+  # A predicate used to select only some dependencies based on their name
+, requiredDepNamePredicate ? _: true
+, canonicalIds ? true
+}:
+let
+  modules = builtins.fromJSON (builtins.readFile lockfile);
+  modulesVersion = modules.lockFileVersion;
+
+  # a foldl' for json values
+  foldlJSON = op: acc: value:
+    let
+      # preorder, visit the current node first
+      acc' = op acc value;
+
+      # then visit child values, ignoring attribute names
+      children =
+        if builtins.isList value then
+          lib.foldl' (foldlJSON op) acc' value
+        else if builtins.isAttrs value then
+          lib.foldlAttrs (_acc: _name: foldlJSON op _acc) acc' value
+        else
+          acc';
+    in
+    # like foldl', force evaluation of intermediate results
+    builtins.seq acc' children;
+
+  # remove the "--" prefix, abusing undocumented negative substring length
+  sanitize = str:
+    if modulesVersion < 3
+    then builtins.substring 2 (-1) str
+    else str;
+
+  # We take any "attributes" object that has a "sha256" field. Every value
+  # under "attributes" is assumed to be an object, and all the "attributes"
+  # with a "sha256" field are assumed to have either a "urls" or "url" field.
+  #
+  # We add them to the `acc`umulator:
+  #
+  #    acc // {
+  #      "ffad2b06ef2e09d040...fc8e33706bb01634" = fetchurl {
+  #        name = "source";
+  #        sha256 = "ffad2b06ef2e09d040...fc8e33706bb01634";
+  #        urls = [
+  #          "https://mirror.bazel.build/github.com/golang/library.zip",
+  #          "https://github.com/golang/library.zip"
+  #        ];
+  #      };
+  #    }
+  #
+  # !REMINDER! This works on a best-effort basis, so try to keep it from
+  # failing loudly. Prefer warning traces.
+  extract_source = f: acc: value:
+    let
+      attrs = value.attributes;
+      entry = hash: urls: name: {
+        ${hash} = fetchurl {
+          name = "source"; # just like fetch*, to get some deduplication
+          inherit urls;
+          sha256 = hash;
+          passthru.sha256 = hash;
+          passthru.source_name = name;
+          passthru.urls = urls;
+        };
+      };
+      insert = acc: hash: urls:
+        let
+          validUrls = builtins.isList urls
+            && builtins.all (url: builtins.isString url && builtins.substring 0 4 url == "http") urls;
+          validName = builtins.isString attrs.name;
+          validHash = builtins.isString hash;
+          valid = validUrls && validName && validHash;
+        in
+        if valid then acc // entry hash urls attrs.name
+        else acc;
+      withToplevelValue = acc: insert acc
+        (attrs.integrity or attrs.sha256)
+        (attrs.urls or [ attrs.url ]);
+      # for http_file patches
+      withRemotePatches = acc: lib.foldlAttrs
+        (acc: url: hash: insert acc hash [ url ])
+        acc
+        (attrs.remote_patches or { });
+      # for _distdir_tar
+      withArchives = acc: lib.foldl'
+        (acc: archive: insert acc attrs.sha256.${archive} attrs.urls.${archive})
+        acc
+        (attrs.archives or [ ]);
+      addSources = acc: withToplevelValue (withRemotePatches (withArchives acc));
+    in
+    if builtins.isAttrs value && value ? attributes
+      && builtins.isAttrs attrs && attrs ? name
+      && (attrs ? sha256 || attrs ? integrity)
+      && (attrs ? urls || attrs ? url)
+      && f attrs.name
+    then addSources acc
+    else acc;
+
+  requiredSourcePredicate = n: requiredDepNamePredicate (sanitize n);
+  requiredDeps = foldlJSON (extract_source requiredSourcePredicate) { } modules;
+
+  command = ''
+    mkdir -p $out/content_addressable/sha256
+    cd $out
+  '' + lib.concatMapStrings
+    (drv: ''
+      filename=$(basename "${lib.head drv.urls}")
+      echo Bundling $filename ${lib.optionalString (drv?source_name) "from ${drv.source_name}"}
+
+      # 1. --repository_cache format:
+      # 1.a. A file under a content-hash directory
+      hash=$(${rnix-hashes}/bin/rnix-hashes --encoding BASE16 ${drv.sha256} | cut -f 2)
+      mkdir -p content_addressable/sha256/$hash
+      ln -sfn ${drv} content_addressable/sha256/$hash/file
+
+      # 1.b. a canonicalId marker based on the download urls
+      # Bazel uses these to avoid reusing a stale hash when the urls have changed.
+      canonicalId="${lib.concatStringsSep " " drv.urls}"
+      canonicalIdHash=$(echo -n "$canonicalId" | sha256sum | cut -d" " -f1)
+      echo -n "$canonicalId" > content_addressable/sha256/$hash/id-$canonicalIdHash
+
+      # 2. --distdir format:
+      # Just a file with the right basename
+      # Mostly to keep old tests happy, and because symlinks cost nothing.
+      # This is brittle because of expected file name conflicts
+      ln -sn ${drv} $filename || true
+    '')
+    (builtins.attrValues requiredDeps)
+  ;
+
+  repository_cache = runCommand "bazel-repository-cache" { } command;
+
+in
+repository_cache
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/cpp-test-MODULE.bazel
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/cpp-test-MODULE.bazel
@ -0,0 +1,7 @@
+###############################################################################
+# Bazel now uses Bzlmod by default to manage external dependencies.
+# Please consider migrating your external dependencies from WORKSPACE to MODULE.bazel.
+#
+# For more details, please check https://github.com/bazelbuild/bazel/issues/18958
+###############################################################################
+
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/cpp-test-MODULE.bazel.lock
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/cpp-test-MODULE.bazel.lock
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/cpp-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/cpp-test.nix
@ -0,0 +1,89 @@
+{
+  bazel
+, bazel-examples
+, bazelTest
+, callPackage
+, darwin
+, distDir
+, extraBazelArgs ? ""
+, Foundation ? null
+, lib
+, runLocal
+, runtimeShell
+, stdenv
+, symlinkJoin
+, writeScript
+, writeText
+}:
+
+let
+
+  localDistDir = callPackage ./bazel-repository-cache.nix {
+    lockfile = ./cpp-test-MODULE.bazel.lock;
+
+    # Take all the rules_ deps, bazel_ deps and their transitive dependencies,
+    # but none of the platform-specific binaries, as they are large and useless.
+    requiredDepNamePredicate = name:
+      null == builtins.match ".*(macos|osx|linux|win|apple|android|maven).*" name
+      && null != builtins.match "(platforms|com_google_|protobuf|rules_|bazel_).*" name ;
+  };
+
+  mergedDistDir = symlinkJoin {
+    name = "mergedDistDir";
+    paths = [ localDistDir distDir ];
+  };
+
+  toolsBazel = writeScript "bazel" ''
+    #! ${runtimeShell}
+
+    export CXX='${stdenv.cc}/bin/clang++'
+    export LD='${darwin.cctools}/bin/ld'
+    export LIBTOOL='${darwin.cctools}/bin/libtool'
+    export CC='${stdenv.cc}/bin/clang'
+
+    # XXX: hack for macosX, this flags disable bazel usage of xcode
+    # See: https://github.com/bazelbuild/bazel/issues/4231
+    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+
+    exec "$BAZEL_REAL" "$@"
+  '';
+
+  workspaceDir = runLocal "our_workspace" {} (''
+    cp -r ${bazel-examples}/cpp-tutorial/stage3 $out
+    find $out -type d -exec chmod 755 {} \;
+    cp ${./cpp-test-MODULE.bazel} $out/MODULE.bazel
+    cp ${./cpp-test-MODULE.bazel.lock} $out/MODULE.bazel.lock
+    echo > $out/WORSPACE
+  ''
+  + (lib.optionalString stdenv.isDarwin ''
+    mkdir $out/tools
+    cp ${toolsBazel} $out/tools/bazel
+  ''));
+
+  testBazel = bazelTest {
+    name = "bazel-test-cpp";
+    inherit workspaceDir;
+    bazelPkg = bazel;
+    bazelScript = ''
+      ${bazel}/bin/bazel build //... \
+        --enable_bzlmod \
+        --verbose_failures \
+        --repository_cache=${mergedDistDir} \
+        --curses=no \
+    '' + lib.optionalString (stdenv.isDarwin) ''
+        --cxxopt=-x --cxxopt=c++ \
+        --host_cxxopt=-x --host_cxxopt=c++ \
+    '' + lib.optionalString (stdenv.cc.isClang && stdenv ? cc.libcxx.cxxabi.libName) ''
+        --linkopt=-Wl,-l${stdenv.cc.libcxx.cxxabi.libName} \
+        --linkopt=-L${stdenv.cc.libcxx.cxxabi}/lib \
+        --host_linkopt=-Wl,-l${stdenv.cc.libcxx.cxxabi.libName} \
+        --host_linkopt=-L${stdenv.cc.libcxx.cxxabi}/lib \
+    '' + lib.optionalString (stdenv.isDarwin && Foundation != null) ''
+        --linkopt=-Wl,-F${Foundation}/Library/Frameworks \
+        --linkopt=-L${darwin.libobjc}/lib \
+    '' + ''
+
+    '';
+  };
+
+in testBazel
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/darwin_sleep.patch
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/darwin_sleep.patch
@ -0,0 +1,56 @@
+diff --git a/src/main/native/darwin/sleep_prevention_jni.cc b/src/main/native/darwin/sleep_prevention_jni.cc
+index 67c35b201e..e50a58320e 100644
+--- a/src/main/native/darwin/sleep_prevention_jni.cc
+++ b/src/main/native/darwin/sleep_prevention_jni.cc
+@@ -33,31 +33,13 @@ static int g_sleep_state_stack = 0;
+ static IOPMAssertionID g_sleep_state_assertion = kIOPMNullAssertionID;
+ 
+ int portable_push_disable_sleep() {
+-  std::lock_guard<std::mutex> lock(g_sleep_state_mutex);
+-  BAZEL_CHECK_GE(g_sleep_state_stack, 0);
+-  if (g_sleep_state_stack == 0) {
+-    BAZEL_CHECK_EQ(g_sleep_state_assertion, kIOPMNullAssertionID);
+-    CFStringRef reasonForActivity = CFSTR("build.bazel");
+-    IOReturn success = IOPMAssertionCreateWithName(
+-        kIOPMAssertionTypeNoIdleSleep, kIOPMAssertionLevelOn, reasonForActivity,
+-        &g_sleep_state_assertion);
+-    BAZEL_CHECK_EQ(success, kIOReturnSuccess);
+-  }
+-  g_sleep_state_stack += 1;
+-  return 0;
+  // Unreliable, disable for now
+  return -1;
+ }
+ 
+ int portable_pop_disable_sleep() {
+-  std::lock_guard<std::mutex> lock(g_sleep_state_mutex);
+-  BAZEL_CHECK_GT(g_sleep_state_stack, 0);
+-  g_sleep_state_stack -= 1;
+-  if (g_sleep_state_stack == 0) {
+-    BAZEL_CHECK_NE(g_sleep_state_assertion, kIOPMNullAssertionID);
+-    IOReturn success = IOPMAssertionRelease(g_sleep_state_assertion);
+-    BAZEL_CHECK_EQ(success, kIOReturnSuccess);
+-    g_sleep_state_assertion = kIOPMNullAssertionID;
+-  }
+-  return 0;
+  // Unreliable, disable for now
+  return -1;
+ }
+ 
+ }  // namespace blaze_jni
+diff --git a/src/main/native/darwin/system_suspension_monitor_jni.cc b/src/main/native/darwin/system_suspension_monitor_jni.cc
+index 3483aa7935..51782986ec 100644
+--- a/src/main/native/darwin/system_suspension_monitor_jni.cc
+++ b/src/main/native/darwin/system_suspension_monitor_jni.cc
+@@ -83,10 +83,7 @@ void portable_start_suspend_monitoring() {
+     // Register to receive system sleep notifications.
+     // Testing needs to be done manually. Use the logging to verify
+     // that sleeps are being caught here.
+-    suspend_state.connect_port = IORegisterForSystemPower(
+-        &suspend_state, &notifyPortRef, SleepCallBack, &notifierObject);
+-    BAZEL_CHECK_NE(suspend_state.connect_port, MACH_PORT_NULL);
+-    IONotificationPortSetDispatchQueue(notifyPortRef, queue);
+    // XXX: Unreliable, disable for now
+ 
+     // Register to deal with SIGCONT.
+     // We register for SIGCONT because we can't catch SIGSTOP.
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@ -0,0 +1,586 @@
+{ stdenv
+  # nix tooling and utilities
+, callPackage
+, lib
+, fetchurl
+, makeWrapper
+, writeTextFile
+, substituteAll
+, writeShellApplication
+, makeBinaryWrapper
+  # this package (through the fixpoint glass)
+, bazel_self
+  # native build inputs
+, runtimeShell
+, zip
+, unzip
+, bash
+, coreutils
+, which
+, gawk
+, gnused
+, gnutar
+, gnugrep
+, gzip
+, findutils
+, diffutils
+, gnupatch
+, file
+, installShellFiles
+, lndir
+, python3
+  # Apple dependencies
+, cctools
+, libcxx
+, sigtool
+, CoreFoundation
+, CoreServices
+, Foundation
+, IOKit
+  # Allow to independently override the jdks used to build and run respectively
+, buildJdk
+, runJdk
+  # Always assume all markers valid (this is needed because we remove markers; they are non-deterministic).
+  # Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
+, enableNixHacks ? false
+}:
+
+let
+  version = "7.0.0";
+  sourceRoot = ".";
+
+  src = fetchurl {
+    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
+    hash = "sha256-R35U9jdAAfQ5qUcbod6deCTa8SnblVEISezF4ZzogXA=";
+  };
+
+  # Use builtins.fetchurl to avoid IFD, in particular on hydra
+  #lockfile = builtins.fetchurl {
+  #  url = "https://raw.githubusercontent.com/bazelbuild/bazel/release-${version}/MODULE.bazel.lock";
+  #  sha256 = "sha256-5xPpCeWVKVp1s4RVce/GoW2+fH8vniz5G1MNI4uezpc=";
+  #};
+  # Use a local copy of the above lockfile to make ofborg happy.
+  lockfile = ./MODULE.bazel.lock;
+
+  # Two-in-one format
+  distDir = repoCache;
+  repoCache = callPackage ./bazel-repository-cache.nix {
+    inherit lockfile;
+
+    # We use the release tarball that already has everything bundled so we
+    # should not need any extra external deps. But our nonprebuilt java
+    # toolchains hack needs just one non bundled dep.
+    requiredDepNamePredicate = name:
+      null != builtins.match "rules_java~.*~toolchains~remote_java_tools" name;
+  };
+
+  defaultShellUtils =
+    # Keep this list conservative. For more exotic tools, prefer to use
+    # @rules_nixpkgs to pull in tools from the nix repository. Example:
+    #
+    # WORKSPACE:
+    #
+    #     nixpkgs_git_repository(
+    #         name = "nixpkgs",
+    #         revision = "def5124ec8367efdba95a99523dd06d918cb0ae8",
+    #     )
+    #
+    #     # This defines an external Bazel workspace.
+    #     nixpkgs_package(
+    #         name = "bison",
+    #         repositories = { "nixpkgs": "@nixpkgs//:default.nix" },
+    #     )
+    #
+    # some/BUILD.bazel:
+    #
+    #     genrule(
+    #        ...
+    #        cmd = "$(location @bison//:bin/bison) -other -args",
+    #        tools = [
+    #            ...
+    #            "@bison//:bin/bison",
+    #        ],
+    #     )
+    [
+      bash
+      coreutils
+      diffutils
+      file
+      findutils
+      gawk
+      gnugrep
+      gnupatch
+      gnused
+      gnutar
+      gzip
+      python3
+      unzip
+      which
+      zip
+    ];
+
+  defaultShellPath = lib.makeBinPath defaultShellUtils;
+
+  bashWithDefaultShellUtilsSh = writeShellApplication {
+    name = "bash";
+    runtimeInputs = defaultShellUtils;
+    text = ''
+      if [[ "$PATH" == "/no-such-path" ]]; then
+        export PATH=${defaultShellPath}
+      fi
+      exec ${bash}/bin/bash "$@"
+    '';
+  };
+
+  # Script-based interpreters in shebangs aren't guaranteed to work,
+  # especially on MacOS. So let's produce a binary
+  bashWithDefaultShellUtils = stdenv.mkDerivation {
+    name = "bash";
+    src = bashWithDefaultShellUtilsSh;
+    nativeBuildInputs = [ makeBinaryWrapper ];
+    buildPhase = ''
+      makeWrapper ${bashWithDefaultShellUtilsSh}/bin/bash $out/bin/bash
+    '';
+  };
+
+  platforms = lib.platforms.linux ++ lib.platforms.darwin;
+
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
+
+  system = if isDarwin then "darwin" else "linux";
+
+  # on aarch64 Darwin, `uname -m` returns "arm64"
+  arch = with stdenv.hostPlatform; if isDarwin && isAarch64 then "arm64" else parsed.cpu.name;
+
+  bazelRC = writeTextFile {
+    name = "bazel-rc";
+    text = ''
+      startup --server_javabase=${runJdk}
+
+      # Register nix-specific nonprebuilt java toolchains
+      build --extra_toolchains=@bazel_tools//tools/jdk:all
+      # and set bazel to use them by default
+      build --tool_java_runtime_version=local_jdk
+      build --java_runtime_version=local_jdk
+
+      # load default location for the system wide configuration
+      try-import /etc/bazel.bazelrc
+    '';
+  };
+
+in
+stdenv.mkDerivation rec {
+  pname = "bazel";
+  inherit version src;
+  inherit sourceRoot;
+
+  patches = [
+    # Remote java toolchains do not work on NixOS because they download binaries,
+    # so we need to use the @local_jdk//:jdk
+    # It could in theory be done by registering @local_jdk//:all toolchains,
+    # but these java toolchains still bundle binaries for ijar and stuff. So we
+    # need a nonprebult java toolchain (where ijar and stuff is built from
+    # sources).
+    # There is no such java toolchain, so we introduce one here.
+    # By providing no version information, the toolchain will set itself to the
+    # version of $JAVA_HOME/bin/java, just like the local_jdk does.
+    # To ensure this toolchain gets used, we can set
+    # --{,tool_}java_runtime_version=local_jdk and rely on the fact no java
+    # toolchain registered by default uses the local_jdk, making the selection
+    # unambiguous.
+    # This toolchain has the advantage that it can use any ambiant java jdk,
+    # not only a given, fixed version. It allows bazel to work correctly in any
+    # environment where JAVA_HOME is set to the right java version, like inside
+    # nix derivations.
+    # However, this patch breaks bazel hermeticity, by picking the ambiant java
+    # version instead of the more hermetic remote_jdk prebuilt binaries that
+    # rules_java provide by default. It also requires the user to have a
+    # JAVA_HOME set to the exact version required by the project.
+    # With more code, we could define java toolchains for all the java versions
+    # supported by the jdk as in rules_java's
+    # toolchains/local_java_repository.bzl, but this is not implemented here.
+    # To recover vanilla behavior, non NixOS users can set
+    # --{,tool_}java_runtime_version=remote_jdk, effectively reverting the
+    # effect of this patch and the fake system bazelrc.
+    ./java_toolchain.patch
+
+    # Bazel integrates with apple IOKit to inhibit and track system sleep.
+    # Inside the darwin sandbox, these API calls are blocked, and bazel
+    # crashes. It seems possible to allow these APIs inside the sandbox, but it
+    # feels simpler to patch bazel not to use it at all. So our bazel is
+    # incapable of preventing system sleep, which is a small price to pay to
+    # guarantee that it will always run in any nix context.
+    #
+    # See also ./bazel_darwin_sandbox.patch in bazel_5. That patch uses
+    # NIX_BUILD_TOP env var to conditionnally disable sleep features inside the
+    # sandbox. Oddly, bazel_6 does not need that patch :-/.
+    #
+    # If you want to investigate the sandbox profile path,
+    # IORegisterForSystemPower can be allowed with
+    #
+    #     propagatedSandboxProfile = ''
+    #       (allow iokit-open (iokit-user-client-class "RootDomainUserClient"))
+    #     '';
+    #
+    # I do not know yet how to allow IOPMAssertion{CreateWithName,Release}
+    ./darwin_sleep.patch
+
+    # Fix DARWIN_XCODE_LOCATOR_COMPILE_COMMAND by removing multi-arch support.
+    # Nixpkgs toolcahins do not support that (yet?) and get confused.
+    # Also add an explicit /usr/bin prefix that will be patched below.
+    ./xcode_locator.patch
+
+    # On Darwin, the last argument to gcc is coming up as an empty string. i.e: ''
+    # This is breaking the build of any C target. This patch removes the last
+    # argument if it's found to be an empty string.
+    ../trim-last-argument-to-gcc-if-empty.patch
+
+    # --experimental_strict_action_env (which may one day become the default
+    # see bazelbuild/bazel#2574) hardcodes the default
+    # action environment to a non hermetic value (e.g. "/usr/local/bin").
+    # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
+    # So we are replacing this bazel paths by defaultShellPath,
+    # improving hermeticity and making it work in nixos.
+    (substituteAll {
+      src = ../strict_action_env.patch;
+      strictActionEnvPatch = defaultShellPath;
+    })
+
+    # bazel reads its system bazelrc in /etc
+    # override this path to a builtin one
+    (substituteAll {
+      src = ../bazel_rc.patch;
+      bazelSystemBazelRCPath = bazelRC;
+    })
+  ]
+  # See enableNixHacks argument above.
+  ++ lib.optional enableNixHacks ./nix-hacks.patch;
+
+  postPatch =
+    let
+      # Workaround for https://github.com/NixOS/nixpkgs/issues/166205
+      nixpkgs166205ldflag = lib.optionalString stdenv.cc.isClang "-l${stdenv.cc.libcxx.cxxabi.libName}";
+      darwinPatches = ''
+        bazelLinkFlags () {
+          eval set -- "$NIX_LDFLAGS"
+          local flag
+          for flag in "$@"; do
+            printf ' -Wl,%s' "$flag"
+          done
+        }
+
+        # Explicitly configure gcov since we don't have it on Darwin, so autodetection fails
+        export GCOV=${coreutils}/bin/false
+
+        # Framework search paths aren't added by bintools hook
+        # https://github.com/NixOS/nixpkgs/pull/41914
+        export NIX_LDFLAGS+=" -F${CoreFoundation}/Library/Frameworks -F${CoreServices}/Library/Frameworks -F${Foundation}/Library/Frameworks -F${IOKit}/Library/Frameworks ${nixpkgs166205ldflag}"
+
+        # libcxx includes aren't added by libcxx hook
+        # https://github.com/NixOS/nixpkgs/pull/41589
+        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${lib.getDev libcxx}/include/c++/v1"
+        # for CLang 16 compatibility in external/upb dependency
+        export NIX_CFLAGS_COMPILE+=" -Wno-gnu-offsetof-extensions"
+
+        # This variable is used by bazel to propagate env vars for homebrew,
+        # which is exactly what we need too.
+        export HOMEBREW_RUBY_PATH="foo"
+
+        # don't use system installed Xcode to run clang, use Nix clang instead
+        sed -i -E \
+          -e "s;/usr/bin/xcrun (--sdk macosx )?clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $(bazelLinkFlags) -framework CoreFoundation;g" \
+          -e "s;/usr/bin/codesign;CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate ${sigtool}/bin/codesign;" \
+          scripts/bootstrap/compile.sh \
+          tools/osx/BUILD
+
+        # nixpkgs's libSystem cannot use pthread headers directly, must import GCD headers instead
+        sed -i -e "/#include <pthread\/spawn.h>/i #include <dispatch/dispatch.h>" src/main/cpp/blaze_util_darwin.cc
+
+        # XXX: What do these do ?
+        sed -i -e 's;"/usr/bin/libtool";_find_generic(repository_ctx, "libtool", "LIBTOOL", overriden_tools);g' tools/cpp/unix_cc_configure.bzl
+        wrappers=( tools/cpp/osx_cc_wrapper.sh.tpl )
+        for wrapper in "''${wrappers[@]}"; do
+          sedVerbose $wrapper \
+            -e "s,/usr/bin/xcrun install_name_tool,${cctools}/bin/install_name_tool,g"
+        done
+      '';
+
+      genericPatches = ''
+        # unzip builtins_bzl.zip so the contents get patched
+        builtins_bzl=src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl
+        unzip ''${builtins_bzl}.zip -d ''${builtins_bzl}_zip >/dev/null
+        rm ''${builtins_bzl}.zip
+        builtins_bzl=''${builtins_bzl}_zip/builtins_bzl
+
+        # md5sum is part of coreutils
+        sed -i 's|/sbin/md5|md5sum|g' src/BUILD third_party/ijar/test/testenv.sh
+
+        echo
+        echo "Substituting */bin/* hardcoded paths in src/main/java/com/google/devtools"
+        # Prefilter the files with grep for speed
+        grep -rlZ /bin/ \
+          src/main/java/com/google/devtools \
+          src/main/starlark/builtins_bzl/common/python \
+          tools \
+        | while IFS="" read -r -d "" path; do
+          # If you add more replacements here, you must change the grep above!
+          # Only files containing /bin are taken into account.
+          sedVerbose "$path" \
+            -e 's!/usr/local/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+            -e 's!/usr/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+            -e 's!/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+            -e 's!/usr/bin/env bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+            -e 's!/usr/bin/env python2!${python3}/bin/python!g' \
+            -e 's!/usr/bin/env python!${python3}/bin/python!g' \
+            -e 's!/usr/bin/env!${coreutils}/bin/env!g' \
+            -e 's!/bin/true!${coreutils}/bin/true!g'
+        done
+
+        # Fixup scripts that generate scripts. Not fixed up by patchShebangs below.
+        sedVerbose scripts/bootstrap/compile.sh \
+          -e 's!/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+          -e 's!shasum -a 256!sha256sum!g'
+
+        # Augment bundled repository_cache with our extra paths
+        ${lndir}/bin/lndir ${repoCache}/content_addressable \
+          $PWD/derived/repository_cache/content_addressable
+
+        # Add required flags to bazel command line.
+        # XXX: It would suit a bazelrc file better, but I found no way to pass it.
+        #      It seems that bazel bootstrapping ignores it.
+        #      Passing EXTRA_BAZEL_ARGS is tricky due to quoting.
+        sedVerbose compile.sh \
+          -e "/bazel_build /a\  --verbose_failures \\\\" \
+          -e "/bazel_build /a\  --curses=no \\\\" \
+          -e "/bazel_build /a\  --features=-layering_check \\\\" \
+          -e "/bazel_build /a\  --experimental_strict_java_deps=off \\\\" \
+          -e "/bazel_build /a\  --strict_proto_deps=off \\\\" \
+          -e "/bazel_build /a\  --toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type' \\\\" \
+          -e "/bazel_build /a\  --tool_java_runtime_version=local_jdk_17 \\\\" \
+          -e "/bazel_build /a\  --java_runtime_version=local_jdk_17 \\\\" \
+          -e "/bazel_build /a\  --tool_java_language_version=17 \\\\" \
+          -e "/bazel_build /a\  --java_language_version=17 \\\\" \
+          -e "/bazel_build /a\  --extra_toolchains=@bazel_tools//tools/jdk:all \\\\" \
+
+        # Also build parser_deploy.jar with bootstrap bazel
+        # TODO: Turn into a proper patch
+        sedVerbose compile.sh \
+          -e 's!bazel_build !bazel_build src/tools/execlog:parser_deploy.jar !' \
+          -e 's!clear_log!cp $(get_bazel_bin_path)/src/tools/execlog/parser_deploy.jar output\nclear_log!'
+
+        # append the PATH with defaultShellPath in tools/bash/runfiles/runfiles.bash
+        echo "PATH=\$PATH:${defaultShellPath}" >> runfiles.bash.tmp
+        cat tools/bash/runfiles/runfiles.bash >> runfiles.bash.tmp
+        mv runfiles.bash.tmp tools/bash/runfiles/runfiles.bash
+
+        # reconstruct the now patched builtins_bzl.zip
+        pushd src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl_zip &>/dev/null
+          zip ../builtins_bzl.zip $(find builtins_bzl -type f) >/dev/null
+          rm -rf builtins_bzl
+        popd &>/dev/null
+        rmdir src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl_zip
+
+        patchShebangs . >/dev/null
+      '';
+    in
+    ''
+      function sedVerbose() {
+        local path=$1; shift;
+        sed -i".bak-nix" "$path" "$@"
+        diff -U0 "$path.bak-nix" "$path" | sed "s/^/  /" || true
+        rm -f "$path.bak-nix"
+      }
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin darwinPatches
+    + genericPatches;
+
+  meta = with lib; {
+    homepage = "https://github.com/bazelbuild/bazel/";
+    description = "Build tool that builds code quickly and reliably";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # source bundles dependencies as jars
+    ];
+    license = licenses.asl20;
+    maintainers = lib.teams.bazel.members;
+    inherit platforms;
+  };
+
+  # Bazel starts a local server and needs to bind a local address.
+  __darwinAllowLocalNetworking = true;
+
+  buildInputs = [ buildJdk bashWithDefaultShellUtils ] ++ defaultShellUtils;
+
+  # when a command can’t be found in a bazel build, you might also
+  # need to add it to `defaultShellPath`.
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+    python3
+    unzip
+    which
+    zip
+    python3.pkgs.absl-py # Needed to build fish completion
+  ] ++ lib.optionals (stdenv.isDarwin) [
+    cctools
+    libcxx
+    Foundation
+    CoreFoundation
+    CoreServices
+  ];
+
+  # Bazel makes extensive use of symlinks in the WORKSPACE.
+  # This causes problems with infinite symlinks if the build output is in the same location as the
+  # Bazel WORKSPACE. This is why before executing the build, the source code is moved into a
+  # subdirectory.
+  # Failing to do this causes "infinite symlink expansion detected"
+  preBuildPhases = [ "preBuildPhase" ];
+  preBuildPhase = ''
+    mkdir bazel_src
+    shopt -s dotglob extglob
+    mv !(bazel_src) bazel_src
+  '';
+  buildPhase = ''
+    runHook preBuild
+
+    # Increasing memory during compilation might be necessary.
+    # export BAZEL_JAVAC_OPTS="-J-Xmx2g -J-Xms200m"
+
+    # If EMBED_LABEL isn't set, it'd be auto-detected from CHANGELOG.md
+    # and `git rev-parse --short HEAD` which would result in
+    # "3.7.0- (@non-git)" due to non-git build and incomplete changelog.
+    # Actual bazel releases use scripts/release/common.sh which is based
+    # on branch/tag information which we don't have with tarball releases.
+    # Note that .bazelversion is always correct and is based on bazel-*
+    # executable name, version checks should work fine
+    export EMBED_LABEL="${version}- (@non-git)"
+    echo "Stage 1 - Running bazel bootstrap script"
+    ${bash}/bin/bash ./bazel_src/compile.sh
+
+    # XXX: get rid of this, or move it to another stage.
+    # It is plain annoying when builds fail.
+    echo "Stage 2 - Generate bazel completions"
+    ${bash}/bin/bash ./bazel_src/scripts/generate_bash_completion.sh \
+        --bazel=./bazel_src/output/bazel \
+        --output=./bazel_src/output/bazel-complete.bash \
+        --prepend=./bazel_src/scripts/bazel-complete-header.bash \
+        --prepend=./bazel_src/scripts/bazel-complete-template.bash
+    ${python3}/bin/python3 ./bazel_src/scripts/generate_fish_completion.py \
+        --bazel=./bazel_src/output/bazel \
+        --output=./bazel_src/output/bazel-complete.fish
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    # official wrapper scripts that searches for $WORKSPACE_ROOT/tools/bazel if
+    # it can’t find something in tools, it calls
+    # $out/bin/bazel-{version}-{os_arch} The binary _must_ exist with this
+    # naming if your project contains a .bazelversion file.
+    cp ./bazel_src/scripts/packages/bazel.sh $out/bin/bazel
+    versionned_bazel="$out/bin/bazel-${version}-${system}-${arch}"
+    mv ./bazel_src/output/bazel "$versionned_bazel"
+    wrapProgram "$versionned_bazel" --suffix PATH : ${defaultShellPath}
+
+    mkdir $out/share
+    cp ./bazel_src/output/parser_deploy.jar $out/share/parser_deploy.jar
+    cat <<EOF > $out/bin/bazel-execlog
+    #!${runtimeShell} -e
+    ${runJdk}/bin/java -jar $out/share/parser_deploy.jar \$@
+    EOF
+    chmod +x $out/bin/bazel-execlog
+
+    # shell completion files
+    installShellCompletion --bash \
+      --name bazel.bash \
+      ./bazel_src/output/bazel-complete.bash
+    installShellCompletion --zsh \
+      --name _bazel \
+      ./bazel_src/scripts/zsh_completion/_bazel
+    installShellCompletion --fish \
+      --name bazel.fish \
+      ./bazel_src/output/bazel-complete.fish
+  '';
+
+  installCheckPhase = ''
+    export TEST_TMPDIR=$(pwd)
+
+    hello_test () {
+      $out/bin/bazel test \
+        --test_output=errors \
+        examples/cpp:hello-success_test \
+        examples/java-native/src/test/java/com/example/myproject:hello
+    }
+
+    cd ./bazel_src
+
+    # If .bazelversion file is present in dist files and doesn't match `bazel` version
+    # running `bazel` command within bazel_src will fail.
+    # Let's remove .bazelversion within the test, if present it is meant to indicate bazel version
+    # to compile bazel with, not version of bazel to be built and tested.
+    rm -f .bazelversion
+
+    # test whether $WORKSPACE_ROOT/tools/bazel works
+
+    mkdir -p tools
+    cat > tools/bazel <<"EOF"
+    #!${runtimeShell} -e
+    exit 1
+    EOF
+    chmod +x tools/bazel
+
+    # first call should fail if tools/bazel is used
+    ! hello_test
+
+    cat > tools/bazel <<"EOF"
+    #!${runtimeShell} -e
+    exec "$BAZEL_REAL" "$@"
+    EOF
+
+    # second call succeeds because it defers to $out/bin/bazel-{version}-{os_arch}
+    hello_test
+
+    ## Test that the GSON serialisation files are present
+    gson_classes=$(unzip -l $(bazel info install_base)/A-server.jar | grep GsonTypeAdapter.class | wc -l)
+    if [ "$gson_classes" -lt 10 ]; then
+      echo "Missing GsonTypeAdapter classes in A-server.jar. Lockfile generation will not work"
+      exit 1
+    fi
+
+    runHook postInstall
+  '';
+
+  # Save paths to hardcoded dependencies so Nix can detect them.
+  # This is needed because the templates get tar’d up into a .jar.
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo "${defaultShellPath}" >> $out/nix-support/depends
+    # The string literal specifying the path to the bazel-rc file is sometimes
+    # stored non-contiguously in the binary due to gcc optimisations, which leads
+    # Nix to miss the hash when scanning for dependencies
+    echo "${bazelRC}" >> $out/nix-support/depends
+  '' + lib.optionalString stdenv.isDarwin ''
+    echo "${cctools}" >> $out/nix-support/depends
+  '';
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  passthru = {
+    # Additional tests that check bazel’s functionality. Execute
+    #
+    #     nix-build . -A bazel_7.tests
+    #
+    # in the nixpkgs checkout root to exercise them locally.
+    tests = callPackage ./tests.nix {
+      inherit Foundation bazel_self lockfile repoCache;
+    };
+
+    # For ease of debugging
+    inherit distDir repoCache lockfile;
+  };
+}
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/java-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/java-test.nix
@ -0,0 +1,89 @@
+{ bazel
+, bazelTest
+, bazel-examples
+, stdenv
+, symlinkJoin
+, callPackage
+, darwin
+, extraBazelArgs ? ""
+, lib
+, openjdk8
+, jdk11_headless
+, runLocal
+, runtimeShell
+, writeScript
+, writeText
+, repoCache ? "unused"
+, distDir
+}:
+
+let
+
+  localDistDir = callPackage ./bazel-repository-cache.nix {
+    lockfile = ./cpp-test-MODULE.bazel.lock;
+
+    # Take all the rules_ deps, bazel_ deps and their transitive dependencies,
+    # but none of the platform-specific binaries, as they are large and useless.
+    requiredDepNamePredicate = name:
+      null == builtins.match ".*(macos|osx|linux|win|apple|android|maven).*" name
+      && null != builtins.match "(platforms|com_google_|protobuf|rules_|bazel_).*" name ;
+  };
+
+  mergedDistDir = symlinkJoin {
+    name = "mergedDistDir";
+    paths = [ localDistDir distDir ];
+  };
+
+  toolsBazel = writeScript "bazel" ''
+    #! ${runtimeShell}
+
+    export CXX='${stdenv.cc}/bin/clang++'
+    export LD='${darwin.cctools}/bin/ld'
+    export LIBTOOL='${darwin.cctools}/bin/libtool'
+    export CC='${stdenv.cc}/bin/clang'
+
+    # XXX: hack for macosX, this flags disable bazel usage of xcode
+    # See: https://github.com/bazelbuild/bazel/issues/4231
+    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+
+    exec "$BAZEL_REAL" "$@"
+  '';
+
+  workspaceDir = runLocal "our_workspace" {} (''
+    cp -r ${bazel-examples}/java-tutorial $out
+    find $out -type d -exec chmod 755 {} \;
+    cp ${./cpp-test-MODULE.bazel} $out/MODULE.bazel
+    cp ${./cpp-test-MODULE.bazel.lock} $out/MODULE.bazel.lock
+  ''
+  + (lib.optionalString stdenv.isDarwin ''
+    mkdir $out/tools
+    cp ${toolsBazel} $out/tools/bazel
+  ''));
+
+  testBazel = bazelTest {
+    name = "bazel-test-java";
+    inherit workspaceDir;
+    bazelPkg = bazel;
+    buildInputs = [ (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless) ];
+    bazelScript = ''
+      ${bazel}/bin/bazel \
+        run \
+        --announce_rc \
+        ${lib.optionalString (lib.strings.versionOlder "5.0.0" bazel.version)
+          "--toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type'"
+        } \
+        --distdir=${mergedDistDir} \
+        --repository_cache=${mergedDistDir} \
+        --verbose_failures \
+        --curses=no \
+        --strict_java_deps=off \
+        //:ProjectRunner \
+    '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
+        --host_javabase='@local_jdk//:jdk' \
+        --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
+        --javabase='@local_jdk//:jdk' \
+    '' + extraBazelArgs;
+  };
+
+in testBazel
+
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/java_toolchain.patch
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/java_toolchain.patch
@ -0,0 +1,30 @@
+diff --git a/tools/jdk/BUILD.tools b/tools/jdk/BUILD.tools
+index a8af76e90c..7f8b030f63 100644
+--- a/tools/jdk/BUILD.tools
+++ b/tools/jdk/BUILD.tools
+@@ -146,6 +146,25 @@ py_test(
+     ],
+ )
+ 
+##### Nonprebuilt toolchains definitions for NixOS and nix build sandboxes ####
+
+load("@rules_java//toolchains:default_java_toolchain.bzl", "default_java_toolchain", "NONPREBUILT_TOOLCHAIN_CONFIGURATION")
+
+[
+    default_java_toolchain(
+        name = "nonprebuilt_toolchain_java" + str(version),
+        configuration = NONPREBUILT_TOOLCHAIN_CONFIGURATION,
+        java_runtime = "@local_jdk//:jdk",
+        source_version = str(version),
+        target_version = str(version),
+    )
+    # Ideally we would only define toolchains for the java versions that the
+    # local jdk supports. But we cannot access this information in a BUILD
+    # file, and this is a hack anyway, so just pick a large enough upper bound.
+    # At the current pace, java <= 30 should cover all realeases until 2028.
+    for version in range(8, 31)
+]
+
+ #### Aliases to rules_java to keep backward-compatibility (begin) ####
+ 
+ TARGET_NAMES = [
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/nix-hacks.patch
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/nix-hacks.patch
@ -0,0 +1,51 @@
+diff --git a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+index 845c8b6aa3..6f07298bd0 100644
+--- a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+@@ -171,14 +171,8 @@ public final class RepositoryDelegatorFunction implements SkyFunction {
+ 
+     DigestWriter digestWriter = new DigestWriter(directories, repositoryName, rule);
+     if (shouldUseCachedRepos(env, handler, repoRoot, rule)) {
+-      // Make sure marker file is up-to-date; correctly describes the current repository state
+-      byte[] markerHash = digestWriter.areRepositoryAndMarkerFileConsistent(handler, env);
+-      if (env.valuesMissing()) {
+-        return null;
+-      }
+-      if (markerHash != null) {
+-        return RepositoryDirectoryValue.builder().setPath(repoRoot).setDigest(markerHash).build();
+-      }
+      // Nix hack: Always consider cached dirs as up-to-date
+      return RepositoryDirectoryValue.builder().setPath(repoRoot).setDigest(digestWriter.writeMarkerFile()).build();
+     }
+ 
+     /* At this point: This is a force fetch, a local repository, OR The repository cache is old or
+@@ -512,11 +506,12 @@ public final class RepositoryDelegatorFunction implements SkyFunction {
+         builder.append(escape(key)).append(" ").append(escape(value)).append("\n");
+       }
+       String content = builder.toString();
+-      try {
+-        FileSystemUtils.writeContent(markerPath, UTF_8, content);
+-      } catch (IOException e) {
+-        throw new RepositoryFunctionException(e, Transience.TRANSIENT);
+-      }
+      // Nix hack: Do not write these pesky marker files
+      //try {
+      //  FileSystemUtils.writeContent(markerPath, UTF_8, content);
+      //} catch (IOException e) {
+      //  throw new RepositoryFunctionException(e, Transience.TRANSIENT);
+      //}
+       return new Fingerprint().addString(content).digestAndReset();
+     }
+ 
+diff --git a/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java b/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java
+index 649647c5f2..64d05b530c 100644
+--- a/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java
+++ b/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java
+@@ -165,7 +165,6 @@ public class JavaSubprocessFactory implements SubprocessFactory {
+     }
+     builder.command(argv);
+     if (params.getEnv() != null) {
+-      builder.environment().clear();
+       builder.environment().putAll(params.getEnv());
+     }
+ 
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/protobuf-test.MODULE.bazel.lock
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/protobuf-test.MODULE.bazel.lock
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/protobuf-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/protobuf-test.nix
@ -0,0 +1,171 @@
+{ bazel
+, Foundation
+, bazelTest
+, callPackage
+, darwin
+, distDir
+, extraBazelArgs ? ""
+, fetchFromGitHub
+, fetchurl
+, jdk11_headless
+, lib
+, libtool
+, lndir
+, openjdk8
+, repoCache
+, runLocal
+, runtimeShell
+, stdenv
+, symlinkJoin
+, tree
+, writeScript
+, writeText
+}:
+
+# This test uses bzlmod because I could not make it work without it.
+# This is good, because we have at least one test with bzlmod enabled.
+# However, we have to create our own lockfile, wich is quite a big file by
+# itself.
+
+let
+  # To update the lockfile, run
+  #    $ nix-shell -A bazel_7.tests.vanilla.protobuf
+  #    [nix-shell]$ genericBuild # (wait a bit for failure, or kill it)
+  #    [nix-shell]$ rm -f MODULE.bazel.lock
+  #    [nix-shell]$ bazel mod deps --lockfile_mode=update
+  #    [nix-shell]$ cp MODULE.bazel.lock $HERE/protobuf-test.MODULE.bazel.lock
+  lockfile = ./protobuf-test.MODULE.bazel.lock;
+
+  protobufRepoCache = callPackage ./bazel-repository-cache.nix {
+    # We are somewhat lucky that bazel's own lockfile works for our tests.
+    # Use extraDeps if the tests need things that are not in that lockfile.
+    # But most test dependencies are bazel's builtin deps, so that at least aligns.
+    inherit lockfile;
+
+    # Remove platform-specific binaries, as they are large and useless.
+    requiredDepNamePredicate = name:
+      null == builtins.match ".*(macos|osx|linux|win|android|maven).*" name;
+  };
+
+  mergedRepoCache = symlinkJoin {
+    name = "mergedDistDir";
+    paths = [ protobufRepoCache distDir ];
+  };
+
+  MODULE = writeText "MODULE.bazel" ''
+    bazel_dep(name = "rules_proto", version = "5.3.0-21.7")
+    bazel_dep(name = "protobuf", version = "21.7")
+    bazel_dep(name = "zlib", version = "1.3")
+  '';
+
+  WORKSPACE = writeText "WORKSPACE" ''
+    # Empty, we use bzlmod instead
+  '';
+
+  personProto = writeText "person.proto" ''
+    syntax = "proto3";
+
+    package person;
+
+    message Person {
+      string name = 1;
+      int32 id = 2;
+      string email = 3;
+    }
+  '';
+
+  personBUILD = writeText "BUILD" ''
+    load("@rules_proto//proto:defs.bzl", "proto_library")
+
+    proto_library(
+        name = "person_proto",
+        srcs = ["person.proto"],
+        visibility = ["//visibility:public"],
+    )
+
+    java_proto_library(
+        name = "person_java_proto",
+        deps = [":person_proto"],
+    )
+
+    cc_proto_library(
+        name = "person_cc_proto",
+        deps = [":person_proto"],
+    )
+  '';
+
+  toolsBazel = writeScript "bazel" ''
+    #! ${runtimeShell}
+
+    export CXX='${stdenv.cc}/bin/clang++'
+    export LD='${darwin.cctools}/bin/ld'
+    export LIBTOOL='${darwin.cctools}/bin/libtool'
+    export CC='${stdenv.cc}/bin/clang'
+
+    # XXX: hack for macosX, this flags disable bazel usage of xcode
+    # See: https://github.com/bazelbuild/bazel/issues/4231
+    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+
+    export HOMEBREW_RUBY_PATH="foo"
+
+    exec "$BAZEL_REAL" "$@"
+  '';
+
+  workspaceDir = runLocal "our_workspace" { } (''
+    mkdir $out
+    cp ${MODULE} $out/MODULE.bazel
+    cp ${./protobuf-test.MODULE.bazel.lock} $out/MODULE.bazel.lock
+    #cp ${WORKSPACE} $out/WORKSPACE
+    touch $out/WORKSPACE
+    touch $out/BUILD.bazel
+    mkdir $out/person
+    cp ${personProto} $out/person/person.proto
+    cp ${personBUILD} $out/person/BUILD.bazel
+  ''
+  + (lib.optionalString stdenv.isDarwin ''
+    echo 'tools bazel created'
+    mkdir $out/tools
+    install ${toolsBazel} $out/tools/bazel
+  ''));
+
+  testBazel = bazelTest {
+    name = "bazel-test-protocol-buffers";
+    inherit workspaceDir;
+    bazelPkg = bazel;
+    buildInputs = [
+      (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless)
+      tree
+      bazel
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      Foundation
+      darwin.objc4
+    ];
+
+    bazelScript = ''
+      ${bazel}/bin/bazel \
+        build \
+        --repository_cache=${mergedRepoCache} \
+        ${extraBazelArgs} \
+        --enable_bzlmod \
+        --lockfile_mode=error \
+        --verbose_failures \
+        //... \
+    '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
+        --host_javabase='@local_jdk//:jdk' \
+        --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
+        --javabase='@local_jdk//:jdk' \
+    '' + lib.optionalString (stdenv.isDarwin) ''
+        --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
+    '' + lib.optionalString (stdenv.cc.isClang && stdenv ? cc.libcxx.cxxabi.libName) ''
+        --linkopt=-Wl,-l${stdenv.cc.libcxx.cxxabi.libName} \
+        --linkopt=-L${stdenv.cc.libcxx.cxxabi}/lib \
+        --host_linkopt=-Wl,-l${stdenv.cc.libcxx.cxxabi.libName} \
+        --host_linkopt=-L${stdenv.cc.libcxx.cxxabi}/lib \
+    '' + ''
+
+    '';
+  };
+
+in
+testBazel
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/strict_proto_deps.patch
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/strict_proto_deps.patch
@ -0,0 +1,21 @@
+diff --git a/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl b/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
+index e2118aabea..6a33f03472 100644
+--- a/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
+++ b/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
+@@ -117,6 +117,7 @@ def java_compile_for_protos(ctx, output_jar_suffix, source_jar = None, deps = []
+             deps = deps,
+             exports = exports,
+             output_source_jar = source_jar,
+            strict_deps = ctx.fragments.proto.strict_proto_deps(),
+             injecting_rule_kind = injecting_rule_kind,
+             javac_opts = java_toolchain.compatible_javacopts("proto"),
+             enable_jspecify = False,
+@@ -140,7 +141,7 @@ bazel_java_proto_aspect = aspect(
+     attr_aspects = ["deps", "exports"],
+     required_providers = [ProtoInfo],
+     provides = [JavaInfo, JavaProtoAspectInfo],
+-    fragments = ["java"],
+    fragments = ["java", "proto"],
+ )
+ 
+ def bazel_java_proto_library_rule(ctx):
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/tests.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/tests.nix
@ -0,0 +1,173 @@
+{ lib
+  # tooling
+, callPackage
+, fetchFromGitHub
+, newScope
+, recurseIntoAttrs
+, runCommandCC
+, stdenv
+  # inputs
+, Foundation
+, bazel_self
+, lr
+, xe
+, lockfile
+, ...
+}:
+let
+  inherit (stdenv.hostPlatform) isDarwin;
+
+  testsDistDir = testsRepoCache;
+  testsRepoCache = callPackage ./bazel-repository-cache.nix {
+    # Bazel builtin tools versions are hard-coded in bazel. If the project
+    # lockfile has not been generated by the same bazel version as this one
+    # then it may be missing depeendencies for builtin tools. Export
+    # dependencies from baazel itself here, and let projects also import their
+    # own if need be. It's just a symlinkJoin after all. See ./cpp-test.nix
+    inherit lockfile;
+
+    # Take all the rules_ deps, bazel_ deps and their transitive dependencies,
+    # but none of the platform-specific binaries, as they are large and useless.
+    requiredDepNamePredicate = name:
+      name == "_main~bazel_build_deps~workspace_repo_cache"
+      || null == builtins.match ".*(macos|osx|linux|win|android|maven).*" name
+      && null != builtins.match "(platforms|com_google_|protobuf|rules_|.*bazel_|apple_support).*" name;
+  };
+
+  runLocal = name: attrs: script:
+    let
+      attrs' = removeAttrs attrs [ "buildInputs" ];
+      buildInputs = attrs.buildInputs or [ ];
+    in
+    runCommandCC name
+      ({
+        inherit buildInputs;
+        preferLocalBuild = true;
+        meta.platforms = bazel_self.meta.platforms;
+      } // attrs')
+      script;
+
+  # bazel wants to extract itself into $install_dir/install every time it runs,
+  # so let’s do that only once.
+  extracted = bazelPkg:
+    let
+      install_dir =
+        # `install_base` field printed by `bazel info`, minus the hash.
+        # yes, this path is kinda magic. Sorry.
+        "$HOME/.cache/bazel/_bazel_nixbld";
+    in
+    runLocal "bazel-extracted-homedir" { passthru.install_dir = install_dir; } ''
+      export HOME=$(mktemp -d)
+      touch WORKSPACE # yeah, everything sucks
+      install_base="$(${bazelPkg}/bin/bazel info install_base)"
+      # assert it’s actually below install_dir
+      [[ "$install_base" =~ ${install_dir} ]] \
+        || (echo "oh no! $install_base but we are \
+      trying to copy ${install_dir} to $out instead!"; exit 1)
+      cp -R ${install_dir} $out
+    '';
+
+  bazelTest = { name, bazelScript, workspaceDir, bazelPkg, buildInputs ? [ ] }:
+    runLocal name
+      {
+        inherit buildInputs;
+        # Necessary for the tests to pass on Darwin with sandbox enabled.
+        __darwinAllowLocalNetworking = true;
+      }
+      ''
+        # Bazel needs a real home for self-extraction and internal cache
+        mkdir bazel_home
+        export HOME=$PWD/bazel_home
+
+        ${# Concurrent bazel invocations have the same workspace path.
+          # On darwin, for some reason, it means they access and corrupt the
+          # same outputRoot, outputUserRoot and outputBase
+          # Ensure they use build-local outputRoot by setting TEST_TMPDIR
+          lib.optionalString isDarwin ''
+            export TEST_TMPDIR=$HOME/.cache/bazel
+          ''
+        }
+        ${# Speed-up tests by caching bazel extraction.
+          # Except on Darwin, because nobody knows how Darwin works.
+          let bazelExtracted = extracted bazelPkg;
+          in lib.optionalString (!isDarwin) ''
+            mkdir -p ${bazelExtracted.install_dir}
+            cp -R ${bazelExtracted}/install ${bazelExtracted.install_dir}
+
+            # https://stackoverflow.com/questions/47775668/bazel-how-to-skip-corrupt-installation-on-centos6
+            # Bazel checks whether the mtime of the install dir files
+            # is >9 years in the future, otherwise it extracts itself again.
+            # see PosixFileMTime::IsUntampered in src/main/cpp/util
+            # What the hell bazel.
+            ${lr}/bin/lr -0 -U ${bazelExtracted.install_dir} | ${xe}/bin/xe -N0 -0 touch --date="9 years 6 months" {}
+          ''
+        }
+        ${# Note https://github.com/bazelbuild/bazel/issues/5763#issuecomment-456374609
+          # about why to create a subdir for the workspace.
+          '' cp -r ${workspaceDir} wd && chmod ug+rw -R wd && cd wd ''
+        }
+        ${# run the actual test snippet
+          bazelScript
+        }
+        ${# Try to keep darwin clean of our garbage
+          lib.optionalString isDarwin ''
+            rm -rf $HOME || true
+          ''
+        }
+
+        touch $out
+      '';
+
+  bazel-examples = fetchFromGitHub {
+    owner = "bazelbuild";
+    repo = "examples";
+    rev = "93564e1f1e7a3c39d6a94acee12b8d7b74de3491";
+    hash = "sha256-DaPKp7Sn5uvfZRjdDx6grot3g3B7trqCyL0TRIdwg98=";
+  };
+
+  callBazelTests = bazel:
+    let
+      callBazelTest = newScope {
+        inherit runLocal bazelTest bazel-examples;
+        inherit Foundation;
+        inherit bazel;
+        distDir = testsDistDir;
+        extraBazelArgs = "--noenable_bzlmod";
+        repoCache = testsRepoCache;
+      };
+    in
+    recurseIntoAttrs (
+      (lib.optionalAttrs (!isDarwin) {
+        # `extracted` doesn’t work on darwin
+        shebang = callBazelTest ../shebang-test.nix {
+          inherit extracted;
+          extraBazelArgs = "--noenable_bzlmod";
+        };
+      }) // {
+        bashTools = callBazelTest ../bash-tools-test.nix { };
+        cpp = callBazelTest ./cpp-test.nix {
+          extraBazelArgs = "";
+        };
+        java = callBazelTest ./java-test.nix { };
+        pythonBinPath = callBazelTest ../python-bin-path-test.nix { };
+        protobuf = callBazelTest ./protobuf-test.nix { };
+      }
+    );
+
+  bazelWithNixHacks = bazel_self.override { enableNixHacks = true; };
+
+in
+recurseIntoAttrs {
+  distDir = testsDistDir;
+  testsRepoCache = testsRepoCache;
+
+  vanilla = callBazelTests bazel_self;
+  withNixHacks = callBazelTests bazelWithNixHacks;
+
+  # add some downstream packages using buildBazelPackage
+  downstream = recurseIntoAttrs ({
+    # TODO: fix bazel-watcher build with bazel 7, or find other packages
+    #inherit bazel-watcher;
+  });
+}
+
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/trim-last-argument-to-gcc-if-empty.patch
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/trim-last-argument-to-gcc-if-empty.patch
@ -0,0 +1,17 @@
+diff --git a/tools/cpp/osx_cc_wrapper.sh.tpl b/tools/cpp/osx_cc_wrapper.sh.tpl
+index 8264090c29..b7b9e8537a 100644
+--- a/tools/cpp/osx_cc_wrapper.sh.tpl
+++ b/tools/cpp/osx_cc_wrapper.sh.tpl
+@@ -64,7 +64,11 @@ done
+ %{env}
+ 
+ # Call the C++ compiler
+-%{cc} "$@"
+if [[ ${*: -1} = "" ]]; then
+    %{cc} "${@:0:$#}"
+else
+    %{cc} "$@"
+fi
+ 
+ function get_library_path() {
+     for libdir in ${LIB_DIRS}; do
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/xcode_locator.patch
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/xcode_locator.patch
@ -0,0 +1,13 @@
+--- a/tools/osx/BUILD
+++ b/tools/osx/BUILD
+@@ -28,8 +28,8 @@ exports_files([
+ 
+ DARWIN_XCODE_LOCATOR_COMPILE_COMMAND = """
+   /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.13 -fobjc-arc -framework CoreServices \
+-      -framework Foundation -arch arm64 -arch x86_64 -Wl,-no_adhoc_codesign -Wl,-no_uuid -o $@ $< && \
+      -framework Foundation                          -Wl,-no_adhoc_codesign -Wl,-no_uuid -o $@ $< && \
+-  env -i codesign --identifier $@ --force --sign - $@
+  /usr/bin/env -i /usr/bin/codesign --identifier $@ --force --sign - $@
+ """
+ 
+ genrule(
--- a/pkgs/development/tools/build-managers/bazel/cpp-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/cpp-test.nix
@ -4,12 +4,14 @@
 , bazel-examples
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , runLocal
 , runtimeShell
 , writeScript
 , writeText
 , distDir
+, Foundation ? null
 }:

 let
@ -43,15 +45,17 @@ let
    inherit workspaceDir;
    bazelPkg = bazel;
    bazelScript = ''
-      ${bazel}/bin/bazel \
-        build --verbose_failures \
+      ${bazel}/bin/bazel build //... \
+        --verbose_failures \
        --distdir=${distDir} \
        --curses=no \
-        --sandbox_debug \
-        //... \
+        ${extraBazelArgs} \
    '' + lib.optionalString (stdenv.isDarwin) ''
        --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
        --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
+    '' + lib.optionalString (stdenv.isDarwin && Foundation != null) ''
+        --linkopt=-Wl,-F${Foundation}/Library/Frameworks \
+        --linkopt=-L${darwin.libobjc}/lib \
    '';
  };

--- a/pkgs/development/tools/build-managers/bazel/java-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/java-test.nix
@ -1,9 +1,9 @@
-{
-  bazel
+{ bazel
 , bazelTest
 , bazel-examples
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , openjdk8
 , jdk11_headless
@ -48,17 +48,20 @@ let
    bazelScript = ''
      ${bazel}/bin/bazel \
        run \
+        --announce_rc \
+        ${lib.optionalString (lib.strings.versionOlder "5.0.0" bazel.version)
+          "--toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type'"
+        } \
        --distdir=${distDir} \
        --verbose_failures \
        --curses=no \
-        --sandbox_debug \
        --strict_java_deps=off \
        //:ProjectRunner \
    '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
        --host_javabase='@local_jdk//:jdk' \
        --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
        --javabase='@local_jdk//:jdk' \
-    '';
+    '' + extraBazelArgs;
  };

 in testBazel
--- a/pkgs/development/tools/build-managers/bazel/protobuf-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/protobuf-test.nix
@ -170,7 +170,7 @@ let
        --distdir=${distDir} \
        --verbose_failures \
        --curses=no \
-        --sandbox_debug \
+        --subcommands \
        --strict_java_deps=off \
        --strict_proto_deps=off \
        //... \
--- a/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
@ -3,6 +3,7 @@
 , bazelTest
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , runLocal
 , runtimeShell
@ -77,6 +78,7 @@ let
      ${bazel}/bin/bazel \
        run \
        --distdir=${distDir} \
+        ${extraBazelArgs} \
        //python:bin
    '';
  };
--- a/pkgs/development/tools/build-managers/bazel/shebang-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/shebang-test.nix
@ -1,10 +1,11 @@
 {
  bazel
 , bazelTest
-, distDir
 , extracted
+, ripgrep
 , runLocal
 , unzip
+, ...
 }:

 # Tests that all shebangs are patched appropriately.
@ -24,18 +25,26 @@ let
      FAIL=
      check_shebangs() {
        local dir="$1"
-        { grep -Re '#!/usr/bin' $dir && FAIL=1; } || true
-        { grep -Re '#![^[:space:]]*/bin/env' $dir && FAIL=1; } || true
+        { rg -e '#!/usr/bin' -e '#![^[:space:]]*/bin/env' $dir -e && echo && FAIL=1; } || true
      }
-      BAZEL_EXTRACTED=${extracted bazel}/install
-      check_shebangs $BAZEL_EXTRACTED
-      while IFS= read -r -d "" zip; do
-        unzipped="./$zip/UNPACKED"
-        mkdir -p "$unzipped"
-        unzip -qq $zip -d "$unzipped"
-        check_shebangs "$unzipped"
-        rm -rf unzipped
-      done < <(find $BAZEL_EXTRACTED -type f -name '*.zip' -or -name '*.jar' -print0)
+      extract() {
+        local dir="$1"
+        find "$dir" -type f '(' -name '*.zip' -or -name '*.jar' ')' -print0 \
+        | while IFS="" read -r -d "" zip ; do
+          echo "Extracting $zip"
+          local unzipped="$zip-UNPACKED"
+          mkdir -p "$unzipped"
+          unzip -qq $zip -d "$unzipped"
+          extract "$unzipped"
+          rm -rf "$unzipped" "$zip" || true
+        done
+        check_shebangs "$dir"
+      }
+
+      mkdir install_root
+      cp --no-preserve=all -r ${extracted bazel}/install/*/* install_root/
+      extract ./install_root
+
      if [[ $FAIL = 1 ]]; then
        echo "Found files in the bazel distribution with illegal shebangs." >&2
        echo "Replace those by explicit Nix store paths." >&2
@ -43,7 +52,7 @@ let
        exit 1
      fi
    '';
-    buildInputs = [ unzip ];
+    buildInputs = [ unzip ripgrep ];
  };

 in testBazel
--- a/pkgs/development/tools/eask/default.nix
+++ b/pkgs/development/tools/eask/default.nix
@ -5,16 +5,16 @@

 buildNpmPackage rec {
  pname = "eask";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "emacs-eask";
    repo = "cli";
    rev = version;
-    hash = "sha256-uQHYVhoa0wkpqV3ScQKT1XnMhJQYs/KiFUMkUG2/ll0=";
+    hash = "sha256-LUN2gnvdToVi6NOF5gKXVPG0Al1Y/gI66o8dI8bTIgM=";
  };

-  npmDepsHash = "sha256-IfuBxU4CNpMUdbGwqykoG7H9LMzrfNbmTN/8VU83ArM=";
+  npmDepsHash = "sha256-YNgLEe7voCFspOBefXYJ7NtAtbTc0mRmFUN0856j6KM=";

  dontBuild = true;

--- a/pkgs/development/tools/misc/polylith/default.nix
+++ b/pkgs/development/tools/misc/polylith/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "polylith";
-  version = "0.2.15-alpha";
+  version = "0.2.18";

  src = fetchurl {
    url = "https://github.com/polyfy/polylith/releases/download/v${version}/poly-${version}.jar";
-    sha256 = "sha256-RAFxOwQykERpW+KEjTQDJN+XRv3JudREyBOk99A/qV8=";
+    sha256 = "sha256-loSv316OV8EjTw65yhSpaYWObs/45k9Xsa+m3cYgNr4=";
  };

  dontUnpack = true;
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -3965,7 +3965,8 @@
    ];
    "roborock" = ps: with ps; [
      python-roborock
-    ]; # missing inputs: vacuum-map-parser-roborock
+      vacuum-map-parser-roborock
+    ];
    "rocketchat" = ps: with ps; [
    ]; # missing inputs: rocketchat-API
    "roku" = ps: with ps; [
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@ -20,14 +20,14 @@ stdenv.mkDerivation {
  # Determine version and revision from:
  # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
  pname = "netpbm";
-  version = "11.4.5";
+  version = "11.5.1";

  outputs = [ "bin" "out" "dev" ];

  src = fetchsvn {
    url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "4800";
-    sha256 = "ftMw2N63iEsf8GPuuXLe/hw+LN0lAUKyhk7wGZMboHY=";
+    rev = "4831";
+    sha256 = "wEbvIQxBi/jiBD9Bfc0+zKdgNVp4cV6f1qXX1XF46hI=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@ -13,13 +13,13 @@ in

 stdenv.mkDerivation rec {
  pname = "ibus-typing-booster";
-  version = "2.24.5";
+  version = "2.24.10";

  src = fetchFromGitHub {
    owner = "mike-fabian";
    repo = "ibus-typing-booster";
    rev = version;
-    hash = "sha256-GMkudpQ91Qwyj7wJIl7LTx+v+goCUccxJggCAvEtL30=";
+    hash = "sha256-C7kZCreJki3acnbInW8MbrbwoWgovB/g072Sf6FKLU0=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook gobject-introspection ];
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@ -18,16 +18,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "broot";
-  version = "1.30.2";
+  version = "1.31.0";

  src = fetchFromGitHub {
    owner = "Canop";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-sWy5Ekq4Jx0JTJgp2xYtfRjPokDsqP5n+pHSyCBzo30=";
+    hash = "sha256-orZAJtQwJ2pFG7c+VcOsck3o06qzMxLZYqRMqMhCZAw=";
  };

-  cargoHash = "sha256-jc3tg+Xs3z7neGx1iyMENXy5s4eAC/9KtsQcal45RoI=";
+  cargoHash = "sha256-JQxvjt0rWwZAmWPfV120Olxf4iTVqMqUFGRdLlnT2Lw=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fend";
-  version = "1.3.3";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "printfn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-4N2MSs4Uhd0NcS57b6qIJd8ovnUVjLiLniMsHTdZHCo=";
+    sha256 = "sha256-s6b15FhVfEwsHtVt4bhd6LDxl/WW1PXlUrH2XFOTT5E=";
  };

-  cargoHash = "sha256-Y8LfkFPM4MKxwW6xk93+vCASkVfsMp3GugjH/kIAvQ8=";
+  cargoHash = "sha256-Ilsv0mo7/4eEdRH3jWZXdF4LSYYdWr6gCvnMMAZn5j0=";

  nativeBuildInputs = [ pandoc installShellFiles copyDesktopItems ];
  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
@ -82,7 +82,7 @@ rustPlatform.buildRustPackage rec {
    description = "Arbitrary-precision unit-aware calculator";
    homepage = "https://github.com/printfn/fend";
    changelog = "https://github.com/printfn/fend/releases/tag/v${version}";
-    license = licenses.mit;
+    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ djanatyn liff ];
    mainProgram = "fend";
  };
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@ -24,16 +24,16 @@ let
 in
 buildGoModule rec {
  pname = "fzf";
-  version = "0.44.1";
+  version = "0.45.0";

  src = fetchFromGitHub {
    owner = "junegunn";
    repo = pname;
    rev = version;
-    hash = "sha256-oL3AA/3RPKcXLBNYaBYleueQph7/xvN/UEhwcYM9lAs=";
+    hash = "sha256-oOAXV3TZ/E2b+P1sUy/oblSBkOF8VN1di7a7dWPmCbo=";
  };

-  vendorHash = "sha256-EutNjyW5bvGvMZP9xBrcu91TOAbl9TDZe2+g0/qnuAQ=";
+  vendorHash = "sha256-w/7Ds31mW1jnjkKVeaH81bLhasxNyy/SWeww20KhBrs=";

  CGO_ENABLED = 0;

--- a/pkgs/tools/video/go2rtc/default.nix
+++ b/pkgs/tools/video/go2rtc/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "go2rtc";
-  version = "1.8.4";
+  version = "1.8.5";

  src = fetchFromGitHub {
    owner = "AlexxIT";
    repo = "go2rtc";
    rev = "refs/tags/v${version}";
-    hash = "sha256-knC8GWu8543QIvk2OKotTHB88qgSQpOI+58oHusgVKc=";
+    hash = "sha256-XG98CJZ9bnFfJL5DyhDon+j74cXXmxYb291PElqXXRY=";
  };

-  vendorHash = "sha256-+n0atALq5e2iEbEeJ1kefnKka7gTE0iFRSRnUCz4bh8=";
+  vendorHash = "sha256-KEW3ykEZvL6y1VacDIqtHW9B2RLHlHC29aqJjkEnRqQ=";

  buildFlagArrays = [
    "-trimpath"
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -67,6 +67,7 @@ mapAliases ({
  alsaPlugins = alsa-plugins; # Added 2021-06-10
  alsaTools = alsa-tools; # Added 2021-06-10
  alsaUtils = alsa-utils; # Added 2021-06-10
+  amtk = throw "amtk has been renamed to libgedit-amtk and is now maintained by Gedit Technology"; # Added 2023-12-31
  angelfish = libsForQt5.kdeGear.angelfish; # Added 2021-10-06
  ansible_2_12 = throw "Ansible 2.12 goes end of life in 2023/05 and can't be supported throughout the 23.05 release cycle"; # Added 2023-05-16
  apacheAnt_1_9 = throw "Ant 1.9 has been removed since it's not used in nixpkgs anymore"; # Added 2023-11-12
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -18127,8 +18127,6 @@ with pkgs;

  h3 = h3_3;

-  amtk = callPackage ../development/libraries/amtk { };
-
  avrlibc      = callPackage ../development/misc/avr/libc { };
  avrlibcCross = callPackage ../development/misc/avr/libc {
    stdenv = crossLibcStdenv;
@ -18566,6 +18564,17 @@ with pkgs;
    bazel_self = bazel_6;
  };

+  bazel_7 = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_7 {
+    inherit (darwin) cctools sigtool;
+    inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation CoreServices Foundation IOKit;
+    buildJdk = jdk17_headless;
+    runJdk = jdk17_headless;
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv
+      else if stdenv.cc.isClang then llvmPackages.stdenv
+      else stdenv;
+    bazel_self = bazel_7;
+  };
+
  bazel-buildtools = callPackage ../development/tools/build-managers/bazel/buildtools { };
  buildifier = bazel-buildtools;
  buildozer = bazel-buildtools;
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -15683,6 +15683,10 @@ self: super: with self; {

  vaa = callPackage ../development/python-modules/vaa { };

+  vacuum-map-parser-base = callPackage ../development/python-modules/vacuum-map-parser-base { };
+
+  vacuum-map-parser-roborock = callPackage ../development/python-modules/vacuum-map-parser-roborock { };
+
  validate-email = callPackage ../development/python-modules/validate-email { };

  validators = callPackage ../development/python-modules/validators { };