libredirect: skip system() test when not in a sandbox

python310Packages.eventlet: disable test_fork_after_monkey_patch test…

doc/builders/special.xml

@@ -6,6 +6,7 @@
   This chapter describes several special builders.
  </para>
  <xi:include href="special/fhs-environments.section.xml" />
+ <xi:include href="special/makesetuphook.section.xml" />
  <xi:include href="special/mkshell.section.xml" />
  <xi:include href="special/darwin-builder.section.xml" />
 </chapter>

doc/builders/special/makesetuphook.section.md

@@ -0,0 +1,37 @@
+# pkgs.makeSetupHook {#sec-pkgs.makeSetupHook}
+
+`pkgs.makeSetupHook` is a builder that produces hooks that go in to `nativeBuildInputs`
+
+## Usage {#sec-pkgs.makeSetupHook-usage}
+
+```nix
+pkgs.makeSetupHook {
+  name = "something-hook";
+  propagatedBuildInputs = [ pkgs.commandsomething ];
+  depsTargetTargetPropagated = [ pkgs.libsomething ];
+} ./script.sh
+```
+
+#### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash
+
+```nix
+pkgs.makeSetupHook {
+    name = "run-hello-hook";
+    propagatedBuildInputs = [ pkgs.hello ];
+    substitutions = { shell = "${pkgs.bash}/bin/bash"; };
+    passthru.tests.greeting = callPackage ./test { };
+    meta.platforms = lib.platforms.linux;
+} (writeScript "run-hello-hook.sh" ''
+    #!@shell@
+    hello
+'')
+```
+
+## Attributes
+
+* `name` Set the name of the hook.
+* `propagatedBuildInputs` Runtime dependencies (such as binaries) of the hook.
+* `depsTargetTargetPropagated` Non-binary dependencies.
+* `meta`
+* `passthru`
+* `substitutions` Variables for `substituteAll`

lib/customisation.nix

@@ -213,7 +213,14 @@ rec {
             outputSpecified = true;
             drvPath = assert condition; drv.${outputName}.drvPath;
             outPath = assert condition; drv.${outputName}.outPath;
-          };
+          } //
+            # TODO: give the derivation control over the outputs.
+            #       `overrideAttrs` may not be the only attribute that needs
+            #       updating when switching outputs.
+            lib.optionalAttrs (passthru?overrideAttrs) {
+              # TODO: also add overrideAttrs when overrideAttrs is not custom, e.g. when not splicing.
+              overrideAttrs = f: (passthru.overrideAttrs f).${outputName};
+            };
         };
 
       outputsList = map outputToAttrListElement outputs;

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -247,6 +247,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.
 
+- `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
+
 - [Xastir](https://xastir.org/index.php/Main_Page) can now access AX.25 interfaces via the `libax25` package.
 
 - `tvbrowser-bin` was removed, and now `tvbrowser` is built from source.

nixos/modules/system/boot/stage-1-init.sh

@@ -267,6 +267,7 @@ lvm vgchange -ay
 if test -n "$debug1devices"; then fail; fi
 
 
+@postDeviceCommands@
 
 
 # Check the specified file system, if appropriate.
@@ -483,8 +484,6 @@ if test -e /sys/power/resume -a -e /sys/power/disk; then
     fi
 fi
 
-@postDeviceCommands@
-
 # If we have a path to an iso file, find the iso and link it to /dev/root
 if [ -n "$isoPath" ]; then
   mkdir -p /findiso

pkgs/applications/audio/helvum/default.nix

@@ -16,20 +16,20 @@
 
 stdenv.mkDerivation rec {
   pname = "helvum";
-  version = "0.3.4";
+  version = "0.4.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "pipewire";
     repo = pname;
     rev = version;
-    sha256 = "0nhv6zw2zzxz2bg2zj32w1brywnm5lv6j3cvmmvwshc389z2k5x1";
+    hash = "sha256-TvjO7fGobGmAltVHeXWyMtMLANdVWVGvBYq20JD3mMI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-EIHO9qVPIXgezfFOaarlTU0an762nFmX1ELbQuAZ7rY";
+    hash = "sha256-W5Imlut30cjV4A6TCjBFLbViB0CDUucNsvIUiCXqu7I=";
   };
 
   nativeBuildInputs = [
@@ -50,9 +50,6 @@ stdenv.mkDerivation rec {
     pipewire
   ];
 
-  # FIXME: workaround for Pipewire 0.3.64 deprecated API change, remove when fixed upstream
-  NIX_CFLAGS_COMPILE = [ "-DPW_ENABLE_DEPRECATED" ];
-
   meta = with lib; {
     description = "A GTK patchbay for pipewire";
     homepage = "https://gitlab.freedesktop.org/pipewire/helvum";

pkgs/applications/blockchains/torq/default.nix

@@ -6,20 +6,20 @@
 
 let
   pname = "torq";
-  version = "0.17.3";
+  version = "0.18.17";
 
   src = fetchFromGitHub {
     owner = "lncapital";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-fqHJZi1NQCrZqsa+N+FVYZ8s9o0D555Sqn5qNlJ1MmI=";
+    hash = "sha256-xiA66yGo8b1+zZ7jQ7SFOtNPmqbdna7fUCT21uibrIM=";
   };
 
   web = buildNpmPackage {
     pname = "${pname}-frontend";
     inherit version;
     src = "${src}/web";
-    npmDepsHash = "sha256-8mUfTFzPjQlQvhC3zZf+WruDBkYnmGt3yckNi0CPWs0=";
+    npmDepsHash = "sha256-/7x5RWYIB5BChYMnMuFVVaZd0pVkew4i4QrF7hSFnCM=";
 
     # copied from upstream Dockerfile
     npmInstallFlags = [ "--legacy-peer-deps" ];
@@ -29,14 +29,14 @@ let
     # override npmInstallHook, we only care about the build/ directory
     installPhase = ''
       mkdir $out
-      cp -r build $out/
+      cp -r build/* $out/
     '';
   };
 in
 buildGoModule rec {
   inherit pname version src;
 
-  vendorHash = "sha256-HETN2IMnpxnTyg6bQDpoD0saJu+gKocdEf0VzEi12Gs=";
+  vendorHash = "sha256-bvisI589Gq9IdyJEqI+uzs3iDPOTUkq95P3n/KoFhF0=";
 
   subPackages = [ "cmd/torq" ];
 
@@ -47,7 +47,8 @@ buildGoModule rec {
   ];
 
   postInstall = ''
-    ln -s ${web} $out/web
+    mkdir -p $out/web/build
+    cp -r ${web}/* $out/web/build/
   '';
 
   meta = with lib; {

pkgs/applications/editors/vim/common.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.0609";
+  version = "9.0.1275";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-UBj3pXY6rdekKnCX/V/4o8LLBMZkNs1U4Z4KuvisIYQ=";
+    hash = "sha256-WDnlYi9o2Kv/f3Fh1MHcfTlBTe1fxw4UyKJlKY04fyA=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/vim-utils.nix

@@ -363,7 +363,7 @@ rec {
   vimGenDocHook = callPackage ({ vim }:
     makeSetupHook {
       name = "vim-gen-doc-hook";
-      deps = [ vim ];
+      propagatedBuildInputs = [ vim ];
       substitutions = {
         vimBinary = "${vim}/bin/vim";
         inherit rtpPath;
@@ -373,7 +373,7 @@ rec {
   vimCommandCheckHook = callPackage ({ neovim-unwrapped }:
     makeSetupHook {
       name = "vim-command-check-hook";
-      deps = [ neovim-unwrapped ];
+      propagatedBuildInputs = [ neovim-unwrapped ];
       substitutions = {
         vimBinary = "${neovim-unwrapped}/bin/nvim";
         inherit rtpPath;
@@ -383,7 +383,7 @@ rec {
   neovimRequireCheckHook = callPackage ({ neovim-unwrapped }:
     makeSetupHook {
       name = "neovim-require-check-hook";
-      deps = [ neovim-unwrapped ];
+      propagatedBuildInputs = [ neovim-unwrapped ];
       substitutions = {
         nvimBinary = "${neovim-unwrapped}/bin/nvim";
         inherit rtpPath;

pkgs/applications/misc/genxword/default.nix

@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     pango
     gtksourceview3
   ];

pkgs/applications/misc/udiskie/default.nix

@@ -43,7 +43,6 @@ python3.pkgs.buildPythonApplication rec {
   dontWrapGApps = true;
 
   buildInputs = [
-    gobject-introspection
     gtk3
     libappindicator-gtk3
     libnotify

pkgs/applications/office/autokey/default.nix

@@ -25,7 +25,6 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
 
   buildInputs = [
-    gobject-introspection
     gtksourceview3
     libappindicator-gtk3
     libnotify

pkgs/applications/science/physics/nnpdf/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , apfel
@@ -16,22 +15,15 @@
 
 stdenv.mkDerivation rec {
   pname = "nnpdf";
-  version = "4.0.4";
+  version = "4.0.6";
 
   src = fetchFromGitHub {
     owner = "NNPDF";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Alx4W0TkPzJBsnRXcKBrlEU6jWTnOjrji/IPk+dNCw0=";
+    hash = "sha256-mwOMNlYFhHZq/wakO1/HGwcxvKGKh5OyFa2D9d3Y3IA=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/NNPDF/nnpdf/commit/7943b62a91d3a41fd4f6366b18881d50695f4b45.diff";
-      hash = "sha256-UXhTO7vZgJiY8h3bgjg7SQC0gMUQsYQ/V/PgtCEQ7VU=";
-    })
-  ];
-
   postPatch = ''
     for file in CMakeLists.txt buildmaster/CMakeLists.txt; do
       substituteInPlace $file \

pkgs/applications/terminal-emulators/terminator/default.nix

@@ -33,7 +33,6 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [
     gtk3
-    gobject-introspection # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
     keybinder3
     libnotify
     python3

pkgs/applications/virtualization/qemu/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, python3, zlib, pkg-config, glib, buildPackages
+{ lib, stdenv, fetchurl, fetchpatch, python3Packages, zlib, pkg-config, glib, buildPackages
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
 , makeWrapper, runtimeShell, removeReferencesTo
@@ -51,7 +51,13 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [ makeWrapper removeReferencesTo pkg-config flex bison meson ninja perl python3 python3.pkgs.sphinx python3.pkgs.sphinx-rtd-theme ]
+  nativeBuildInputs = [
+    makeWrapper removeReferencesTo
+    pkg-config flex bison meson ninja perl
+
+    # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
+    python3Packages.python python3Packages.sphinx python3Packages.sphinx-rtd-theme
+  ]
     ++ lib.optionals gtkSupport [ wrapGAppsHook ]
     ++ lib.optionals stdenv.isDarwin [ sigtool ];
 
@@ -143,7 +149,6 @@ stdenv.mkDerivation rec {
     # have our patches and will be subtly broken because of that.
     "--meson=meson"
     "--cross-prefix=${stdenv.cc.targetPrefix}"
-    "--cpu=${stdenv.hostPlatform.uname.processor}"
     (lib.enableFeature guestAgentSupport "guest-agent")
   ] ++ lib.optional numaSupport "--enable-numa"
     ++ lib.optional seccompSupport "--enable-seccomp"

pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix

@@ -20,7 +20,7 @@ in
   dotnetConfigureHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-configure-hook";
-      deps = [ dotnet-sdk nuget-source ];
+      propagatedBuildInputs = [ dotnet-sdk nuget-source ];
       substitutions = {
         nugetSource = nuget-source;
         inherit runtimeId;
@@ -30,7 +30,7 @@ in
   dotnetBuildHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-build-hook";
-      deps = [ dotnet-sdk ];
+      propagatedBuildInputs = [ dotnet-sdk ];
       substitutions = {
         inherit buildType runtimeId;
       };
@@ -39,7 +39,7 @@ in
   dotnetCheckHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-check-hook";
-      deps = [ dotnet-test-sdk ];
+      propagatedBuildInputs = [ dotnet-test-sdk ];
       substitutions = {
         inherit buildType libraryPath;
         disabledTests = lib.optionalString (disabledTests != [])
@@ -54,7 +54,7 @@ in
   dotnetInstallHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-install-hook";
-      deps = [ dotnet-sdk ];
+      propagatedBuildInputs = [ dotnet-sdk ];
       substitutions = {
         inherit buildType runtimeId;
       };
@@ -63,7 +63,7 @@ in
   dotnetFixupHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-fixup-hook";
-      deps = [ dotnet-runtime ];
+      propagatedBuildInputs = [ dotnet-runtime ];
       substitutions = {
         dotnetRuntime = dotnet-runtime;
         runtimeDeps = libraryPath;

pkgs/build-support/go/module.nix

@@ -193,6 +193,12 @@ let
       ''}
     '' + ''
 
+      # currently pie is only enabled by default in pkgsMusl
+      # this will respect the `hardening{Disable,Enable}` flags if set
+      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+        export GOFLAGS="-buildmode=pie $GOFLAGS"
+      fi
+
       runHook postConfigure
     '';
 

pkgs/build-support/go/package.nix

@@ -134,6 +134,12 @@ let
       export GOPATH=$NIX_BUILD_TOP/go:$GOPATH
       export GOCACHE=$TMPDIR/go-cache
 
+      # currently pie is only enabled by default in pkgsMusl
+      # this will respect the `hardening{Disable,Enable}` flags if set
+      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+        export GOFLAGS="-buildmode=pie $GOFLAGS"
+      fi
+
       runHook postConfigure
     '';
 

pkgs/build-support/libredirect/default.nix

@@ -32,6 +32,14 @@ else stdenv.mkDerivation rec {
   buildPhase = ''
     runHook preBuild
 
+    ENABLE_TEST_SYSTEM=1
+    if [ "$(cat /proc/self/uid_map)" = "         0          0 4294967295" ]; then
+      echo "Boot namespace detected! Disabling tests that use system()."
+      echo "The system() relies on /bin/sh which may not be compatible with nixpkgs's"
+      echo "glibc, so we can't test this without the sandboxing isolation."
+      ENABLE_TEST_SYSTEM=0
+    fi
+
     ${if stdenv.isDarwin && stdenv.isAarch64 then ''
     # We need the unwrapped binutils and clang:
     # We also want to build a fat library with x86_64, arm64, arm64e in there.
@@ -45,16 +53,15 @@ else stdenv.mkDerivation rec {
       -isystem ${llvmPackages_13.libclang.lib}/lib/clang/*/include \
       -L${llvmPackages_13.clang.libc}/lib \
       -Wl,-install_name,$libName \
-      -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -shared -o "$libName"
     '' else if stdenv.isDarwin then ''
-    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
+    $CC \
       -Wl,-install_name,$out/lib/$libName \
-      -shared -o "$libName"
     '' else ''
-    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
+    $CC \
+    ''} \
+      -Wall -std=c99 -O3 -fPIC libredirect.c \
+      -DENABLE_TEST_SYSTEM=$ENABLE_TEST_SYSTEM \
       -shared -o "$libName"
-    ''}
 
     if [ -n "$doInstallCheck" ]; then
       $CC -Wall -std=c99 \

pkgs/build-support/libredirect/test.c

@@ -146,6 +146,8 @@ int main(int argc, char *argv[])
     assert_mktemp_path(TESTDIR "/temp", "", buf);
 
     test_spawn();
+
+#if ENABLE_TEST_SYSTEM
     test_system();
 
     // Only run subprocess if no arguments are given
@@ -154,6 +156,7 @@ int main(int argc, char *argv[])
     if (argc == 1) {
         test_subprocess();
     }
+#endif
 
     test_execv();
 

pkgs/build-support/node/build-npm-package/hooks/default.nix

@@ -26,7 +26,7 @@
   npmInstallHook = makeSetupHook
     {
       name = "npm-install-hook";
-      deps = [ buildPackages.makeWrapper ];
+      propagatedBuildInputs = [ buildPackages.makeWrapper ];
       substitutions = {
         hostNode = "${nodejs}/bin/node";
         jq = "${buildPackages.jq}/bin/jq";

pkgs/build-support/rust/hooks/default.nix

@@ -31,7 +31,7 @@ in {
   cargoBuildHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-build-hook.sh";
-      deps = [ cargo ];
+      propagatedBuildInputs = [ cargo ];
       substitutions = {
         inherit ccForBuild ccForHost cxxForBuild cxxForHost
           rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
@@ -41,7 +41,7 @@ in {
   cargoCheckHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-check-hook.sh";
-      deps = [ cargo ];
+      propagatedBuildInputs = [ cargo ];
       substitutions = {
         inherit rustTargetPlatformSpec;
       };
@@ -50,7 +50,7 @@ in {
   cargoInstallHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-install-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
       substitutions = {
         inherit shortTarget;
       };
@@ -59,7 +59,7 @@ in {
   cargoNextestHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-nextest-hook.sh";
-      deps = [ cargo cargo-nextest ];
+      propagatedBuildInputs = [ cargo cargo-nextest ];
       substitutions = {
         inherit rustTargetPlatformSpec;
       };
@@ -68,7 +68,7 @@ in {
   cargoSetupHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-setup-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
       substitutions = {
         defaultConfig = ../fetchcargo-default-config.toml;
 
@@ -117,7 +117,7 @@ in {
   maturinBuildHook = callPackage ({ }:
     makeSetupHook {
       name = "maturin-build-hook.sh";
-      deps = [ cargo maturin rustc ];
+      propagatedBuildInputs = [ cargo maturin rustc ];
       substitutions = {
         inherit ccForBuild ccForHost cxxForBuild cxxForHost
           rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;

pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix

@@ -11,8 +11,7 @@
 
 makeSetupHook {
   name = "make-binary-wrapper-hook";
-
-  deps = [ dieHook ]
+  propagatedBuildInputs = [ dieHook ]
     # https://github.com/NixOS/nixpkgs/issues/148189
     ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;
 

pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix

@@ -9,12 +9,15 @@
 , dconf
 , callPackage
 , wrapGAppsHook
-, writeTextFile
+, targetPackages
 }:
 
 makeSetupHook {
   name = "wrap-gapps-hook";
-  deps = lib.optionals (!stdenv.isDarwin) [
+  propagatedBuildInputs = [
+    # We use the wrapProgram function.
+    makeWrapper
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     # It is highly probable that a program will use GSettings,
     # at minimum through GTK file chooser dialogue.
     # Let’s add a GIO module for “dconf” GSettings backend
@@ -23,19 +26,22 @@ makeSetupHook {
     # Unfortunately, it also requires the user to have dconf
     # D-Bus service enabled globally (e.g. through a NixOS module).
     dconf.lib
+
   ] ++ lib.optionals isGraphical [
     # TODO: remove this, packages should depend on GTK explicitly.
     gtk3
 
+    librsvg
+  ];
+
+  # depsTargetTargetPropagated will essentially be buildInputs when wrapGAppsHook is placed into nativeBuildInputs
+  # the librsvg above should be removed but kept to not break anything that implicitly depended on its binaries
+  depsTargetTargetPropagated = assert (lib.assertMsg (!targetPackages ? raw) "wrapGAppsHook must be in nativeBuildInputs"); lib.optionals isGraphical [
     # librsvg provides a module for gdk-pixbuf to allow rendering
     # SVG icons. Most icon themes are SVG-based and so are some
     # graphics in GTK (e.g. cross for closing window in window title bar)
     # so it is pretty much required for applications using GTK.
     librsvg
-  ] ++ [
-
-    # We use the wrapProgram function.
-    makeWrapper
   ];
   passthru = {
     tests = let
@@ -65,6 +71,15 @@ makeSetupHook {
         ''
       );
 
+      basic-contains-gdk-pixbuf = let
+        tested = basic;
+      in testLib.runTest "basic-contains-gdk-pixbuf" (
+        testLib.skip stdenv.isDarwin ''
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GDK_PIXBUF_MODULE_FILE" "${lib.getLib librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"}
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GDK_PIXBUF_MODULE_FILE" "${lib.getLib librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"}
+        ''
+      );
+
       # Simple derivation containing a gobject-introspection typelib.
       typelib-Mahjong = stdenv.mkDerivation {
         name = "typelib-Mahjong";

pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix

@@ -1,7 +1,7 @@
 { lib, runCommand }:
 
 rec {
-  runTest = name: body: runCommand name { } ''
+  runTest = name: body: runCommand name { strictDeps = true; } ''
     set -o errexit
     ${body}
     touch $out

pkgs/build-support/trivial-builders.nix

@@ -593,45 +593,28 @@ rec {
     in linkFarm name (map mkEntryFromDrv drvs);
 
 
-  /*
-    Make a package that just contains a setup hook with the given contents.
-    This setup hook will be invoked by any package that includes this package
-    as a buildInput. Optionally takes a list of substitutions that should be
-    applied to the resulting script.
-
-    Examples:
-    # setup hook that depends on the hello package and runs ./myscript.sh
-    myhellohook = makeSetupHook { deps = [ hello ]; } ./myscript.sh;
-
-    # writes a Linux-exclusive setup hook where @bash@ myscript.sh is substituted for the
-    # bash interpreter.
-    myhellohookSub = makeSetupHook {
-                   name = "myscript-hook";
-                   deps = [ hello ];
-                   substitutions = { bash = "${pkgs.bash}/bin/bash"; };
-                   meta.platforms = lib.platforms.linux;
-                 } ./myscript.sh;
-
-    # setup hook with a package test
-    myhellohookTested = makeSetupHook {
-                   name = "myscript-hook";
-                   deps = [ hello ];
-                   substitutions = { bash = "${pkgs.bash}/bin/bash"; };
-                   meta.platforms = lib.platforms.linux;
-                   passthru.tests.greeting = callPackage ./test { };
-                 } ./myscript.sh;
-   */
+  # docs in doc/builders/special/makesetuphook.section.md
   makeSetupHook =
     { name ? lib.warn "calling makeSetupHook without passing a name is deprecated." "hook"
-    , deps ? []
-    , substitutions ? {}
-    , meta ? {}
-    , passthru ? {}
+    , deps ? [ ]
+      # hooks go in nativeBuildInput so these will be nativeBuildInput
+    , propagatedBuildInputs ? [ ]
+      # these will be buildInputs
+    , depsTargetTargetPropagated ? [ ]
+    , meta ? { }
+    , passthru ? { }
+    , substitutions ? { }
     }:
     script:
     runCommand name
       (substitutions // {
         inherit meta;
+        inherit depsTargetTargetPropagated;
+        propagatedBuildInputs =
+          # remove list conditionals before 23.11
+          lib.warnIf (!lib.isList deps) "'deps' argument to makeSetupHook must be a list. content of deps: ${toString deps}"
+            (lib.warnIf (deps != [ ]) "'deps' argument to makeSetupHook is deprecated and will be removed in release 23.11., Please use propagatedBuildInputs instead. content of deps: ${toString deps}"
+              propagatedBuildInputs ++ (if lib.isList deps then deps else [ deps ]));
         strictDeps = true;
         # TODO 2023-01, no backport: simplify to inherit passthru;
         passthru = passthru
@@ -642,8 +625,7 @@ rec {
       (''
         mkdir -p $out/nix-support
         cp ${script} $out/nix-support/setup-hook
-      '' + lib.optionalString (deps != []) ''
-        printWords ${toString deps} > $out/nix-support/propagated-build-inputs
+        recordPropagatedDependencies
       '' + lib.optionalString (substitutions != {}) ''
         substituteAll ${script} $out/nix-support/setup-hook
       '');

pkgs/development/compilers/chez-racket/default.nix

@@ -1,16 +1,23 @@
 { stdenv, buildPackages, callPackage }:
 
 let
-  chezSystemMap = {
-    # See `/workarea` of source code for list of systems
-    "aarch64-darwin" = "tarm64osx";
-    "aarch64-linux" = "tarm64le";
-    "armv7l-linux" = "tarm32le";
-    "x86_64-darwin" = "ta6osx";
-    "x86_64-linux" = "ta6le";
-  };
+  chezArch =
+    /**/ if stdenv.hostPlatform.isAarch then "arm${toString stdenv.hostPlatform.parsed.cpu.bits}"
+    else if stdenv.hostPlatform.isx86_32 then "i3"
+    else if stdenv.hostPlatform.isx86_64 then "a6"
+    else if stdenv.hostPlatform.isPower then "ppc${toString stdenv.hostPlatform.parsed.cpu.bits}"
+    else throw "Add ${stdenv.hostPlatform.parsed.cpu.arch} to chezArch to enable building chez-racket";
+
+  chezOs =
+    /**/ if stdenv.hostPlatform.isDarwin then "osx"
+    else if stdenv.hostPlatform.isFreeBSD then "fb"
+    else if stdenv.hostPlatform.isLinux then "le"
+    else if stdenv.hostPlatform.isNetBSD then "nb"
+    else if stdenv.hostPlatform.isOpenBSD then "ob"
+    else throw "Add ${stdenv.hostPlatform.uname.system} to chezOs to enable building chez-racket";
+
   inherit (stdenv.hostPlatform) system;
-  chezSystem = chezSystemMap.${system} or (throw "Add ${system} to chezSystemMap to enable building chez-racket");
+  chezSystem = "t${chezArch}${chezOs}";
   # Chez Scheme uses an ad-hoc `configure`, hence we don't use the usual
   # stdenv abstractions.
   forBoot = {

pkgs/development/compilers/chez-racket/shared.nix

@@ -24,8 +24,7 @@ stdenv.mkDerivation (args // {
   '';
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin (with darwin; [ cctools autoSignDarwinBinariesHook ]);
-  buildInputs = [ ncurses libX11 zlib lz4 ]
-    ++ lib.optional stdenv.isDarwin libiconv;
+  buildInputs = [ libiconv libX11 lz4 ncurses zlib ];
 
   enableParallelBuilding = true;
 

pkgs/development/compilers/glslang/default.nix

@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = "sdk-${version}";
-    hash = "sha256-iVcx1j7OMJEU4cPydNwQSFufTUiqq7GKp69Y6pEt7Wc=";
+    hash = "sha256-P2HG/oJXdB5nvU3zVnj2vSLJGQuDcZiQBfBBvuR66Kk=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
@@ -33,6 +33,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/KhronosGroup/glslang/commit/7627bd89583c5aafb8b38c81c15494019271fabf.patch";
       hash = "sha256-1Dwhn78PG4gAGgEwTXpC+mkZRyvy8sTIsEvihXFeNaQ=";
     })
+    # Upstream tries to detect the Darwin linker by checking for AppleClang, but it’s just Clang in nixpkgs.
+    # Revert the commit to allow the build to work on Darwin with the nixpkg Darwin Clang toolchain.
+    (fetchpatch {
+      name = "Fix-Darwin-linker-error.patch";
+      url = "https://github.com/KhronosGroup/glslang/commit/586baa35a47b3aa6ad3fa829a27f0f4206400668.patch";
+      hash = "sha256-paAl4E8GzogcxDEzn/XuhNH6XObp+i7WfArqAiuH4Mk=";
+      revert = true;
+    })
   ];
 
   postPatch = ''

pkgs/development/compilers/openjdk/11.nix

@@ -4,15 +4,15 @@
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
 let
   major = "11";
   minor = "0";
-  update = "17";
-  build = "8";
+  update = "18";
+  build = "10";
 
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
@@ -22,7 +22,7 @@ let
       owner = "openjdk";
       repo = "jdk${major}u";
       rev = "jdk-${version}";
-      sha256 = "sha256-kvgLYqQZPqyuigVyzbDHc3TMff0clvzM8IdzYLYcxPU=";
+      sha256 = "sha256-QGOpMIrWwOtIcUY/CLbTRDvcVTG2xioZu46v+n+IIQ4=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];

pkgs/development/compilers/openjdk/12.nix

@@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11, fetchpatch
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 

pkgs/development/compilers/openjdk/13.nix

@@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk13-bootstrap, fetchpatch
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 

pkgs/development/compilers/openjdk/14.nix

@@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk14-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 

pkgs/development/compilers/openjdk/15.nix

@@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk15-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 

pkgs/development/compilers/openjdk/16.nix

@@ -4,7 +4,7 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk16-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 

pkgs/development/compilers/openjdk/17.nix

@@ -4,15 +4,15 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk17-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
 let
   version = {
     feature = "17";
-    interim = ".0.5";
-    build = "8";
+    interim = ".0.6";
+    build = "10";
   };
 
   openjdk = stdenv.mkDerivation {
@@ -23,7 +23,7 @@ let
       owner = "openjdk";
       repo = "jdk${version.feature}u";
       rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      sha256 = "sha256-2k1Mm36ds6MZheZVsLvXkoqQG4zYeIRWzbP1aZ72Vqs=";
+      sha256 = "sha256-zPpINi++3Ct0PCwlwlfhceh/ploMkclw+MgeI9dULdc=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];

pkgs/development/compilers/openjdk/18.nix

@@ -4,7 +4,7 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk18-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 

pkgs/development/compilers/openjdk/19.nix

@@ -7,15 +7,15 @@
 # TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
 # which should be fixable, this is a no-rebuild workaround for GHC.
 , headless ? stdenv.targetPlatform.isGhcjs
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
 let
   version = {
     feature = "19";
-    interim = ".0.1";
-    build = "10";
+    interim = ".0.2";
+    build = "7";
   };
 
   openjdk = stdenv.mkDerivation {
@@ -26,7 +26,7 @@ let
       owner = "openjdk";
       repo = "jdk${version.feature}u";
       rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      hash = "sha256-IS6ABnVdW1qJ4gu4YSgMVFXBTNdtWFdbNNz+kMaiyk8=";
+      hash = "sha256-pBEHmBtIgG4Czou4C/zpBBYZEDImvXiLoA5CjOzpeyI=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
@@ -57,8 +57,8 @@ let
       # Patch borrowed from Alpine to fix build errors with musl libc and recent gcc.
       # This is applied anywhere to prevent patchrot.
       (fetchpatch {
-        url = "https://git.alpinelinux.org/aports/plain/testing/openjdk19/FixNullPtrCast.patch?id=b93d1fc37fcf106144958d957bb97c7db67bd41f";
-        hash = "sha256-cnpeYcVoRYjuDgrl2x27frv6KUAnu1+1MVPehPZy/Cg=";
+        url = "https://git.alpinelinux.org/aports/plain/testing/openjdk19/FixNullPtrCast.patch?id=93dc07f97ff716b647c5f57c6224901ea06da560";
+        hash = "sha256-H4X3Yip5bCpXMH7MSu9BgXIOYRVUBMZPZW8EvZSWI5k=";
       })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk13.patch

pkgs/development/compilers/openjdk/8.nix

@@ -20,7 +20,7 @@ let
     powerpc64le-linux = "ppc64le";
   }.${stdenv.system} or (throw "Unsupported platform ${stdenv.system}");
 
-  update = "352";
+  update = "362";
   build = "ga";
 
   openjdk8 = stdenv.mkDerivation rec {
@@ -31,7 +31,7 @@ let
       owner = "openjdk";
       repo = "jdk8u";
       rev = "jdk${version}";
-      sha256 = "sha256-xDiiALDjStD9IPhbBr997rm/v2Q/WdS10cILBCmdJIQ=";
+      sha256 = "sha256-C5dQwfIIpIrLeO3JWERyFCQHUSgG8gARuc3qXAeLkJ4=";
     };
     outputs = [ "out" "jre" ];
 

pkgs/development/compilers/openjdk/openjfx/11.nix

@@ -1,26 +1,19 @@
 { stdenv, lib, fetchFromGitHub, writeText, gradle_7, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, icu68
-, openjdk11-bootstrap }:
+, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, icu68
+, openjdk11-bootstrap
+, withMedia ? true
+, withWebKit ? false
+}:
 
 let
   major = "11";
-  update = ".0.17";
+  update = ".0.18";
   build = "1";
   repover = "${major}${update}+${build}";
   gradle_ = (gradle_7.override {
     java = openjdk11-bootstrap;
   });
 
-  NIX_CFLAGS_COMPILE = [
-    # avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
-    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
-    # glib-2.62 deprecations
-    # -fcommon: gstreamer workaround for -fno-common toolchains:
-    #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
-    #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
-    "-fcommon"
-  ];
-
   makePackage = args: stdenv.mkDerivation ({
     version = "${major}${update}-${build}";
 
@@ -28,10 +21,10 @@ let
       owner = "openjdk";
       repo = "jfx${major}u";
       rev = repover;
-      sha256 = "sha256-uKb6k+tIFdwy1BYiHWeGmKNz82X4CZjFlGYqLDpSFY0=";
+      sha256 = "sha256-46DjIzcBHkmp5vnhYnLu78CG72bIBRM4A6mgk2OLOko=";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -81,8 +74,8 @@ in makePackage {
   pname = "openjfx-modular-sdk";
 
   gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
   '';
 
   preBuild = ''

pkgs/development/compilers/openjdk/openjfx/15.nix

@@ -1,6 +1,9 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk11_headless, gradle_6
-, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4-headless, python3, ruby }:
+, pkg-config, perl, cmake, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib
+, ffmpeg_4-headless, python3, ruby
+, withMedia ? true
+, withWebKit ? false
+}:
 
 let
   major = "15";
@@ -21,7 +24,7 @@ let
       sha256 = "019glq8rhn6amy3n5jc17vi2wpf1pxpmmywvyz1ga8n09w7xscq1";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -76,8 +79,8 @@ in makePackage {
   pname = "openjfx-modular-sdk";
 
   gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
   '';
 
   preBuild = ''

pkgs/development/compilers/openjdk/openjfx/17.nix

@@ -1,11 +1,14 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk17_headless, gradle_7
-, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4-headless, python3, ruby, icu68 }:
+, pkg-config, perl, cmake, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib
+, ffmpeg_4-headless, python3, ruby, icu68
+, withMedia ? true
+, withWebKit ? false
+}:
 
 let
   major = "17";
-  update = ".0.5";
-  build = "+1";
+  update = ".0.6";
+  build = "+3";
   repover = "${major}${update}${build}";
   gradle_ = (gradle_7.override {
     java = openjdk17_headless;
@@ -18,10 +21,10 @@ let
       owner = "openjdk";
       repo = "jfx${major}u";
       rev = repover;
-      sha256 = "sha256-jzLOlWuhkUS0/4+nXtjd1/IYbAHHnJrusFRTh7aPt8U=";
+      sha256 = "sha256-9VfXk2EfMebMyVKPohPRP2QXRFf8XemUtfY0JtBCHyw=";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -66,8 +69,8 @@ in makePackage {
   pname = "openjfx-modular-sdk";
 
   gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
   '';
 
   preBuild = ''

pkgs/development/compilers/openjdk/openjfx/19.nix

@@ -1,11 +1,14 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, writeText, openjdk17_headless
-, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst
-, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68 }:
+, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk3, libXtst
+, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68
+, withMedia ? true
+, withWebKit ? false
+}:
 
 let
   major = "19";
-  update = "";
-  build = "+11";
+  update = ".0.2.1";
+  build = "+1";
   repover = "${major}${update}${build}";
   gradle_ = (gradle_7.override {
     # note: gradle does not yet support running on 19
@@ -19,7 +22,7 @@ let
       owner = "openjdk";
       repo = "jfx";
       rev = repover;
-      hash = "sha256-UXTaXtJ8py83V7IQK9wACIEWDAMRUaYNgH9e/Aeyuzc=";
+      hash = "sha256-A08GhCGpzWlUG1+f6mcjvkJmMNaOReacQKPEmNpUvLs=";
     };
 
     patches = [
@@ -35,7 +38,7 @@ let
       })
     ];
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -83,8 +86,8 @@ in makePackage {
   pname = "openjfx-modular-sdk";
 
   gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
   '';
 
   preBuild = ''

pkgs/development/compilers/rust/1_67.nix

@@ -21,8 +21,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.67.0";
-  rustcSha256 = "sha256-0CnxT85Foux6mmBdKgpAquRznLL9rinun3pukCWn/eQ=";
+  rustcVersion = "1.67.1";
+  rustcSha256 = "sha256-Rkg9Pl3oWjvUb456OuGDdJY5EGfb5xOiXTzwUbPZ/24=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
@@ -59,14 +59,6 @@ import ./default.nix {
   selectRustPackage = pkgs: pkgs.rust_1_67;
 
   rustcPatches = [
-    # fix thin archive reading
-    # https://github.com/rust-lang/rust/pull/107360
-    (fetchpatch {
-      name = "revert-back-to-llvmarchivebuilder-on-all-platforms.patch";
-      url = "https://github.com/rust-lang/rust/commit/de363d54c40a378717881240e719f5f7223ba376.patch";
-      hash = "sha256-3Xb803LZUZ1dldxGJ65Iw6gg1V1K827OB/0b32GqilU=";
-    })
-
     # Fixes ICE.
     # https://github.com/rust-lang/rust/pull/107688
     (fetchpatch {

pkgs/development/interpreters/lua-5/hooks/default.nix

@@ -27,7 +27,7 @@ in {
   luarocksCheckHook = callPackage ({ luarocks }:
     makeSetupHook {
       name = "luarocks-check-hook";
-      deps = [ luarocks ];
+      propagatedBuildInputs = [ luarocks ];
     } ./luarocks-check-hook.sh) {};
 
   # luarocks installs data in a non-overridable location. Until a proper luarocks patch,
@@ -35,6 +35,6 @@ in {
   luarocksMoveDataFolder = callPackage ({ }:
     makeSetupHook {
       name = "luarocks-move-rock";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
     } ./luarocks-move-data.sh) {};
 }

pkgs/development/interpreters/lua-5/wrap-lua.nix

@@ -8,7 +8,7 @@
 # imported as wrapLua in lua-packages.nix and passed to build-lua-derivation to be used as buildInput
 makeSetupHook {
   name = "wrap-lua-hook";
-  deps = makeWrapper;
+  propagatedBuildInputs = [ makeWrapper ];
   substitutions.executable = lua.interpreter;
   substitutions.lua = lua;
   substitutions.LuaPathSearchPaths = lib.escapeShellArgs lua.LuaPathSearchPaths;

pkgs/development/interpreters/octave/wrap-octave.nix

@@ -10,7 +10,7 @@
 # Each of the substitutions is available in the wrap.sh script as @thingSubstituted@
 makeSetupHook {
   name = "${octave.name}-pkgs-setup-hook";
-  deps = makeWrapper;
+  propagatedBuildInputs = [ makeWrapper ];
   substitutions.executable = octave.interpreter;
   substitutions.octave = octave;
 } ./wrap.sh

pkgs/development/interpreters/python/cpython/2.7/default.nix

@@ -24,7 +24,7 @@
 , pkgsHostHost
 , pkgsTargetTarget
 , sourceVersion
-, sha256
+, hash
 , passthruFun
 , static ? stdenv.hostPlatform.isStatic
 , stripBytecode ? reproducibleBuild
@@ -87,7 +87,7 @@ let
     owner = "ActiveState";
     repo = "cpython";
     rev = "v${version}";
-    inherit sha256;
+    inherit hash;
   };
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);

pkgs/development/interpreters/python/cpython/default.nix

@@ -30,7 +30,7 @@
 , pkgsHostHost
 , pkgsTargetTarget
 , sourceVersion
-, sha256
+, hash
 , passthruFun
 , bash
 , stripConfig ? false
@@ -215,7 +215,7 @@ in with passthru; stdenv.mkDerivation {
 
   src = fetchurl {
     url = with sourceVersion; "https://www.python.org/ftp/python/${major}.${minor}.${patch}/Python-${version}.tar.xz";
-    inherit sha256;
+    inherit hash;
   };
 
   prePatch = optionalString stdenv.isDarwin ''
@@ -235,7 +235,7 @@ in with passthru; stdenv.mkDerivation {
       url = "https://github.com/python/cpython/commit/3fae04b10e2655a20a3aadb5e0d63e87206d0c67.diff";
       revert = true;
       excludes = [ "Misc/NEWS.d/*" ];
-      sha256 = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
+      hash = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
     })
   ] ++ [
     # Disable the use of ldconfig in ctypes.util.find_library (since

pkgs/development/interpreters/python/default.nix

@@ -117,23 +117,24 @@
   };
 
   sources = {
-    python39 = {
-      sourceVersion = {
-        major = "3";
-        minor = "9";
-        patch = "16";
-        suffix = "";
-      };
-      sha256 = "sha256-It3cCZJG3SdgZlVh6K23OU6gzEOnJoTGSA+TgPd4ZDk=";
-    };
     python310 = {
       sourceVersion = {
         major = "3";
         minor = "10";
-        patch = "9";
+        patch = "10";
         suffix = "";
       };
-      sha256 = "sha256-WuA+MIJgFkuro5kh/bTb+ObQPYI1qTnUWCsz8LXkaoM=";
+      hash = "sha256-BBnpCFv1G3pnIAmz9Q2/GFms3xi6cl0OwZqlyFA/DqM=";
+    };
+
+    python311 = {
+      sourceVersion = {
+        major = "3";
+        minor = "11";
+        patch = "2";
+        suffix = "";
+      };
+      hash = "sha256-KeS49fFlhUKowT4t0nc1jJxI8rL3MYZS7xZ15AK50q8=";
     };
   };
 
@@ -147,7 +148,7 @@ in {
       patch = "18";
       suffix = ".6"; # ActiveState's Python 2 extended support
     };
-    sha256 = "sha256-+I0QOBkuTHMIQz71lgNn1X1vjPsjJMtFbgC0xcGTwWY=";
+    hash = "sha256-+I0QOBkuTHMIQz71lgNn1X1vjPsjJMtFbgC0xcGTwWY=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -160,16 +161,23 @@ in {
       patch = "16";
       suffix = "";
     };
-    sha256 = "sha256-2F27N3QTJHPYCB3LFY80oQzK16kLlsflDqS7YfXORWI=";
+    hash = "sha256-2F27N3QTJHPYCB3LFY80oQzK16kLlsflDqS7YfXORWI=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
 
-  python39 = callPackage ./cpython ({
+  python39 = callPackage ./cpython {
     self = __splicedPackages.python39;
+    sourceVersion = {
+      major = "3";
+      minor = "9";
+      patch = "16";
+      suffix = "";
+    };
+    hash = "sha256-It3cCZJG3SdgZlVh6K23OU6gzEOnJoTGSA+TgPd4ZDk=";
     inherit (darwin) configd;
     inherit passthruFun;
-  } // sources.python39);
+  };
 
   python310 = callPackage ./cpython ({
     self = __splicedPackages.python310;
@@ -177,18 +185,11 @@ in {
     inherit passthruFun;
   } // sources.python310);
 
-  python311 = callPackage ./cpython {
+  python311 = callPackage ./cpython ({
     self = __splicedPackages.python311;
-    sourceVersion = {
-      major = "3";
-      minor = "11";
-      patch = "1";
-      suffix = "";
-    };
-    sha256 = "sha256-hYeRkvLP/VbLFsCSkFlJ6/Pl45S392RyNSljeQHftY8=";
     inherit (darwin) configd;
     inherit passthruFun;
-  };
+  } // sources.python311);
 
   python312 = callPackage ./cpython {
     self = __splicedPackages.python312;
@@ -198,7 +199,7 @@ in {
       patch = "0";
       suffix = "a5";
     };
-    sha256 = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
+    hash = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -241,7 +242,7 @@ in {
       patch = "11";
     };
 
-    sha256 = "sha256-ERevtmgx2k6m852NIIR4enRon9AineC+MB+e2bJVCTw=";
+    hash = "sha256-ERevtmgx2k6m852NIIR4enRon9AineC+MB+e2bJVCTw=";
     pythonVersion = "2.7";
     db = db.override { dbmSupport = !stdenv.isDarwin; };
     python = __splicedPackages.pythonInterpreters.pypy27_prebuilt;
@@ -258,7 +259,7 @@ in {
       patch = "11";
     };
 
-    sha256 = "sha256-sPMWb7Klqt/VzrnbXN1feSmg7MygK0omwNrgSS98qOo=";
+    hash = "sha256-sPMWb7Klqt/VzrnbXN1feSmg7MygK0omwNrgSS98qOo=";
     pythonVersion = "3.9";
     db = db.override { dbmSupport = !stdenv.isDarwin; };
     python = __splicedPackages.pypy27;
@@ -270,7 +271,7 @@ in {
   pypy38 = __splicedPackages.pypy39.override {
     self = __splicedPackages.pythonInterpreters.pypy38;
     pythonVersion = "3.8";
-    sha256 = "sha256-TWdpv8pzc06GZv1wUDt86wam4lkRDmFzMbs4mcpOYFg=";
+    hash = "sha256-TWdpv8pzc06GZv1wUDt86wam4lkRDmFzMbs4mcpOYFg=";
   };
 
   pypy37 = throw "pypy37 has been removed from nixpkgs since it is no longer supported upstream"; # Added 2023-01-04
@@ -284,7 +285,7 @@ in {
       patch = "11";
     };
 
-    sha256 = {
+    hash = {
       aarch64-linux = "sha256-6pJNod7+kyXvdg4oiwT5hGFOQFWA9TIetqXI9Tm9QVo=";
       x86_64-linux = "sha256-uo7ZWKkFwHNaTP/yh1wlCJlU3AIOCH2YKw/6W52jFs0=";
       aarch64-darwin = "sha256-zFaWq0+TzTSBweSZC13t17pgrAYC+hiQ02iImmxb93E=";
@@ -302,7 +303,7 @@ in {
       minor = "3";
       patch = "11";
     };
-    sha256 = {
+    hash = {
       aarch64-linux = "sha256-CRddxlLtiV2Y6a1j0haBK/PufjmNkAqb+espBrqDArk=";
       x86_64-linux = "sha256-1QYXLKEQcSdBdddOnFgcMWZDLQF5sDZHDjuejSDq5YE=";
       aarch64-darwin = "sha256-ka11APGjlTHb76CzRaPc/5J/+ZcWVOjS6e98WuMR9X4=";

pkgs/development/interpreters/python/hooks/default.nix

@@ -11,7 +11,7 @@ in {
   condaInstallHook = callPackage ({ makePythonHook, gnutar, lbzip2 }:
     makePythonHook {
       name = "conda-install-hook";
-      deps = [ gnutar lbzip2 ];
+      propagatedBuildInputs = [ gnutar lbzip2 ];
       substitutions = {
         inherit pythonSitePackages;
       };
@@ -20,19 +20,19 @@ in {
   condaUnpackHook = callPackage ({ makePythonHook }:
     makePythonHook {
       name = "conda-unpack-hook";
-      deps = [];
+      propagatedBuildInputs = [];
     } ./conda-unpack-hook.sh) {};
 
   eggBuildHook = callPackage ({ makePythonHook }:
     makePythonHook {
       name = "egg-build-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
     } ./egg-build-hook.sh) {};
 
   eggInstallHook = callPackage ({ makePythonHook, setuptools }:
     makePythonHook {
       name = "egg-install-hook.sh";
-      deps = [ setuptools ];
+      propagatedBuildInputs = [ setuptools ];
       substitutions = {
         inherit pythonInterpreter pythonSitePackages;
       };
@@ -41,13 +41,13 @@ in {
   eggUnpackHook = callPackage ({ makePythonHook, }:
     makePythonHook {
       name = "egg-unpack-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
     } ./egg-unpack-hook.sh) {};
 
   flitBuildHook = callPackage ({ makePythonHook, flit }:
     makePythonHook {
       name = "flit-build-hook";
-      deps = [ flit ];
+      propagatedBuildInputs = [ flit ];
       substitutions = {
         inherit pythonInterpreter;
       };
@@ -56,7 +56,7 @@ in {
   pipBuildHook = callPackage ({ makePythonHook, pip, wheel }:
     makePythonHook {
       name = "pip-build-hook.sh";
-      deps = [ pip wheel ];
+      propagatedBuildInputs = [ pip wheel ];
       substitutions = {
         inherit pythonInterpreter pythonSitePackages;
       };
@@ -65,7 +65,7 @@ in {
   pipInstallHook = callPackage ({ makePythonHook, pip }:
     makePythonHook {
       name = "pip-install-hook";
-      deps = [ pip ];
+      propagatedBuildInputs = [ pip ];
       substitutions = {
         inherit pythonInterpreter pythonSitePackages;
       };
@@ -74,7 +74,7 @@ in {
   pytestCheckHook = callPackage ({ makePythonHook, pytest }:
     makePythonHook {
       name = "pytest-check-hook";
-      deps = [ pytest ];
+      propagatedBuildInputs = [ pytest ];
       substitutions = {
         inherit pythonCheckInterpreter;
       };
@@ -123,7 +123,7 @@ in {
   pythonRelaxDepsHook = callPackage ({ makePythonHook, wheel }:
     makePythonHook {
       name = "python-relax-deps-hook";
-      deps = [ wheel ];
+      propagatedBuildInputs = [ wheel ];
       substitutions = {
         inherit pythonInterpreter;
       };
@@ -145,7 +145,7 @@ in {
   setuptoolsBuildHook = callPackage ({ makePythonHook, setuptools, wheel }:
     makePythonHook {
       name = "setuptools-setup-hook";
-      deps = [ setuptools wheel ];
+      propagatedBuildInputs = [ setuptools wheel ];
       substitutions = {
         inherit pythonInterpreter pythonSitePackages setuppy;
       };
@@ -154,7 +154,7 @@ in {
   setuptoolsCheckHook = callPackage ({ makePythonHook, setuptools }:
     makePythonHook {
       name = "setuptools-check-hook";
-      deps = [ setuptools ];
+      propagatedBuildInputs = [ setuptools ];
       substitutions = {
         inherit pythonCheckInterpreter setuppy;
       };
@@ -171,7 +171,7 @@ in {
   venvShellHook = disabledIf (!isPy3k) (callPackage ({ makePythonHook, ensureNewerSourcesForZipFilesHook }:
     makePythonHook {
       name = "venv-shell-hook";
-      deps = [ ensureNewerSourcesForZipFilesHook ];
+      propagatedBuildInputs = [ ensureNewerSourcesForZipFilesHook ];
       substitutions = {
         inherit pythonInterpreter;
       };
@@ -180,7 +180,7 @@ in {
   wheelUnpackHook = callPackage ({ makePythonHook, wheel }:
     makePythonHook {
       name = "wheel-unpack-hook.sh";
-      deps = [ wheel ];
+      propagatedBuildInputs = [ wheel ];
     } ./wheel-unpack-hook.sh) {};
 
   wrapPython = callPackage ../wrap-python.nix {
@@ -190,6 +190,6 @@ in {
   sphinxHook = callPackage ({ makePythonHook, sphinx, installShellFiles }:
     makePythonHook {
       name = "python${python.pythonVersion}-sphinx-hook";
-      deps = [ sphinx installShellFiles ];
+      propagatedBuildInputs = [ sphinx installShellFiles ];
     } ./sphinx-hook.sh) {};
 }

pkgs/development/interpreters/python/python-packages-base.nix

@@ -16,17 +16,22 @@ let
   # This function introduces `overridePythonAttrs` and it overrides the call to `buildPythonPackage`.
   makeOverridablePythonPackage = f: origArgs:
     let
-      ff = f origArgs;
-      overrideWith = newArgs: origArgs // (if pkgs.lib.isFunction newArgs then newArgs origArgs else newArgs);
+      args = lib.fix (lib.extends
+        (_: previousAttrs: {
+          passthru = (previousAttrs.passthru or { }) // {
+            overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
+          };
+        })
+        (_: origArgs));
+      result = f args;
+      overrideWith = newArgs: args // (if pkgs.lib.isFunction newArgs then newArgs args else newArgs);
     in
-      if builtins.isAttrs ff then (ff // {
+      if builtins.isAttrs result then result
+      else if builtins.isFunction result then {
         overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
-      })
-      else if builtins.isFunction ff then {
-        overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
-        __functor = self: ff;
+        __functor = self: result;
       }
-      else ff;
+      else result;
 
   buildPythonPackage = makeOverridablePythonPackage (lib.makeOverridable (callPackage ./mk-python-derivation.nix {
     inherit namePrefix;     # We want Python libraries to be named like e.g. "python3.6-${name}"

pkgs/development/interpreters/python/tests.nix

@@ -43,7 +43,8 @@ let
       # Use virtualenv from a Nix env.
       nixenv-virtualenv = rec {
         env = runCommand "${python.name}-virtualenv" {} ''
-          ${pythonVirtualEnv.interpreter} -m virtualenv $out
+          ${pythonVirtualEnv.interpreter} -m virtualenv venv
+          mv venv $out
         '';
         interpreter = "${env}/bin/${python.executable}";
         is_venv = "False";
@@ -173,7 +174,7 @@ let
       }
     ) {};
     pythonWithRequests = requests.pythonModule.withPackages (ps: [ requests ]);
-    in
+    in lib.optionalAttrs stdenv.isLinux
     {
       condaExamplePackage = runCommand "import-requests" {} ''
         ${pythonWithRequests.interpreter} -c "import requests" > $out

pkgs/development/interpreters/python/wrap-python.nix

@@ -5,7 +5,7 @@
 
 makePythonHook {
       name = "wrap-python-hook";
-      deps = makeWrapper;
+      propagatedBuildInputs = [ makeWrapper ];
       substitutions.sitePackages = python.sitePackages;
       substitutions.executable = python.interpreter;
       substitutions.python = python.pythonForBuild;

pkgs/development/interpreters/ruby/default.nix

@@ -190,14 +190,7 @@ let
 
           # Allow to override compiler. This is important for cross compiling as
           # we need to set a compiler that is different from the build one.
-          awk -i inplace -F' = ' \
-            ' # operate on the line starting with
-              /^  CONFIG\["CC"\]/ {
-                # replace the right hand side
-                sub($2, "ENV[\"CC\"] || \"1\"")
-              }; { print }' "$rbConfig"
-          # test that the line isn't mangled in case upstream made the above unnecessary
-          grep -qx '  CONFIG\["CC"\] = ENV\["CC"\] || "1"' "$rbConfig"
+          sed -i 's/CONFIG\["CC"\] = "\(.*\)"/CONFIG["CC"] = if ENV["CC"].nil? || ENV["CC"].empty? then "\1" else ENV["CC"] end/'  "$rbConfig"
 
           # Remove unnecessary external intermediate files created by gems
           extMakefiles=$(find $out/${passthru.gemPath} -name Makefile)
@@ -235,6 +228,21 @@ let
             $rbConfig $out/lib/libruby*
         '';
 
+        installCheckPhase = ''
+          overriden_cc=$(CC=foo $out/bin/ruby -rrbconfig -e 'puts RbConfig::CONFIG["CC"]')
+          if [[ "$overriden_cc" != "foo" ]]; then
+             echo "CC cannot be overwritten: $overriden_cc != foo" >&2
+             false
+          fi
+
+          fallback_cc=$(unset CC; $out/bin/ruby -rrbconfig -e 'puts RbConfig::CONFIG["CC"]')
+          if [[ "$fallback_cc" != "$CC" ]]; then
+             echo "CC='$fallback_cc' should be '$CC' by default" >&2
+             false
+          fi
+        '';
+        doInstallCheck = true;
+
         disallowedRequisites = op (!jitSupport) stdenv.cc.cc
           ++ op useBaseRuby baseRuby;
 

pkgs/development/interpreters/tcl/generic.nix

@@ -53,7 +53,7 @@ let
         libdir = "lib/${libPrefix}";
         tclPackageHook = callPackage ({ buildPackages }: makeSetupHook {
           name = "tcl-package-hook";
-          deps = [ buildPackages.makeWrapper ];
+          propagatedBuildInputs = [ buildPackages.makeWrapper ];
         } ./tcl-package-hook.sh) {};
       };
     };

pkgs/development/libraries/accountsservice/default.nix

@@ -62,8 +62,8 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     dbus
+    gettext
     glib
     polkit
     systemd

pkgs/development/libraries/audio/libopenmpt/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.6";
+  version = "0.6.8";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "bdueJqQwYglEiReW/vsbuzi9kUj2z8VYgQwNPyaYdsc=";
+    sha256 = "HGGLPf8afLaiT0MXVZIPokN1YmgTj/ox09t8YHwsLWk=";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/audio/roc-toolkit/default.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   pname = "roc-toolkit";
   version = "0.2.1";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "roc-streaming";
     repo = "roc-toolkit";

pkgs/development/libraries/boost/generic.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv, libxcrypt
+{ lib, stdenv, icu, expat, zlib, bzip2, zstd, xz, python ? null, fixDarwinDylibNames, libiconv, libxcrypt
 , boost-build
 , fetchpatch
 , which
@@ -226,6 +226,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ which boost-build ]
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [ expat zlib bzip2 libiconv ]
+    ++ lib.optional (lib.versionAtLeast version "1.69") zstd
+    ++ lib.optional (lib.versionAtLeast version "1.65") xz
     ++ lib.optional enableIcu icu
     ++ lib.optionals enablePython [ libxcrypt python ]
     ++ lib.optional enableNumpy python.pkgs.numpy;

pkgs/development/libraries/cmocka/default.nix

@@ -20,38 +20,42 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = lib.optional doCheck "-DUNIT_TESTING=ON"
+    ++ lib.optional stdenv.hostPlatform.isStatic "-DBUILD_SHARED_LIBS=OFF";
+
+  doCheck = true;
+
   meta = with lib; {
     description = "Lightweight library to simplify and generalize unit tests for C";
+    longDescription = ''
+      There are a variety of C unit testing frameworks available however
+      many of them are fairly complex and require the latest compiler
+      technology.  Some development requires the use of old compilers which
+      makes it difficult to use some unit testing frameworks. In addition
+      many unit testing frameworks assume the code being tested is an
+      application or module that is targeted to the same platform that will
+      ultimately execute the test.  Because of this assumption many
+      frameworks require the inclusion of standard C library headers in the
+      code module being tested which may collide with the custom or
+      incomplete implementation of the C library utilized by the code under
+      test.
 
-    longDescription =
-      ''There are a variety of C unit testing frameworks available however
-        many of them are fairly complex and require the latest compiler
-        technology.  Some development requires the use of old compilers which
-        makes it difficult to use some unit testing frameworks. In addition
-        many unit testing frameworks assume the code being tested is an
-        application or module that is targeted to the same platform that will
-        ultimately execute the test.  Because of this assumption many
-        frameworks require the inclusion of standard C library headers in the
-        code module being tested which may collide with the custom or
-        incomplete implementation of the C library utilized by the code under
-        test.
+      Cmocka only requires a test application is linked with the standard C
+      library which minimizes conflicts with standard C library headers.
+      Also, CMocka tries to avoid the use of some of the newer features of
+      C compilers.
 
-        Cmocka only requires a test application is linked with the standard C
-        library which minimizes conflicts with standard C library headers.
-        Also, CMocka tries to avoid the use of some of the newer features of
-        C compilers.
-
-        This results in CMocka being a relatively small library that can be
-        used to test a variety of exotic code. If a developer wishes to
-        simply test an application with the latest compiler then other unit
-        testing frameworks may be preferable.
-
-        This is the successor of Google's Cmockery.'';
+      This results in CMocka being a relatively small library that can be
+      used to test a variety of exotic code. If a developer wishes to
+      simply test an application with the latest compiler then other unit
+      testing frameworks may be preferable.
 
+      This is the successor of Google's Cmockery.
+    '';
     homepage = "https://cmocka.org/";
-
     license = licenses.asl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ kragniz rasendubi ];
+    broken = stdenv.hostPlatform.isStatic; # See https://github.com/NixOS/nixpkgs/issues/213623
   };
 }

pkgs/development/libraries/gjs/default.nix

@@ -27,7 +27,6 @@
 
 let
   testDeps = [
-    gobject-introspection # for Gio and cairo typelibs
     gtk3 atk pango.out gdk-pixbuf harfbuzz
   ];
 in stdenv.mkDerivation rec {

pkgs/development/libraries/glib/default.nix

@@ -56,11 +56,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.74.3";
+  version = "2.74.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "6bxB7NlpDZvGqXDMc4ARm4KOW2pLFsOTxjiz3CuHy8s=";
+    sha256 = "zrqDpZmc6zGkxPyZISB8uf//0qsdbsA8Fi0/YIpcFMg=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
@@ -118,20 +118,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Disable flaky test.
     # https://gitlab.gnome.org/GNOME/glib/-/issues/820
     ./skip-timer-test.patch
-
-    # GVariant security fixes
-    # https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126.patch";
-      sha256 = "CNCxouYy8xNHt4eJtPZ2eOi9b0SxzI2DkklNfQMk3d8=";
-    })
-
-    # Menu model security fix
-    # https://discourse.gnome.org/t/fixes-for-gdbusmenumodel-crashes-in-glib/12846
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/4f4d770a1e40f719d5a310cffdac29cbb4e20c11.patch";
-      sha256 = "+S44AnC86HfbMwkRe1ll54IK9pLxaFD3LqiVhPelnXI=";
-    })
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];

pkgs/development/libraries/gtest/default.nix

@@ -21,7 +21,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
-  ] ++ lib.optionals (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0")) [
+  ] ++ lib.optionals (
+    (stdenv.cc.isGNU && (lib.versionOlder stdenv.cc.version "11.0"))
+    || (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0"))
+  ) [
     # Enable C++17 support
     # https://github.com/google/googletest/issues/3081
     "-DCMAKE_CXX_STANDARD=17"

pkgs/development/libraries/harfbuzz/default.nix

@@ -10,6 +10,8 @@
 , meson
 , ninja
 , gobject-introspection
+, buildPackages
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , icu
 , graphite2
 , harfbuzz # The icu variant uses and propagates the non-icu one.
@@ -61,6 +63,7 @@ stdenv.mkDerivation rec {
     (lib.mesonEnable "coretext" withCoreText)
     (lib.mesonEnable "graphite" withGraphite2)
     (lib.mesonEnable "icu" withIcu)
+    (lib.mesonEnable "introspection" withIntrospection)
   ];
 
   depsBuildBuild = [
@@ -70,14 +73,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson
     ninja
-    gobject-introspection
     libintl
     pkg-config
     python3
+    glib
     gtk-doc
     docbook-xsl-nons
     docbook_xml_dtd_43
-  ];
+  ] ++ lib.optional withIntrospection gobject-introspection;
 
   buildInputs = [ glib freetype ]
     ++ lib.optionals withCoreText [ ApplicationServices CoreText ];
@@ -107,6 +110,6 @@ stdenv.mkDerivation rec {
     homepage = "https://harfbuzz.github.io/";
     maintainers = [ maintainers.eelco ];
     license = licenses.mit;
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
   };
 }

pkgs/development/libraries/hidapi/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hidapi";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "hidapi";
     rev = "${pname}-${version}";
-    sha256 = "sha256-SMhlcB7LcViC6UFVYACjunxsGkvSOKC3mbLBH4XQSzM=";
+    sha256 = "sha256-CEZP5n8qEAzsqn8dz3u1nG0YoT7J1P+WfN7urkRTuVg=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/development/libraries/iso-codes/default.nix

@@ -9,15 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-QI95nfQTVGj6fKNetrBcQAS+pEPYHKWLibLkgkAagrs=";
   };
 
-  patchPhase = ''
-    for i in `find . -name \*.py`
-    do
-        sed -i -e "s|#!/usr/bin/env python|#!${python3}/bin/python|" $i
-    done
-  '';
-
   nativeBuildInputs = [ gettext python3 ];
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     homepage = "https://salsa.debian.org/iso-codes-team/iso-codes";
     description = "Various ISO codes packaged as XML files";

pkgs/development/libraries/libbsd/default.nix

@@ -1,12 +1,18 @@
-{ lib, stdenv, fetchurl, autoreconfHook, libmd }:
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, libmd
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "libbsd";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchurl {
     url = "https://libbsd.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-GbOPMXLq9pPm4caHFGNhkMfkiFHkUiTXILO1vASZtd8=";
+    hash = "sha256-m6oYYFnrvyXAYwjp+ZH9ox9xg8DySTGCbYOqar2KAmE=";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -18,6 +24,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./darwin.patch ];
 
+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "https://gitlab.freedesktop.org/libbsd/libbsd.git";
+  };
+
   meta = with lib; {
     description = "Common functions found on BSD systems";
     homepage = "https://libbsd.freedesktop.org/";

pkgs/development/libraries/libde265/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , pkg-config
 
@@ -13,25 +12,16 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.10";
+  version = "1.0.11";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "sha256-d2TJKPvOAqLe+ZO1+Rd/yRIn3W1u1q62ZH20/9N2Shw=";
+    sha256 = "sha256-0aRUh5h49fnjBjy42A5fWYHnhnQ4CFoeSIXZilZewW8=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "revert-cmake-change-pkg-config.patch";
-      url = "https://github.com/strukturag/libde265/commit/388b61459c2abe2b949114ab54e83fb4dbfa8ba0.patch";
-      sha256 = "sha256-b6wwSvZpK7lIu0uD1SqK2zGBUjb/25+JW1Pf1fvHc0I=";
-      revert = true;
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   enableParallelBuilding = true;

pkgs/development/libraries/libdrm/default.nix

@@ -20,12 +20,13 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dinstall-test-programs=true"
-    "-Domap=enabled"
     "-Dcairo-tests=disabled"
-    "-Dvalgrind=${if withValgrind then "enabled" else "disabled"}"
+    (lib.mesonEnable "omap" stdenv.hostPlatform.isLinux)
+    (lib.mesonEnable "valgrind" withValgrind)
   ] ++ lib.optionals stdenv.hostPlatform.isAarch [
     "-Dtegra=enabled"
-    "-Detnaviv=enabled"
+  ] ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
+    "-Detnaviv=disabled"
   ];
 
   meta = with lib; {

pkgs/development/libraries/libgudev/default.nix

@@ -55,7 +55,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     udev
     glib
   ];

pkgs/development/libraries/libical/default.nix

@@ -59,7 +59,6 @@ stdenv.mkDerivation rec {
     glib
     libxml2
     icu
-    gobject-introspection
   ];
 
   cmakeFlags = [

pkgs/development/libraries/libimagequant/Cargo.lock

@@ -0,0 +1,322 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "ahash"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+dependencies = [
+ "getrandom",
+ "once_cell",
+ "version_check",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bytemuck"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c041d3eab048880cb0b86b256447da3f18859a163c3b8d8893f4e6368abe6393"
+
+[[package]]
+name = "c_test"
+version = "0.1.0"
+dependencies = [
+ "cc",
+ "imagequant-sys",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2dd04ddaf88237dc3b8d8f9a3c1004b506b54b3313403944054d23c0870c521"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "715e8152b692bba2d374b53d4875445368fdf21a94751410af607a5ac677d1fc"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a9af1f4c2ef74bb8aa1f7e19706bc72d03598c8a570bb5de72243c7a9d9d5a"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "either"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+
+[[package]]
+name = "fallible_collections"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f57ccc32870366ae684be48b32a1a2e196f98a42a9b4361fe77e13fd4a34755"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8a2db397cb1c8772f31494cb8917e48cd1e64f0fa7efac59fbd741a0a8ce841"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "imagequant"
+version = "4.1.0"
+dependencies = [
+ "arrayvec",
+ "lodepng",
+ "noisy_float",
+ "num_cpus",
+ "once_cell",
+ "rayon",
+ "rgb",
+ "thread_local",
+]
+
+[[package]]
+name = "imagequant-sys"
+version = "4.0.1"
+dependencies = [
+ "bitflags",
+ "imagequant",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
+
+[[package]]
+name = "lodepng"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0ad39f75bbaa4b10bb6f2316543632a8046a5bcf9c785488d79720b21f044f8"
+dependencies = [
+ "crc32fast",
+ "fallible_collections",
+ "flate2",
+ "libc",
+ "rgb",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "noisy_float"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978fe6e6ebc0bf53de533cd456ca2d9de13de13856eda1518a285d7705a213af"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+
+[[package]]
+name = "rayon"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db3a213adf02b3bcfd2d3846bb41cb22857d131789e01df434fb7e7bc0759b7"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "356a0625f1954f730c0201cdab48611198dc6ce21f4acff55089b5a78e6e835b"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
+
+[[package]]
+name = "rgb"
+version = "0.8.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3603b7d71ca82644f79b5a06d1220e9a58ede60bd32255f698cb1af8838b8db3"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "thread_local"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5516c27b78311c50bf42c071425c560ac799b11c30b31f87e3081965fe5e0180"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"

pkgs/development/libraries/libimagequant/default.nix

@@ -1,21 +1,48 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, rust, rustPlatform, cargo-c, python3 }:
 
-stdenv.mkDerivation rec {
+let
+  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
+in
+rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "2.17.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZoBCZsoUO66X4sDbMO89g4IX5+jqGMLGR7aC2UwD2tE=";
+    hash = "sha256-W9Q81AbFhWUe6c3csAnm8L5wLqURizrjwqcurWhPISI=";
   };
 
-  preConfigure = ''
-    patchShebangs ./configure
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
   '';
 
-  configureFlags = lib.optionals (!stdenv.hostPlatform.isx86) [ "--disable-sse" ];
+  cargoHash = "sha256-0HOmItooNsGq6iTIb9M5IPXMwYh2nQ03qfjomkg0d00=";
+
+  auditable = true; # TODO: remove when this is the default
+
+  nativeBuildInputs = [ cargo-c ];
+
+  postBuild = ''
+    pushd imagequant-sys
+    cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    popd
+  '';
+
+  postInstall = ''
+    pushd imagequant-sys
+    cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    popd
+  '';
+
+  passthru.tests = {
+    inherit (python3.pkgs) pillow;
+  };
 
   meta = with lib; {
     homepage = "https://pngquant.org/lib/";

pkgs/development/libraries/libinput/default.nix

@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.21.0";
+  version = "1.22.1";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     owner = "libinput";
     repo = "libinput";
     rev = version;
-    sha256 = "R94BdrjI4szNbVtQ+ydRNUg9clR8mkRL7+GE9b2FcDs=";
+    sha256 = "RgwEp60Anr+CpJws6srIv/Qzk2r9NoekeNQ0UT3FRZ0=";
   };
 
   patches = [

pkgs/development/libraries/libmanette/default.nix

@@ -40,7 +40,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     glib
     libgudev
     libevdev

pkgs/development/libraries/libmbim/default.nix

@@ -1,46 +1,63 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, meson
+, ninja
 , pkg-config
 , glib
 , python3
+, help2man
 , systemd
+, bash-completion
 , withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.26.4";
+  version = "1.28.2";
 
   outputs = [ "out" "dev" "man" ];
 
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "sha256-9ojOxMRYahdXX14ydEjOYvIADvagfJ5FiYc9SmhWitk=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mobile-broadband";
+    repo = "libmbim";
+    rev = version;
+    hash = "sha256-EtjUaSNBT1e/eeTX4oHzQolGrisbsGKBK8Cfl3rRQTQ=";
   };
 
-  configureFlags = [
-    "--with-udev-base-dir=${placeholder "out"}/lib/udev"
-    (lib.enableFeature withIntrospection "introspection")
+  mesonFlags = [
+    "-Dudevdir=${placeholder "out"}/lib/udev"
+    (lib.mesonBool "introspection" withIntrospection)
   ];
 
   nativeBuildInputs = [
+    meson
+    ninja
     pkg-config
     python3
+    help2man
     gobject-introspection
   ];
 
   buildInputs = [
     glib
     systemd
+    bash-completion
   ];
 
   doCheck = true;
 
+  postPatch = ''
+    patchShebangs \
+      build-aux/mbim-codegen/mbim-codegen
+  '';
+
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/libmbim/";
     description = "Library for talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
+    maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
   };

pkgs/development/libraries/libnotify/default.nix

@@ -44,10 +44,6 @@ stdenv.mkDerivation rec {
     gobject-introspection
   ];
 
-  buildInputs = lib.optionals withIntrospection [
-    gobject-introspection
-  ];
-
   propagatedBuildInputs = [
     gdk-pixbuf
     glib

pkgs/development/libraries/libptytty/default.nix

@@ -4,6 +4,12 @@
 , cmake
 }:
 
+let
+  isCross = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  isStatic = stdenv.hostPlatform.isStatic;
+  isMusl = stdenv.hostPlatform.isMusl;
+in
+
 stdenv.mkDerivation rec {
   pname = "libptytty";
   version = "2.0";
@@ -15,12 +21,24 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = lib.optional isStatic "-DBUILD_SHARED_LIBS=OFF"
+    ++ lib.optional (isCross || isStatic) "-DTTY_GID_SUPPORT=OFF"
+    # Musl lacks UTMP/WTMP built-in support
+    ++ lib.optionals isMusl [
+      "-DUTMP_SUPPORT=OFF"
+      "-DWTMP_SUPPORT=OFF"
+      "-DLASTLOG_SUPPORT=OFF"
+    ];
+
   meta = with lib; {
     description = "OS independent and secure pty/tty and utmp/wtmp/lastlog";
     homepage = "http://dist.schmorp.de/libptytty";
     maintainers = with maintainers; [ rnhmjoj ];
     platforms = platforms.unix;
     license = licenses.gpl2;
+    # pkgsMusl.pkgsStatic errors as:
+    #   ln: failed to create symbolic link './include': File exists
+    broken = isStatic && isMusl;
   };
 
 }

pkgs/development/libraries/libqmi/default.nix

@@ -1,40 +1,61 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, fetchpatch2
+, meson
+, ninja
 , pkg-config
 , gobject-introspection
 , gtk-doc
 , docbook-xsl-nons
 , docbook_xml_dtd_43
+, help2man
 , glib
 , python3
 , libgudev
+, bash-completion
 , libmbim
 , libqrtr-glib
 }:
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.30.8";
+  version = "1.32.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hiSCzp460L1l0mQzTuMRzblLnfKGO1txNjCbQbisGZA=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mobile-broadband";
+    repo = "libqmi";
+    rev = version;
+    hash = "sha256-XIbeWgkPiJL8hN8Rb6KFt5Q5sG3KsiEQr0EnhwmI6h8=";
   };
 
+  patches = [
+    # Fix pkg-config file missing qrtr in Requires.
+    # https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/99
+    (fetchpatch2 {
+      url = "https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/commit/7d08150910974c6bd2c29f887c2c6d4a3526e085.patch";
+      hash = "sha256-LFrlm2ZqLqewLGO2FxL5kFYbZ7HaxdxvVHsFHYSgZ4Y=";
+    })
+  ];
+
   nativeBuildInputs = [
+    meson
+    ninja
     pkg-config
     gobject-introspection
     python3
     gtk-doc
     docbook-xsl-nons
     docbook_xml_dtd_43
+    help2man
   ];
 
   buildInputs = [
     libgudev
+    bash-completion
     libmbim
   ];
 
@@ -43,16 +64,19 @@ stdenv.mkDerivation rec {
     libqrtr-glib
   ];
 
-  configureFlags = [
-    "--with-udev-base-dir=${placeholder "out"}/lib/udev"
-    "--enable-gtk-doc=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "yes" else "no"}"
-    "--enable-introspection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "yes" else "no"}"
+  mesonFlags = [
+    "-Dudevdir=${placeholder "out"}/lib/udev"
+    (lib.mesonBool "gtk_doc" (stdenv.buildPlatform == stdenv.hostPlatform))
+    (lib.mesonBool "introspection" (stdenv.buildPlatform == stdenv.hostPlatform))
   ];
 
-  enableParallelBuilding = true;
-
   doCheck = true;
 
+  postPatch = ''
+    patchShebangs \
+      build-aux/qmi-codegen/qmi-codegen
+  '';
+
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/libqmi/";
     description = "Modem protocol helper library";

pkgs/development/libraries/libqrtr-glib/default.nix

@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     glib
   ];
 

pkgs/development/libraries/librsvg/default.nix

@@ -71,8 +71,6 @@ stdenv.mkDerivation rec {
     bzip2
     pango
     libintl
-  ] ++ lib.optionals withIntrospection [
-    gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices
     Foundation

pkgs/development/libraries/libsecret/default.nix

@@ -52,7 +52,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libgcrypt
-    gobject-introspection
   ];
 
   propagatedBuildInputs = [
@@ -88,7 +87,7 @@ stdenv.mkDerivation rec {
 
     dbus-run-session \
       --config-file=${dbus}/share/dbus-1/session.conf \
-      meson test --print-errorlogs
+      meson test --print-errorlogs --timeout-multiplier 0
 
     runHook postCheck
   '';

pkgs/development/libraries/libvirt-glib/default.nix

@@ -55,8 +55,6 @@ stdenv.mkDerivation rec {
     libxml2
   ] ++ lib.optionals stdenv.isLinux [
     libcap_ng
-  ] ++ lib.optionals withIntrospection [
-    gobject-introspection
   ];
 
   strictDeps = true;

pkgs/development/libraries/libvisual/default.nix

@@ -1,7 +1,9 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , SDL
+, autoreconfHook
 , glib
 , pkg-config
 }:
@@ -15,12 +17,36 @@ stdenv.mkDerivation rec {
     hash = "sha256-qhKHdBf3bTZC2fTHIzAjgNgzF1Y51jpVZB0Bkopd230=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  patches = [
+    # pull upstream fix for SDL1 cross-compilation.
+    #   https://github.com/Libvisual/libvisual/pull/238
+    (fetchpatch {
+      name = "sdl-cross-prereq.patch";
+      url = "https://github.com/Libvisual/libvisual/commit/7902d24aa1a552619a5738339b3823e90dd3b865.patch";
+      hash = "sha256-84u8klHDAw/q4d+9L4ROAr7XsbXItHrhaEKkTEMSPcc=";
+      # remove extra libvisual prefix
+      stripLen = 1;
+      # pull in only useful configure.ac changes.
+      excludes = [ "Makefile.am" ];
+    })
+    (fetchpatch {
+      name = "sdl-cross-pc.patch";
+      url = "https://github.com/Libvisual/libvisual/commit/f79a2e8d21ad1d7fe26e2aa83cea4c9f48f9e392.patch";
+      hash = "sha256-8c7SdLxXC8K9BAwj7DzozsZAcbs5l1xuBqky9LJ1MfM=";
+      # remove extra libvisual prefix
+      stripLen = 1;
+    })
+  ];
+
+  strictDeps = true;
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ SDL glib ];
 
   configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
     "ac_cv_func_realloc_0_nonnull=yes"
+    # Remove once "sdl-cross-prereq.patch" patch above is removed.
+    "--disable-lv-tool"
   ];
 
   meta = {

pkgs/development/libraries/libvmaf/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, nasm }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm }:
 
 stdenv.mkDerivation rec {
   pname = "libvmaf";
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/libvmaf";
 
+  patches = [
+    # Backport fix for non-Linux, non-Darwin platforms.
+    (fetchpatch {
+      url = "https://github.com/Netflix/vmaf/commit/f47640f9ffee9494571bd7c9622e353660c93fc4.patch";
+      stripLen = 1;
+      sha256 = "rsTKuqp8VJG5DBDpixPke3LrdfjKzUO945i+iL0n7CY=";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja nasm ];
 
   mesonFlags = [ "-Denable_avx512=true" ];

pkgs/development/libraries/libwacom/default.nix

@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.4.0";
+  version = "2.6.0";
 
   outputs = [ "out" "dev" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "sha256-9uhnO+MqB7tAnSXjBcJWCzHGiz9izun4nVjFb17G8Gg=";
+    sha256 = "sha256-9zqW6zPrFcxv/yAAtFgdVavKVMXeDBoMP3E/XriUcT0=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libxml2/default.nix

@@ -11,7 +11,10 @@
 , ncurses
 , findXMLCatalogs
 , libiconv
-, pythonSupport ? enableShared
+# Python limits cross-compilation to an allowlist of host OSes.
+# https://github.com/python/cpython/blob/dfad678d7024ab86d265d84ed45999e031a03691/configure.ac#L534-L562
+, pythonSupport ? enableShared &&
+    (stdenv.hostPlatform == stdenv.buildPlatform || stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isWasi)
 , icuSupport ? false
 , icu
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic

pkgs/development/libraries/mesa/default.nix

@@ -88,7 +88,7 @@
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.3.4";
+  version = "22.3.5";
   branch  = lib.versions.major version;
 
   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
@@ -120,7 +120,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "37a1ddaf03f41919ee3c89c97cff41e87de96e00e9d3247959cc8279d8294593";
+    sha256 = "3eed2ecae2bc674494566faab9fcc9beb21cd804c7ba2b59a1694f3d7236e6a9";
   };
 
   # TODO:

pkgs/development/libraries/neon/darwin-fix-configure.patch

@@ -2,9 +2,9 @@ diff -Nuar neon-0.29.6/configure neon-0.29.6-darwin-fix-configure/configure
 --- neon-0.29.6/configure	2011-05-03 14:25:31.000000000 +0200
 +++ neon-0.29.6-darwin-fix-configure/configure	2012-06-06 23:32:21.000000000 +0200
 @@ -4184,7 +4184,7 @@
- $as_echo "$ne_cv_os_uname" >&6; }
+ case x"$ne_cv_os_uname" in #(
+   x"Darwin") :
  
- if test "$ne_cv_os_uname" = "Darwin"; then
 -  CPPFLAGS="$CPPFLAGS -no-cpp-precomp"
 +  CPPFLAGS="$CPPFLAGS"
    LDFLAGS="$LDFLAGS -flat_namespace"

pkgs/development/libraries/neon/default.nix

@@ -15,12 +15,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "0.32.3";
+  version = "0.32.5";
   pname = "neon";
 
   src = fetchurl {
     url = "https://notroj.github.io/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-lMuHXcbb/N7ljwObdjxnSwIyiGzf16Xekb5c36K3WWo=";
+    sha256 = "sha256-SHLhL4Alct7dSwL4cAZYFLLVFB99va9wju2rgmtRpYo=";
   };
 
   patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];

pkgs/development/libraries/nss/esr.nix

@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.3";
-  hash = "sha256-8fhrlMe832xWYTYVMnZE7MV20W8sMX+5hHDcAcWYSA4=";
+  version = "3.79.4";
+  hash = "sha256-Skcdv6Wzo7fsB4U8b8CijNBmn2mEEp4k9VQeLOFdcdU=";
 }

pkgs/development/libraries/openjpeg/default.nix

@@ -55,10 +55,10 @@ stdenv.mkDerivation rec {
     ++ lib.optional (jpipLibSupport) jdk;
 
   doCheck = (!stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
-
+  nativeCheckInputs = [ jpylyzer ];
   checkPhase = ''
     substituteInPlace ../tools/ctest_scripts/travis-ci.cmake \
-      --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"${jpylyzer}/bin/jpylyzer\" # "
+      --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"$(command -v jpylyzer)\" # "
     OPJ_SOURCE_DIR=.. ctest -S ../tools/ctest_scripts/travis-ci.cmake
   '';
 

pkgs/development/libraries/pango/default.nix

@@ -16,15 +16,16 @@
 , ninja
 , glib
 , python3
-, gobject-introspection
 , x11Support? !stdenv.isDarwin, libXft
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, buildPackages, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
   pname = "pango";
   version = "1.50.12";
 
-  outputs = [ "bin" "out" "dev" "devdoc" ];
+  outputs = [ "bin" "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
@@ -39,9 +40,10 @@ stdenv.mkDerivation rec {
     meson ninja
     glib # for glib-mkenum
     pkg-config
-    gobject-introspection
-    gi-docgen
     python3
+  ] ++ lib.optionals withIntrospection [
+    gi-docgen
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -64,9 +66,9 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
-  ] ++ lib.optionals (!x11Support) [
-    "-Dxft=disabled" # only works with x11
+    (lib.mesonBool "gtk_doc" withIntrospection)
+    (lib.mesonEnable "introspection" withIntrospection)
+    (lib.mesonEnable "xft" x11Support)
   ];
 
   # Fontconfig error: Cannot load default config file
@@ -116,6 +118,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2Plus;
 
     maintainers = with maintainers; [ raskin ] ++ teams.gnome.members;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
   };
 }

pkgs/development/libraries/pmdk/default.nix

@@ -1,42 +0,0 @@
-{ lib, stdenv, fetchFromGitHub
-, autoconf, libndctl, pkg-config, gnum4, pandoc
-}:
-
-stdenv.mkDerivation rec {
-  pname = "pmdk";
-  version = "1.11.1";
-
-  src = fetchFromGitHub {
-    owner  = "pmem";
-    repo   = "pmdk";
-    rev    = "refs/tags/${version}";
-    hash = "sha256-8bnyLtgkKfgIjJkfY/ZS1I9aCYcrz0nrdY7m/TUVWAk=";
-  };
-
-  nativeBuildInputs = [ autoconf pkg-config gnum4 pandoc ];
-  buildInputs = [ libndctl ];
-  enableParallelBuilding = true;
-
-  outputs = [ "out" "lib" "dev" "man" ];
-
-  patchPhase = "patchShebangs utils";
-
-  NIX_CFLAGS_COMPILE = "-Wno-error";
-
-  installPhase = ''
-    make install prefix=$out
-
-    mkdir -p $lib $dev $man/share
-    mv $out/share/man $man/share/man
-    mv $out/include $dev/include
-    mv $out/lib     $lib/lib
-  '';
-
-  meta = with lib; {
-    description = "Persistent Memory Development Kit";
-    homepage    = "https://github.com/pmem/pmdk";
-    license     = licenses.lgpl21;
-    maintainers = with maintainers; [ thoughtpolice ];
-    platforms   = [ "x86_64-linux" ]; # aarch64 is experimental
-  };
-}

pkgs/development/libraries/polkit/default.nix

@@ -90,7 +90,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     expat
     pam
     dbus

pkgs/development/libraries/portaudio/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , alsa-lib
+, libjack2
 , pkg-config
 , which
 , AudioUnit
@@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
   nativeBuildInputs = [ pkg-config which ];
-  buildInputs = lib.optional (!stdenv.isDarwin) alsa-lib;
+  buildInputs = [ libjack2 ] ++ lib.optionals (!stdenv.isDarwin) [ alsa-lib ];
 
   configureFlags = [ "--disable-mac-universal" "--enable-cxx" ];
 

pkgs/development/libraries/qt-5/5.15/default.nix

@@ -211,7 +211,7 @@ let
 
       qmake = makeSetupHook {
         name = "qmake-hook";
-        deps = [ self.qtbase.dev ];
+        propagatedBuildInputs = [ self.qtbase.dev ];
         substitutions = {
           inherit debug;
           fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
@@ -220,7 +220,7 @@ let
 
       wrapQtAppsHook = makeSetupHook {
         name = "wrap-qt5-apps-hook";
-        deps = [ self.qtbase.dev buildPackages.makeWrapper ]
+        propagatedBuildInputs = [ self.qtbase.dev buildPackages.makeWrapper ]
           ++ lib.optional stdenv.isLinux self.qtwayland.dev;
       } ../hooks/wrap-qt-apps-hook.sh;
     };

pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh

@@ -34,7 +34,7 @@ qtHostPathHook() {
         qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
     fi
 }
-addEnvHooks "$hostOffset" qtHostPathHook
+addEnvHooks "$targetOffset" qtHostPathHook
 
 makeQtWrapper() {
     local original="$1"

pkgs/development/libraries/qt-6/default.nix

@@ -141,12 +141,12 @@ let
 
       wrapQtAppsHook = makeSetupHook {
         name = "wrap-qt6-apps-hook";
-          deps = [ buildPackages.makeWrapper ];
+        propagatedBuildInputs = [ buildPackages.makeWrapper ];
         } ./hooks/wrap-qt-apps-hook.sh;
 
       qmake = makeSetupHook {
         name = "qmake6-hook";
-        deps = [ self.qtbase.dev ];
+        propagatedBuildInputs = [ self.qtbase.dev ];
         substitutions = {
           inherit debug;
           fix_qmake_libtool = ./hooks/fix-qmake-libtool.sh;