From caeb16f2c35aae64f1c63783e45f4b8392234c35 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 11 Sep 2023 06:20:48 +0000
Subject: [PATCH 001/175] srt: 1.5.2 -> 1.5.3

---
 pkgs/development/libraries/srt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index 73bf5c25ae54..32c3b4edbd0f 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "srt";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${version}";
-    sha256 = "sha256-HW5l26k9w4F6IJrtiahU/8/CPY6M/cKn8AgESsntC6A=";
+    sha256 = "sha256-HmfbBPyR+z5d9/XBvNhosk8pSSPToNtM+V0hEyb2G2w=";
   };
 
   nativeBuildInputs = [ cmake ];

From 2128a2f3fd739aae1a9534afb9d16d39b587aa57 Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Fri, 29 Sep 2023 20:38:29 +0100
Subject: [PATCH 002/175] libcamera: 0.0.5 -> 0.1.0

---
 pkgs/development/libraries/libcamera/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index a502bc0d7962..dfbc2382b057 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.0.5";
+  version = "0.1.0";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-rd1YIEosg4+H/FJBYCoxdQlV9F0evU5fckHJrSdVPOE=";
+    hash = "sha256-icHZtv25QvJEv0DlELT3cDxho3Oz2BJAMNKr5W4bshk=";
   };
 
   outputs = [ "out" "dev" "doc" ];

From b8f8c9b4139977c197fb7c1c1a7a20a90b88661f Mon Sep 17 00:00:00 2001
From: Vincent Breitmoser <look@my.amazin.horse>
Date: Sat, 21 Oct 2023 16:02:47 +0200
Subject: [PATCH 003/175] gnupg: revert defaults to openpgp in 2.4 branch

GnuPG upstream changed some of its behavior on the 2.4 branch to use its
own, non-standardized format for keys and encrypted data by default.
This affects in particular the way that keys are generated, and
algorithm capability flags within now signal the ability to use GnuPG's
own AEAD encryption format.

Notably, these formats are not compatible with other implementations of
OpenPGP. It is based on a draft spec that is specific to GnuPG
(draft-koch-openpgp-2015-rfc4880bis), and not compatible with the format
that is on track to be standardized as upcoming OpenPGP version 6.

The political circumstances that led to this issue are complex (and a
bit dumb), but in the end GnuPG emitting incompatible packets is
certainly in noone's interest. This patch is a revert of a GnuPG
upstream commit as it is applied by Fedora, I suggest we follow suit
until the situation becomes more clear.

See also: https://src.fedoraproject.org/rpms/gnupg2/pull-request/15
---
 .../gnupg/24-revert-rfc4880bis-defaults.patch | 200 ++++++++++++++++++
 pkgs/tools/security/gnupg/24.nix              |   1 +
 2 files changed, 201 insertions(+)
 create mode 100644 pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch

diff --git a/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch b/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch
new file mode 100644
index 000000000000..8bc65ede79c0
--- /dev/null
+++ b/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch
@@ -0,0 +1,200 @@
+From 1e4f1550996334d2a631a5d769e937d29ace47bb Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Thu, 9 Feb 2023 16:38:58 +0100
+Subject: [PATCH gnupg] Revert the introduction of the RFC4880bis draft into
+ defaults
+
+This reverts commit 4583f4fe2 (gpg: Merge --rfc4880bis features into
+--gnupg, 2022-10-31).
+---
+ g10/gpg.c    | 35 ++++++++++++++++++++++++++++++++---
+ g10/keygen.c | 30 ++++++++++++++++++------------
+ 2 files changed, 50 insertions(+), 15 deletions(-)
+
+diff --git a/g10/gpg.c b/g10/gpg.c
+index dcab0a11a..796888013 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -247,6 +247,7 @@ enum cmd_and_opt_values
+     oGnuPG,
+     oRFC2440,
+     oRFC4880,
++    oRFC4880bis,
+     oOpenPGP,
+     oPGP7,
+     oPGP8,
+@@ -636,6 +637,7 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"),
+   ARGPARSE_s_n (oRFC2440, "rfc2440", "@"),
+   ARGPARSE_s_n (oRFC4880, "rfc4880", "@"),
++  ARGPARSE_s_n (oRFC4880bis, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")),
+   ARGPARSE_s_n (oPGP7, "pgp6", "@"),
+   ARGPARSE_s_n (oPGP7, "pgp7", "@"),
+@@ -978,7 +980,6 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oNoop, "no-allow-multiple-messages", "@"),
+   ARGPARSE_s_s (oNoop, "aead-algo", "@"),
+   ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
+-  ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
+ 
+ 
+@@ -2227,7 +2228,7 @@ static struct gnupg_compliance_option compliance_options[] =
+   {
+     { "gnupg",      oGnuPG },
+     { "openpgp",    oOpenPGP },
+-    { "rfc4880bis", oGnuPG },
++    { "rfc4880bis", oRFC4880bis },
+     { "rfc4880",    oRFC4880 },
+     { "rfc2440",    oRFC2440 },
+     { "pgp6",       oPGP7 },
+@@ -2243,8 +2244,28 @@ static struct gnupg_compliance_option compliance_options[] =
+ static void
+ set_compliance_option (enum cmd_and_opt_values option)
+ {
++  opt.flags.rfc4880bis = 0;  /* Clear because it is initially set.  */
++
+   switch (option)
+     {
++    case oRFC4880bis:
++      opt.flags.rfc4880bis = 1;
++      opt.compliance = CO_RFC4880;
++      opt.flags.dsa2 = 1;
++      opt.flags.require_cross_cert = 1;
++      opt.rfc2440_text = 0;
++      opt.allow_non_selfsigned_uid = 1;
++      opt.allow_freeform_uid = 1;
++      opt.escape_from = 1;
++      opt.not_dash_escaped = 0;
++      opt.def_cipher_algo = 0;
++      opt.def_digest_algo = 0;
++      opt.cert_digest_algo = 0;
++      opt.compress_algo = -1;
++      opt.s2k_mode = 3; /* iterated+salted */
++      opt.s2k_digest_algo = DIGEST_ALGO_SHA256;
++      opt.s2k_cipher_algo = CIPHER_ALGO_AES256;
++      break;
+     case oOpenPGP:
+     case oRFC4880:
+       /* This is effectively the same as RFC2440, but with
+@@ -2288,6 +2309,7 @@ set_compliance_option (enum cmd_and_opt_values option)
+     case oPGP8:  opt.compliance = CO_PGP8;  break;
+     case oGnuPG:
+       opt.compliance = CO_GNUPG;
++      opt.flags.rfc4880bis = 1;
+       break;
+ 
+     case oDE_VS:
+@@ -2491,6 +2513,7 @@ main (int argc, char **argv)
+     opt.emit_version = 0;
+     opt.weak_digests = NULL;
+     opt.compliance = CO_GNUPG;
++    opt.flags.rfc4880bis = 1;
+ 
+     /* Check special options given on the command line.  */
+     orig_argc = argc;
+@@ -3033,6 +3056,7 @@ main (int argc, char **argv)
+           case oOpenPGP:
+           case oRFC2440:
+           case oRFC4880:
++          case oRFC4880bis:
+           case oPGP7:
+           case oPGP8:
+           case oGnuPG:
+@@ -3862,6 +3886,11 @@ main (int argc, char **argv)
+     if( may_coredump && !opt.quiet )
+ 	log_info(_("WARNING: program may create a core file!\n"));
+ 
++    if (!opt.flags.rfc4880bis)
++      {
++        opt.mimemode = 0; /* This will use text mode instead.  */
++      }
++
+     if (eyes_only) {
+       if (opt.set_filename)
+ 	  log_info(_("WARNING: %s overrides %s\n"),
+@@ -4078,7 +4107,7 @@ main (int argc, char **argv)
+     /* Check our chosen algorithms against the list of legal
+        algorithms. */
+ 
+-    if(!GNUPG)
++    if(!GNUPG && !opt.flags.rfc4880bis)
+       {
+ 	const char *badalg=NULL;
+ 	preftype_t badtype=PREFTYPE_NONE;
+diff --git a/g10/keygen.c b/g10/keygen.c
+index a2cfe3ccf..2a1dd1f81 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -404,7 +404,7 @@ keygen_set_std_prefs (const char *string,int personal)
+ 	      strcat(dummy_string,"S7 ");
+ 	    strcat(dummy_string,"S2 "); /* 3DES */
+ 
+-            if (!openpgp_aead_test_algo (AEAD_ALGO_OCB))
++            if (opt.flags.rfc4880bis && !openpgp_aead_test_algo (AEAD_ALGO_OCB))
+ 	      strcat(dummy_string,"A2 ");
+ 
+             if (personal)
+@@ -889,7 +889,7 @@ keygen_upd_std_prefs (PKT_signature *sig, void *opaque)
+   /* Make sure that the MDC feature flag is set if needed.  */
+   add_feature_mdc (sig,mdc_available);
+   add_feature_aead (sig, aead_available);
+-  add_feature_v5 (sig, 1);
++  add_feature_v5 (sig, opt.flags.rfc4880bis);
+   add_keyserver_modify (sig,ks_modify);
+   keygen_add_keyserver_url(sig,NULL);
+ 
+@@ -3382,7 +3382,10 @@ parse_key_parameter_part (ctrl_t ctrl,
+                 }
+             }
+           else if (!ascii_strcasecmp (s, "v5"))
+-            keyversion = 5;
++            {
++              if (opt.flags.rfc4880bis)
++                keyversion = 5;
++            }
+           else if (!ascii_strcasecmp (s, "v4"))
+             keyversion = 4;
+           else
+@@ -3641,7 +3644,7 @@ parse_key_parameter_part (ctrl_t ctrl,
+  *   ecdsa := Use algorithm ECDSA.
+  *   eddsa := Use algorithm EdDSA.
+  *   ecdh  := Use algorithm ECDH.
+- *   v5    := Create version 5 key
++ *   v5    := Create version 5 key (requires option --rfc4880bis)
+  *
+  * There are several defaults and fallbacks depending on the
+  * algorithm.  PART can be used to select which part of STRING is
+@@ -4513,9 +4516,9 @@ read_parameter_file (ctrl_t ctrl, const char *fname )
+ 	    }
+ 	}
+ 
+-        if ((keywords[i].key == pVERSION
+-             || keywords[i].key == pSUBVERSION))
+-          ; /* Ignore version.  */
++        if (!opt.flags.rfc4880bis && (keywords[i].key == pVERSION
++                                      || keywords[i].key == pSUBVERSION))
++          ; /* Ignore version unless --rfc4880bis is active.  */
+         else
+           {
+             r = xmalloc_clear( sizeof *r + strlen( value ) );
+@@ -4610,11 +4613,14 @@ quickgen_set_para (struct para_data_s *para, int for_subkey,
+       para = r;
+     }
+ 
+-  r = xmalloc_clear (sizeof *r + 20);
+-  r->key = for_subkey? pSUBVERSION : pVERSION;
+-  snprintf (r->u.value, 20, "%d", version);
+-  r->next = para;
+-  para = r;
++  if (opt.flags.rfc4880bis)
++    {
++      r = xmalloc_clear (sizeof *r + 20);
++      r->key = for_subkey? pSUBVERSION : pVERSION;
++      snprintf (r->u.value, 20, "%d", version);
++      r->next = para;
++      para = r;
++    }
+ 
+   if (keytime)
+     {
diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index 2f5c6e2ce428..63882117b08e 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
     ./tests-add-test-cases-for-import-without-uid.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
     ./24-allow-import-of-previously-known-keys-even-without-UI.patch
+    ./24-revert-rfc4880bis-defaults.patch
     # Patch for DoS vuln from https://seclists.org/oss-sec/2022/q3/27
     ./v3-0001-Disallow-compressed-signatures-and-certificates.patch
   ];

From 27769500ea5430a42187651bd26185c19f5fde2c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Nov 2023 00:53:00 +0000
Subject: [PATCH 004/175] m17n_lib: 1.8.2 -> 1.8.4

---
 pkgs/tools/inputmethods/m17n-lib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index c526f6a844d7..ca586a449703 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "m17n-lib";
-  version = "1.8.2";
+  version = "1.8.4";
 
   src = fetchurl {
     url = "https://download.savannah.gnu.org/releases/m17n/m17n-lib-${version}.tar.gz";
-    hash = "sha256-5bA0SvnxFdlJV6P5ud68T45nG2n4wf1eC2iKeU16J/I=";
+    hash = "sha256-xqJYLG5PKowueihE+lx+s2Oq0lOLBS8gPHEGSd1CHMg=";
   };
 
   strictDeps = true;

From 84ef5ebe4d6ed2abec353c2905b26f3e245dfe25 Mon Sep 17 00:00:00 2001
From: IogaMaster <iogamastercode@gmail.com>
Date: Fri, 3 Nov 2023 11:45:06 -0600
Subject: [PATCH 005/175] gnupg: 2.4.1 -> 2.4.3

---
 pkgs/tools/security/gnupg/24.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index 2f5c6e2ce428..5a175c13d0e2 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -13,11 +13,11 @@ assert guiSupport -> enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.4.1";
+  version = "2.4.3";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    hash = "sha256-drceWutEO/2RDOnLyCgbYXyDQWh6+2e65FWHeXK1neg=";
+    hash = "sha256-onGubXMvb02AwlitnuiN2clMj9wzw+RTKMTXwSa9IZ0=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

From c1b98c1879b181df11c2d263237b64d80f6d69f3 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 14 Nov 2023 13:02:03 +0000
Subject: [PATCH 006/175] pam: 1.5.2 -> 1.5.3

Changes: https://github.com/linux-pam/linux-pam/releases/tag/v1.5.3
---
 pkgs/os-specific/linux/pam/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index b16bebbe3d60..2a125d40bf14 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchurl {
-    url    = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    sha256 = "sha256-5OxxMakdpEUSV0Jo9JPG2MoQXIcJFpG46bVspoXU+U0=";
+    url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
+    hash = "sha256-esS1D+7gBKn6iPHf0tL6c4qCiWdjBQzXc7PFSwqBgoM=";
   };
 
   patches = [ ./suid-wrapper-path.patch ];

From ee736a3dc985e9713ab97520f552c607249859b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 19 May 2023 23:07:55 +0200
Subject: [PATCH 007/175] gd: disable fontconfig when built without Xorg

---
 pkgs/development/libraries/gd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index c9845feb9678..af96d9d06d27 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -44,8 +44,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake pkg-config ];
 
-  buildInputs = [ zlib fontconfig freetype libpng libjpeg libwebp libtiff libavif ]
-    ++ lib.optional withXorg libXpm;
+  buildInputs = [ zlib freetype libpng libjpeg libwebp libtiff libavif ]
+    ++ lib.optionals withXorg [ fontconfig libXpm ];
 
   outputs = [ "bin" "dev" "out" ];
 

From 8d8f355ba1ef8d3313ea09e08b4c1cb3d5ec08fe Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Tue, 5 Dec 2023 22:47:59 +0100
Subject: [PATCH 008/175] groff: Update site.tmac to fix glyph usage errors

in man pages.

Fixes #271810
---
 pkgs/tools/text/groff/site.tmac | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/text/groff/site.tmac b/pkgs/tools/text/groff/site.tmac
index 07923f120009..6f0f18dea6d5 100644
--- a/pkgs/tools/text/groff/site.tmac
+++ b/pkgs/tools/text/groff/site.tmac
@@ -1,13 +1,26 @@
 .
 .if n \{\
-.  \" Character translations for non-keyboard
-.  \" characters - to make them searchable
+.  \" With groff 1.23.0 "[t]he 'utf8' output device now maps the input
+.  \" characters '^' (caret, circumflex accent, or 'hat') and '~' (tilde)
+.  \" to U+02C6 (modifier letter circumflex accent) and U+02DC (small tilde),
+.  \" respectively, for consistency with groff's other output devices.
+.  \" This change is expected to expose glyph usage errors in man pages.
+.  \" See [http://git.savannah.gnu.org/cgit/groff.git/tree/PROBLEMS] for
+.  \" a recipe that will conceal these errors"
+.  \" -- https://lists.gnu.org/archive/html/groff/2023-07/msg00051.html
+.  \"
+.  \" Conceal glyph usage errors in man pages with the following
+.  \" character translations for non-keyboard characters to make them searchable.
 .  if '\*[.T]'utf8' \{\
 .    char \- \N'45'
 .    char - \N'45'
-.    char ' \N'39'
-.    char \' \N'39'
+.    char \' \[aq]
+.    char ' \[aq]
+.    char ` \[ga]
+.    char ^ \[ha]
+.    char ~ \[ti]
 .  \}
+.\}
 .
 .ds doc-default-operating-system Nixpkgs
 .ds doc-volume-operating-system Nixpkgs

From 7be9f0f52630eec0bd9026ff0e0e31c8116ac7b2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 8 Dec 2023 11:47:50 +0000
Subject: [PATCH 009/175] curl: 8.4.0 -> 8.5.0

---
 pkgs/tools/networking/curl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 48bf59e25266..58fff9befa86 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -47,14 +47,14 @@ assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsS
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.4.0";
+  version = "8.5.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
       "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
+    hash = "sha256-QquNueINgpCjtjPn+7POwV2zTfZf0QFe+KweRyN1Dus=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];

From 701410a98791b01678c89c56a9d4fa2e1a01e6dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 11 Dec 2023 20:54:13 -0800
Subject: [PATCH 010/175] catch2_3: 3.4.0 -> 3.5.0

Diff: https://github.com/catchorg/Catch2/compare/v3.4.0...v3.5.0

Changelog: https://github.com/catchorg/Catch2/blob/v3.5.0/docs/release-notes.md
---
 pkgs/development/libraries/catch2/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/catch2/3.nix b/pkgs/development/libraries/catch2/3.nix
index f064eb7a4fdb..ba93701b5669 100644
--- a/pkgs/development/libraries/catch2/3.nix
+++ b/pkgs/development/libraries/catch2/3.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    hash = "sha256-DqGGfNjKPW9HFJrX9arFHyNYjB61uoL6NabZatTWrr0=";
+    hash = "sha256-jXrLZiVHi/TAZ0lEENHkCYlcCW59wOrXCfz1mHBFEfQ=";
   };
 
   nativeBuildInputs = [

From 2fecacbe0bbd69a6f9c5ad6d07c9793ba30d67e7 Mon Sep 17 00:00:00 2001
From: rhododendrox <rhododendrox@gmail.com>
Date: Fri, 1 Dec 2023 20:52:31 +0100
Subject: [PATCH 011/175] libplacebo: 5.264.1 -> 6.338.1

---
 .../libraries/libplacebo/default.nix          | 24 ++++++++++---------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/libplacebo/default.nix b/pkgs/development/libraries/libplacebo/default.nix
index 60a3f8989578..c303ffb29558 100644
--- a/pkgs/development/libraries/libplacebo/default.nix
+++ b/pkgs/development/libraries/libplacebo/default.nix
@@ -10,21 +10,22 @@
 , shaderc
 , lcms2
 , libGL
-, xorg
+, libX11
 , libunwind
 , libdovi
+, xxHash
 }:
 
 stdenv.mkDerivation rec {
   pname = "libplacebo";
-  version = "5.264.1";
+  version = "6.338.1";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YEefuEfJURi5/wswQKskA/J1UGzessQQkBpltJ0Spq8=";
+    hash = "sha256-NZmwR3+lIC2PF+k+kqCjoMYkMM/PKOJmDwAq7t6YONY=";
   };
 
   nativeBuildInputs = [
@@ -41,18 +42,19 @@ stdenv.mkDerivation rec {
     shaderc
     lcms2
     libGL
-    xorg.libX11
+    libX11
     libunwind
     libdovi
+    xxHash
   ];
 
-  mesonFlags = [
-    "-Dvulkan-registry=${vulkan-headers}/share/vulkan/registry/vk.xml"
-    "-Ddemos=false" # Don't build and install the demo programs
-    "-Dd3d11=disabled" # Disable the Direct3D 11 based renderer
-    "-Dglslang=disabled" # rely on shaderc for GLSL compilation instead
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-Dunwind=disabled" # libplacebo doesn’t build with `darwin.libunwind`
+  mesonFlags = with lib; [
+    (mesonOption "vulkan-registry" "${vulkan-headers}/share/vulkan/registry/vk.xml")
+    (mesonBool "demos" false) # Don't build and install the demo programs
+    (mesonEnable "d3d11" false) # Disable the Direct3D 11 based renderer
+    (mesonEnable "glslang" false) # rely on shaderc for GLSL compilation instead
+  ] ++ optionals stdenv.isDarwin [
+    (mesonEnable "unwind" false) # libplacebo doesn’t build with `darwin.libunwind`
   ];
 
   postPatch = ''

From e2c74eb96df03c2703f377d28233180c8294913f Mon Sep 17 00:00:00 2001
From: rhododendrox <rhododendrox@gmail.com>
Date: Fri, 1 Dec 2023 20:54:23 +0100
Subject: [PATCH 012/175] libplacebo_5: init at 5.264.1

---
 pkgs/development/libraries/libplacebo/5.nix | 77 +++++++++++++++++++++
 pkgs/top-level/all-packages.nix             |  1 +
 2 files changed, 78 insertions(+)
 create mode 100644 pkgs/development/libraries/libplacebo/5.nix

diff --git a/pkgs/development/libraries/libplacebo/5.nix b/pkgs/development/libraries/libplacebo/5.nix
new file mode 100644
index 000000000000..f307a869e940
--- /dev/null
+++ b/pkgs/development/libraries/libplacebo/5.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, python3Packages
+, vulkan-headers
+, vulkan-loader
+, shaderc
+, lcms2
+, libGL
+, libX11
+, libunwind
+, libdovi
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libplacebo";
+  version = "5.264.1";
+
+  src = fetchFromGitLab {
+    domain = "code.videolan.org";
+    owner = "videolan";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-YEefuEfJURi5/wswQKskA/J1UGzessQQkBpltJ0Spq8=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    vulkan-headers
+    python3Packages.jinja2
+    python3Packages.glad2
+  ];
+
+  buildInputs = [
+    vulkan-loader
+    shaderc
+    lcms2
+    libGL
+    libX11
+    libunwind
+    libdovi
+  ];
+
+  mesonFlags = with lib; [
+    (mesonOption "vulkan-registry" "${vulkan-headers}/share/vulkan/registry/vk.xml")
+    (mesonBool "demos" false) # Don't build and install the demo programs
+    (mesonEnable "d3d11" false) # Disable the Direct3D 11 based renderer
+    (mesonEnable "glslang" false) # rely on shaderc for GLSL compilation instead
+  ] ++ optionals stdenv.isDarwin [
+    (mesonEnable "unwind" false) # libplacebo doesn’t build with `darwin.libunwind`
+  ];
+
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace 'python_env.append' '#'
+  '';
+
+  meta = with lib; {
+    description = "Reusable library for GPU-accelerated video/image rendering primitives";
+    longDescription = ''
+      Reusable library for GPU-accelerated image/view processing primitives and
+      shaders, as well a batteries-included, extensible, high-quality rendering
+      pipeline (similar to mpv's vo_gpu). Supports Vulkan, OpenGL and Metal (via
+      MoltenVK).
+    '';
+    homepage = "https://code.videolan.org/videolan/libplacebo";
+    changelog = "https://code.videolan.org/videolan/libplacebo/-/tags/v${version}";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ primeos tadeokondrak ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d9d15824e3e9..aec5a259a7d6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23418,6 +23418,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Foundation;
   };
 
+  libplacebo_5 = callPackage ../development/libraries/libplacebo/5.nix { };
   libplacebo = callPackage ../development/libraries/libplacebo { };
 
   libpng = callPackage ../development/libraries/libpng { };

From 3fb17d290c93c66590b4af21e433b60af1851f82 Mon Sep 17 00:00:00 2001
From: rhododendrox <rhododendrox@gmail.com>
Date: Tue, 28 Nov 2023 08:58:01 +0100
Subject: [PATCH 013/175] vlc: use libplacebo_5

---
 pkgs/applications/video/vlc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index 8f2358fdd6ab..cc19839bde74 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -44,7 +44,7 @@
 , libmtp
 , liboggz
 , libopus
-, libplacebo
+, libplacebo_5
 , libpulseaudio
 , libraw1394
 , librsvg
@@ -164,7 +164,7 @@ stdenv.mkDerivation (finalAttrs: {
     libmtp
     liboggz
     libopus
-    libplacebo
+    libplacebo_5
     libpulseaudio
     libraw1394
     librsvg

From f4e7e4a19bb2ec8738caf0154ca2943776fca32b Mon Sep 17 00:00:00 2001
From: rhododendrox <rhododendrox@gmail.com>
Date: Tue, 12 Dec 2023 11:42:19 +0100
Subject: [PATCH 014/175] ffmpeg_5: use libplacebo_5

---
 pkgs/development/libraries/ffmpeg/generic.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 5ae6469c7435..b6ef374626c5 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -213,6 +213,7 @@
 , libopenmpt
 , libopus
 , libplacebo
+, libplacebo_5
 , libpulseaudio
 , libraw1394
 , librsvg
@@ -577,7 +578,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
   ++ optionals withJack [ libjack2 ]
   ++ optionals withLadspa [ ladspaH ]
-  ++ optionals withLibplacebo [ libplacebo vulkan-headers ]
+  ++ optionals withLibplacebo [ (if (lib.versionAtLeast version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withLzma [ xz ]
   ++ optionals withMfx [ intel-media-sdk ]
   ++ optionals withModplug [ libmodplug ]

From c9b63b03a1e664341c354744d0001901b596398c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 22 Dec 2023 04:45:06 +0000
Subject: [PATCH 015/175] libcap_ng: 0.8.3 -> 0.8.4

---
 pkgs/os-specific/linux/libcap-ng/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 0f60a8655ced..59aa5bbc0e5d 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
-    sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
+    sha256 = "sha256-aFgdOzjnVTy29t33gTsfyZ5ShW8hQh97R3zlq9JgWoo=";
   };
 
   outputs = [ "out" "dev" "man" ];

From 061702528519ad56dc5f9bfacaa6c8221de4f4a5 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 14 Dec 2023 09:32:24 +0100
Subject: [PATCH 016/175] zulu: drop version from pname

---
 pkgs/development/compilers/zulu/common.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/zulu/common.nix b/pkgs/development/compilers/zulu/common.nix
index d09555b00c9c..75925ed81bec 100644
--- a/pkgs/development/compilers/zulu/common.nix
+++ b/pkgs/development/compilers/zulu/common.nix
@@ -57,7 +57,7 @@ let
   isJdk8 = lib.versions.major dist.jdkVersion == "8";
 
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
+    pname = "zulu-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {

From d55de31158557df0dbc8c51d4d53bd6394beb09a Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 23 Dec 2023 08:39:27 +0000
Subject: [PATCH 017/175] libraw: 0.21.1 -> 0.21.2

Changes: https://github.com/LibRaw/LibRaw/compare/0.21.1...0.21.2
---
 pkgs/development/libraries/libraw/default.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/libraw/default.nix b/pkgs/development/libraries/libraw/default.nix
index b03be435aac5..d8e9f1f5a2f5 100644
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , lcms2
 , pkg-config
@@ -16,23 +15,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libraw";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "LibRaw";
     repo = "LibRaw";
     rev = version;
-    sha256 = "sha256-K9mULf6V/TCl5Vu4iuIdSGF9HzQlgNQLRFHIpNbmAlY";
+    hash = "sha256-p9CmOCulvV7+KKn1lXwpcysOo0+mD5UgPqy2ki0cIFE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-1729.patch";
-      url = "https://github.com/LibRaw/LibRaw/commit/9ab70f6dca19229cb5caad7cc31af4e7501bac93.patch";
-      hash = "sha256-OAyqphxvtSM15NI77HwtGTmTmP9YNu3xhZ6D1CceJ7I=";
-    })
-  ];
-
   outputs = [ "out" "lib" "dev" "doc" ];
 
   propagatedBuildInputs = [ lcms2 ];

From 80e66e3c448264ad1447567e0b2dae2ada94fd8c Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 23 Dec 2023 20:00:49 +0000
Subject: [PATCH 018/175] editline: pull `autoconf-2.72` fix pending upstream
 inclusion

Without the cnage `editline` will fails to build against `autoocnf-2.72`
as:

    editline> ./configure: line 13944: syntax error near unexpected token `;;'
    editline> ./configure: line 13944: ` ;;'
---
 pkgs/development/libraries/editline/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/editline/default.nix b/pkgs/development/libraries/editline/default.nix
index 15a056edb691..4f891a24f1f0 100644
--- a/pkgs/development/libraries/editline/default.nix
+++ b/pkgs/development/libraries/editline/default.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/troglobit/editline/commit/265c1fb6a0b99bedb157dc7c320f2c9629136518.patch";
       sha256 = "sha256-9fhQH0hT8BcykGzOUoT18HBtWjjoXnePSGDJQp8GH30=";
     })
+
+    # Pending autoconf-2.72 upstream support:
+    #   https://github.com/troglobit/editline/pull/64
+    (fetchpatch {
+      name = "autoconf-2.72.patch";
+      url = "https://github.com/troglobit/editline/commit/f444a316f5178b8e20fe31e7b2d979e651da077e.patch";
+      hash = "sha256-m3jExTkPvE+ZBwHzf/A+ugzzfbLmeWYn726l7Po7f10=";
+    })
   ];
 
   nativeBuildInputs = [ autoreconfHook ];

From 7a366773e0f01899e622cc06a6acad927273d913 Mon Sep 17 00:00:00 2001
From: Markus Kowalewski <markus.kowalewski@gmail.com>
Date: Sun, 24 Dec 2023 22:37:23 +0100
Subject: [PATCH 019/175] lapack-reference: 3.11 -> 3.12.0

---
 pkgs/development/libraries/science/math/liblapack/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index 3bf16057f835..595ba2aa5713 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "liblapack";
-  version = "3.11";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "Reference-LAPACK";
     repo = "lapack";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-AYD78u70y8cY19hmM/aDjQEzxO8u9lPWhCFxRe5cqXI=";
+    sha256 = "sha256-xn9HL4YF8JPka1gwet5bGGo2k505H3RfWpxkUIYNecQ=";
   };
 
   nativeBuildInputs = [ gfortran cmake ];

From 0569a9280356782250fdc45e07a2601a9429a438 Mon Sep 17 00:00:00 2001
From: ivan770 <ivan@ivan770.me>
Date: Mon, 25 Dec 2023 12:36:37 -0500
Subject: [PATCH 020/175] doxygen: 1.9.8 -> 1.10.0

---
 .../tools/documentation/doxygen/default.nix      | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index 3b1a1fa0aa1f..ddf27b35dbd0 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -8,18 +8,18 @@
 , qt5
 , CoreServices
 , libiconv
-, withSqlite ? true, sqlite
+, sqlite
 }:
 
 stdenv.mkDerivation rec {
   pname = "doxygen";
-  version = "1.9.8";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "doxygen";
     repo = "doxygen";
     rev = "Release_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-uQ1Fl2kmY7qmzy34NOmZCgPxVGwmqRqDvV6yEab5P4w=";
+    sha256 = "sha256-FPI5ICdn9Tne/g9SP6jAQS813AAyoDNooDR/Hyvq6R4=";
   };
 
   nativeBuildInputs = [
@@ -29,14 +29,14 @@ stdenv.mkDerivation rec {
     bison
   ];
 
-  buildInputs = [ libiconv ]
-    ++ lib.optionals withSqlite [ sqlite ]
+  buildInputs = [ libiconv sqlite ]
     ++ lib.optionals (qt5 != null) (with qt5; [ qtbase wrapQtAppsHook ])
     ++ lib.optionals stdenv.isDarwin [ CoreServices ];
 
-  cmakeFlags = [ "-DICONV_INCLUDE_DIR=${libiconv}/include" ]
-    ++ lib.optional withSqlite "-Duse_sqlite3=ON"
-    ++ lib.optional (qt5 != null) "-Dbuild_wizard=YES";
+  cmakeFlags = [
+    "-DICONV_INCLUDE_DIR=${libiconv}/include"
+    "-Duse_sys_sqlite3=ON"
+  ] ++ lib.optional (qt5 != null) "-Dbuild_wizard=YES";
 
   env.NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";

From 72b7ebcdfcba7bd6194385493fb41d4b7bc59c17 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 Dec 2023 22:16:41 +0000
Subject: [PATCH 021/175] rapidfuzz-cpp: 2.2.3 -> 3.0.0

---
 pkgs/development/libraries/rapidfuzz-cpp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/rapidfuzz-cpp/default.nix b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
index 8375d55e4056..2668025bcbe1 100644
--- a/pkgs/development/libraries/rapidfuzz-cpp/default.nix
+++ b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "2.2.3";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "maxbachmann";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yEDihPvTGGL5gsd4QMYNRyfLucKLItIQM4pm6W0i2W8=";
+    hash = "sha256-N9yGOxlk1+wgRXWLbDIXWQz+/pwbnYVs3ub4/16Nzws=";
   };
 
   nativeBuildInputs = [

From 71be5a01183b959e1f0e97e8f6474bcb2f3599b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 Dec 2023 14:24:36 +0100
Subject: [PATCH 022/175] python311Packages.rapidfuzz: 3.5.2 -> 3.6.0

Diff: https://github.com/maxbachmann/RapidFuzz/compare/refs/tags/v3.5.2...v3.6.0

Changelog: https://github.com/maxbachmann/RapidFuzz/blob/refs/tags/v3.6.0/CHANGELOG.rst
---
 pkgs/development/python-modules/rapidfuzz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 97f2a09e55e2..a7c816b4a33f 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.5.2";
+  version = "3.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D7Z0xKqAJAPKSAEK+3Mpz/LaEKqKYczp+m6SqfzufwA=";
+    hash = "sha256-OO8ztnildJ8nmI1crGW4FfA8uKVo7MZPlDguEatOzyA=";
   };
 
   postPatch = ''

From 42fc5919f1b4544ef0c436cd7f14ff0af0e2ae3d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 Dec 2023 14:38:21 +0100
Subject: [PATCH 023/175] python311Packages.cython_3: 3.0.6 -> 3.0.7

Changelog: https://github.com/cython/cython/blob/3.0.7/CHANGES.rst
---
 pkgs/top-level/python-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2685c6564d02..b61a34f67692 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2540,10 +2540,10 @@ self: super: with self; {
   cython = callPackage ../development/python-modules/cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.6";
+    version = "3.0.7";
     src = old.src.override {
       inherit version;
-      hash = "sha256-OZ0YVnLGZ7Juq73KQgyYVkWDeYrzvEdnCooJ6fGd1mA=";
+      hash = "sha256-+ymazzpXhXPBkMhY1J4M+ddfS8ScPyTFpjgEmX7wkhM=";
     };
     patches = [ ];
   });

From 891a6348766ff17e4666b43aa94a28390467340e Mon Sep 17 00:00:00 2001
From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Date: Sun, 24 Dec 2023 21:05:13 +0100
Subject: [PATCH 024/175] buildGoModule: always set `-buildid=` as ldflag

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
---
 pkgs/build-support/go/module.nix  | 6 ++++++
 pkgs/build-support/go/package.nix | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index d0fd8928c91a..a9f87e3d222f 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -39,6 +39,8 @@
   # Not needed with buildGoModule
 , goPackagePath ? ""
 
+, ldflags ? [ ]
+
   # needed for buildFlags{,Array} warning
 , buildFlags ? ""
 , buildFlagsArray ? ""
@@ -154,6 +156,9 @@ let
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
     inherit CGO_ENABLED enableParallelBuilding GO111MODULE GOTOOLCHAIN;
 
+    # If not set to an explicit value, set the buildid empty for reproducibility.
+    ldflags = ldflags ++ lib.optionals (!lib.any (lib.hasPrefix "-buildid=") ldflags) [ "-buildid=" ];
+
     configurePhase = args.configurePhase or (''
       runHook preConfigure
 
@@ -300,4 +305,5 @@ in
 lib.warnIf (args' ? vendorSha256) "`vendorSha256` is deprecated. Use `vendorHash` instead"
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
+lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
   package
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index 7e099b76f0b7..8ca5ca0dca01 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -37,6 +37,8 @@
 
 , CGO_ENABLED ? go.CGO_ENABLED
 
+, ldflags ? [ ]
+
 # needed for buildFlags{,Array} warning
 , buildFlags ? ""
 , buildFlagsArray ? ""
@@ -91,6 +93,9 @@ let
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
 
+    # If not set to an explicit value, set the buildid empty for reproducibility.
+    ldflags = ldflags ++ lib.optionals (!lib.any (lib.hasPrefix "-buildid=") ldflags) [ "-buildid=" ];
+
     configurePhase = args.configurePhase or (''
       runHook preConfigure
 
@@ -280,4 +285,5 @@ let
 in
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
+lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
   package

From 77d6ba8a4cf5a71bca40b76de3bc071e56399eb1 Mon Sep 17 00:00:00 2001
From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Date: Sun, 24 Dec 2023 21:14:12 +0100
Subject: [PATCH 025/175] treewide: remove explicit `-buildid=` from
 buildGoModules invocations

This is now always set by buildGoModule.
---
 pkgs/applications/networking/go-graft/default.nix        | 2 +-
 pkgs/applications/version-management/gitsign/default.nix | 2 +-
 pkgs/by-name/at/athens/package.nix                       | 2 +-
 pkgs/by-name/up/uplosi/package.nix                       | 2 +-
 pkgs/development/tools/gofumpt/default.nix               | 6 +++++-
 pkgs/development/tools/kind/default.nix                  | 2 +-
 pkgs/tools/networking/tun2socks/default.nix              | 2 +-
 pkgs/tools/networking/v2ray/default.nix                  | 2 +-
 pkgs/tools/networking/xray/default.nix                   | 2 +-
 pkgs/tools/security/slsa-verifier/default.nix            | 1 -
 pkgs/tools/security/step-ca/default.nix                  | 4 ----
 11 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index ec9ca385e1ef..14dbcea6277b 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   CGO_ENABLED = 0;
 
-  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
+  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" ];
   vendorHash = "sha256-fnM4ycqDyruCdCA1Cr4Ki48xeQiTG4l5dLVuAafEm14=";
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/version-management/gitsign/default.nix b/pkgs/applications/version-management/gitsign/default.nix
index cf804ddfb54c..87b73391987e 100644
--- a/pkgs/applications/version-management/gitsign/default.nix
+++ b/pkgs/applications/version-management/gitsign/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  ldflags = [ "-s" "-w" "-buildid=" "-X github.com/sigstore/gitsign/pkg/version.gitVersion=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/sigstore/gitsign/pkg/version.gitVersion=${version}" ];
 
   preCheck = ''
     # test all paths
diff --git a/pkgs/by-name/at/athens/package.nix b/pkgs/by-name/at/athens/package.nix
index f483e465f268..93f0c45af2a7 100644
--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
   vendorHash = "sha256-5U9ql0wszhr5H3hAo2utONuEh4mUSiO71XQHkAnMhZU=";
 
   CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-buildid=" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
 
   subPackages = [ "cmd/proxy" ];
 
diff --git a/pkgs/by-name/up/uplosi/package.nix b/pkgs/by-name/up/uplosi/package.nix
index 05e38ca8026c..738f7ea5a567 100644
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@@ -16,7 +16,7 @@ buildGo121Module rec {
   vendorHash = "sha256-RsjUPLe8omoN+XGyNhHDxzNfZR7VVTkh/f/On1oCRqM=";
 
   CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-buildid=" "-X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
   flags = [ "-trimpath" ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/gofumpt/default.nix b/pkgs/development/tools/gofumpt/default.nix
index 0949c1ff9dd6..25e8a4ef730b 100644
--- a/pkgs/development/tools/gofumpt/default.nix
+++ b/pkgs/development/tools/gofumpt/default.nix
@@ -21,7 +21,11 @@ buildGoModule rec {
 
   CGO_ENABLED = "0";
 
-  ldflags = "-s -w -X main.version=v${version}";
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
 
   checkFlags = [
     # Requires network access (Error: module lookup disabled by GOPROXY=off).
diff --git a/pkgs/development/tools/kind/default.nix b/pkgs/development/tools/kind/default.nix
index 63f6fff66b62..1f58fd637a6d 100644
--- a/pkgs/development/tools/kind/default.nix
+++ b/pkgs/development/tools/kind/default.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   CGO_ENABLED = 0;
   GOFLAGS = [ "-trimpath" ];
-  ldflags = [ "-buildid=" "-w" ];
+  ldflags = [ "-w" ];
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/tun2socks/default.nix b/pkgs/tools/networking/tun2socks/default.nix
index 9296b0df0068..37019a38b348 100644
--- a/pkgs/tools/networking/tun2socks/default.nix
+++ b/pkgs/tools/networking/tun2socks/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
   vendorHash = "sha256-zeiOcn33PnyoseYb0wynkn7MfGp3rHEYBStY98C6aR8=";
 
   ldflags = [
-    "-w" "-s" "-buildid="
+    "-w" "-s"
     "-X github.com/xjasonlyu/tun2socks/v2/internal/version.Version=v${version}"
     "-X github.com/xjasonlyu/tun2socks/v2/internal/version.GitCommit=v${version}"
   ];
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index cbaeead5a4ba..4d7a49524589 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
   # https://github.com/Mic92/nix-update/pull/95
   vendorHash = "sha256-pC3KXx1KBvQx6eZZG1czaGjCOd0xAB42B5HmKn7p52c=";
 
-  ldflags = [ "-s" "-w" "-buildid=" ];
+  ldflags = [ "-s" "-w" ];
 
   subPackages = [ "main" ];
 
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index bb317055dc04..683cd9e48447 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  ldflags = [ "-s" "-w" "-buildid=" ];
+  ldflags = [ "-s" "-w" ];
   subPackages = [ "main" ];
 
    installPhase = ''
diff --git a/pkgs/tools/security/slsa-verifier/default.nix b/pkgs/tools/security/slsa-verifier/default.nix
index d02b574b1563..5a6ab18a49ec 100644
--- a/pkgs/tools/security/slsa-verifier/default.nix
+++ b/pkgs/tools/security/slsa-verifier/default.nix
@@ -27,7 +27,6 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-buildid="
     "-X sigs.k8s.io/release-utils/version.gitVersion=${version}"
   ];
 
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index 5c1463ec117b..6bdbfa02d62a 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -23,10 +23,6 @@ buildGoModule rec {
 
   vendorHash = "sha256-AXMMpzXEhdKSGeVg/KK2NEgalxIXP6DUTcoxOQVqow4=";
 
-  ldflags = [
-    "-buildid="
-  ];
-
   nativeBuildInputs = lib.optionals hsmSupport [
     pkg-config
   ];

From 6d432900e2abba9817fc0588ac072f25dc331ec2 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 28 Dec 2023 23:17:22 +0100
Subject: [PATCH 026/175] curl: add websocket support

disabled by default, enabled in curlFull
https://curl.se/docs/websocket.html
---
 pkgs/tools/networking/curl/default.nix | 2 ++
 pkgs/top-level/all-packages.nix        | 1 +
 2 files changed, 3 insertions(+)

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 48bf59e25266..190d7f0250f7 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -15,6 +15,7 @@
   ), libkrb5
 , http2Support ? true, nghttp2
 , http3Support ? false, nghttp3, ngtcp2
+, websocketSupport ? false
 , idnSupport ? false, libidn2
 , ldapSupport ? false, openldap
 , opensslSupport ? zlibSupport, openssl
@@ -105,6 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.enableFeature c-aresSupport "ares")
       (lib.enableFeature ldapSupport "ldap")
       (lib.enableFeature ldapSupport "ldaps")
+      (lib.enableFeature websocketSupport "websockets")
       # --with-ca-fallback is only supported for openssl and gnutls https://github.com/curl/curl/blame/curl-8_0_1/acinclude.m4#L1640
       (lib.withFeature (opensslSupport || gnutlsSupport) "ca-fallback")
       (lib.withFeature http3Support "nghttp3")
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e051ece6d370..a2a0d85d8cdc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7373,6 +7373,7 @@ with pkgs;
     gsaslSupport = true;
     rtmpSupport = true;
     pslSupport = true;
+    websocketSupport = true;
   };
 
   curlHTTP3 = curl.override {

From ea00c860cfe8546e6516a587d20befbf08645ec4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 Dec 2023 14:29:05 -0800
Subject: [PATCH 027/175] python311Packages.python-memcached: 1.59 -> 1.60

Diff: https://github.com/linsomniac/python-memcached/compare/1.59...1.60

Changelog: https://github.com/linsomniac/python-memcached/releases/tag/1.60
---
 .../python-modules/python-memcached/default.nix      | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/python-memcached/default.nix b/pkgs/development/python-modules/python-memcached/default.nix
index 27a9eed537bb..a2e30e45562d 100644
--- a/pkgs/development/python-modules/python-memcached/default.nix
+++ b/pkgs/development/python-modules/python-memcached/default.nix
@@ -1,25 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, six
+, setuptools
 , mock
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "python-memcached";
-  version = "1.59";
-  format = "setuptools";
+  version = "1.60";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "linsomniac";
     repo = "python-memcached";
     rev = version;
-    hash = "sha256-tHqkwNloPTXOrEGtuDLu1cTw4SKJ4auv8UUbqdNp698=";
+    hash = "sha256-ByW6WaR7OyWlKuzxVw12L0W5b88seLlIf5N5MKxiAog=";
   };
 
-  propagatedBuildInputs = [
-    six
+  nativeBuildInputs = [
+    setuptools
   ];
 
   nativeCheckInputs = [

From 925a03e1b36a709788d1897e90dcac2e9002f19d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 Dec 2023 14:34:03 -0800
Subject: [PATCH 028/175] python311Packages.pymemcache: add python-memcached
 test dependency

---
 pkgs/development/python-modules/pymemcache/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pymemcache/default.nix b/pkgs/development/python-modules/pymemcache/default.nix
index 68925fe7f4a9..74784a35ff95 100644
--- a/pkgs/development/python-modules/pymemcache/default.nix
+++ b/pkgs/development/python-modules/pymemcache/default.nix
@@ -5,6 +5,7 @@
 , mock
 , six
 , pytestCheckHook
+, python-memcached
 , pythonOlder
 , zstd
 , stdenv
@@ -32,6 +33,7 @@ buildPythonPackage rec {
     faker
     mock
     pytestCheckHook
+    python-memcached
     zstd
   ];
 
@@ -39,10 +41,7 @@ buildPythonPackage rec {
     sed -i "/--cov/d" setup.cfg
   '';
 
-  disabledTests = [
-    # python-memcached is not available (last release in 2017)
-    "TestClientSocketConnect"
-  ] ++ lib.optionals stdenv.is32bit [
+  disabledTests = lib.optionals stdenv.is32bit [
     # test_compressed_complex is broken on 32-bit platforms
     # this can be removed on the next version bump
     # see also https://github.com/pinterest/pymemcache/pull/480

From 09bd661b59aaf7ba5034fb0f80f0b720205e8719 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Dec 2023 03:13:21 +0000
Subject: [PATCH 029/175] zxing-cpp: 2.1.0 -> 2.2.1

---
 pkgs/development/libraries/zxing-cpp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/zxing-cpp/default.nix b/pkgs/development/libraries/zxing-cpp/default.nix
index 1c010638693e..cd5d10551192 100644
--- a/pkgs/development/libraries/zxing-cpp/default.nix
+++ b/pkgs/development/libraries/zxing-cpp/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zxing-cpp";
-  version = "2.1.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "zxing-cpp";
     repo = "zxing-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-B/jGsHImRfj0iEio2b6R6laWBI1LL3OI407O7sren8s=";
+    hash = "sha256-teFspdATn9M7Z1vSr/7PdJx/xAv+TVai8rIekxqpBZk=";
   };
 
   nativeBuildInputs = [

From 38d5ab182bfa51f0c5297494fc5b2ab6668b537a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Dec 2023 07:25:05 +0000
Subject: [PATCH 030/175] rav1e: 0.6.6 -> 0.7.0

---
 pkgs/tools/video/rav1e/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 859e523dfa65..1cb5b484c354 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.6.6";
+  version = "0.7.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-urYMT1sJUMBj1L/2Hi+hcYbWbi0ScSls0pm9gLj9H3o=";
+    sha256 = "sha256-rZyQVivvb/XMzqKpgRl6JtilUU5hk76yzqs6bEKISIQ=";
   };
 
-  cargoHash = "sha256-qQfEpynhlIEKU1Ptq/jM1Wdtn+BVCZT1lmou2S1GL4I=";
+  cargoHash = "sha256-0I094hEDUriPsDgbeqYtWAO1b1vJIBPMCndOsX4A3RM=";
 
   depsBuildBuild = [ pkg-config ];
 

From 0ff6a0bdaed9f6b6fc799f429a28f25519082b12 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 26 Dec 2023 17:31:57 -0500
Subject: [PATCH 031/175] ffmpeg_6: make patch unconditional

---
 pkgs/development/libraries/ffmpeg/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 8b810120b80b..fe9f9a4e76a6 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -356,7 +356,7 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-FQV9/PiarPXCm45ldtCsxGHjlrriL8DKpn1LaKJ8owI=";
       }
     )
-    ++ (lib.optional (stdenv.isDarwin && lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
+    ++ (lib.optional (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
       { # this can be removed post 6.1
         name = "fix_build_failure_due_to_PropertyKey_EncoderID";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";

From 32339b669b724ccc5a64791727ff1f4819eae763 Mon Sep 17 00:00:00 2001
From: Ivan Babrou <github@ivan.computer>
Date: Mon, 1 Jan 2024 19:57:10 -0800
Subject: [PATCH 032/175] rsync: fix missing ipv6 support

---
 .../rsync/configure.ac-fix-failing-IPv6-check.patch  | 12 ++++++++++++
 pkgs/applications/networking/sync/rsync/default.nix  |  2 ++
 2 files changed, 14 insertions(+)
 create mode 100644 pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch

diff --git a/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch b/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch
new file mode 100644
index 000000000000..3305653d025f
--- /dev/null
+++ b/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch
@@ -0,0 +1,12 @@
+diff -rup rsync-3.2.7/configure.sh rsync-3.2.7-fixed/configure.sh
+--- rsync-3.2.7/configure.sh	2022-10-20 17:57:22
++++ rsync-3.2.7-fixed/configure.sh	2024-01-01 19:51:58
+@@ -7706,7 +7706,7 @@ else $as_nop
+ #include <stdlib.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+-main()
++int main()
+ {
+    if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+      exit(1);
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index 1baf1c40eb14..0d8b3d78ec05 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     # https://github.com/WayneD/rsync/issues/511#issuecomment-1774612577
     # original source: https://build.opensuse.org/package/view_file/network/rsync/rsync-fortified-strlcpy-fix.patch?expand=1&rev=3f8dd2f4a404c96c0f69176e60893714
     ./rsync-fortified-strlcpy-fix.patch
+    # https://github.com/WayneD/rsync/pull/558
+    ./configure.ac-fix-failing-IPv6-check.patch
   ];
 
   buildInputs = [ libiconv zlib popt ]

From ad89162ccf4102386de5c1be87d1a312e08583ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 2 Jan 2024 02:43:32 -0800
Subject: [PATCH 033/175] python311Packages.python-memcached: 1.60 -> 1.61

Diff: https://github.com/linsomniac/python-memcached/compare/1.60...1.61

Changelog: https://github.com/linsomniac/python-memcached/releases/tag/1.61
---
 pkgs/development/python-modules/python-memcached/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-memcached/default.nix b/pkgs/development/python-modules/python-memcached/default.nix
index a2e30e45562d..e82b6b51643a 100644
--- a/pkgs/development/python-modules/python-memcached/default.nix
+++ b/pkgs/development/python-modules/python-memcached/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "python-memcached";
-  version = "1.60";
+  version = "1.61";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "linsomniac";
     repo = "python-memcached";
     rev = version;
-    hash = "sha256-ByW6WaR7OyWlKuzxVw12L0W5b88seLlIf5N5MKxiAog=";
+    hash = "sha256-7bUCVAmOJ6znVmTZg9AJokOuym07NHL12gZgQ2uhfNo=";
   };
 
   nativeBuildInputs = [

From 507113361f8c34b865c692dbea76d95bb626b6aa Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Fri, 29 Dec 2023 22:53:48 +0100
Subject: [PATCH 034/175] =?UTF-8?q?fontconfig:=202.14.2=20=E2=86=92=202.15?=
 =?UTF-8?q?.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.freedesktop.org/fontconfig/fontconfig/-/compare/2.14.2...2.15.0
---
 pkgs/development/libraries/fontconfig/default.nix | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index eadb30352e9a..9ff72c202193 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch2
 , pkg-config
 , python3
 , freetype
@@ -15,25 +14,15 @@
 
 stdenv.mkDerivation rec {
   pname = "fontconfig";
-  version = "2.14.2";
+  version = "2.15.0";
 
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/fontconfig/release/${pname}-${version}.tar.xz";
-    hash = "sha256-26aVtXvOFQI9LO7e+CBiwrkl5R9dTMSu9zbPE/YKRos=";
+    hash = "sha256-Y6BljQ4G4PqIYQZFK1jvBPIfWCAuoCqUw53g0zNdfA4=";
   };
 
-  patches = [
-    # Provide 11-lcdfilter-none.conf for NixOS module
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/268
-    (fetchpatch2 {
-      name = "add-optional-11-lcdfilter-none-configuration.patch";
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/c2666a6d9a6ed18b1bfcef8176e25f62993e24db.patch";
-      hash = "sha256-UBzkxy3uxFO+g0aQtPnBZv7OncgQdinwzNwWS8ngjcE=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     gperf

From 5ae439867ea3afb115d6eade7271f1d5c4b3d5ac Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 2 Jan 2024 18:28:53 +0000
Subject: [PATCH 035/175] libxmlb: 0.3.14 -> 0.3.15

---
 pkgs/development/libraries/libxmlb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libxmlb/default.nix b/pkgs/development/libraries/libxmlb/default.nix
index 391874e531d7..522d3546b8e0 100644
--- a/pkgs/development/libraries/libxmlb/default.nix
+++ b/pkgs/development/libraries/libxmlb/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libxmlb";
-  version = "0.3.14";
+  version = "0.3.15";
 
   outputs = [ "out" "lib" "dev" "devdoc" "installedTests" ];
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "libxmlb";
     rev = version;
-    hash = "sha256-lpVXl/n/ecDLbbLQg9T+o4GdGZM7pNXGYTyVogNCl2E=";
+    hash = "sha256-S0wBVhfRa81mAmqpYYAKAyKLnfnVsXJEcGA21i5tdzo=";
   };
 
   patches = [

From 3a1b8034c4fa8917997903443de000323272269f Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Fri, 24 Nov 2023 11:55:06 +0100
Subject: [PATCH 036/175] lvm2: 2.03.22 -> 2.03.23

---
 pkgs/os-specific/linux/lvm2/2_03.nix         |  4 +-
 pkgs/os-specific/linux/lvm2/common.nix       |  4 +-
 pkgs/os-specific/linux/lvm2/fix-static.patch | 28 ++++++++++++
 pkgs/os-specific/linux/lvm2/no-shared.patch  | 46 --------------------
 4 files changed, 32 insertions(+), 50 deletions(-)
 create mode 100644 pkgs/os-specific/linux/lvm2/fix-static.patch
 delete mode 100644 pkgs/os-specific/linux/lvm2/no-shared.patch

diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index b2f6b0aa8a23..fa0a2cc8a600 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.22";
-  hash = "sha256-TFppI70aznzgRHRgioSTfOBTupGxrOnwsAFyaOcy3Hw=";
+  version = "2.03.23";
+  hash = "sha256-dOeUqene4bz4ogZfZbkZbET98yHiLWO5jtfejJqhel0=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 7b9cc10be167..97f1eb3a1771 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -103,8 +103,8 @@ stdenv.mkDerivation rec {
     }))
     # Musl fix from Alpine
     ./fix-stdio-usage.patch
-  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
-    ./no-shared.patch
+    # https://gitlab.com/lvmteam/lvm2/-/merge_requests/8
+    ./fix-static.patch
   ];
 
   doCheck = false; # requires root
diff --git a/pkgs/os-specific/linux/lvm2/fix-static.patch b/pkgs/os-specific/linux/lvm2/fix-static.patch
new file mode 100644
index 000000000000..89192744adec
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/fix-static.patch
@@ -0,0 +1,28 @@
+From 0cbe7f0adc86c92c61156c417b27b063f156b31b Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Tue, 2 Jan 2024 18:15:20 +0100
+Subject: [PATCH] makefiles: fix disabling shared link
+
+LIB_SHARED still gets set when shared linking has been disabled, so
+the previous version of this check still attempted to build the
+shared library.
+---
+ libdm/make.tmpl.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
+index 2dd9625d4d..69ba2c35ab 100644
+--- a/libdm/make.tmpl.in
++++ b/libdm/make.tmpl.in
+@@ -436,7 +436,7 @@ DEFS+=-D_FILE_OFFSET_BITS=64
+ 	@echo "    [CC] $(<F)"
+ 	$(Q) $(CC) -c $(CFLAGS) $(CLDFLAGS) $< $(LIBS) -o $@
+ 
+-ifneq (,$(LIB_SHARED))
++ifeq ("@SHARED_LINK@", "yes")
+ 
+ TARGETS += $(LIB_SHARED).$(LIB_VERSION)
+ $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
+-- 
+GitLab
+
diff --git a/pkgs/os-specific/linux/lvm2/no-shared.patch b/pkgs/os-specific/linux/lvm2/no-shared.patch
deleted file mode 100644
index 23a82a0fa294..000000000000
--- a/pkgs/os-specific/linux/lvm2/no-shared.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff --git a/libdm/Makefile.in b/libdm/Makefile.in
-index 2758648e6..f305a12b0 100644
---- a/libdm/Makefile.in
-+++ b/libdm/Makefile.in
-@@ -47,7 +47,6 @@ endif
- 
- LIB_SHARED = $(interface)/libdevmapper.$(LIB_SUFFIX)
- LIB_VERSION = $(LIB_VERSION_DM)
--TARGETS = libdevmapper.$(LIB_SUFFIX) libdevmapper.$(LIB_SUFFIX).$(LIB_VERSION) .symver_check
- 
- CFLOW_LIST = $(SOURCES)
- CFLOW_LIST_TARGET = libdevmapper.cflow
-diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
-index a731687c2..9366cdf1c 100644
---- a/libdm/make.tmpl.in
-+++ b/libdm/make.tmpl.in
-@@ -314,7 +314,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
- SUBDIRS.clean := $(SUBDIRS:=.clean)
- SUBDIRS.distclean := $(SUBDIRS:=.distclean)
- 
--TARGETS += $(LIB_SHARED) $(LIB_STATIC)
-+TARGETS += $(LIB_STATIC)
- 
- all: $(SUBDIRS) $(TARGETS)
- 
-@@ -431,7 +431,6 @@ DEFS+=-D_FILE_OFFSET_BITS=64
- 
- ifneq (,$(LIB_SHARED))
- 
--TARGETS += $(LIB_SHARED).$(LIB_VERSION)
- $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
- 	@echo "    [CC] $@"
- ifeq ("@LIB_SUFFIX@","so")
-diff --git a/make.tmpl.in b/make.tmpl.in
-index b73176f5a..6100d0dfd 100644
---- a/make.tmpl.in
-+++ b/make.tmpl.in
-@@ -368,7 +368,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
- SUBDIRS.clean := $(SUBDIRS:=.clean)
- SUBDIRS.distclean := $(SUBDIRS:=.distclean)
- 
--TARGETS += $(LIB_SHARED) $(LIB_STATIC)
-+TARGETS += $(LIB_STATIC)
- 
- INTERNAL_LIBS = \
- 	$(top_builddir)/libdaemon/client/libdaemonclient.a \

From 121750d851e9e759b21007e19d826ff801b8efc7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 3 Jan 2024 17:15:18 +0000
Subject: [PATCH 037/175] aws-c-auth: 0.7.7 -> 0.7.10

Changes:
- https://github.com/awslabs/aws-c-auth/releases/tag/v0.7.8
- https://github.com/awslabs/aws-c-auth/releases/tag/v0.7.9
- https://github.com/awslabs/aws-c-auth/releases/tag/v0.7.10
---
 pkgs/development/libraries/aws-c-auth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 284671b43f17..f818e35c458e 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.7";
+  version = "0.7.10";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    sha256 = "sha256-GO3Sfbi1dwsqQM6rlnEHyE7wolQjdVwD5BAu5ychEuY=";
+    hash = "sha256-yJ0sgw0y9tIiIHgTPVnfYd8zAGjO83qfeeEzstGH9CE=";
   };
 
   nativeBuildInputs = [

From 7a5da4fc0bc2b627eca98d7c1653e4fc6ac82758 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 20 Dec 2023 15:48:30 +0100
Subject: [PATCH 038/175] pixman: enable parallel building

Tested at -j64.
---
 pkgs/development/libraries/pixman/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index 76ec2244c833..8bc8934d9561 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
     export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 184 ? 184 : NIX_BUILD_CORES))
   '';
 
+  enableParallelBuilding = true;
+
   doCheck = true;
 
   postInstall = glib.flattenInclude;

From e9affccd5dc411af25206238f5b44ba4444454f7 Mon Sep 17 00:00:00 2001
From: Lin Xianyi <iynaix@gmail.com>
Date: Fri, 5 Jan 2024 09:04:38 +0800
Subject: [PATCH 039/175] catch2_3: 3.5.0 -> 3.5.1

---
 pkgs/development/libraries/catch2/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/catch2/3.nix b/pkgs/development/libraries/catch2/3.nix
index ba93701b5669..a6b51710e615 100644
--- a/pkgs/development/libraries/catch2/3.nix
+++ b/pkgs/development/libraries/catch2/3.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    hash = "sha256-jXrLZiVHi/TAZ0lEENHkCYlcCW59wOrXCfz1mHBFEfQ=";
+    hash = "sha256-OyYNUfnu6h1+MfCF8O+awQ4Usad0qrdCtdZhYgOY+Vw=";
   };
 
   nativeBuildInputs = [

From 27e46a6f43a8c3d06e37327253d955c74a2781ed Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 27 Dec 2023 12:47:36 -0300
Subject: [PATCH 040/175] bluez: migrate to by-name

---
 .../bluez/default.nix => by-name/bl/bluez/package.nix}     | 0
 pkgs/top-level/all-packages.nix                            | 7 +++----
 2 files changed, 3 insertions(+), 4 deletions(-)
 rename pkgs/{os-specific/linux/bluez/default.nix => by-name/bl/bluez/package.nix} (100%)

diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/by-name/bl/bluez/package.nix
similarity index 100%
rename from pkgs/os-specific/linux/bluez/default.nix
rename to pkgs/by-name/bl/bluez/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bbc4969c3621..a0e30745d6f9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27700,13 +27700,12 @@ with pkgs;
 
   blktrace = callPackage ../os-specific/linux/blktrace { };
 
-  bluez5 = callPackage ../os-specific/linux/bluez { };
-
-  bluez5-experimental = callPackage ../os-specific/linux/bluez {
+  bluez-experimental = bluez.override {
     withExperimental = true;
   };
 
-  bluez = bluez5;
+  bluez5 = bluez;
+  bluez5-experimental = bluez-experimental;
 
   bolt = callPackage ../os-specific/linux/bolt { };
 

From 3e06702eb49238f293e6f5742f48ef5ee1aac48c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Fri, 5 Jan 2024 13:38:05 +0100
Subject: [PATCH 041/175] iana-etc: 20230316 -> 20231227

Diff: https://github.com/Mic92/iana-etc/compare/None...20231227
---
 pkgs/data/misc/iana-etc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index de19347e3403..ee83d1cca0bb 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20230316";
+  version = "20231227";
 
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-5acFYPSwevEw5tZNbQDpui3stWuMdnhaKHqC8lhnsOY=";
+    sha256 = "sha256-8Pa6LtAml8axjrUS32UbFIqTtM8v124U2Tt0J4sC0Is=";
   };
 
   installPhase = ''

From 95a4f83dbbddbba117736d1437d707a8f4c53802 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 27 Dec 2023 20:15:07 -0300
Subject: [PATCH 042/175] bluez: refactor

- rename withExperimental to enableExperimental
- finalAttrs design pattern
- use lib.* string functions
- update meta
  - mainProgram
  - changelog
  - new maintainer: AndersonTorres
---
 pkgs/by-name/bl/bluez/package.nix | 139 +++++++++++++++++-------------
 pkgs/top-level/all-packages.nix   |   8 +-
 2 files changed, 81 insertions(+), 66 deletions(-)

diff --git a/pkgs/by-name/bl/bluez/package.nix b/pkgs/by-name/bl/bluez/package.nix
index d864f30096d7..5cbacf53fd17 100644
--- a/pkgs/by-name/bl/bluez/package.nix
+++ b/pkgs/by-name/bl/bluez/package.nix
@@ -1,52 +1,49 @@
-{ stdenv
-, lib
-, fetchurl
-, fetchpatch
+{ lib
+, stdenv
 , alsa-lib
 , dbus
+, docutils
 , ell
+, enableExperimental ? false
+, fetchpatch
+, fetchurl
 , glib
 , json_c
 , libical
-, docutils
 , pkg-config
 , python3
 , readline
 , systemdMinimal
 , udev
-, withExperimental ? false
-}: let
-  pythonPath = with python3.pkgs; [
-    dbus-python
-    pygobject3
-    recursivePthLoader
-  ];
-in stdenv.mkDerivation rec {
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "bluez";
   version = "5.70";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-N+Ny6RaVXhRMuIL4iOS+QImPEK47fCE93N1V7pwAkng=";
+    url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
+    hash = "sha256-N+Ny6RaVXhRMuIL4iOS+QImPEK47fCE93N1V7pwAkng=";
   };
 
   patches = [
-    # replace use of a non-standard symbol to fix build with musl libc (pkgsMusl.bluez)
+    # replace use of a non-standard symbol to fix build with musl libc
+    # (pkgsMusl.bluez)
     (fetchpatch {
       url = "https://git.alpinelinux.org/aports/plain/main/bluez/max-input.patch?id=32b31b484cb13009bd8081c4106e4cf064ec2f1f";
-      sha256 = "sha256-SczbXtsxBkCO+izH8XOBcrJEO2f7MdtYVT3+2fCV8wU=";
+      hash = "sha256-SczbXtsxBkCO+izH8XOBcrJEO2f7MdtYVT3+2fCV8wU=";
     })
     # Fix device pairing regression
     # FIXME: remove in next release
     (fetchpatch {
-      url = "https://github.com/bluez/bluez/commit/3a9c637010f8dc1ba3e8382abe01065761d4f5bb.patch";
+      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=3a9c637010f8dc1ba3e8382abe01065761d4f5bb";
       hash = "sha256-UUmYMHnxYrw663nEEC2mv3zj5e0omkLNejmmPUtgS3c=";
     })
-    # CVE-2023-45866 / https://github.com/skysafe/reblog/tree/main/cve-2023-45866
+    # https://github.com/skysafe/reblog/tree/main/cve-2023-45866
     (fetchpatch {
       name = "CVE-2023-45866.patch";
       url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675";
-      sha256 = "sha256-IuPQ18yN0EO/PkqdT/JETyOxdZCKewBiDjGN4CG2GLo=";
+      hash = "sha256-IuPQ18yN0EO/PkqdT/JETyOxdZCKewBiDjGN4CG2GLo=";
     })
   ];
 
@@ -74,64 +71,79 @@ in stdenv.mkDerivation rec {
     substituteInPlace tools/hid2hci.rules \
       --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
       --replace "hid2hci " "$out/lib/udev/hid2hci "
-    # Disable some tests:
-    # - test-mesh-crypto depends on the following kernel settings:
-    #   CONFIG_CRYPTO_[USER|USER_API|USER_API_AEAD|USER_API_HASH|AES|CCM|AEAD|CMAC]
-    if [[ ! -f unit/test-mesh-crypto.c ]]; then echo "unit/test-mesh-crypto.c no longer exists"; false; fi
+  '' +
+  # Disable some tests:
+  # - test-mesh-crypto depends on the following kernel settings:
+  #   CONFIG_CRYPTO_[USER|USER_API|USER_API_AEAD|USER_API_HASH|AES|CCM|AEAD|CMAC]
+  ''
+    if [[ ! -f unit/test-mesh-crypto.c ]]; then
+      echo "unit/test-mesh-crypto.c no longer exists"
+      false
+    fi
     echo 'int main() { return 77; }' > unit/test-mesh-crypto.c
   '';
 
   configureFlags = [
     "--localstatedir=/var"
-    "--enable-library"
-    "--enable-cups"
-    "--enable-pie"
-    "--enable-external-ell"
-    "--with-dbusconfdir=${placeholder "out"}/share"
-    "--with-dbussystembusdir=${placeholder "out"}/share/dbus-1/system-services"
-    "--with-dbussessionbusdir=${placeholder "out"}/share/dbus-1/services"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/etc/systemd/user"
-    "--with-udevdir=${placeholder "out"}/lib/udev"
-    "--enable-health"
-    "--enable-mesh"
-    "--enable-midi"
-    "--enable-nfc"
-    "--enable-sixaxis"
-    "--enable-btpclient"
-    "--enable-hid2hci"
-    "--enable-logger"
-
-    # To provide ciptool, sdptool, and rfcomm (unmaintained)
+    (lib.enableFeature enableExperimental "experimental")
+    (lib.enableFeature true "btpclient")
+    (lib.enableFeature true "cups")
+    (lib.enableFeature true "external-ell")
+    (lib.enableFeature true "health")
+    (lib.enableFeature true "hid2hci")
+    (lib.enableFeature true "library")
+    (lib.enableFeature true "logger")
+    (lib.enableFeature true "mesh")
+    (lib.enableFeature true "midi")
+    (lib.enableFeature true "nfc")
+    (lib.enableFeature true "pie")
+    (lib.enableFeature true "sixaxis")
+    # Set "deprecated" to provide ciptool, sdptool, and rfcomm (unmaintained);
     # superseded by new D-Bus APIs
-    "--enable-deprecated"
-  ] ++ lib.optional withExperimental "--enable-experimental";
+    (lib.enableFeature true "deprecated")
+    (lib.withFeatureAs true "dbusconfdir" "${placeholder "out"}/share")
+    (lib.withFeatureAs true "dbussessionbusdir" "${placeholder "out"}/share/dbus-1/services")
+    (lib.withFeatureAs true "dbussystembusdir" "${placeholder "out"}/share/dbus-1/system-services")
+    (lib.withFeatureAs true "systemdsystemunitdir" "${placeholder "out"}/etc/systemd/system")
+    (lib.withFeatureAs true "systemduserunitdir" "${placeholder "out"}/etc/systemd/user")
+    (lib.withFeatureAs true "udevdir" "${placeholder "out"}/lib/udev")
+  ];
 
+  makeFlags = [
+    "rulesdir=${placeholder "out"}/lib/udev/rules.d"
+  ];
 
   # Work around `make install' trying to create /var/lib/bluetooth.
-  installFlags = [ "statedir=$(TMPDIR)/var/lib/bluetooth" ];
-
-  makeFlags = [ "rulesdir=${placeholder "out"}/lib/udev/rules.d" ];
+  installFlags = [
+    "statedir=$(TMPDIR)/var/lib/bluetooth"
+  ];
 
   doCheck = stdenv.hostPlatform.isx86_64;
 
-  postInstall = ''
+  postInstall = let
+    pythonPath = with python3.pkgs; [
+      dbus-python
+      pygobject3
+      recursivePthLoader
+    ];
+  in
+  ''
     mkdir -p $test/{bin,test}
     cp -a test $test
     pushd $test/test
-    for a in \
+    for t in \
+            list-devices \
+            monitor-bluetooth \
             simple-agent \
             test-adapter \
             test-device \
             test-thermometer \
-            list-devices \
-            monitor-bluetooth \
             ; do
-      ln -s ../test/$a $test/bin/bluez-$a
+      ln -s ../test/$t $test/bin/bluez-$t
     done
     popd
     wrapPythonProgramsIn $test/test "$test/test ${toString pythonPath}"
-  '' + ''
+
     # for bluez4 compatibility for NixOS
     mkdir $out/sbin
     ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
@@ -146,7 +158,7 @@ in stdenv.mkDerivation rec {
     ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
 
     # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
-    for files in `find tools/ -type f -perm -755`; do
+    for files in $(find tools/ -type f -perm -755); do
       filename=$(basename $files)
       install -Dm755 tools/$filename $out/bin/$filename
     done
@@ -155,10 +167,13 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
-    description = "Bluetooth support for Linux";
-    homepage = "http://www.bluez.org/";
-    license = with licenses; [ gpl2 lgpl21 ];
-    platforms = platforms.linux;
+  meta = {
+    homepage = "https://www.bluez.org/";
+    description = "Official Linux Bluetooth protocol stack";
+    changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
+    license = with lib.licenses; [ bsd2 gpl2Plus lgpl21Plus mit ];
+    mainProgram = "btinfo";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a0e30745d6f9..30d88ac2e5e3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27700,13 +27700,13 @@ with pkgs;
 
   blktrace = callPackage ../os-specific/linux/blktrace { };
 
-  bluez-experimental = bluez.override {
-    withExperimental = true;
-  };
-
   bluez5 = bluez;
   bluez5-experimental = bluez-experimental;
 
+  bluez-experimental = bluez.override {
+    enableExperimental = true;
+  };
+
   bolt = callPackage ../os-specific/linux/bolt { };
 
   bpf-linker = callPackage ../development/tools/bpf-linker { };

From af69d4ac9603f4ad0210613fe90baa6c17e3c721 Mon Sep 17 00:00:00 2001
From: Anderson Torres <torres.anderson.85@protonmail.com>
Date: Wed, 27 Dec 2023 20:45:13 -0300
Subject: [PATCH 043/175] bluez: 5.70 -> 5.71

---
 pkgs/by-name/bl/bluez/package.nix | 25 ++-----------------------
 1 file changed, 2 insertions(+), 23 deletions(-)

diff --git a/pkgs/by-name/bl/bluez/package.nix b/pkgs/by-name/bl/bluez/package.nix
index 5cbacf53fd17..e8b649db3939 100644
--- a/pkgs/by-name/bl/bluez/package.nix
+++ b/pkgs/by-name/bl/bluez/package.nix
@@ -19,34 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez";
-  version = "5.70";
+  version = "5.71";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-N+Ny6RaVXhRMuIL4iOS+QImPEK47fCE93N1V7pwAkng=";
+    hash = "sha256-uCjUGMk87R9Vthb7VILPAVN0QL+zT72hpWTz7OlHNdg=";
   };
 
-  patches = [
-    # replace use of a non-standard symbol to fix build with musl libc
-    # (pkgsMusl.bluez)
-    (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/main/bluez/max-input.patch?id=32b31b484cb13009bd8081c4106e4cf064ec2f1f";
-      hash = "sha256-SczbXtsxBkCO+izH8XOBcrJEO2f7MdtYVT3+2fCV8wU=";
-    })
-    # Fix device pairing regression
-    # FIXME: remove in next release
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=3a9c637010f8dc1ba3e8382abe01065761d4f5bb";
-      hash = "sha256-UUmYMHnxYrw663nEEC2mv3zj5e0omkLNejmmPUtgS3c=";
-    })
-    # https://github.com/skysafe/reblog/tree/main/cve-2023-45866
-    (fetchpatch {
-      name = "CVE-2023-45866.patch";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675";
-      hash = "sha256-IuPQ18yN0EO/PkqdT/JETyOxdZCKewBiDjGN4CG2GLo=";
-    })
-  ];
-
   buildInputs = [
     alsa-lib
     dbus

From 0d8901c01fff0b208100854dd81f41844a69b859 Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <max@ine.dev>
Date: Tue, 5 Dec 2023 23:13:25 +0100
Subject: [PATCH 044/175] libmbim: 1.28.4 -> 1.30.0

---
 .../development/libraries/libmbim/default.nix | 23 ++-----------------
 1 file changed, 2 insertions(+), 21 deletions(-)

diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 9965771c1531..8ceb1b3b03bf 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -19,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.28.4";
+  version = "1.30.0";
 
   outputs = [ "out" "dev" ]
     ++ lib.optionals withDocs [ "man" ];
@@ -29,27 +28,9 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libmbim";
     rev = version;
-    hash = "sha256-aaYjvJ2OMTzkUyqWCyHdmsKJ3VGqBmKQzb1DWK/1cPU=";
+    hash = "sha256-sHTpu9WeMZroT+1I18ObEHWSzcyj/Relyz8UNe+WawI=";
   };
 
-  patches = [
-    # Intel Mutual Authentication - FCC lock. Part of 1.30, backported to
-    # openSUSE and Fedora and ChromeOS.
-    # https://src.fedoraproject.org/rpms/libmbim/blob/rawhide/f/libmbim.spec
-    (fetchpatch {
-      url = "https://cgit.freedesktop.org/libmbim/libmbim/patch/?id=910db9cb2b6fde303d3b4720890cf6dc6fc00880";
-      hash = "sha256-412sXdWb8WsSexe1scI/C57dwENgNWoREGO1GxSF4hs=";
-    })
-
-    # Intel Tools. Allows tracing various commands. Part of 1.30, backported to
-    # openSUSE, Fedora and ChromeOS.
-    # https://src.fedoraproject.org/rpms/libmbim/blob/rawhide/f/libmbim.spec
-    (fetchpatch {
-      url = "https://cgit.freedesktop.org/libmbim/libmbim/patch/?id=8a6dec6ed11931601e605c9537da9904b3be5bc0";
-      hash = "sha256-tU4zkUl5aZJE+g/qbnWprUHe/PmZvqVKB9qecSaUBhk=";
-    })
-  ];
-
   mesonFlags = [
     "-Dudevdir=${placeholder "out"}/lib/udev"
     (lib.mesonBool "introspection" withIntrospection)

From f9f1dc58bd729fa61ebf842ee88e32562d51989c Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <max@ine.dev>
Date: Tue, 5 Dec 2023 23:13:34 +0100
Subject: [PATCH 045/175] libqmi: 1.32.4 -> 1.34.0

---
 pkgs/development/libraries/libqmi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 6f7583d563b1..58fadd30ee8d 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.32.4";
+  version = "1.34.0";
 
   outputs = [ "out" "dev" ]
     ++ lib.optional withIntrospection "devdoc";
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libqmi";
     rev = version;
-    hash = "sha256-cczGvoD+2+G6uiAt0Iv1BO4/FqzO9bkqhFsEwOfp7qw=";
+    hash = "sha256-l9ev9ZOWicVNZ/Wj//KNd3NHcefIrLVriqJhEpwWvtQ=";
   };
 
   nativeBuildInputs = [

From cdca96d5069ba474a9b55d1b5c2d6d32b3fda661 Mon Sep 17 00:00:00 2001
From: Maxine Aubrey <max@ine.dev>
Date: Tue, 5 Dec 2023 23:13:44 +0100
Subject: [PATCH 046/175] modemmanager: 1.20.6 -> 1.22.0

---
 pkgs/tools/networking/modemmanager/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index d66c277f1dac..dd36f4b7465a 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.20.6";
+  version = "1.22.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mobile-broadband";
     repo = "ModemManager";
     rev = version;
-    hash = "sha256-/A4WTsUQVeZDi5ei6qBvqoWYLKdRcZaYZU8/qWOPrvM=";
+    hash = "sha256-/D9b2rCCUhpDCUfSNAWR65+3EyUywzFdH1R17eSKRDo=";
   };
 
   patches = [

From b5eb6663413b8ef5914db6f8ef0060f0e63e367b Mon Sep 17 00:00:00 2001
From: Bryan Lai <bryanlais@gmail.com>
Date: Thu, 4 Jan 2024 12:43:00 +0800
Subject: [PATCH 047/175] folly: split outputs to reduce closure sizes

This shaves off a 100MiB+ `boost.dev` dependence from `folly.out`, which
would benefit all downstream packages that dynamically link to folly.

Upstream's cmake configuration is not suitable for split packages, and
some tweaks are applied for it to work; these are taken from:

- https://github.com/NixOS/nixpkgs/commit/04384d56cf6d88bf6fd5fd74b0a39b312b104d42
- https://github.com/NixOS/nixpkgs/commit/8d712ccc161b11323e92e87e7057e461462d50e0

See: https://github.com/jtojnar/cmake-snips
---
 pkgs/development/libraries/folly/default.nix | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/folly/default.nix b/pkgs/development/libraries/folly/default.nix
index 4d98c163c6d3..22d395785434 100644
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@@ -4,7 +4,6 @@
 , boost
 , cmake
 , double-conversion
-, fetchpatch
 , fmt_8
 , gflags
 , glog
@@ -64,12 +63,21 @@ stdenv.mkDerivation rec {
     # temporary hack until folly builds work on aarch64,
     # see https://github.com/facebook/folly/issues/1880
     "-DCMAKE_LIBRARY_ARCHITECTURE=${if stdenv.isx86_64 then "x86_64" else "dummy"}"
+
+    # ensure correct dirs in $dev/lib/pkgconfig/libfolly.pc
+    # see https://github.com/NixOS/nixpkgs/issues/144170
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
+  # split outputs to reduce downstream closure sizes
+  outputs = [ "out" "dev" ];
+
+  # patch prefix issues again
+  # see https://github.com/NixOS/nixpkgs/issues/144170
   postFixup = ''
-    substituteInPlace "$out"/lib/pkgconfig/libfolly.pc \
-      --replace '=''${prefix}//' '=/' \
-      --replace '=''${exec_prefix}//' '=/'
+    substituteInPlace $dev/lib/cmake/${pname}/${pname}-targets-release.cmake  \
+      --replace '$'{_IMPORT_PREFIX}/lib/ $out/lib/
   '';
 
   # folly-config.cmake, will `find_package` these, thus there should be

From 503f06151fb868a78bbd6303720813cf260ec4e8 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 28 Dec 2023 21:30:54 +0100
Subject: [PATCH 048/175] meson: 1.3.0 -> 1.3.1

---
 .../meson/007-darwin-case-sensitivity.patch   | 27 -------------------
 pkgs/by-name/me/meson/package.nix             |  7 ++---
 2 files changed, 2 insertions(+), 32 deletions(-)
 delete mode 100644 pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch

diff --git a/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch b/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
deleted file mode 100644
index aea0348f4b63..000000000000
--- a/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From a908a574daf8bac10bb2a0ee3771052d2167a85f Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Sun, 3 Dec 2023 15:41:20 -0500
-Subject: [PATCH] Fix test failure on Darwin on a case-sensitive fs
-
-This was encountered while looking into an issue with
-https://github.com/NixOS/nixpkgs/pull/268583.
-
-I run my Nix store on case-sensitive APFS, so the test fails due to
-trying to link `-framework ldap` instead of `-framework LDAP`.
----
- test cases/osx/5 extra frameworks/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/test cases/osx/5 extra frameworks/meson.build b/test cases/osx/5 extra frameworks/meson.build
-index f6c01e63a1bd..96532846c632 100644
---- a/test cases/osx/5 extra frameworks/meson.build	
-+++ b/test cases/osx/5 extra frameworks/meson.build	
-@@ -7,7 +7,7 @@ dep_main = dependency('Foundation')
- assert(dep_main.type_name() == 'extraframeworks', 'type_name is ' + dep_main.type_name())
- 
- # https://github.com/mesonbuild/meson/issues/10002
--ldap_dep = dependency('ldap', method : 'extraframework')
-+ldap_dep = dependency('LDAP', method : 'extraframework')
- assert(ldap_dep.type_name() == 'extraframeworks', 'type_name is ' + ldap_dep.type_name())
- 
- stlib = static_library('stat', 'stat.c', install : true, dependencies: [opengl_dep, ldap_dep])
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 86ac76ffafbb..9064b9eaf793 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -18,13 +18,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-Jt3PWnbv/8P6Rvf3E/Yli2vdtfgx3CmsW+jlc9CK5KA=";
+    hash = "sha256-KNNtHi3jx0MRiOgmluA4ucZJWB2WeIYdApfHuspbCqg=";
   };
 
   patches = [
@@ -65,9 +65,6 @@ python3.pkgs.buildPythonApplication rec {
 
     # Nixpkgs cctools does not have bitcode support.
     ./006-disable-bitcode.patch
-
-    # https://github.com/mesonbuild/meson/pull/12587
-    ./007-darwin-case-sensitivity.patch
   ];
 
   buildInputs = lib.optionals (python3.pythonOlder "3.9") [

From 4b1990d18f8b6689243c039300f5f908589714df Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 6 Jan 2024 00:45:50 +0000
Subject: [PATCH 049/175] vim: 9.0.2116 -> 9.1.0004

---
 pkgs/applications/editors/vim/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index b392cc0aa565..d041601445f2 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.2116";
+  version = "9.1.0004";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-ZKcNg/RrjvEsxpIcTjzQYi1xig3zLeTV+PXaBb4gUuM=";
+    hash = "sha256-Y5ZSJLEFdptEMA0xvstr6H1G4iiaYXpkJGSSFwoTfc0=";
   };
 
   enableParallelBuilding = true;

From 188392f19e0c72924c16f3d3a8481329cf0ff099 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 6 Jan 2024 07:55:13 +0000
Subject: [PATCH 050/175] hwdata: 0.377-2 -> 0.378

Changes: https://github.com/vcrhonek/hwdata/compare/v0.377-2...v0.378
---
 pkgs/os-specific/linux/hwdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 83dd82e6ab26..a705a9fb5d38 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.377-2";
+  version = "0.378";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-Nh+EIsJ/98NnflndQeSgiV2iOC0icTEfgwAySPbG6Lo=";
+    hash = "sha256-YCx0b4crg8A7mGXwqk1XQZKsm/3TUE8C2bOYKnb/FSA=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];

From b4ac0c8d9863b80b5fa7086c7be30a975e0ff4fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=A9clairevoyant?=
 <848000+eclairevoyant@users.noreply.github.com>
Date: Sat, 6 Jan 2024 08:17:04 -0500
Subject: [PATCH 051/175] openexr: 2.5.8 -> 2.5.10 (#278994)

With updated gcc-13 patch to fix pkgsMusl.openexr_2
---
 .../development/libraries/openexr/default.nix |  7 ++-
 .../libraries/openexr/gcc-13.patch            | 48 ++++++++-----------
 2 files changed, 23 insertions(+), 32 deletions(-)

diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index 1a135fa6d4a8..6d45ca33e982 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "2.5.8";
+  version = "2.5.10";
 
   outputs = [ "bin" "dev" "out" "doc" ];
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "sha256-N7XdDaDsYdx4TXvHplQDTvhHNUmW5rntdaTKua4C0es=";
+    hash = "sha256-xdC+T79ZQBx/XhuIXtP93Roj0N9lF+E65ReEKQ4kIsg=";
   };
 
   patches = [
@@ -36,8 +36,7 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-DrpldpNgN5pWKzIuuPIrynGX3EpP8YhJlu+lLfNFGxQ=";
     })
 
-    # Backport gcc-13 fix:
-    #   https://github.com/AcademySoftwareFoundation/openexr/pull/1264
+    # GCC 13 fixes
     ./gcc-13.patch
   ];
 
diff --git a/pkgs/development/libraries/openexr/gcc-13.patch b/pkgs/development/libraries/openexr/gcc-13.patch
index d508b6028f76..6264a8df2433 100644
--- a/pkgs/development/libraries/openexr/gcc-13.patch
+++ b/pkgs/development/libraries/openexr/gcc-13.patch
@@ -1,33 +1,25 @@
-https://github.com/AcademySoftwareFoundation/openexr/pull/1264
-https://github.com/AcademySoftwareFoundation/openexr/commit/d0088a3c6943a9a53fc24e29885414d082d531fe.patch
+From 8aa103fe6e815514990e59708468eabc36f7f332 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=A9clairevoyant?=
+ <848000+eclairevoyant@users.noreply.github.com>
+Date: Fri, 5 Jan 2024 18:12:16 -0500
+Subject: [PATCH] gcc13
 
---- a/OpenEXR/IlmImf/ImfDwaCompressor.cpp
-+++ b/OpenEXR/IlmImf/ImfDwaCompressor.cpp
-@@ -159,6 +159,7 @@
- #include <limits>
- 
- #include <cstddef>
-+#include <cstdint>
- 
- 
- // Windows specific addition to prevent the indirect import of the redefined min/max macros
---- a/OpenEXR/IlmImf/ImfHuf.cpp
-+++ b/OpenEXR/IlmImf/ImfHuf.cpp
-@@ -53,6 +53,7 @@
- #include <cstring>
- #include <cassert>
- #include <algorithm>
-+#include <cstdint>
- 
- 
- using namespace std;
---- a/OpenEXR/IlmImf/ImfMisc.cpp
-+++ b/OpenEXR/IlmImf/ImfMisc.cpp
-@@ -52,6 +52,7 @@
- #include <ImfConvert.h>
- #include <ImfPartType.h>
+---
+ OpenEXR/IlmImf/ImfTiledMisc.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/OpenEXR/IlmImf/ImfTiledMisc.cpp b/OpenEXR/IlmImf/ImfTiledMisc.cpp
+index 06ea3144..749537d4 100644
+--- a/OpenEXR/IlmImf/ImfTiledMisc.cpp
++++ b/OpenEXR/IlmImf/ImfTiledMisc.cpp
+@@ -46,6 +46,7 @@
  #include <ImfTileDescription.h>
+ #include <algorithm>
+ #include <limits>
 +#include <cstdint>
+ 
  #include "ImfNamespace.h"
  
- OPENEXR_IMF_INTERNAL_NAMESPACE_SOURCE_ENTER
+-- 
+2.42.0
+

From 8ad3e398b7270d7f36814bff1b72fdefca171fc8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 6 Jan 2024 07:48:33 +0000
Subject: [PATCH 052/175] pixman: 0.42.2 -> 0.43.0

While at it:
- added a trivial updater
- migrated to `meson` build system as `autotoocs`-based is dropped
  upstream

Changes: https://lists.freedesktop.org/archives/pixman/2024-January/005008.html
---
 pkgs/development/libraries/pixman/default.nix | 32 ++++++++++++++-----
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index 76ec2244c833..286ea90fa91f 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchurl
+, meson
+, ninja
 , pkg-config
 , libpng
 , glib /*just passthru*/
@@ -12,29 +14,37 @@
 , tigervnc
 , wlroots
 , xwayland
+
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "pixman";
-  version = "0.42.2";
+  version = "0.43.0";
 
   src = fetchurl {
     urls = [
       "mirror://xorg/individual/lib/${pname}-${version}.tar.gz"
       "https://cairographics.org/releases/${pname}-${version}.tar.gz"
     ];
-    hash = "sha256-6hSA762i/ZSLx1Nm98NJ4cltMpfQmj/mJibjjiNKYl4=";
+    hash = "sha256-plwoIJhY+xa+5Q2AnID5Co5BXA5P2DIQeKGCJ4WlVgo=";
   };
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [ libpng ];
 
-  configureFlags = lib.optional stdenv.isAarch32 "--disable-arm-iwmmxt"
-    # Disable until https://gitlab.freedesktop.org/pixman/pixman/-/issues/46 is resolved
-    ++ lib.optional (stdenv.isAarch64 && !stdenv.cc.isGNU) "--disable-arm-a64-neon";
+  # Default "enabled" value attempts to enable CPU features on all
+  # architectures and requires used to disable them:
+  #   https://gitlab.freedesktop.org/pixman/pixman/-/issues/88
+  mesonAutoFeatures = "auto";
+  mesonFlags = [
+    "-Diwmmxt=disabled"
+  ]
+  # Disable until https://gitlab.freedesktop.org/pixman/pixman/-/issues/46 is resolved
+  ++ lib.optional (stdenv.isAarch64 && !stdenv.cc.isGNU) "-Da64-neon=disabled";
 
   preConfigure = ''
     # https://gitlab.freedesktop.org/pixman/pixman/-/issues/62
@@ -45,8 +55,14 @@ stdenv.mkDerivation rec {
 
   postInstall = glib.flattenInclude;
 
-  passthru.tests = {
-    inherit cairo qemu scribus tigervnc wlroots xwayland;
+  passthru = {
+    tests = {
+      inherit cairo qemu scribus tigervnc wlroots xwayland;
+    };
+    updateScript = gitUpdater {
+      url = "https://gitlab.freedesktop.org/pixman/pixman.git";
+      rev-prefix = "pixman-";
+    };
   };
 
   meta = with lib; {

From 06289384cf531ca2936879574746d7dcff0ace82 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 6 Jan 2024 23:04:47 +0100
Subject: [PATCH 053/175] python311Packages.pycurl: disable failing test

We already disabled another test due to this issue, so I'm confident
this is the correct way forward.
---
 pkgs/development/python-modules/pycurl/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index fb4aacf3b83d..504b6f462791 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -69,6 +69,7 @@ buildPythonPackage rec {
     # https://github.com/pycurl/pycurl/issues/819
     "test_multi_socket_select"
     # https://github.com/pycurl/pycurl/issues/729
+    "test_easy_pause_unpause"
     "test_multi_socket_action"
     # https://github.com/pycurl/pycurl/issues/822
     "test_request_with_verifypeer"

From 699fa56eb0401fb5db69299685494794bb26ebfd Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sat, 6 Jan 2024 23:08:46 +0000
Subject: [PATCH 054/175] python3Packages.pycryptodome: 3.19.0 -> 3.19.1

---
 pkgs/development/python-modules/pycryptodome/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 4b37a0765f0e..444d673100bb 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -10,14 +10,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.19.0";
+  version = "3.19.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Legrandin";
     repo = "pycryptodome";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WD+OEjePVtqlmn7h1CIfraLuEQlodkvjmYQ8q7nNoGU=";
+    hash = "sha256-+m0gF47l3c9gZ9dLdOUNW0I2W1O+OGrmsdysu7QdjvI=";
   };
 
   postPatch = ''

From 9cb36140078d3f461bcc8267d10f8a4a3d9d85b8 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sun, 7 Jan 2024 12:00:00 +0000
Subject: [PATCH 055/175] gcc: prevent runtime references via __FILE__ but in a
 reversible manner

the mangling done by mangle-NIX_STORE-in-__FILE__.patch also applies to
source paths embedded in debug symbols. When putting a breakpoint in a
template instanciation from another lib, the path that gdb looks for is
therefore mangled (/nix/store/eeeeeee;...-the-lib-dev/include/foo.h)
This severely degrades the debugging experience. To alleviate that, it's
possible to make the mangling reversible: a debuginfod server can then
reverse the mangling. I plan to implement that in nixseparatedebuginfod.
The reversible mangling that was chosen in making the hash of the store
path uppercase.
---
 .../12/mangle-NIX_STORE-in-__FILE__.patch     | 28 +++++++++++++-----
 .../13/mangle-NIX_STORE-in-__FILE__.patch     | 29 +++++++++++++------
 2 files changed, 40 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
index 4e6c392ce76e..51078925eeb8 100644
--- a/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
+++ b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
@@ -12,9 +12,20 @@ inputs to be retained in runtime closure.
 Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
 `lttng-ust.dev`.
 
+For this reason we want to remove the occurrences of hashes in the
+expansion of `__FILE__`. `nuke-references` does it by replacing hashes
+by `eeeeee...` but those paths are also used for debug symbols. It is
+handy to be able to invert the transformation to go back to the original
+store path for debuginfod servers. The chosen solution is to make the
+hash uppercase:
+- it does not trigger runtime references (except for all digit hashes,
+  which are unlikely enough)
+- it visually looks like a bogus store path
+- it is easy to find the original store path if required
+
 Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
 
-  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/$HASH1-nlohmann-json-ver
   -fmacro-prefix-map=/nix/...
 
 In practice it quickly exhausts argument length limit due to `gcc`
@@ -25,9 +36,9 @@ is present in the environment.
 
 Tested as:
 
-    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    $ printf "# 0 \"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
     ...
-    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    .string "/nix/store/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-pppppp-vvvvvvv"
     ...
 
 Mangled successfully.
@@ -43,7 +54,7 @@ Mangled successfully.
  /* Perform user-specified mapping of filename prefixes.  Return the
     GC-allocated new name corresponding to FILENAME or FILENAME if no
     remapping was performed.  */
-@@ -76,7 +79,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -76,7 +79,31 @@ remap_filename (file_prefix_map *maps, const char *filename)
      if (filename_ncmp (filename, map->old_prefix, map->old_len) == 0)
        break;
    if (!map)
@@ -51,8 +62,7 @@ Mangled successfully.
 +    {
 +      if (maps == macro_prefix_maps)
 +	{
-+	  /* Remap all fo $NIX_STORE/.{32} paths to
-+	  * equivalent $NIX_STORE/e{32}.
++	  /* Remap the 32 characters after $NIX_STORE/ to uppercase
 +	  *
 +	  * That way we avoid argument parameters explosion
 +	  * and still avoid embedding headers into runtime closure:
@@ -66,7 +76,9 @@ Mangled successfully.
 +	    {
 +	       s = (char *) ggc_alloc_atomic (name_len + 1);
 +	       memcpy(s, name, name_len + 1);
-+	       memset(s + nix_store_len + 1, 'e', 32);
++	       for (int i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
++		 s[i] = TOUPPER(s[i]);
++	       }
 +	       return s;
 +	    }
 +	}
@@ -75,7 +87,7 @@ Mangled successfully.
    name = filename + map->old_len;
    name_len = strlen (name) + 1;
  
-@@ -90,7 +116,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -90,7 +117,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
     ignore it in DW_AT_producer (dwarf2out.cc).  */
  
  /* Linked lists of file_prefix_map structures.  */
diff --git a/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
index ea0673219eb1..351d6d0f764b 100644
--- a/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
+++ b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
@@ -12,9 +12,20 @@ inputs to be retained in runtime closure.
 Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
 `lttng-ust.dev`.
 
+For this reason we want to remove the occurrences of hashes in the
+expansion of `__FILE__`. `nuke-references` does it by replacing hashes
+by `eeeeee...` but those paths are also used for debug symbols. It is
+handy to be able to invert the transformation to go back to the original
+store path for debuginfod servers. The chosen solution is to make the
+hash uppercase:
+- it does not trigger runtime references (except for all digit hashes,
+  which are unlikely enough)
+- it visually looks like a bogus store path
+- it is easy to find the original store path if required
+
 Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
 
-  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/$HASH1-nlohmann-json-ver
   -fmacro-prefix-map=/nix/...
 
 In practice it quickly exhausts argument length limit due to `gcc`
@@ -25,9 +36,9 @@ is present in the environment.
 
 Tested as:
 
-    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    $ printf "# 0 \"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
     ...
-    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    .string "/nix/store/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-pppppp-vvvvvvv"
     ...
 
 Mangled successfully.
@@ -43,14 +54,13 @@ Mangled successfully.
  /* Perform user-specified mapping of filename prefixes.  Return the
     GC-allocated new name corresponding to FILENAME or FILENAME if no
     remapping was performed.  */
-@@ -102,6 +105,29 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -102,6 +105,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
        break;
    if (!map)
      {
 +      if (maps == macro_prefix_maps)
 +	{
-+	  /* Remap all fo $NIX_STORE/.{32} paths to
-+	   * equivalent $NIX_STORE/e{32}.
++	  /* Remap all fo $NIX_STORE/.{32} paths to uppercase
 +	   *
 +	   * That way we avoid argument parameters explosion
 +	   * and still avoid embedding headers into runtime closure:
@@ -64,7 +74,9 @@ Mangled successfully.
 +	     {
 +		s = (char *) ggc_alloc_atomic (name_len + 1);
 +		memcpy(s, name, name_len + 1);
-+		memset(s + nix_store_len + 1, 'e', 32);
++		for (int i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
++		  s[i] = TOUPPER(s[i]);
++		}
 +		if (realname != filename)
 +		  free (const_cast <char *> (realname));
 +		return s;
@@ -73,7 +85,7 @@ Mangled successfully.
        if (realname != filename)
  	free (const_cast <char *> (realname));
        return filename;
-@@ -124,7 +150,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -124,7 +151,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
     ignore it in DW_AT_producer (gen_command_line_string in opts.cc).  */
  
  /* Linked lists of file_prefix_map structures.  */
@@ -81,4 +93,3 @@ Mangled successfully.
  static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
  static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
  
-

From b0c8d214bb3cb9211e0ee7e26007dcb9cb893d11 Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Sun, 7 Jan 2024 12:36:22 +0100
Subject: [PATCH 056/175] python311Packages.pyrfc3339: rename from pyRFC3339

---
 pkgs/development/python-modules/acme/default.nix      | 4 ++--
 pkgs/development/python-modules/certbot/default.nix   | 4 ++--
 pkgs/development/python-modules/pyrfc3339/default.nix | 5 +++--
 pkgs/top-level/python-aliases.nix                     | 1 +
 pkgs/top-level/python-packages.nix                    | 2 +-
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/acme/default.nix b/pkgs/development/python-modules/acme/default.nix
index 538b8dff964a..65e930e07414 100644
--- a/pkgs/development/python-modules/acme/default.nix
+++ b/pkgs/development/python-modules/acme/default.nix
@@ -3,7 +3,7 @@
 , cryptography
 , pyasn1
 , pyopenssl
-, pyRFC3339
+, pyrfc3339
 , josepy
 , pytz
 , requests
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   format = "setuptools";
 
   propagatedBuildInputs = [
-    cryptography pyasn1 pyopenssl pyRFC3339 pytz requests requests-toolbelt six
+    cryptography pyasn1 pyopenssl pyrfc3339 pytz requests requests-toolbelt six
     werkzeug ndg-httpsclient josepy
   ];
 
diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index 621a0f991856..0689319840e6 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -10,7 +10,7 @@
 , distro
 , josepy
 , parsedatetime
-, pyRFC3339
+, pyrfc3339
 , pyopenssl
 , pytz
 , requests
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     distro
     josepy
     parsedatetime
-    pyRFC3339
+    pyrfc3339
     pyopenssl
     pytz
     requests
diff --git a/pkgs/development/python-modules/pyrfc3339/default.nix b/pkgs/development/python-modules/pyrfc3339/default.nix
index 9345b819f75c..368f3cda24de 100644
--- a/pkgs/development/python-modules/pyrfc3339/default.nix
+++ b/pkgs/development/python-modules/pyrfc3339/default.nix
@@ -14,12 +14,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "pyRFC3339";
+  pname = "pyrfc3339";
   version = "1.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "pyRFC3339";
+    inherit version;
     sha256 = "06jv7ar7lpvvk0dixzwdr3wgm0g1lipxs429s2z7knwwa7hwpf41";
   };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index da8ea5e389b7..dd65048e28f5 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -345,6 +345,7 @@ mapAliases ({
   pyramid_multiauth = pyramid-multiauth; # added 2023-08-24
   pyreadability = readability-lxml; # added 2022-05-24
   pyres = throw "pyres has been removed, since it is abandoned and broken"; # added 2023-06-20
+  pyRFC3339 = pyrfc3339; # added 2024-01-07
   pyroute2-core = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
   pyroute2-ethtool = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
   pyroute2-ipdb = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3474f3b6c829..c440f07570bd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11107,7 +11107,7 @@ self: super: with self; {
 
   pyrituals = callPackage ../development/python-modules/pyrituals { };
 
-  pyRFC3339 = callPackage ../development/python-modules/pyrfc3339 { };
+  pyrfc3339 = callPackage ../development/python-modules/pyrfc3339 { };
 
   pyrmvtransport = callPackage ../development/python-modules/pyrmvtransport { };
 

From bfb2d0dfae7559542b99615e261b01eb6f85fa96 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Tue, 2 Jan 2024 12:56:02 +0100
Subject: [PATCH 057/175] inetutils: 2.4 -> 2.5

Changes:
```
* Noteworthy changes in release 2.4 (2022-10-25) [stable]

** ifconfig

*** Support specifying prefix netmask lengths in -A.
Patch by Samuel Thibault <samuel.thibault@gnu.org>.

** Hurd: tell pfinet translator interfaces to configure
Patch by Samuel Thibault <samuel.thibault@gnu.org>.

** ftp

*** Avoid crash caused by signed integer overflow resulting in
out-of-bounds buffer access.  Reported by AiDai in
<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00003.html>.

*** Avoid crash caused by heap buffer overflow.  Reported by ZFeiXQ in
<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00016.html>.

*** Avoid crash caused by NULL pointer dereference.  Reported by AiDai in
<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00004.html>.

*** Avoid crash caused by infinite macro recursion.  Reported by AiDai in
<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00005.html>.

** telnetd

*** Avoid crash on 0xff 0xf7 (IAC EC) or 0xff 0xf8 (IAC EL).  CVE-2022-39028
https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html

** telnet

*** Fix a buffer overflow problem.  CVE-2019-0053
https://cgit.freebsd.org/src/commit/?id=14aab889f4e50072a6b914eb95ebbfa939539dad

** tftp

*** Avoid crashing when given unexpected or invalid commands from tty.
Reported by AiDai in
<https://lists.gnu.org/archive/html/bug-inetutils/2021-12/msg00018.html>.

** Various bugs fixes, internal improvements and clean ups.
Update of gnulib and build fixes for C23.

```
---
 pkgs/tools/networking/inetutils/default.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/tools/networking/inetutils/default.nix b/pkgs/tools/networking/inetutils/default.nix
index 9b1723a4d122..53901be2f592 100644
--- a/pkgs/tools/networking/inetutils/default.nix
+++ b/pkgs/tools/networking/inetutils/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , ncurses
 , perl
 , help2man
@@ -11,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "inetutils";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-F4nWsbGlff4qere1M+6fXf2cv1tZuxuzwmEu0I0PaLI=";
+    hash = "sha256-h2l9YKMeELXLhqnwZR4ex77pgyDQSMBzlDGqw9V2T7Y=";
   };
 
   outputs = ["out" "apparmor"];
@@ -23,11 +22,6 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
     ./inetutils-1_9-PATH_PROCNET_DEV.patch
-    (fetchpatch {
-      name = "CVE-2023-40303.patch";
-      url = "https://git.savannah.gnu.org/cgit/inetutils.git/patch/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6";
-      hash = "sha256-I5skN537owfpFpAZr4vDKPHuERI6+oq5/hFW2RQeUxI=";
-    })
   ];
 
   strictDeps = true;

From 3f4ed1565b0fead4feaee6795aa60e78847cd1ed Mon Sep 17 00:00:00 2001
From: Russell O'Connor <roconnor@blockstream.io>
Date: Mon, 8 Jan 2024 10:45:57 -0500
Subject: [PATCH 058/175] gperftools: Add runtime perl dependency

pprof requires perl at run time.  Adding perl as a runtime dependencies lets the autoPatchSheBangs to patch up the programs in /bin.
---
 pkgs/development/libraries/gperftools/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gperftools/default.nix b/pkgs/development/libraries/gperftools/default.nix
index da40c66e9fe5..132ae64577a7 100644
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@@ -4,6 +4,7 @@
 , fetchpatch
 , autoreconfHook
 , libunwind
+, perl
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +30,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   # tcmalloc uses libunwind in a way that works correctly only on non-ARM dynamically linked linux
-  buildInputs = lib.optional (stdenv.isLinux && !(stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isStatic )) libunwind;
+  buildInputs = [ perl ]
+             ++ lib.optional (stdenv.isLinux && !(stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isStatic )) libunwind;
 
   # Disable general dynamic TLS on AArch to support dlopen()'ing the library:
   # https://bugzilla.redhat.com/show_bug.cgi?id=1483558

From 751a9553243b4220c74894fe9cd867be5cf07103 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 8 Jan 2024 13:17:58 -0800
Subject: [PATCH 059/175] imagemagick: 7.1.1-25 -> 7.1.1-26

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.1-25...7.1.1-26

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 8ac049648889..b2d5dacb20fc 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -49,13 +49,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-25";
+  version = "7.1.1-26";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-HKDeeh8DNj0y7wS4DqctXhmNaOqZ02JeBXRFrEpH0M4=";
+    hash = "sha256-diJhCRDT0SbAYZdBPoxZJWlrUW2Nz4/d7H0Nnybw0Yw=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

From 18436b6546500412fa03ec2e5aa3fecdcf7fa3a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 Dec 2023 10:48:15 -0800
Subject: [PATCH 060/175] python311Packages.pikepdf: 8.9.0 -> 8.11.2

Diff: https://github.com/pikepdf/pikepdf/compare/v8.9.0...v8.11.2

Changelog: https://github.com/pikepdf/pikepdf/blob/v8.11.2/docs/releasenotes/version8.rst
---
 pkgs/development/python-modules/pikepdf/default.nix | 10 ++++------
 pkgs/development/python-modules/pikepdf/paths.patch | 10 +++++-----
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 4ba20f5aef31..788c195d5d61 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -20,12 +20,11 @@
 , qpdf
 , setuptools
 , substituteAll
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.9.0";
+  version = "8.11.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,14 +39,14 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-ia+D0OeB/MQWRniYkBEWZsDCwEApYGgu0++I/HupK6w=";
+    hash = "sha256-mxUXXD7/ERC6mfmLLo+zdsVblIplrlcnzTNQ7YUk3Q4=";
   };
 
   patches = [
     (substituteAll {
       src = ./paths.patch;
-      jbig2dec = "${lib.getBin jbig2dec}/bin/jbig2dec";
-      mudraw = "${lib.getBin mupdf}/bin/mudraw";
+      jbig2dec = lib.getExe' jbig2dec "jbig2dec";
+      mutool = lib.getExe' mupdf "mutool";
     })
   ];
 
@@ -63,7 +62,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     pybind11
     setuptools
-    wheel
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pikepdf/paths.patch b/pkgs/development/python-modules/pikepdf/paths.patch
index c9c61176aa6f..1bd030c186c2 100644
--- a/pkgs/development/python-modules/pikepdf/paths.patch
+++ b/pkgs/development/python-modules/pikepdf/paths.patch
@@ -1,18 +1,18 @@
 diff --git a/src/pikepdf/_methods.py b/src/pikepdf/_methods.py
-index d27c660..6796984 100644
+index da40043f..4f566f01 100644
 --- a/src/pikepdf/_methods.py
 +++ b/src/pikepdf/_methods.py
-@@ -72,7 +72,7 @@ def _mudraw(buffer, fmt) -> bytes:
+@@ -74,7 +74,7 @@ def _mudraw(buffer, fmt) -> bytes:
          tmp_in.flush()
  
          proc = run(
--            ['mudraw', '-F', fmt, '-o', '-', tmp_in.name],
-+            ['@mudraw@', '-F', fmt, '-o', '-', tmp_in.name],
+-            ['mutool', 'draw', '-F', fmt, '-o', '-', tmp_in.name],
++            ['@mutool@', 'draw', '-F', fmt, '-o', '-', tmp_in.name],
              capture_output=True,
              check=True,
          )
 diff --git a/src/pikepdf/jbig2.py b/src/pikepdf/jbig2.py
-index f89b4f9..f187ebd 100644
+index f89b4f90..f187ebdf 100644
 --- a/src/pikepdf/jbig2.py
 +++ b/src/pikepdf/jbig2.py
 @@ -63,7 +63,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):

From cdd62b2f565ecbfc75237052c998421a01fd0fe7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 Dec 2023 10:49:52 -0800
Subject: [PATCH 061/175] python311Packages.ocrmypdf: 15.4.4 -> 16.0.4

Diff: https://github.com/ocrmypdf/OCRmyPDF/compare/v15.4.4...v16.0.4

Changelog: https://github.com/ocrmypdf/OCRmyPDF/blob/v16.0.4/docs/release_notes.rst
---
 pkgs/development/python-modules/ocrmypdf/default.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 1104bcc02f82..9b4e1d0287eb 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -25,15 +25,14 @@
 , tqdm
 , typing-extensions
 , unpaper
-, wheel
 , installShellFiles
 }:
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "15.4.4";
+  version = "16.0.4";
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   pyproject = true;
 
@@ -47,7 +46,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-Ff0OrSJFglVPpSNB0KvDMnatj+P57zWdcVAFaM+Sg0s=";
+    hash = "sha256-1Bg1R8c5VtJsd8NHd+WWdJRA39Jjgv9JUMcijZm942o=";
   };
 
   patches = [
@@ -64,7 +63,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools
     setuptools-scm
-    wheel
     installShellFiles
   ];
 

From ca6da7a5571b77ac6e823f5fb90a87d91ea0610f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 10 Dec 2023 21:14:30 +0100
Subject: [PATCH 062/175] vim: delete commented code

---
 pkgs/applications/editors/vim/default.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index c5b9a607f20d..6430e2275599 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -62,11 +62,4 @@ stdenv.mkDerivation {
   '';
 
   __impureHostDeps = [ "/dev/ptmx" ];
-
-  # To fix the trouble in vim73, that it cannot cross-build with this patch
-  # to bypass a configure script check that cannot be done cross-building.
-  # http://groups.google.com/group/vim_dev/browse_thread/thread/66c02efd1523554b?pli=1
-  # patchPhase = ''
-  #   sed -i -e 's/as_fn_error.*int32.*/:/' src/auto/configure
-  # '';
 }

From 1332fa0d74e3b403d8540640cb185203e5994ec4 Mon Sep 17 00:00:00 2001
From: Harsh Thakur <harshthakur9030@gmail.com>
Date: Wed, 10 Jan 2024 02:29:49 +0530
Subject: [PATCH 063/175] go: 1.21.5 -> 1.21.6 Changelog:
 https://go.dev/doc/devel/release#go1.21

Signed-off-by: Harsh Thakur <harshthakur9030@gmail.com>
---
 pkgs/development/compilers/go/1.21.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index 5dec10e3e477..06391b1740a6 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.21.5";
+  version = "1.21.6";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-KFy730tubmLtWPNw8/bYwwgl1uVsWFPGbTwjvNsJ2xk=";
+    hash = "sha256-Ekkmpi5F942qu67bnAEdl2MxhqM8I4/8HiUyDAIEYkg=";
   };
 
   strictDeps = true;

From e05a981d057a66b0e5885ac496039ebd4d6ca70d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 12 Sep 2023 16:32:10 +0200
Subject: [PATCH 064/175] xxd: reduce closure size by splitting it into it's
 own output

---
 .../manual/release-notes/rl-2405.section.md   |  2 ++
 pkgs/applications/editors/vim/common.nix      | 24 ++++++++++++++-----
 pkgs/applications/editors/vim/default.nix     |  2 +-
 pkgs/applications/editors/vim/full.nix        |  4 ++--
 pkgs/top-level/unixtools.nix                  |  4 ++--
 5 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 766a4ea2d99b..828c6a45b8ca 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -75,6 +75,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `services.resolved.fallbackDns` can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead.
 
+- `xxd` has been moved from `vim` default output to its own output to reduce closure size. The canonical way to reference it across all platforms is `unixtools.xxd`.
+
 - `services.avahi.nssmdns` got split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switch for IPv4 and IPv6 respectively.
   Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.
 
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index b392cc0aa565..5ee964adbc09 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -2,6 +2,8 @@
 rec {
   version = "9.0.2116";
 
+  outputs = [ "out" "xxd" ];
+
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
@@ -14,12 +16,21 @@ rec {
 
   hardeningDisable = [ "fortify" ];
 
-  postPatch =
-    # Use man from $PATH; escape sequences are still problematic.
-    ''
-      substituteInPlace runtime/ftplugin/man.vim \
-        --replace "/usr/bin/man " "man "
-    '';
+  # Use man from $PATH; escape sequences are still problematic.
+  postPatch = ''
+    substituteInPlace runtime/ftplugin/man.vim \
+      --replace "/usr/bin/man " "man "
+  '';
+
+  # man page moving is done in postFixup instead of postInstall otherwise fixupPhase moves it right back where it was
+  postFixup = ''
+    moveToOutput bin/xxd "$xxd"
+    moveToOutput share/man/man1/xxd.1.gz "$xxd"
+    for manFile in $out/share/man/*/man1/xxd.1*; do
+      # moveToOutput does not take full paths or wildcards...
+      moveToOutput "share/man/$(basename "$(dirname "$(dirname "$manFile")")")/man1/xxd.1.gz" "$xxd"
+    done
+  '';
 
   meta = with lib; {
     description = "The most popular clone of the VI editor";
@@ -28,5 +39,6 @@ rec {
     maintainers = with maintainers; [ das_j equirosa ];
     platforms   = platforms.unix;
     mainProgram = "vim";
+    outputsToInstall = [ "out" "xxd" ];
   };
 }
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index 6430e2275599..d04fa241ba73 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -15,7 +15,7 @@ in
 stdenv.mkDerivation {
   pname = "vim";
 
-  inherit (common) version src postPatch hardeningDisable enableParallelBuilding enableParallelInstalling meta;
+  inherit (common) version outputs src postPatch hardeningDisable enableParallelBuilding enableParallelInstalling postFixup meta;
 
   nativeBuildInputs = [ gettext pkg-config ];
   buildInputs = [ ncurses bash gawk ]
diff --git a/pkgs/applications/editors/vim/full.nix b/pkgs/applications/editors/vim/full.nix
index cfb8b84560cb..263f8d2984d0 100644
--- a/pkgs/applications/editors/vim/full.nix
+++ b/pkgs/applications/editors/vim/full.nix
@@ -66,7 +66,7 @@ in stdenv.mkDerivation {
 
   pname = "vim-full";
 
-  inherit (common) version postPatch hardeningDisable enableParallelBuilding meta;
+  inherit (common) version outputs postPatch hardeningDisable enableParallelBuilding meta;
 
   src = builtins.getAttr source {
     default = common.src; # latest release
@@ -181,7 +181,7 @@ in stdenv.mkDerivation {
     ln -sfn '${nixosRuntimepath}' "$out"/share/vim/vimrc
   '';
 
-  postFixup = lib.optionalString wrapPythonDrv ''
+  postFixup = common.postFixup + lib.optionalString wrapPythonDrv ''
     wrapProgram "$out/bin/vim" --prefix PATH : "${python3}/bin" \
       --set NIX_PYTHONPATH "${python3}/${python3.sitePackages}"
   '';
diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index 40faa7642129..bcbbd6799d88 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -174,8 +174,8 @@ let
       darwin = pkgs.darwin.basic_cmds;
     };
     xxd = {
-      linux = pkgs.vim;
-      darwin = pkgs.vim;
+      linux = pkgs.vim.xxd;
+      darwin = pkgs.vim.xxd;
     };
   };
 

From f683663dd2c637593f0799ce4052e5a3ff413aa1 Mon Sep 17 00:00:00 2001
From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Date: Tue, 26 Dec 2023 10:38:17 +0100
Subject: [PATCH 065/175] gocode: remove

---
 pkgs/development/tools/gocode/default.nix | 43 ----------------
 pkgs/development/tools/gocode/deps.nix    | 12 -----
 pkgs/top-level/aliases.nix                | 62 +++++++++++++----------
 pkgs/top-level/all-packages.nix           |  2 -
 4 files changed, 36 insertions(+), 83 deletions(-)
 delete mode 100644 pkgs/development/tools/gocode/default.nix
 delete mode 100644 pkgs/development/tools/gocode/deps.nix

diff --git a/pkgs/development/tools/gocode/default.nix b/pkgs/development/tools/gocode/default.nix
deleted file mode 100644
index 687b69cf2027..000000000000
--- a/pkgs/development/tools/gocode/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
-
-buildGoPackage rec {
-  pname = "gocode-unstable";
-  version = "2020-04-06";
-  rev = "4acdcbdea79de6b3dee1c637eca5cbea0fdbe37c";
-
-  goPackagePath = "github.com/mdempsky/gocode";
-
-  # we must allow references to the original `go` package,
-  # because `gocode` needs to dig into $GOROOT to provide completions for the
-  # standard packages.
-  allowGoReference = true;
-
-  src = fetchFromGitHub {
-    inherit rev;
-
-    owner = "mdempsky";
-    repo = "gocode";
-    sha256 = "0i1hc089gb6a4mcgg56vn5l0q96wrlza2n08l4349s3dc2j559fb";
-  };
-
-  goDeps = ./deps.nix;
-
-  meta = with lib; {
-    description = "An autocompletion daemon for the Go programming language";
-    longDescription = ''
-      Gocode is a helper tool which is intended to be integrated with your
-      source code editor, like vim, neovim and emacs. It provides several
-      advanced capabilities, which currently includes:
-
-        - Context-sensitive autocompletion
-
-      It is called daemon, because it uses client/server architecture for
-      caching purposes. In particular, it makes autocompletions very fast.
-      Typical autocompletion time with warm cache is 30ms, which is barely
-      noticeable.
-    '';
-    homepage = "https://github.com/mdempsky/gocode";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kalbasit ];
-  };
-}
diff --git a/pkgs/development/tools/gocode/deps.nix b/pkgs/development/tools/gocode/deps.nix
deleted file mode 100644
index b2518109171a..000000000000
--- a/pkgs/development/tools/gocode/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "72e4a01eba4315301fd9ce00c8c2f492580ded8a";
-      sha256 = "0a8c7j4w784w441j3j3bh640vy1g6g214641qv485wyi0xj49anf";
-    };
-  }
-]
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 151d691b6d2d..df5192cf85ec 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -24,7 +24,7 @@ let
   # to appear while listing all the packages available.
   removeRecurseForDerivations = alias: with lib;
     if alias.recurseForDerivations or false
-    then removeAttrs alias ["recurseForDerivations"]
+    then removeAttrs alias [ "recurseForDerivations" ]
     else alias;
 
   # Disabling distribution prevents top-level aliases for non-recursed package
@@ -41,10 +41,11 @@ let
     else alias;
 
   mapAliases = aliases:
-    lib.mapAttrs (n: alias:
-      removeDistribute
-        (removeRecurseForDerivations
-          (checkInPkgs n alias)))
+    lib.mapAttrs
+      (n: alias:
+        removeDistribute
+          (removeRecurseForDerivations
+            (checkInPkgs n alias)))
       aliases;
 in
 
@@ -59,7 +60,7 @@ mapAliases ({
   a4term = a4; # Added 2023-10-06
   aether = throw "aether has been removed from nixpkgs; upstream unmaintained, security issues"; # Added 2023-10-03
   airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
-  alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream" ; # Added 2023-07-28
+  alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream"; # Added 2023-07-28
   alsa-project = throw "alsa-project was removed and its sub-attributes were promoted to top-level."; # Added 2023-11-12
   alsaLib = alsa-lib; # Added 2021-06-09
   alsaOss = alsa-oss; # Added 2021-06-10
@@ -101,7 +102,8 @@ mapAliases ({
   bitwig-studio2 = throw "bitwig-studio2 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
   blender-with-packages = args:
     lib.warn "blender-with-packages is deprecated in favor of blender.withPackages, e.g. `blender.withPackages(ps: [ ps.foobar ])`"
-    (blender.withPackages (_: args.packages)).overrideAttrs (lib.optionalAttrs (args ? name) { pname = "blender-" + args.name; }); # Added 2023-10-30
+      (blender.withPackages (_: args.packages)).overrideAttrs
+      (lib.optionalAttrs (args ? name) { pname = "blender-" + args.name; }); # Added 2023-10-30
   bluezFull = throw "'bluezFull' has been renamed to/replaced by 'bluez'"; # Converted to throw 2023-09-10
   bookletimposer = throw "bookletimposer has been removed from nixpkgs; upstream unmaintained and broke with pypdf3"; # Added 2024-01-01
   boost168 = throw "boost168 has been deprecated in favor of the latest version"; # Added 2023-06-08
@@ -185,8 +187,8 @@ mapAliases ({
   clang16Stdenv = lowPrio llvmPackages_16.stdenv;
   clang17Stdenv = lowPrio llvmPackages_17.stdenv;
 
-  clang-tools_7  = throw "clang-tools_7 has been removed from nixpkgs"; # Added 2023-11-19
-  clang_7  = throw "clang_7 has been removed from nixpkgs"; # Added 2023-11-19
+  clang-tools_7 = throw "clang-tools_7 has been removed from nixpkgs"; # Added 2023-11-19
+  clang_7 = throw "clang_7 has been removed from nixpkgs"; # Added 2023-11-19
 
   ### D ###
 
@@ -215,8 +217,8 @@ mapAliases ({
   dotnet-sdk_3 = dotnetCorePackages.sdk_3_1; # Added 2020-01-19
   dotnet-sdk_5 = dotnetCorePackages.sdk_5_0; # Added 2020-09-11
   drgeo = throw "'drgeo' has been removed as it is outdated and unmaintained"; # Added 2023-10-15
-  dtv-scan-tables_linuxtv = dtv-scan-tables;  # Added 2023-03-03
-  dtv-scan-tables_tvheadend = dtv-scan-tables;  # Added 2023-03-03
+  dtv-scan-tables_linuxtv = dtv-scan-tables; # Added 2023-03-03
+  dtv-scan-tables_tvheadend = dtv-scan-tables; # Added 2023-03-03
   dylibbundler = macdylibbundler; # Added 2021-04-24
 
   ### E ###
@@ -333,8 +335,14 @@ mapAliases ({
 
   gnuradio-with-packages = gnuradio3_7.override {
     extraPackages = lib.attrVals [
-      "osmosdr" "ais" "gsm" "nacl" "rds" "limesdr"
-    ] gnuradio3_7Packages;
+      "osmosdr"
+      "ais"
+      "gsm"
+      "nacl"
+      "rds"
+      "limesdr"
+    ]
+      gnuradio3_7Packages;
   }; # Added 2020-10-16
 
   gmock = gtest; # moved from top-level 2021-03-14
@@ -360,6 +368,7 @@ mapAliases ({
   google-chrome-dev = throw "'google-chrome-dev' has been removed due to the lack of maintenance in nixpkgs. Consider using 'google-chrome' instead."; # Added 2023-10-18
   google-gflags = throw "'google-gflags' has been renamed to/replaced by 'gflags'"; # Converted to throw 2023-09-10
   go-thumbnailer = thud; # Added 2023-09-21
+  gocode = throw "'gocode' has been removed as the upstream project was archived. 'gopls' is suggested as replacement"; # Added 2023-12-26
   govendor = throw "'govendor' has been removed as it is no longer maintained upstream, please use Go modules instead"; # Added 2023-12-26
   gometer = throw "gometer has been removed from nixpkgs because goLance stopped offering Linux support"; # Added 2023-02-10
 
@@ -458,7 +467,7 @@ mapAliases ({
   kerberos = libkrb5; # moved from top-level 2021-03-14
   kexectools = kexec-tools; # Added 2021-09-03
   keysmith = libsForQt5.kdeGear.keysmith; # Added 2021-07-14
-  kfctl = throw "kfctl is broken and has been archived by upstream" ; # Added 2023-08-21
+  kfctl = throw "kfctl is broken and has been archived by upstream"; # Added 2023-08-21
   kgx = gnome-console; # Added 2022-02-19
   kibana7 = throw "Kibana 7.x has been removed from nixpkgs as it depends on an end of life Node.js version and received no maintenance in time."; # Added 2023-30-10
   kibana = kibana7;
@@ -505,7 +514,7 @@ mapAliases ({
   librewolf-wayland = librewolf; # Added 2022-11-15
   libseat = seatd; # Added 2021-06-24
   libsigcxx12 = throw "'libsigcxx12' has been removed, please use newer versions"; # Added 2023-10-20
-  libsForQt515 = libsForQt5;  # Added 2022-11-24
+  libsForQt515 = libsForQt5; # Added 2022-11-24
   libtensorflow-bin = libtensorflow; # Added 2022-09-25
   libtorrentRasterbar = libtorrent-rasterbar; # Added 2020-12-20
   libtorrentRasterbar-1_2_x = libtorrent-rasterbar-1_2_x; # Added 2020-12-20
@@ -685,12 +694,13 @@ mapAliases ({
   neochat = libsForQt5.kdeGear.neochat; # added 2022-05-10
   nitrokey-udev-rules = libnitrokey; # Added 2023-03-25
   nix-direnv-flakes = nix-direnv;
-  nix-repl = throw ( # Added 2018-08-26
+  nix-repl = throw (
+    # Added 2018-08-26
     "nix-repl has been removed because it's not maintained anymore, " +
     "use `nix repl` instead. Also see https://github.com/NixOS/nixpkgs/pull/44903"
   );
   nix-review = throw "'nix-review' has been renamed to/replaced by 'nixpkgs-review'"; # Converted to throw 2023-09-10
-  nix-template-rpm = throw "'nix-template-rpm' has been removed as it is broken and unmaintained" ; # Added 2023-11-20
+  nix-template-rpm = throw "'nix-template-rpm' has been removed as it is broken and unmaintained"; # Added 2023-11-20
   nixFlakes = nixVersions.stable; # Added 2021-05-21
   nixStable = nixVersions.stable; # Added 2022-01-24
   nixUnstable = nixVersions.unstable; # Added 2022-01-26
@@ -842,7 +852,7 @@ mapAliases ({
   qlandkartegt = throw "'qlandkartegt' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-04-17
   qscintilla = libsForQt5.qscintilla; # Added 2023-09-20
   qscintilla-qt6 = qt6Packages.qscintilla; # Added 2023-09-20
-  qt515 = qt5;  # Added 2022-11-24
+  qt515 = qt5; # Added 2022-11-24
   qt5ct = libsForQt5.qt5ct; # Added 2021-12-27
   qt6ct = qt6Packages.qt6ct; # Added 2023-03-07
   qtcurve = libsForQt5.qtcurve; # Added 2020-11-07
@@ -930,7 +940,7 @@ mapAliases ({
   sgtpuzzles = throw "'sgtpuzzles' has been renamed to 'sgt-puzzles'"; # Added 2023-10-06
   sgtpuzzles-mobile = throw "'sgtpuzzles-mobile' has been renamed to 'sgt-puzzles-mobile'"; # Added 2023-10-06
   inherit (libsForQt5.mauiPackages) shelf; # added 2022-05-17
-  shhgit = throw "shhgit is broken and is no longer maintained. See https://github.com/eth0izzle/shhgit#-shhgit-is-no-longer-maintained-" ; # Added 2023-08-08
+  shhgit = throw "shhgit is broken and is no longer maintained. See https://github.com/eth0izzle/shhgit#-shhgit-is-no-longer-maintained-"; # Added 2023-08-08
   shipyard = jumppad; # Added 2023-06-06
   signumone-ks = throw "signumone-ks has been removed from nixpkgs because the developers stopped offering the binaries"; # Added 2023-08-17
   simplenote = throw "'simplenote' has been removed because it is no longer maintained and insecure"; # Added 2023-10-09
@@ -1047,7 +1057,7 @@ mapAliases ({
   vamp = { vampSDK = vamp-plugin-sdk; }; # Added 2020-03-26
   vaapiIntel = intel-vaapi-driver; # Added 2023-05-31
   vaultwarden-vault = vaultwarden.webvault; # Added 2022-12-13
-  vdirsyncerStable  = vdirsyncer; # Added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
+  vdirsyncerStable = vdirsyncer; # Added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
   ventoy-bin = ventoy; # Added 2023-04-12
   ventoy-bin-full = ventoy-full; # Added 2023-04-12
   ViennaRNA = viennarna; # Added 2023-08-23
@@ -1144,7 +1154,7 @@ mapAliases ({
   });
 
   /* If these are in the scope of all-packages.nix, they cause collisions
-  between mixed versions of qt. See:
+    between mixed versions of qt. See:
   https://github.com/NixOS/nixpkgs/pull/101369 */
 
   inherit (plasma5Packages)
@@ -1167,9 +1177,9 @@ mapAliases ({
     plasma-vault plasma-workspace plasma-workspace-wallpapers polkit-kde-agent
     powerdevil qqc2-breeze-style sddm-kcm skanlite skanpage spectacle
     systemsettings xdg-desktop-portal-kde yakuake zanshin
-  ;
+    ;
 
-  kalendar = merkuro;  # Renamed in 23.08
+  kalendar = merkuro; # Renamed in 23.08
   kfloppy = throw "kfloppy has been removed upstream in KDE Gear 23.08";
 
   inherit (plasma5Packages.thirdParty)
@@ -1180,11 +1190,11 @@ mapAliases ({
     kwin-tiling
     plasma-applet-caffeine-plus
     plasma-applet-virtual-desktop-bar
-  ;
+    ;
 
   inherit (libsForQt5)
     sddm
-  ;
+    ;
 
   inherit (pidginPackages)
     pidgin-indicator
@@ -1212,6 +1222,6 @@ mapAliases ({
     tdlib-purple
     pidgin-opensteamworks
     purple-facebook
-  ;
+    ;
 
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7000cbd290e3..6e0347228746 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28373,8 +28373,6 @@ with pkgs;
 
   go-outline = callPackage ../development/tools/go-outline { };
 
-  gocode = callPackage ../development/tools/gocode { };
-
   gocode-gomod = callPackage ../development/tools/gocode-gomod { };
 
   goconst = callPackage ../development/tools/goconst { };

From ff4dd0e56292a45b34217b2f9a27d50e1d3ec5e1 Mon Sep 17 00:00:00 2001
From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Date: Sat, 6 Jan 2024 16:25:10 +0100
Subject: [PATCH 066/175] vimPlugins.vim-go: remove gocode from binPath

---
 pkgs/applications/editors/vim/plugins/overrides.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 73fdb754bb39..6e2f6d860fcf 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -97,7 +97,6 @@
 , errcheck
 , go-motion
 , go-tools
-, gocode
 , gocode-gomod
 , godef
 , gogetdoc
@@ -1513,7 +1512,6 @@
         errcheck
         go-motion
         go-tools # contains staticcheck
-        gocode
         gocode-gomod
         godef
         gogetdoc

From ec45311ab3edbca26848311dd8ddab5bf477c1ea Mon Sep 17 00:00:00 2001
From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Date: Sat, 6 Jan 2024 16:32:38 +0100
Subject: [PATCH 067/175] ycmd: remove gocode support

---
 pkgs/development/tools/misc/ycmd/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/tools/misc/ycmd/default.nix b/pkgs/development/tools/misc/ycmd/default.nix
index aeca3c437ff4..ae741234a8e2 100644
--- a/pkgs/development/tools/misc/ycmd/default.nix
+++ b/pkgs/development/tools/misc/ycmd/default.nix
@@ -1,5 +1,4 @@
 { stdenv, lib, fetchFromGitHub, cmake, ninja, python
-, withGocode ? true, gocode
 , withGodef ? true, godef
 , withGotools? true, gotools
 , withTypescript ? true, typescript
@@ -63,10 +62,6 @@ stdenv.mkDerivation {
     mkdir -p $out/lib/ycmd/third_party
     cp -r third_party/* $out/lib/ycmd/third_party/
 
-  '' + lib.optionalString withGocode ''
-    TARGET=$out/lib/ycmd/third_party/gocode
-    mkdir -p $TARGET
-    ln -sf ${gocode}/bin/gocode $TARGET
   '' + lib.optionalString withGodef ''
     TARGET=$out/lib/ycmd/third_party/godef
     mkdir -p $TARGET

From adaab58ad0dcbdc1a31834c3255d7a692bdd9b54 Mon Sep 17 00:00:00 2001
From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Date: Sat, 6 Jan 2024 17:01:11 +0100
Subject: [PATCH 068/175] vimPlugins.vim-go: add revive, cleanup todos

---
 pkgs/applications/editors/vim/plugins/overrides.nix | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 6e2f6d860fcf..455b61e95b34 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -109,6 +109,7 @@
 , iferr
 , impl
 , reftools
+, revive
 , # hurl dependencies
   hurl
 , # must be lua51Packages
@@ -1506,12 +1507,11 @@
   vim-go =
     let
       binPath = lib.makeBinPath [
-        # TODO: package commented packages
         asmfmt
         delve
         errcheck
         go-motion
-        go-tools # contains staticcheck
+        go-tools # contains staticcheck, keyify
         gocode-gomod
         godef
         gogetdoc
@@ -1519,15 +1519,12 @@
         golangci-lint
         gomodifytags
         gopls
-        # gorename
         gotags
-        gotools
-        # guru
+        gotools # contains guru, gorename
         iferr
         impl
-        # keyify
         reftools
-        # revive
+        revive
       ];
     in
     super.vim-go.overrideAttrs {

From 803ba5276526950f47a520323dd958aebf2b9d8a Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Sun, 3 Sep 2023 21:53:42 +0800
Subject: [PATCH 069/175] libunwind: 1.6.2 -> 1.7.2

The original upstream no longer publishs new tarballs, switch to GitHub.

Remove upstreamed patch.

Add new platforms supported by latest libunwind.
---
 .../libraries/libunwind/default.nix           | 22 +++++++------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 6f05307381a0..7330e42ff323 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -1,22 +1,16 @@
-{ stdenv, lib, fetchurl, fetchpatch, autoreconfHook, xz, buildPackages }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, xz, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
-  version = "1.6.2";
+  version = "1.7.2";
 
-  src = fetchurl {
-    url = "mirror://savannah/libunwind/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SmrsZmmR+0XQiJxErt6K1usQgHHDVU/N/2cfnJR5SXY=";
+  src = fetchFromGitHub {
+    owner = "libunwind";
+    repo = "libunwind";
+    rev = "v${version}";
+    hash = "sha256-z5YCue0zadQnMEbGFniFvDjXNy6dSHQDQnXRXS6Uh/Y=";
   };
 
-  patches = [
-    # Fix for aarch64 and non-4K pages. Remove once upgraded past 1.6.2.
-    (fetchpatch {
-      url = "https://github.com/libunwind/libunwind/commit/e85b65cec757ef589f28957d0c6c21c498a03bdf.patch";
-      sha256 = "1lnlygvhqrdrjgw303pg2k2k4ms4gaghpjsgmhk47q83vy1yjwfg";
-    })
-  ];
-
   postPatch = if (stdenv.cc.isClang || stdenv.hostPlatform.isStatic) then ''
     substituteInPlace configure.ac --replace "-lgcc_s" ""
   '' else lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -46,7 +40,7 @@ stdenv.mkDerivation rec {
     description = "A portable and efficient API to determine the call-chain of a program";
     maintainers = with maintainers; [ orivej ];
     # https://github.com/libunwind/libunwind#libunwind
-    platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd13" "i686-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "x86_64-freebsd13" "x86_64-linux" "x86_64-solaris" ];
+    platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd13" "i686-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "loongarch64-linux" "x86_64-freebsd13" "x86_64-linux" "x86_64-solaris" ];
     license = licenses.mit;
   };
 }

From 221464d5df7e0f5af986f4b873aed9fa2e886b10 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 11 Jan 2024 00:28:28 +0100
Subject: [PATCH 070/175] python311Packages.jinja2: 3.1.2 -> 3.1.3

https://github.com/pallets/jinja/releases/tag/3.1.3
https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95
---
 pkgs/development/python-modules/jinja2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index 1b154f90d386..836583136daa 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "Jinja2";
-  version = "3.1.2";
+  version = "3.1.3";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MTUacCpAip51laj8YVD8P0O7a/fjGXcMvA2535Q36FI=";
+    hash = "sha256-rIvWVE1Lssl5K/OhWegLuo/afwfoG8Ou1WVDLVklupA=";
   };
 
   propagatedBuildInputs = [

From 0c56aff1f27dd769f38866ebdcb7b7e0ee002eb3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 11 Jan 2024 00:43:54 +0100
Subject: [PATCH 071/175] python311Packages.jinja2: refactor

- Use pep517 builder
- Expose babel as i18n extra
- Update meta
---
 .../python-modules/jinja2/default.nix         | 78 ++++++++++---------
 1 file changed, 41 insertions(+), 37 deletions(-)

diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index 836583136daa..1c260e37c7b0 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -9,79 +9,83 @@
 , pytestCheckHook
 , sphinxHook
 , pallets-sphinx-themes
+, setuptools
 , sphinxcontrib-log-cabinet
 , sphinx-issues
 }:
 
 buildPythonPackage rec {
-  pname = "Jinja2";
+  pname = "jinja2";
   version = "3.1.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Jinja2";
+    inherit version;
     hash = "sha256-rIvWVE1Lssl5K/OhWegLuo/afwfoG8Ou1WVDLVklupA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    babel
     markupsafe
   ];
 
+  passthru.optional-dependencies = {
+    i18n = [
+      babel
+    ];
+  };
+
   # Multiple tests run out of stack space on 32bit systems with python2.
   # See https://github.com/pallets/jinja/issues/1158
   doCheck = !stdenv.is32bit;
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
+  ] ++ passthru.optional-dependencies.i18n;
 
-  pytestFlagsArray = [
-    # Avoid failure due to deprecation warning
-    # Fixed in https://github.com/python/cpython/pull/28153
-    # Remove after cpython 3.9.8
-    "-p no:warnings"
-  ];
+  passthru.doc = stdenv.mkDerivation {
+    # Forge look and feel of multi-output derivation as best as we can.
+    #
+    # Using 'outputs = [ "doc" ];' breaks a lot of assumptions.
+    name = "${pname}-${version}-doc";
+    inherit src pname version;
 
-  passthru = {
-    doc = stdenv.mkDerivation {
-      # Forge look and feel of multi-output derivation as best as we can.
-      #
-      # Using 'outputs = [ "doc" ];' breaks a lot of assumptions.
-      name = "${pname}-${version}-doc";
-      inherit src pname version;
+    patches = [
+      # Fix import of "sphinxcontrib-log-cabinet"
+      ./patches/import-order.patch
+    ];
 
-      patches = [
-        # Fix import of "sphinxcontrib-log-cabinet"
-        ./patches/import-order.patch
-      ];
+    postInstallSphinx = ''
+      mv $out/share/doc/* $out/share/doc/python$pythonVersion-$pname-$version
+    '';
 
-      postInstallSphinx = ''
-        mv $out/share/doc/* $out/share/doc/python$pythonVersion-$pname-$version
-      '';
+    nativeBuildInputs = [
+      sphinxHook
+      sphinxcontrib-log-cabinet
+      pallets-sphinx-themes
+      sphinx-issues
+    ];
 
-      nativeBuildInputs = [
-        sphinxHook
-        sphinxcontrib-log-cabinet
-        pallets-sphinx-themes
-        sphinx-issues
-      ];
-
-      inherit (python) pythonVersion;
-      inherit meta;
-    };
+    inherit (python) pythonVersion;
+    inherit meta;
   };
 
   meta = with lib; {
-    homepage = "https://jinja.palletsprojects.com/";
-    description = "Stand-alone template engine";
+    changelog = "https://github.com/pallets/jinja/blob/${version}/CHANGES.rst";
+    description = "Very fast and expressive template engine";
+    downloadPage = "https://github.com/pallets/jinja";
+    homepage = "https://jinja.palletsprojects.com";
     license = licenses.bsd3;
     longDescription = ''
       Jinja is a fast, expressive, extensible templating engine. Special
       placeholders in the template allow writing code similar to Python
       syntax. Then the template is passed data to render the final document.
-      an optional sandboxed environment.
     '';
     maintainers = with maintainers; [ pierron ];
   };

From 5bd22370b9a3d55103fe2656522fbef4440f8e02 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 11 Jan 2024 11:29:18 +0300
Subject: [PATCH 072/175] Reapply "python311Packages.sphinxcontrib-apidoc:
 don't propagate pbr"

This reverts commit 697b88d91554f480facaf628ee292b64a2d47a15.
---
 .../python-modules/sphinxcontrib-apidoc/default.nix         | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix b/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
index 3945f8bf4c4f..327ff267eebc 100644
--- a/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
@@ -2,12 +2,13 @@
 , buildPythonPackage
 , fetchPypi
 , pbr
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-apidoc";
   version = "0.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -19,8 +20,9 @@ buildPythonPackage rec {
     rm test-requirements.txt requirements.txt
   '';
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
     pbr
+    setuptools
   ];
 
   # Check is disabled due to circular dependency of sphinx

From a0b4b85bfaf02e20837f23d2f9bc294101344583 Mon Sep 17 00:00:00 2001
From: Sameer Rahmani <lxsameer@gnu.org>
Date: Wed, 10 Jan 2024 21:46:20 +0000
Subject: [PATCH 073/175] llvm: Avoid cross compiling if the build platform can
 execute host binaries

---
 pkgs/development/compilers/llvm/10/llvm/default.nix  | 2 +-
 pkgs/development/compilers/llvm/11/llvm/default.nix  | 2 +-
 pkgs/development/compilers/llvm/12/llvm/default.nix  | 2 +-
 pkgs/development/compilers/llvm/13/llvm/default.nix  | 2 +-
 pkgs/development/compilers/llvm/14/llvm/default.nix  | 2 +-
 pkgs/development/compilers/llvm/15/llvm/default.nix  | 2 +-
 pkgs/development/compilers/llvm/16/llvm/default.nix  | 2 +-
 pkgs/development/compilers/llvm/17/llvm/default.nix  | 2 +-
 pkgs/development/compilers/llvm/8/llvm/default.nix   | 2 +-
 pkgs/development/compilers/llvm/9/llvm/default.nix   | 2 +-
 pkgs/development/compilers/llvm/git/llvm/default.nix | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index c09ec676e9ea..534d38e86663 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -248,7 +248,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 01e6483ad640..423b08396666 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -256,7 +256,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 97d8f27672e3..3263c4ddaf35 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -244,7 +244,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 2a7c1c1867cb..1e71cdd89c6c 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -206,7 +206,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 6eec4c563f9c..eab49d326ad4 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -205,7 +205,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
index 0b9e83259b2c..4f17678ba14f 100644
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -343,7 +343,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index a6faf9fd635d..73fb6a785413 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -331,7 +331,7 @@ in
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/17/llvm/default.nix b/pkgs/development/compilers/llvm/17/llvm/default.nix
index b38fef333135..627679ce812f 100644
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/17/llvm/default.nix
@@ -330,7 +330,7 @@ stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 7cef04347429..c2f924331098 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -222,7 +222,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 75c786855973..c0ef7801c348 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -237,7 +237,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 36edfee8a091..a6e9f9289d03 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -329,7 +329,7 @@ stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (

From 1e8bba4d5dadc087a8d53f131af2bb2505e663d8 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Thu, 11 Jan 2024 12:33:48 +0100
Subject: [PATCH 074/175] libjxl: build with openexr 3 (#279947)

---
 pkgs/development/libraries/libjxl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 820f466d8447..8454f3e1e83b 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -9,7 +9,7 @@
 , libjpeg
 , libpng
 , libwebp
-, openexr
+, openexr_3
 , pkg-config
 , zlib
 , buildDocs ? true
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     libjpeg
     libpng
     libwebp
-    openexr
+    openexr_3
     zlib
   ];
 

From 556394dec06937cae8d2440fd4b4188e8fcac021 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 11 Jan 2024 12:44:23 +0000
Subject: [PATCH 075/175] mpg123: 1.32.3 -> 1.32.4

Changes: https://mpg123.org/#2024-01-10
---
 pkgs/applications/audio/mpg123/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 94ee6ad53e69..e1d2e8d35d52 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.3";
+  version = "1.32.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-LZkTpX1O6PSXoYLG6CWCYCQJeCpPtIHpif7r9ENYZ7Q=";
+    hash = "sha256-WplmQzj7L3UbZi9A7iWATQydtrV13LXOdBxtxkIkoIo=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";

From 98237a67c733e5ed513d891907dd38b7e23c031f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 11 Jan 2024 06:12:45 -0800
Subject: [PATCH 076/175] mupdf-headless: init at 1.23.6

---
 pkgs/applications/misc/mupdf/default.nix | 5 +++--
 pkgs/top-level/all-packages.nix          | 4 ++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 7e172f279d44..b2c2335db0b2 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -98,9 +98,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional (enableGL || enableX11) copyDesktopItems
+    ++ lib.optional (stdenv.isDarwin && (enableGL || enableX11)) desktopToDarwinBundle
     ++ lib.optionals (enableCxx || enablePython) [ python3 python3.pkgs.setuptools python3.pkgs.libclang ]
     ++ lib.optionals (enablePython) [ which swig ]
-    ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle fixDarwinDylibNames xcbuild ];
+    ++ lib.optionals stdenv.isDarwin [ fixDarwinDylibNames xcbuild ];
 
   buildInputs = [ freetype harfbuzz openjpeg jbig2dec libjpeg gumbo ]
     ++ lib.optionals enableX11 [ libX11 libXext libXi libXrandr ]
@@ -126,7 +127,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  desktopItems = [
+  desktopItems = lib.optionals (enableGL || enableX11) [
     (makeDesktopItem {
       name = pname;
       desktopName = pname;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8774ebe1cb6e..6fffc03c5e46 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -34236,6 +34236,10 @@ with pkgs;
   };
 
   mupdf = callPackage ../applications/misc/mupdf { };
+  mupdf-headless = mupdf.override {
+    enableX11 = false;
+    enableGL = false;
+  };
   mupdf_1_17 = callPackage ../applications/misc/mupdf/1.17 { };
 
   muso = callPackage ../applications/audio/muso {

From 20c11b364d4e6318ae58a5522e099f8c08f205fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 11 Jan 2024 06:15:19 -0800
Subject: [PATCH 077/175] python311Packages.pikepdf: use mupdf-headless

---
 pkgs/development/python-modules/pikepdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 788c195d5d61..386f64718eb0 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -7,7 +7,7 @@
 , jbig2dec
 , deprecated
 , lxml
-, mupdf
+, mupdf-headless
 , numpy
 , packaging
 , pillow
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     (substituteAll {
       src = ./paths.patch;
       jbig2dec = lib.getExe' jbig2dec "jbig2dec";
-      mutool = lib.getExe' mupdf "mutool";
+      mutool = lib.getExe' mupdf-headless "mutool";
     })
   ];
 

From e062c9d93c04f9734310b0e6b6abd05ecd40ffa6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 11 Jan 2024 06:15:56 -0800
Subject: [PATCH 078/175] python311Packages.img2pdf: use mupdf-headless

---
 pkgs/development/python-modules/img2pdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/img2pdf/default.nix b/pkgs/development/python-modules/img2pdf/default.nix
index 1a69525d8438..2dc389f70ecc 100644
--- a/pkgs/development/python-modules/img2pdf/default.nix
+++ b/pkgs/development/python-modules/img2pdf/default.nix
@@ -12,7 +12,7 @@
 , exiftool
 , ghostscript
 , imagemagick
-, mupdf
+, mupdf-headless
 , netpbm
 , numpy
 , poppler_utils
@@ -74,7 +74,7 @@ buildPythonPackage rec {
     exiftool
     ghostscript
     imagemagick
-    mupdf
+    mupdf-headless
     netpbm
     numpy
     poppler_utils

From 674a5019a494cf67c615ad250b0209ba15013375 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 11 Jan 2024 06:27:43 -0800
Subject: [PATCH 079/175] desktopToDarwinBundle: use imagemagick_light

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6fffc03c5e46..a88ac5936cf2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1425,7 +1425,7 @@ with pkgs;
 
   desktopToDarwinBundle = makeSetupHook {
     name = "desktop-to-darwin-bundle-hook";
-    propagatedBuildInputs = [ writeDarwinBundle librsvg imagemagick python3Packages.icnsutil ];
+    propagatedBuildInputs = [ writeDarwinBundle librsvg imagemagick_light python3Packages.icnsutil ];
   } ../build-support/setup-hooks/desktop-to-darwin-bundle.sh;
 
   keepBuildTree = makeSetupHook {

From e3613515f13e680a7258c792b1bdb3ee9d6a5b30 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 11 Jan 2024 15:50:25 +0300
Subject: [PATCH 080/175] mesa: 23.3.2 -> 23.3.3

---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 28656a5b78a6..cb9d19c30c84 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -85,8 +85,8 @@
 */
 
 let
-  version = "23.3.2";
-  hash = "sha256-PPy4H6FvicVqvjhV0mN9OW7k4DhJtlkACmuOX1fmmtw=";
+  version = "23.3.3";
+  hash = "sha256-UYMHwAV/o87otY33i+Qx1N9ar6ftxg0JJ4stegqA87Q=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule

From ba653c4def9fc5851c9f85808052e2051463cc0b Mon Sep 17 00:00:00 2001
From: Henri Menke <henri@henrimenke.de>
Date: Thu, 11 Jan 2024 17:23:27 +0100
Subject: [PATCH 081/175] libzip: backport patch for pkgconfig file

---
 pkgs/development/libraries/libzip/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/libraries/libzip/default.nix b/pkgs/development/libraries/libzip/default.nix
index d3b7e5642546..c143ea3d1caf 100644
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , cmake
+, fetchpatch2
 , fetchurl
 , perl
 , zlib
@@ -23,6 +24,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/Wp/dF3j1pz1YD7cnLM9KJDwGY5BUlXQmHoM8Q2CTG8=";
   };
 
+  patches = [
+    # https://github.com/nih-at/libzip/issues/404
+    (fetchpatch2 {
+      name = "Check-for-zstd_TARGET-before-using-it-in-a-regex.patch";
+      url = "https://github.com/nih-at/libzip/commit/c719428916b4d19e838f873b1a177b126a080d61.patch";
+      hash = "sha256-4ksbXEM8kNvs3wtbIaXLEQNSKaxl0es/sIg0EINaTHE=";
+    })
+  ];
+
   outputs = [ "out" "dev" "man" ];
 
   nativeBuildInputs = [ cmake perl groff ];

From a04b6ba924b3160457caf24021c58cf011795844 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 7 Jan 2024 09:36:48 +0200
Subject: [PATCH 082/175] python310Packages.matplotlib: cleanup duplicate
 MPLSETUPCFG content

---
 pkgs/development/python-modules/matplotlib/default.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 1100d1bdbc99..6070b32575c0 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -109,13 +109,6 @@ buildPythonPackage rec {
       substituteInPlace src/_c_internal_utils.c \
         --replace libX11.so.6 ${libX11}/lib/libX11.so.6 \
         --replace libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
-    '' +
-    # bring our own system libraries
-    # https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst#c-libraries
-    ''
-      echo "[libs]
-      system_freetype=true
-      system_qhull=true" > mplsetup.cfg
     '';
 
   nativeBuildInputs = [

From 0d9a06c96eec03d1ec02be02409636ade1f0fa14 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 7 Jan 2024 09:37:51 +0200
Subject: [PATCH 083/175] python310Packages.matplotlib: remove
 oldest-supported-numpy

---
 pkgs/development/python-modules/matplotlib/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 6070b32575c0..ac47a507ba29 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -9,7 +9,6 @@
 # https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst
 # build-system
 , certifi
-, oldest-supported-numpy
 , pkg-config
 , pybind11
 , setuptools
@@ -114,7 +113,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     certifi
     numpy
-    oldest-supported-numpy # TODO remove after updating to 3.8.0
     pkg-config
     pybind11
     setuptools

From e68cf14d27fbebf87656762c02ab980b19d7796b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 7 Jan 2024 09:38:05 +0200
Subject: [PATCH 084/175] python310Packages.matplotlib: enable_lto explicitly

---
 pkgs/development/python-modules/matplotlib/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index ac47a507ba29..bad385ee3ad9 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -175,9 +175,8 @@ buildPythonPackage rec {
     libs = {
       system_freetype = true;
       system_qhull = true;
-    } // lib.optionalAttrs stdenv.isDarwin {
       # LTO not working in darwin stdenv, see #19312
-      enable_lto = false;
+      enable_lto = !stdenv.isDarwin;
     };
   };
 

From eba8931d4c2cbe5b87c457a9e41eae8940ba62ee Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 7 Jan 2024 10:28:52 +0200
Subject: [PATCH 085/175] python310Packages.matplotlib: comments fixes

The link to the build docs is outdated, and it doesn't have an updated
direct alternative. While I tried to enable at least some of the tests,
I encountered https://github.com/NixOS/nixpkgs/issues/255262 which is
now linked in a comment.
---
 pkgs/development/python-modules/matplotlib/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index bad385ee3ad9..8fb5c7c292cf 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -6,7 +6,6 @@
 , isPyPy
 , pythonOlder
 
-# https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst
 # build-system
 , certifi
 , pkg-config
@@ -182,8 +181,10 @@ buildPythonPackage rec {
 
   env.MPLSETUPCFG = writeText "mplsetup.cfg" (lib.generators.toINI {} passthru.config);
 
-  # Matplotlib needs to be built against a specific version of freetype in
-  # order for all of the tests to pass.
+  # Encountering a ModuleNotFoundError, as describved and investigated at:
+  # https://github.com/NixOS/nixpkgs/issues/255262 . It could be that some of
+  # which may fail due to a freetype version that doesn't match the freetype
+  # version used by upstream.
   doCheck = false;
 
   meta = with lib; {

From da0100beaf6885dc0d68712927cbe18d818381c2 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 4 Jan 2024 17:46:18 +0100
Subject: [PATCH 086/175] dbus: enable debug info

---
 pkgs/development/libraries/dbus/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a809eda31c0d..cb5fe9e4fbd3 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   outputs = [ "out" "dev" "lib" "doc" "man" ];
+  separateDebugInfo = true;
 
   strictDeps = true;
   nativeBuildInputs = [

From d178ca8b13ebc6bd971133c4df495d73a8cfe63a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 4 Jan 2024 17:56:05 +0100
Subject: [PATCH 087/175] libxslt: enable parallel building

Tested at -j64.
---
 pkgs/development/libraries/libxslt/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index dbca7f7fc2b7..95ecbbc44dee 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -60,6 +60,8 @@ stdenv.mkDerivation rec {
     "--without-crypto"
   ];
 
+  enableParallelBuilding = true;
+
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
     moveToOutput lib/xsltConf.sh "$dev"

From 08e61ec0c320c10ede227766e4a3dc0fdcef7517 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Wed, 10 Jan 2024 21:41:00 +0100
Subject: [PATCH 088/175] redis: 7.2.3 -> 7.2.4

Fixes CVE-2023-41056.

https://github.com/redis/redis/releases/tag/7.2.4
---
 pkgs/servers/nosql/redis/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index c3ac0ebbf969..8fd23ae186c4 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "7.2.3";
+  version = "7.2.4";
 
   src = fetchurl {
     url = "https://download.redis.io/releases/redis-${finalAttrs.version}.tar.gz";
-    hash = "sha256-PisZbW603bnnQwiL/CkVzLtC1A9aij7djLaccW7DS+c=";
+    hash = "sha256-jRBMJqFUsp/WfWVotPN1ISISrUHgwsqj1mSA5429O1k=";
   };
 
   patches = lib.optionals useSystemJemalloc [

From fea57dc5b57285d33918813d2f3695024d8fc9e8 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 12 Jan 2024 04:20:00 +0000
Subject: [PATCH 089/175] nodejs_20: 20.10.0 -> 20.11.0

Changelog: https://github.com/nodejs/node/releases/tag/v20.11.0
---
 pkgs/development/web/nodejs/v20.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 5868c5d9a990..d1a75dcdf7e5 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -8,8 +8,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.10.0";
-  sha256 = "sha256-MuslbuvYys1VdOZjHlS0K+fsjr4lrUeoymhUA7rRVTU=";
+  version = "20.11.0";
+  sha256 = "sha256-MYB+vu6wScU/F2XkqVrtaUdqS2lt0QDLU5q2aNeVC0A=";
   patches = [
     ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch

From 182459799640e0ac73d2d98eceb779c585ad3192 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jan 2024 04:39:43 +0000
Subject: [PATCH 090/175] pipewire: 1.0.0 -> 1.0.1

---
 pkgs/development/libraries/pipewire/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index fa5cb97b214f..0d1e3b03a09a 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -81,7 +81,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "1.0.0";
+    version = "1.0.1";
 
     outputs = [
       "out"
@@ -97,7 +97,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-mfnMluxJAxDbB6JlIM6HJ0zg7e1q3ia3uFbht6zeHCk=";
+      sha256 = "sha256-rvf0sZRgDDLcqroLg7hcMUqXD/4JT+3lBRX6/m+3Ry8=";
     };
 
     patches = [

From c2cf4f3d9e2889e5c3735914478ff73d178c73c0 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 12 Jan 2024 14:41:20 +0000
Subject: [PATCH 091/175] rav1e: 0.7.0 -> 0.7.1

Changes: https://github.com/xiph/rav1e/releases/tag/v0.7.1
---
 pkgs/tools/video/rav1e/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 1cb5b484c354..4f62161b0189 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-rZyQVivvb/XMzqKpgRl6JtilUU5hk76yzqs6bEKISIQ=";
+    sha256 = "sha256-Db7qb7HBAy6lniIiN07iEzURmbfNtuhmgJRv7OUagUM=";
   };
 
-  cargoHash = "sha256-0I094hEDUriPsDgbeqYtWAO1b1vJIBPMCndOsX4A3RM=";
+  cargoHash = "sha256-VyQ6n2kIJ7OjK6Xlf0T0GNsBvgESRETzKZDZzAn8ZuY=";
 
   depsBuildBuild = [ pkg-config ];
 

From 2ec46240ae10398d789e163d4745e6d6d4a99398 Mon Sep 17 00:00:00 2001
From: a-n-n-a-l-e-e <150648636+a-n-n-a-l-e-e@users.noreply.github.com>
Date: Fri, 12 Jan 2024 06:45:41 -0800
Subject: [PATCH 092/175] llvmPackages_{15,16,17,git}.libcxx: fix darwin link
 flags (#278945)

This change applies the upstream PR
https://github.com/llvm/llvm-project/pull/77218 so the same link flags
on darwin are used as when LIBCXX_CXX_ABI=libcxxabi. Specifically, this
adds
"-Wl,-force_symbols_not_weak_list,${CMAKE_CURRENT_SOURCE_DIR}/../lib/notweak.exp"
which prevents libcxx from segfaulting on darwin
---
 .../compilers/llvm/15/libcxx/default.nix            |  8 ++++++++
 .../compilers/llvm/16/libcxx/default.nix            | 10 +++++++++-
 .../compilers/llvm/17/libcxx/default.nix            | 13 ++++++++++++-
 .../compilers/llvm/git/libcxx/default.nix           | 13 ++++++++++++-
 4 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/15/libcxx/default.nix b/pkgs/development/compilers/llvm/15/libcxx/default.nix
index ed5f48e8c38f..be56770039d8 100644
--- a/pkgs/development/compilers/llvm/15/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/15/libcxx/default.nix
@@ -56,6 +56,14 @@ stdenv.mkDerivation rec {
       hash = "sha256-AaM9A6tQ4YAw7uDqCIV4VaiUyLZv+unwcOqbakwW9/k=";
       relative = "libcxx";
     })
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     ../../libcxx-0001-musl-hacks.patch
   ];
diff --git a/pkgs/development/compilers/llvm/16/libcxx/default.nix b/pkgs/development/compilers/llvm/16/libcxx/default.nix
index 78cd632024cd..d6c8c57c1743 100644
--- a/pkgs/development/compilers/llvm/16/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/16/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -47,6 +47,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gnu-install-dirs.patch
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/compilers/llvm/17/libcxx/default.nix b/pkgs/development/compilers/llvm/17/libcxx/default.nix
index 7b9996641663..8a5272ea07af 100644
--- a/pkgs/development/compilers/llvm/17/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/17/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -45,6 +45,17 @@ stdenv.mkDerivation rec {
     chmod -R u+w .
   '';
 
+  patches = [
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
+  ];
+
   postPatch = ''
     cd ../runtimes
   '';
diff --git a/pkgs/development/compilers/llvm/git/libcxx/default.nix b/pkgs/development/compilers/llvm/git/libcxx/default.nix
index 7b9996641663..8a5272ea07af 100644
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -45,6 +45,17 @@ stdenv.mkDerivation rec {
     chmod -R u+w .
   '';
 
+  patches = [
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
+  ];
+
   postPatch = ''
     cd ../runtimes
   '';

From 6362ce27a81b9845c748ee8305979d8c50769e7e Mon Sep 17 00:00:00 2001
From: pacien <pacien.trangirard@pacien.net>
Date: Fri, 12 Jan 2024 18:30:21 +0100
Subject: [PATCH 093/175] mercurial: 6.6.1 -> 6.6.2

Release notes: https://wiki.mercurial-scm.org/Release6.6
---
 pkgs/applications/version-management/mercurial/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 1051dc6da886..07cc4e7b8f58 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -23,11 +23,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.6.1";
+    version = "6.6.2";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-opRlo/5Ao+jUm6g0MTSsKrooa2g//rg42gz25FIflpU=";
+      sha256 = "sha256-y0lNe+fdwvydMXHIiDCvnAKyHHU+PlET3vrJwDc7S2A=";
     };
 
     format = "other";
@@ -37,7 +37,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-wLV0qdCfMgGpZRxnZik/lRwZHm/66p0sJn/mYVRvRkQ=";
+      sha256 = "sha256-yOysqMrTWDx/ENcJng8Rm338NI9vpuBGH6Yq8B7+MFg=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;

From 8a5f6594daa32af3686d13eb2efa5092598f9bbe Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Thu, 14 Dec 2023 13:58:59 +0100
Subject: [PATCH 094/175] linux_latest: optionally build Linux 6.7 and onwards
 with rust support

With the current patching situation around enabling Linux to build
with whatever rustc/bindgen version we have in nixpkgs, it feels like
supporting a Rust-by-default build at this time is not fully
justified.

Co-authored-by: Julian Stecklina <julian.stecklina@cyberus-technology.de>
---
 .../linux/kernel/common-config.nix            | 10 +++++
 pkgs/os-specific/linux/kernel/generic.nix     | 13 +++++-
 .../linux/kernel/manual-config.nix            | 43 +++++++++++--------
 3 files changed, 46 insertions(+), 20 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 94d61233a2c1..72baf6a9c1a0 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -380,6 +380,16 @@ let
       DRM_VC4_HDMI_CEC = yes;
     };
 
+    # Enables Rust support in the Linux kernel. This is currently not enabled by default, because it occasionally requires
+    # patching the Linux kernel for the specific Rust toolchain in nixpkgs. These patches usually take a bit
+    # of time to appear and this would hold up Linux kernel and Rust toolchain updates.
+    #
+    # Once Rust in the kernel has more users, we can reconsider enabling it by default.
+    rust = optionalAttrs ((features.rust or false) && versionAtLeast version "6.7") {
+      RUST = yes;
+      GCC_PLUGINS = no;
+    };
+
     sound = {
       SND_DYNAMIC_MINORS  = yes;
       SND_AC97_POWER_SAVE = yes; # AC97 Power-Saving Mode
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index df67005dd816..7fc90ace2624 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -9,6 +9,9 @@
 , pahole
 , lib
 , stdenv
+, rustc
+, rustPlatform
+, rust-bindgen
 
 , # The kernel source tarball.
   src
@@ -117,6 +120,8 @@ let
         map ({extraConfig ? "", ...}: extraConfig) kernelPatches;
     in lib.concatStringsSep "\n" ([baseConfigStr] ++ configFromPatches);
 
+  withRust = ((configfile.moduleStructuredConfig.settings.RUST or {}).tristate or null) == "y";
+
   configfile = stdenv.mkDerivation {
     inherit ignoreConfigErrors autoModules preferBuiltin kernelArch extraMakeFlags;
     pname = "linux-config";
@@ -130,7 +135,11 @@ let
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     nativeBuildInputs = [ perl gmp libmpc mpfr ]
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ lib.optional (lib.versionAtLeast version "5.2") pahole;
+      ++ lib.optional (lib.versionAtLeast version "5.2") pahole
+      ++ lib.optionals withRust [ rust-bindgen rustc ]
+    ;
+
+    RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
 
     platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
@@ -202,7 +211,7 @@ let
     inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile;
     pos = builtins.unsafeGetAttrPos "version" args;
 
-    config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
+    config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; } // lib.optionalAttrs withRust { CONFIG_RUST = "y"; };
   } // lib.optionalAttrs (modDirVersion != null) { inherit modDirVersion; });
 
   passthru = basicArgs // {
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 2ba31fbc9789..baf0231f13e1 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
 , libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
 , fetchpatch
+, rustc, rust-bindgen, rustPlatform
 }:
 
 let
@@ -56,15 +57,6 @@ let
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
-  # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [
-    pahole
-    perl
-    libelf
-    # module makefiles often run uname commands to find out the kernel version
-    (buildPackages.deterministic-uname.override { inherit modDirVersion; })
-  ] ++ optional (lib.versionAtLeast version "5.13") zstd;
-
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
     let
       config = let attrName = attr: "CONFIG_" + attr; in {
@@ -84,14 +76,27 @@ let
       } // config_;
 
       isModular = config.isYes "MODULES";
+      withRust = config.isYes "RUST";
 
       buildDTBs = kernelConf.DTB or false;
 
+      # Dependencies that are required to build kernel modules
+      moduleBuildDependencies = [
+        pahole
+        perl
+        libelf
+        # module makefiles often run uname commands to find out the kernel version
+        (buildPackages.deterministic-uname.override { inherit modDirVersion; })
+      ]
+      ++ optional (lib.versionAtLeast version "5.13") zstd
+      ++ optionals withRust [ rustc rust-bindgen ]
+      ;
+
     in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
       passthru = rec {
         inherit version modDirVersion config kernelPatches configfile
           moduleBuildDependencies stdenv;
-        inherit isZen isHardened isLibre;
+        inherit isZen isHardened isLibre withRust;
         isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
         baseVersion = lib.head (lib.splitString "-rc" version);
         kernelOlder = lib.versionOlder baseVersion;
@@ -100,6 +105,16 @@ let
 
       inherit src;
 
+      depsBuildBuild = [ buildPackages.stdenv.cc ];
+      nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
+                          ++ optional  (lib.versionOlder version "5.8") libelf
+                          ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+                          ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
+                          ++ optional  (lib.versionAtLeast version "5.8")  elfutils
+                          ++ optionals withRust [ rustc rust-bindgen ];
+
+      RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
+
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
@@ -363,14 +378,6 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
 
   enableParallelBuilding = true;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
-      ++ optional  (lib.versionOlder version "5.8") libelf
-      ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
-      ++ optional  (lib.versionAtLeast version "5.8")  elfutils
-      ;
-
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
   # Absolute paths for compilers avoid any PATH-clobbering issues.

From 5fca7feab9b1811348b6bb86fc0bbfa86a3acfea Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Mon, 27 Nov 2023 14:28:37 +0100
Subject: [PATCH 095/175] rust-out-of-tree-module: init

Adding this as an example and test whether the Rust support in the
Linux kernel works.
---
 .../linux/rust-out-of-tree-module/default.nix | 28 +++++++++++++++++++
 pkgs/top-level/linux-kernels.nix              |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/os-specific/linux/rust-out-of-tree-module/default.nix

diff --git a/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
new file mode 100644
index 000000000000..fd6b85a4dbd6
--- /dev/null
+++ b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub, kernel }:
+kernel.stdenv.mkDerivation {
+  name = "rust-out-of-tree-module";
+
+  src = fetchFromGitHub {
+    owner = "Rust-for-linux";
+    repo = "rust-out-of-tree-module";
+
+    rev = "7addf9dafba795524f6179a557f7272ecbe1b165";
+    hash = "sha256-Bj7WonZ499W/FajbxjM7yBkU9iTxTW7CrRbCSzWbsSc=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = {
+    broken = !kernel.withRust;
+    description = "A basic template for an out-of-tree Linux kernel module written in Rust";
+    homepage = "https://github.com/Rust-for-Linux/rust-out-of-tree-module";
+    license = lib.licenses.gpl2Only;
+    maintainers = [ lib.maintainers.blitz ];
+    platforms = lib.platforms.linux;
+  };
+
+}
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index dc71b01f3c26..9017edd70126 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -458,6 +458,8 @@ in {
 
     facetimehd = callPackage ../os-specific/linux/facetimehd { };
 
+    rust-out-of-tree-module = if lib.versionAtLeast kernel.version "6.7" then callPackage ../os-specific/linux/rust-out-of-tree-module { } else null;
+
     tuxedo-keyboard = if lib.versionAtLeast kernel.version "4.14" then callPackage ../os-specific/linux/tuxedo-keyboard { } else null;
 
     jool = callPackage ../os-specific/linux/jool { };

From d1f33201effb2ce5b09e86bc15f787b909d40f99 Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Thu, 30 Nov 2023 17:00:39 +0100
Subject: [PATCH 096/175] nixos/tests/kernel-rust: init

---
 nixos/tests/all-tests.nix   |  1 +
 nixos/tests/kernel-rust.nix | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 nixos/tests/kernel-rust.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index be394c19ebef..a5eda261139d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -448,6 +448,7 @@ in {
   kerberos = handleTest ./kerberos/default.nix {};
   kernel-generic = handleTest ./kernel-generic.nix {};
   kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {};
+  kernel-rust = runTestOn ["x86_64-linux"] ./kernel-rust.nix;
   keter = handleTest ./keter.nix {};
   kexec = handleTest ./kexec.nix {};
   keycloak = discoverTests (import ./keycloak.nix);
diff --git a/nixos/tests/kernel-rust.nix b/nixos/tests/kernel-rust.nix
new file mode 100644
index 000000000000..80eb38693677
--- /dev/null
+++ b/nixos/tests/kernel-rust.nix
@@ -0,0 +1,30 @@
+{ pkgs, ... }: {
+  name = "kernel-rust";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ blitz ];
+  };
+
+  nodes.machine = { config, pkgs, ... }:
+    {
+      boot.kernelPackages = pkgs.linuxPackages_testing;
+
+      boot.extraModulePackages = [
+        config.boot.kernelPackages.rust-out-of-tree-module
+      ];
+
+      boot.kernelPatches = [
+        {
+          name = "Rust Support";
+          patch = null;
+          features = {
+            rust = true;
+          };
+        }
+      ];
+    };
+
+  testScript = ''
+    machine.wait_for_unit("default.target")
+    machine.succeed("modprobe rust_out_of_tree")
+  '';
+}

From ec2016dda402ded1261d2af0e29d02506b191eab Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Thu, 30 Nov 2023 17:03:09 +0100
Subject: [PATCH 097/175] doc: explain how to enable Rust support in the Linux
 kernel

---
 .../configuration/linux-kernel.chapter.md      | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/nixos/doc/manual/configuration/linux-kernel.chapter.md b/nixos/doc/manual/configuration/linux-kernel.chapter.md
index 9d1b2bc2f9b8..99c94fe64e82 100644
--- a/nixos/doc/manual/configuration/linux-kernel.chapter.md
+++ b/nixos/doc/manual/configuration/linux-kernel.chapter.md
@@ -92,6 +92,24 @@ To use your custom kernel package in your NixOS configuration, set
 boot.kernelPackages = pkgs.linuxPackagesFor yourCustomKernel;
 ```
 
+## Rust
+
+The Linux kernel does not have Rust language support enabled by
+default. For kernel versions 6.7 or newer, experimental Rust support
+can be enabled. In a NixOS configuration, set:
+
+```nix
+boot.kernelPatches = [
+  {
+    name = "Rust Support";
+    patch = null;
+    features = {
+      rust = true;
+    };
+  }
+];
+```
+
 ## Developing kernel modules {#sec-linux-config-developing-modules}
 
 This section was moved to the [Nixpkgs manual](https://nixos.org/nixpkgs/manual#sec-linux-kernel-developing-modules).

From f19268c4063d233bc837eb1ebce792dafdb91c2a Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 7 Dec 2023 13:51:56 +0100
Subject: [PATCH 098/175] default-gcc-version: 12 -> 13 if !stdenv.isDarwin

---
 pkgs/top-level/all-packages.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1a7bfa536675..efa17850c56b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15831,7 +15831,6 @@ with pkgs;
   default-gcc-version =
     if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
     else if stdenv.buildPlatform.isDarwin  then 12  # unable to test
-    else if stdenv.buildPlatform.isAarch64 then 12  # unable to test
     else 13;
   gcc = pkgs.${"gcc${toString default-gcc-version}"};
   gccFun = callPackage ../development/compilers/gcc;

From b384f04673bf7c75ba628855d7b6c773e6d08024 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 7 Dec 2023 17:39:56 +0100
Subject: [PATCH 099/175] gcc13: add patch for PR110280

---
 .../gcc/patches/13/ICE-PR110280.patch         | 60 +++++++++++++++++++
 .../compilers/gcc/patches/default.nix         |  1 +
 2 files changed, 61 insertions(+)
 create mode 100644 pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch

diff --git a/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch b/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch
new file mode 100644
index 000000000000..7338b3dd1ede
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch
@@ -0,0 +1,60 @@
+From f4029de35fb1b293a4fd586574b1b4b73ddf7880 Mon Sep 17 00:00:00 2001
+From: Prathamesh Kulkarni <prathamesh.kulkarni@linaro.org>
+Date: Wed, 26 Jul 2023 22:36:26 +0530
+Subject: [PATCH] [aarch64/match.pd] Fix ICE observed in PR110280.
+
+gcc/ChangeLog:
+	PR tree-optimization/110280
+	* match.pd (vec_perm_expr(v, v, mask) -> v): Explicitly build vector
+	using build_vector_from_val with the element of input operand, and
+	mask's type if operand and mask's types don't match.
+
+gcc/testsuite/ChangeLog:
+	PR tree-optimization/110280
+	* gcc.target/aarch64/sve/pr110280.c: New test.
+
+(cherry picked from commit 85d8e0d8d5342ec8b4e6a54e22741c30b33c6f04)
+---
+ gcc/match.pd                                    |  9 ++++++++-
+ gcc/testsuite/gcc.target/aarch64/sve/pr110280.c | 12 ++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+
+diff --git a/gcc/match.pd b/gcc/match.pd
+index 9118244825054..c3bb4fbc0a7a2 100644
+--- a/gcc/match.pd
++++ b/gcc/match.pd
+@@ -8292,7 +8292,14 @@ and,
+ 
+ (simplify
+  (vec_perm vec_same_elem_p@0 @0 @1)
+- @0)
++ (if (types_match (type, TREE_TYPE (@0)))
++  @0
++  (with
++   {
++     tree elem = uniform_vector_p (@0);
++   }
++   (if (elem)
++    { build_vector_from_val (type, elem); }))))
+ 
+ /* Push VEC_PERM earlier if that may help FMA perception (PR101895).  */
+ (simplify
+diff --git a/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c b/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+new file mode 100644
+index 0000000000000..d3279f383629f
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+@@ -0,0 +1,12 @@
++/* { dg-do compile } */
++/* { dg-options "-O3 -fdump-tree-optimized" } */
++
++#include "arm_sve.h"
++
++svuint32_t l()
++{
++  _Alignas(16) const unsigned int lanes[4] = {0, 0, 0, 0};
++  return svld1rq_u32(svptrue_b8(), lanes);
++}
++
++/* { dg-final { scan-tree-dump-not "VEC_PERM_EXPR" "optimized" } } */
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 55636b8ab51c..9cb2f701df57 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -74,6 +74,7 @@ in
 ++ optional langFortran (if atLeast12 then ./gcc-12-gfortran-driving.patch else ./gfortran-driving.patch)
 ++ optional atLeast7 ./ppc-musl.patch
 ++ optional is12 ./12/lambda-ICE-PR109241.patch # backport ICE fix on ccache code
+++ optional is13 ./13/ICE-PR110280.patch # backport ICE fix on const_unop
 ++ optional (atLeast9 && langD) ./libphobos.patch
 
 

From 810cef75ba11c147c99f72e6db6d2df90ad8f50d Mon Sep 17 00:00:00 2001
From: SharzyL <me@sharzy.in>
Date: Sun, 15 Oct 2023 10:35:33 +0800
Subject: [PATCH 100/175] llvmPackages_*.clangUseLLVM: add libunwind to lib
 search path

---
 pkgs/development/compilers/llvm/10/default.nix  | 1 +
 pkgs/development/compilers/llvm/11/default.nix  | 1 +
 pkgs/development/compilers/llvm/12/default.nix  | 1 +
 pkgs/development/compilers/llvm/13/default.nix  | 1 +
 pkgs/development/compilers/llvm/14/default.nix  | 1 +
 pkgs/development/compilers/llvm/15/default.nix  | 1 +
 pkgs/development/compilers/llvm/16/default.nix  | 1 +
 pkgs/development/compilers/llvm/8/default.nix   | 1 +
 pkgs/development/compilers/llvm/9/default.nix   | 1 +
 pkgs/development/compilers/llvm/git/default.nix | 1 +
 10 files changed, 10 insertions(+)

diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index bc72be0ce7a1..16238221e279 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -158,6 +158,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 2d9790fe61ac..3044199e2811 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -173,6 +173,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 4de048827071..a38e35e91f6d 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -173,6 +173,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index c46ebee1d0db..c811b24c48ef 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -213,6 +213,7 @@ in let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 3513833c6f56..090eec234886 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -216,6 +216,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index 9e9008c7f1ee..45512528fde6 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -215,6 +215,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 30da7d57e791..e4fe73fd60ad 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -220,6 +220,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 0483916a620b..83e19e7e90a2 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -161,6 +161,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index fbd2e57805be..a6274c8b2b9c 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -161,6 +161,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 41ce6076da5f..efa8daf5d98b 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -216,6 +216,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {

From 8ed53ddbb5b001f0a96d11ace1f3ef4ddc8d0bc9 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 13 Jan 2024 04:20:00 +0000
Subject: [PATCH 101/175] ruby.rubygems: 3.5.3 -> 3.5.4

Changelog: https://github.com/rubygems/rubygems/blob/v3.5.4/CHANGELOG.md
---
 pkgs/development/interpreters/ruby/rubygems/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 95a6fb077eb1..a7f44a7b62dd 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.5.3";
+  version = "3.5.4";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-8xFe6AgJkvJXwBYbgR4HsBLyAXXtiTSfsayYl33cXJw=";
+    hash = "sha256-v3D+6NzBHr6nbTE5nDtu6pBZCwbBxYfO8bblPsMrASg=";
   };
 
   patches = [

From ac17462172cf2e1b3a1086903e16c03fccfdd60b Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 13 Jan 2024 04:20:00 +0000
Subject: [PATCH 102/175] bundler: 2.5.3 -> 2.5.4

Changelog: https://github.com/rubygems/rubygems/blob/bundler-v2.5.4/bundler/CHANGELOG.md
---
 pkgs/development/ruby-modules/bundler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 05d1bfbf64e6..d3f66b570019 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.5.3";
-  source.sha256 = "sha256-JJzQdaxPM1rnD3iMm+D0wYgJOk2n0FvVO+K67z8l58s=";
+  version = "2.5.4";
+  source.sha256 = "sha256-97nwjEfoxmVhOmaKobYz32P4GLmRg87kt5dwSoFu3v4=";
   dontPatchShebangs = true;
 
   postFixup = ''

From 2f66478faa833e951e377bb31ec2657944f00260 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=A9clairevoyant?=
 <848000+eclairevoyant@users.noreply.github.com>
Date: Sat, 13 Jan 2024 03:25:54 -0500
Subject: [PATCH 103/175] enchant: fix build with `strictDeps = true;`

---
 pkgs/development/libraries/enchant/2.x.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 43f9093848b8..c843fef4a0ef 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-wcVxnypZfOPgbJOM+5n7aX2gk96nuFfMAE3B3PG7oYI=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     groff
     pkg-config
@@ -33,7 +35,7 @@ stdenv.mkDerivation rec {
     nuspell
   ];
 
-  nativeCheckInputs = [
+  checkInputs = [
     unittest-cpp
   ];
 

From 4143d9ab9bc6158257998e3c2936d1bc35c9db49 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 13 Jan 2024 15:59:24 +0300
Subject: [PATCH 104/175] kde/frameworks: 5.113 -> 5.114

---
 .../libraries/kde-frameworks/fetch.sh         |   2 +-
 .../libraries/kde-frameworks/srcs.nix         | 664 +++++++++---------
 2 files changed, 333 insertions(+), 333 deletions(-)

diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index 590818546a4b..a6797786ee53 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.113/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.114/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 06b5e6b04cfa..d51c74cc4e64 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/attica-5.113.0.tar.xz";
-      sha256 = "0p6n2jvky5x9gpwmp31mdxf0bzywaljgnkszgbklyc35xk9i6j14";
-      name = "attica-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/attica-5.114.0.tar.xz";
+      sha256 = "0gkdsm1vyyyxxyl4rni9s2bdz5w6zphzjl58fddjl899da06hqfq";
+      name = "attica-5.114.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/baloo-5.113.0.tar.xz";
-      sha256 = "1jv7202dj2w0vcv49bgp0iv1sfy3kdqr974rcr77pcfzhhda9bix";
-      name = "baloo-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/baloo-5.114.0.tar.xz";
+      sha256 = "19sib1y0m5h2gnnpr9rfk810p6pdfm4zzxlm0a44r7910llp8i50";
+      name = "baloo-5.114.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/bluez-qt-5.113.0.tar.xz";
-      sha256 = "1y6nkl9zc5298jc6klxz88h6srmma085w1q5l4jmjihgys2zkcx7";
-      name = "bluez-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/bluez-qt-5.114.0.tar.xz";
+      sha256 = "1ni50jwnb5ww8mkql0p3q8660c0srj8p0ik27lvxakwdq4wf6l9s";
+      name = "bluez-qt-5.114.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/breeze-icons-5.113.0.tar.xz";
-      sha256 = "0kb3wchx84dpi77zsi1b9pzlkhg3sjagxcsf1pdappagq3xn1p48";
-      name = "breeze-icons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/breeze-icons-5.114.0.tar.xz";
+      sha256 = "0z5cpv10jyjdwjfkm7nj6hyp4vj29apm476hvbpb4gan27jyb91y";
+      name = "breeze-icons-5.114.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/extra-cmake-modules-5.113.0.tar.xz";
-      sha256 = "1i1vpf9860cwrq5b01yrgf94hmzk9dx637j638shgjmyxr058pi6";
-      name = "extra-cmake-modules-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/extra-cmake-modules-5.114.0.tar.xz";
+      sha256 = "0z4nqravsfzlsgvkg5rha2d0qxfr3pfncw7z2fxzzqvzj7mfk6im";
+      name = "extra-cmake-modules-5.114.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/frameworkintegration-5.113.0.tar.xz";
-      sha256 = "17i7frachq23kfg78ar33x5acwf7pmwl1a5c02qif44mml8b09hi";
-      name = "frameworkintegration-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/frameworkintegration-5.114.0.tar.xz";
+      sha256 = "1dqgzhhh8gnvl8jsvh2i6pjn935d61avh63b4z9kpllhvp9a2lnd";
+      name = "frameworkintegration-5.114.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kactivities-5.113.0.tar.xz";
-      sha256 = "1d9lkhp344wdss9vab3gh9h31f1k6fifdhp17fblpkykgyvbb26y";
-      name = "kactivities-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kactivities-5.114.0.tar.xz";
+      sha256 = "10pyynqz8c22la9aqms080iqlisj3irbi1kwnn3s0vg5dsjxr1p3";
+      name = "kactivities-5.114.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kactivities-stats-5.113.0.tar.xz";
-      sha256 = "136z2njw3k2l71xp4vg10sm5q925xh8yfr9a784wnr0kwngdb71i";
-      name = "kactivities-stats-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kactivities-stats-5.114.0.tar.xz";
+      sha256 = "1zhrs2p3c831rwx7ww87i82k5i236vfywdxv7zhz93k3vffyqby7";
+      name = "kactivities-stats-5.114.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kapidox-5.113.0.tar.xz";
-      sha256 = "05407c01wnjyslbbz0w5wipjpx6ng3izya41mg13g700ainj9q1x";
-      name = "kapidox-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kapidox-5.114.0.tar.xz";
+      sha256 = "0xxw3lvipyax8r1af3ypwjj6waarbp2z9n11fjb4kvyigsypglmb";
+      name = "kapidox-5.114.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/karchive-5.113.0.tar.xz";
-      sha256 = "03a3p85hmx4ycfp0y5l9yw4cy3i9jwy7jd27psmckr4q0538k91d";
-      name = "karchive-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/karchive-5.114.0.tar.xz";
+      sha256 = "015gc1zarny8r478p7g9m6r67l5dk3r0vcp28ilmfmznxy0k0hda";
+      name = "karchive-5.114.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kauth-5.113.0.tar.xz";
-      sha256 = "0ncpyq2l53p4yhhxkvk23x0ji9amrbnm6kbz8dp573cqww79pih2";
-      name = "kauth-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kauth-5.114.0.tar.xz";
+      sha256 = "1rkf9mc9718wn8pzd3d3wcg3lsn0vkr9a2cqnz86rbg3cf2qdbir";
+      name = "kauth-5.114.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kbookmarks-5.113.0.tar.xz";
-      sha256 = "1fgnh8amy2ghn50i59al0iyqvj05pzdxai9qxqzbvi65f1pibi7d";
-      name = "kbookmarks-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kbookmarks-5.114.0.tar.xz";
+      sha256 = "06lnsyjhh80mdcqjww40glinmrjydbmkhv27a267vf34r7kam9rc";
+      name = "kbookmarks-5.114.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcalendarcore-5.113.0.tar.xz";
-      sha256 = "18psjzqcfzaplcfjpjda983mrpv306il0j49q3rm9hj9ycj54wc2";
-      name = "kcalendarcore-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcalendarcore-5.114.0.tar.xz";
+      sha256 = "0aimda01zqw4fz5ldvz4vh767bi10r00kvm62n89nxhsq46wlk7p";
+      name = "kcalendarcore-5.114.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcmutils-5.113.0.tar.xz";
-      sha256 = "1xbfzw2zfl966zp70jzfp3hjzn334zf4hnwr82priffafgrin57s";
-      name = "kcmutils-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcmutils-5.114.0.tar.xz";
+      sha256 = "1pblf3c60m0gn3vhdprw28f8y54kij02jwz91r2vnmng8d1xkrp9";
+      name = "kcmutils-5.114.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcodecs-5.113.0.tar.xz";
-      sha256 = "1xvaq0yg4n4lwyq3yx2m8jrvfg7f0qrwgxxam4rmp2l245bvn34i";
-      name = "kcodecs-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcodecs-5.114.0.tar.xz";
+      sha256 = "080zvcqd8iq05p5x3qaf3rryx75lg2l2j1dr18sp50ir50zfwh2w";
+      name = "kcodecs-5.114.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcompletion-5.113.0.tar.xz";
-      sha256 = "016280h98j1ssvc3a4b3vyh4s93s9y9hn1jrpbfbkm9xxnvi7k79";
-      name = "kcompletion-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcompletion-5.114.0.tar.xz";
+      sha256 = "0qvdxqlh1dklkbmqfjg5gc3dkdicgzn6q5lgvyf8cv46dinj6mwc";
+      name = "kcompletion-5.114.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kconfig-5.113.0.tar.xz";
-      sha256 = "0fwhn3yp4gfwjiy5dx7gs0zd65yjlrrzkqpy7fpg7n97qf99q2a8";
-      name = "kconfig-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kconfig-5.114.0.tar.xz";
+      sha256 = "0hghdh4p6cq9ckp4g5jdgd8w47pdsxxvzimrdfjrs71lmy8ydiy2";
+      name = "kconfig-5.114.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kconfigwidgets-5.113.0.tar.xz";
-      sha256 = "0bmk5qxiss7a71xpfsbqj831wkcf94b7wfbw9xisvnxlfmf60y4v";
-      name = "kconfigwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kconfigwidgets-5.114.0.tar.xz";
+      sha256 = "16layydkcwfbvzxqjzprkq8bbxifn0z0wm7mc9bzwrfxy761rjnj";
+      name = "kconfigwidgets-5.114.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcontacts-5.113.0.tar.xz";
-      sha256 = "1y9cdv1g2ypwl4b0hk1sxk7lvb5qkbm4n1gh62plqsran62jsimm";
-      name = "kcontacts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcontacts-5.114.0.tar.xz";
+      sha256 = "0lyqvbs216p5zpssaf4pyccph7nbwkbvhpmhbi32y2rm23cmxlwf";
+      name = "kcontacts-5.114.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcoreaddons-5.113.0.tar.xz";
-      sha256 = "1bhanzfjw2i49sx2hjnim8k72vvbs7gyig7nkqkgbaxzpa8qgwrf";
-      name = "kcoreaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcoreaddons-5.114.0.tar.xz";
+      sha256 = "1wv3s3xsiii96k17nzs2fb0ih2lyg52krf58v44nlk9wfi4wmnqx";
+      name = "kcoreaddons-5.114.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcrash-5.113.0.tar.xz";
-      sha256 = "1mg90xm6ckcd30s07psn30sgh81lx8kfs0p1h6cblg4q8bkgkndv";
-      name = "kcrash-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcrash-5.114.0.tar.xz";
+      sha256 = "1avi4yd3kpjqxrvci1nicxbh9mjafj1w2vgfmqanq66b76s4kxj1";
+      name = "kcrash-5.114.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdav-5.113.0.tar.xz";
-      sha256 = "1djng9c741xairr84nvjbkq4dk551p7yk91g8d4nndy8s1kiz1dv";
-      name = "kdav-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdav-5.114.0.tar.xz";
+      sha256 = "11959fxz24snk2l31kw8w96wah0s2fjimimrxh6xhppiy5qp2fp2";
+      name = "kdav-5.114.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdbusaddons-5.113.0.tar.xz";
-      sha256 = "101a406f8i0wgaxd0ilvfcb3plzjgvxw9bhhm5pin6fpr0xkjrnk";
-      name = "kdbusaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdbusaddons-5.114.0.tar.xz";
+      sha256 = "0pzzznyxhi48z5hhdsdxz3vaaihrdshpx65ha2v2nn2gh3ww7ikm";
+      name = "kdbusaddons-5.114.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdeclarative-5.113.0.tar.xz";
-      sha256 = "1wj9arkmjdrac04cq2w5bw5184jnlq5xn2cw6n7lajc31yrbc0rk";
-      name = "kdeclarative-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdeclarative-5.114.0.tar.xz";
+      sha256 = "0w98pj8acxb4m9645963rzq5vja1fbih5czz24mf9zdqlg2dkz8g";
+      name = "kdeclarative-5.114.0.tar.xz";
     };
   };
   kded = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kded-5.113.0.tar.xz";
-      sha256 = "1vb3z7r2l206n7p70a4cbkrm7fvyk7hqqf0bz7514r4g86l4l5n4";
-      name = "kded-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kded-5.114.0.tar.xz";
+      sha256 = "00n4isc4ahii0ldrg761lkmnq27kmrfqs9zkmpvmgbg57259mvc3";
+      name = "kded-5.114.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdelibs4support-5.113.0.tar.xz";
-      sha256 = "1z843zq1g5n3b8gb20y8266hyikvbzdsgc77gvcgzvqfdxk19l24";
-      name = "kdelibs4support-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdelibs4support-5.114.0.tar.xz";
+      sha256 = "17473him2fjfcw5f88diarqac815wsakfyb9fka82a4qqh9l41mc";
+      name = "kdelibs4support-5.114.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdesignerplugin-5.113.0.tar.xz";
-      sha256 = "05hwq8rpm1f9ad5fyk2gjqxm6gvvx2gx2zdbklww9ghlh8qndl9i";
-      name = "kdesignerplugin-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdesignerplugin-5.114.0.tar.xz";
+      sha256 = "0zlvkayv6zl5rp1076bscmdzyw93y7sxqb5848w11vs0g9amcj9n";
+      name = "kdesignerplugin-5.114.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdesu-5.113.0.tar.xz";
-      sha256 = "085d3d6qpl4m7z8smm0bq9khfjjglpb1gd9n8q0d541127y2cpq4";
-      name = "kdesu-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdesu-5.114.0.tar.xz";
+      sha256 = "14dcf32izn4lxr8vx372rfznflc1rcxwanx06phkd8mx9zyg4jxr";
+      name = "kdesu-5.114.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdewebkit-5.113.0.tar.xz";
-      sha256 = "18bmg88xj07h8y5f3f2ckjs9m61mf8jrxrg4vg8hrf4nabxz20xn";
-      name = "kdewebkit-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdewebkit-5.114.0.tar.xz";
+      sha256 = "04zc2qs13k04gsn124mnh6sqi3pax8c014jcb0qdh3h2r2y72bz3";
+      name = "kdewebkit-5.114.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdnssd-5.113.0.tar.xz";
-      sha256 = "1hbb9zy1f13m45b6kzndxw619vnmx0s418brqgkdaxgsh12j5anq";
-      name = "kdnssd-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdnssd-5.114.0.tar.xz";
+      sha256 = "1zw5rkprr54j05ic8zljk57zahp2v6333slr253r3n1679zqlv64";
+      name = "kdnssd-5.114.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdoctools-5.113.0.tar.xz";
-      sha256 = "0cfs4znhp7psrz99j3brp8q39gg0bpzvkrdx90zl6vvrc06d2zaa";
-      name = "kdoctools-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdoctools-5.114.0.tar.xz";
+      sha256 = "15s58r2zvdckw30x9q9ir8h1i8q2ncfgjn9h4jnmylwm79z3z27v";
+      name = "kdoctools-5.114.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kemoticons-5.113.0.tar.xz";
-      sha256 = "127frvsp1h9hg755vz2i609wxqqgzgsz15iqr7hcpbmmf6xvm8i2";
-      name = "kemoticons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kemoticons-5.114.0.tar.xz";
+      sha256 = "0w87prkhdmba7y8ylbycdpwdzd2djmp7hvv5ljb9s4aqqhnn3vw4";
+      name = "kemoticons-5.114.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kfilemetadata-5.113.0.tar.xz";
-      sha256 = "1ap25y66y1r185fghvkkkkp4f6acnkazny8wxw5hv1gg25ilpsir";
-      name = "kfilemetadata-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kfilemetadata-5.114.0.tar.xz";
+      sha256 = "15va29chlsrxii02w1ax718hp1b14ym59lcfyzh7w30zlf681560";
+      name = "kfilemetadata-5.114.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kglobalaccel-5.113.0.tar.xz";
-      sha256 = "0ibm1wd7fhi3j5za0agyq2zrs9nx5a8b47iijkzgkpz9ylxniwrs";
-      name = "kglobalaccel-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kglobalaccel-5.114.0.tar.xz";
+      sha256 = "19mmav055fnzyl760fyhf0pdvaidd5i1h04l2hcnpin4p1jnpfap";
+      name = "kglobalaccel-5.114.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kguiaddons-5.113.0.tar.xz";
-      sha256 = "1ykhxgx89x1qv916pcz3j0q14ylalg9v23jjw0dbwpg5hlj4qlyc";
-      name = "kguiaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kguiaddons-5.114.0.tar.xz";
+      sha256 = "0riya9plcz9c1ndhdbsradssndshbm12705swn7vf7am17n7f947";
+      name = "kguiaddons-5.114.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kholidays-5.113.0.tar.xz";
-      sha256 = "1wq397j3m3s9a45k9h5hsdsfansvb3a5q8biag2w3fsb1i84id0i";
-      name = "kholidays-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kholidays-5.114.0.tar.xz";
+      sha256 = "19r8dxglz5ll6iyvigsccil3ikvcsnyy5nwcpjvjr1c0brigcjmy";
+      name = "kholidays-5.114.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/khtml-5.113.0.tar.xz";
-      sha256 = "0m284rwq8f49j71lcapzr4qi0f72a0adnv67mfg5blar867161mq";
-      name = "khtml-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/khtml-5.114.0.tar.xz";
+      sha256 = "1mf84zs9hjvmi74f8rgqzrfkqjq597f9k64dn1bqcj13v0w10vry";
+      name = "khtml-5.114.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ki18n-5.113.0.tar.xz";
-      sha256 = "0hl0qp3653xiwa5ndk82ygy2kgrc0pygqkknb1cx5w54s56bm57w";
-      name = "ki18n-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ki18n-5.114.0.tar.xz";
+      sha256 = "1yg03awcx5ay6lgbgwv91i0ankrm94z9m0wky4v03gnwnvw8pa0v";
+      name = "ki18n-5.114.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kiconthemes-5.113.0.tar.xz";
-      sha256 = "0q2c1s8pwl7dnx9v7q061zn5n1prk0vv0j77kki9wfncjaf15g0g";
-      name = "kiconthemes-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kiconthemes-5.114.0.tar.xz";
+      sha256 = "0ndiqmcs1ybj4acc6k3p9jwq09slqc4nj12ifqvlxrfj3ak6sb28";
+      name = "kiconthemes-5.114.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kidletime-5.113.0.tar.xz";
-      sha256 = "1cdfhn3mcxvizba1gpf0viba3g0mnva3l226lkca3p9ps8c4z3rm";
-      name = "kidletime-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kidletime-5.114.0.tar.xz";
+      sha256 = "06sc9w54g4n7s5gjkqz08rgcz6v3pr0bdgx3gbjgzass6l4m8w7p";
+      name = "kidletime-5.114.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kimageformats-5.113.0.tar.xz";
-      sha256 = "0gys83sazgbj7h3yiaacqr464z951ixygrhzcw16cnqjm8phic44";
-      name = "kimageformats-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kimageformats-5.114.0.tar.xz";
+      sha256 = "1nfzpgnrbwncx9zp9cwa169jlfv7i85p00a07d4jc5hrdyvvkn0w";
+      name = "kimageformats-5.114.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kinit-5.113.0.tar.xz";
-      sha256 = "1ydmgxyr5j9zi0a5vlb64kkjxka3rsyvzj10y3dww92qyapnn2bv";
-      name = "kinit-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kinit-5.114.0.tar.xz";
+      sha256 = "0b6z9gq05vz20hm5y9ai3sbqq3gxwm3a3z88dkvi7dywk7vbqcph";
+      name = "kinit-5.114.0.tar.xz";
     };
   };
   kio = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kio-5.113.0.tar.xz";
-      sha256 = "1bjmv3wdpmzqbv1xzzl0ydirccbknnjyqn6wzb057zgy7kpi1cd8";
-      name = "kio-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kio-5.114.0.tar.xz";
+      sha256 = "0nwmxbfhvfw69q07vxvflri7rkdczyc89xv4ll3nrzrhgf15kb2z";
+      name = "kio-5.114.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kirigami2-5.113.0.tar.xz";
-      sha256 = "0zy3s841q2xw4d048a3qh4cfh9kb3qaqxml4ny5zi73crm173h8y";
-      name = "kirigami2-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kirigami2-5.114.0.tar.xz";
+      sha256 = "1bd232gs4394fa3aq31mjqrn8f3vjsghx7817szi7ryvnn6fnqkw";
+      name = "kirigami2-5.114.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kitemmodels-5.113.0.tar.xz";
-      sha256 = "01i1s7rw7ndp3gnl3bg0pv8a9qz95rmz0jxkw97p72gcah2q2yvk";
-      name = "kitemmodels-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kitemmodels-5.114.0.tar.xz";
+      sha256 = "1bfmcrbcbrvp2rcaf32vzvarqwp41gn6s4xpf56hnxbwf9kgk1fl";
+      name = "kitemmodels-5.114.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kitemviews-5.113.0.tar.xz";
-      sha256 = "0wnmgm72kv7vxadsrkdbnjknb4lkzrmn6gk7car7jx2i91kz7xdd";
-      name = "kitemviews-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kitemviews-5.114.0.tar.xz";
+      sha256 = "00vl2ck0pq0sqcxvhlr2pimgr27hd9v7y9dz6w4arb5smi5q1ixg";
+      name = "kitemviews-5.114.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kjobwidgets-5.113.0.tar.xz";
-      sha256 = "0f5shrapjvwp8bc34vypzfsfl07pj7nmdflf9lcwc8h3kwf2rxqr";
-      name = "kjobwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kjobwidgets-5.114.0.tar.xz";
+      sha256 = "1ymlqi5cqcs79nj1vff8pqwgvy0dxj5vv7l529w3a3n315hkrny8";
+      name = "kjobwidgets-5.114.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kjs-5.113.0.tar.xz";
-      sha256 = "0h50jyd9mddnavafikn9haqqcq1mql2v8qcc1c233ffplkx1f6hb";
-      name = "kjs-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kjs-5.114.0.tar.xz";
+      sha256 = "08nh6yr6bqifpb5s9a4wbjwmwnm7zp5k8hcdmyb6mlcbam9qp6j7";
+      name = "kjs-5.114.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kjsembed-5.113.0.tar.xz";
-      sha256 = "0bwsj0n3d038vs3n2mw6x8srbg4da40bw59q14cpv70ws1sg2r2n";
-      name = "kjsembed-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kjsembed-5.114.0.tar.xz";
+      sha256 = "1xglisxv7nfsbj9lgpvc4c5ql4f6m7n71vf7vih5ff3aqybrkgxa";
+      name = "kjsembed-5.114.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kmediaplayer-5.113.0.tar.xz";
-      sha256 = "1nyn7x28j17yrb7zx31519h2ghp5h3pwk6baxais0q1mv9azyfay";
-      name = "kmediaplayer-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kmediaplayer-5.114.0.tar.xz";
+      sha256 = "092yvzvrkvr8xxncw7h5ghfd2bggzxsqfj67c2vhymhfw4i0c54x";
+      name = "kmediaplayer-5.114.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knewstuff-5.113.0.tar.xz";
-      sha256 = "0fj17rxyp9wmmc9jh8zjpgwpia9r4xlvabvkb4ynd1vhy58k8w51";
-      name = "knewstuff-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knewstuff-5.114.0.tar.xz";
+      sha256 = "15xmx7rnnrsz2cj044aviyr4hi9h8r0nnva9qzcjcq2hkkgj7wjj";
+      name = "knewstuff-5.114.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knotifications-5.113.0.tar.xz";
-      sha256 = "1yzpf12wsi3h3v7z68b42rjdrnfkah6avq4y611b0r004shgkl1x";
-      name = "knotifications-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knotifications-5.114.0.tar.xz";
+      sha256 = "0cjd5ml9hyzprjgmrc132cmp7g9hnl0h5swlxw2ifqnxxyfkg72b";
+      name = "knotifications-5.114.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knotifyconfig-5.113.0.tar.xz";
-      sha256 = "1gdzyxcc371lmnzc153k8wdyxgsv7r2y44j8d5srld36amssxnc6";
-      name = "knotifyconfig-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knotifyconfig-5.114.0.tar.xz";
+      sha256 = "049n64qlr69zv1dc1dhgbsca37179hp06xfsxnhg97lblz3p3gds";
+      name = "knotifyconfig-5.114.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpackage-5.113.0.tar.xz";
-      sha256 = "04605kr2w0yhwx64lqq1qc1zmmip7vkxnxv3fs2846864814fkk2";
-      name = "kpackage-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpackage-5.114.0.tar.xz";
+      sha256 = "0v165az3k5lfszxy0kl2464573y0dcq92fyfiklwnkkcjsvba69d";
+      name = "kpackage-5.114.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kparts-5.113.0.tar.xz";
-      sha256 = "0mx95xrr6pad4q5p0sn2iqmc59787bpfkvkyiz9li56wynh1jf48";
-      name = "kparts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kparts-5.114.0.tar.xz";
+      sha256 = "1rrf765p554r7l8j23gx5zxdq6wimh0v91qdkwz7ilm2qr16vd5v";
+      name = "kparts-5.114.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpeople-5.113.0.tar.xz";
-      sha256 = "08g44hq1iywycf44imdqkql4gx2vyg87n1nxxqq6ssva0kybia7n";
-      name = "kpeople-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpeople-5.114.0.tar.xz";
+      sha256 = "04v0s3amn6lbb16qvp1r6figckva6xk8z7djk8jda8fbnx8dx2r1";
+      name = "kpeople-5.114.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kplotting-5.113.0.tar.xz";
-      sha256 = "16pfia711y9iqnl0svyg00g7a2x4ln8yaxmrmy74xj7y0dj5jcyj";
-      name = "kplotting-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kplotting-5.114.0.tar.xz";
+      sha256 = "17x58pplln0plqiyhjpzdiqxngylxq5gkc5gk7b91xzm783x2k0n";
+      name = "kplotting-5.114.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpty-5.113.0.tar.xz";
-      sha256 = "0hzn18lidiiaxr08fjhk0r5zh0m01ls46w1fyjnv42bvf7vd7v5y";
-      name = "kpty-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpty-5.114.0.tar.xz";
+      sha256 = "0fm7bfp89kvg1a64q8piiyal71p6vjnqcm13zak6r9fbfwcm0gs9";
+      name = "kpty-5.114.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kquickcharts-5.113.0.tar.xz";
-      sha256 = "0v47c6mdx72rdz441zk4csc6a2bj6wi7772vlpz2yr3ay70l8f5d";
-      name = "kquickcharts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kquickcharts-5.114.0.tar.xz";
+      sha256 = "1f91x92qdzxp31z7ixx9jn41hq9f3w9hjia94pab9vsnaz8prbd1";
+      name = "kquickcharts-5.114.0.tar.xz";
     };
   };
   kross = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kross-5.113.0.tar.xz";
-      sha256 = "1cqdcm086a4kjrb9k6cwqn05fg5ij3zppc8bi7dxrgrfxc494c8s";
-      name = "kross-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kross-5.114.0.tar.xz";
+      sha256 = "0bbpi63lxbb4ylx2jd172a2bqyxkd606n7w8zrvcjy466lkv3sz4";
+      name = "kross-5.114.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/krunner-5.113.0.tar.xz";
-      sha256 = "0z7d6nyvrlgr7aw9ibz1xgp62220iwzvhqpqikwlxhc9hjggmdlh";
-      name = "krunner-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/krunner-5.114.0.tar.xz";
+      sha256 = "1rjs9b87bi4f6pdm9fwnha2sj2mrq260l80iz2jq1zah83p546sw";
+      name = "krunner-5.114.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kservice-5.113.0.tar.xz";
-      sha256 = "09ph72jb40pkw1nzayvzzav4m6240amkj6jvx390dmsvr7jzn0nb";
-      name = "kservice-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kservice-5.114.0.tar.xz";
+      sha256 = "0jdvlplnsb9w628wh3ip6awxvhgyc097zh7ls9614ymkbnpc9xca";
+      name = "kservice-5.114.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ktexteditor-5.113.0.tar.xz";
-      sha256 = "02nclhfgqximsl8w6la5w0fshzcj71nrz5kjb2p1s28xdf1ahvgg";
-      name = "ktexteditor-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ktexteditor-5.114.0.tar.xz";
+      sha256 = "06amzk6290imi2gj3v1k3f56zdlad7zbz4wwlf34v4iibj9mfgw8";
+      name = "ktexteditor-5.114.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ktextwidgets-5.113.0.tar.xz";
-      sha256 = "060grfna4kj8nhxgk38yf3csqfgxg0358dkwmg8aw5y5k0jys2az";
-      name = "ktextwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ktextwidgets-5.114.0.tar.xz";
+      sha256 = "0w1wwyd3fy351rmkhf3i55is5031j2zxvswm0b1sb3pd159v888v";
+      name = "ktextwidgets-5.114.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kunitconversion-5.113.0.tar.xz";
-      sha256 = "1x7gwrz43wvd3r87x545bxxyzhqj87mhhx05dqh0b09vqk6gxzza";
-      name = "kunitconversion-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kunitconversion-5.114.0.tar.xz";
+      sha256 = "1qyqvl8fy105zwma5nrkz9zg5932w2f33daw0azhj322iffrm39n";
+      name = "kunitconversion-5.114.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwallet-5.113.0.tar.xz";
-      sha256 = "0aq8d5c5p9j19bzspd205gh297n7fh5f26m49826fx5mp1im4lwn";
-      name = "kwallet-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwallet-5.114.0.tar.xz";
+      sha256 = "1cji8bvy5m77zljyrrgipsw8pxcds1sgikxlq3sdfxymcsw2wr36";
+      name = "kwallet-5.114.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwayland-5.113.0.tar.xz";
-      sha256 = "1anhvz4b1q835py451jznnfj9z2jh1fwnx4lfwhi67viaplpiwqg";
-      name = "kwayland-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwayland-5.114.0.tar.xz";
+      sha256 = "1lzmlbv5vl656cigjj07hbc0gj6g1i2xqanvnhxj360109kzilf1";
+      name = "kwayland-5.114.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwidgetsaddons-5.113.0.tar.xz";
-      sha256 = "01rabfl2v5l9r3fgwgy75krib1486mdc4k3kfi035s6dvg8iy015";
-      name = "kwidgetsaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwidgetsaddons-5.114.0.tar.xz";
+      sha256 = "1cc8lsk9v0cp2wiy1q26mlkf8np0yj01sq8a7w13ga5s6hv4sh2n";
+      name = "kwidgetsaddons-5.114.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwindowsystem-5.113.0.tar.xz";
-      sha256 = "1hzavawsl14rsl9qb874zahvsvkrbcin7fg1xn1d7ssypphlis51";
-      name = "kwindowsystem-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwindowsystem-5.114.0.tar.xz";
+      sha256 = "03xbsf1pmswd2kpn3pdszp4vndclsh7j02fp22npxaxllmfr4va9";
+      name = "kwindowsystem-5.114.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kxmlgui-5.113.0.tar.xz";
-      sha256 = "022l557z9jgrz2hj8hh9z7cjkvfhl5rdp81jhk2gd3wzmyf5zzmq";
-      name = "kxmlgui-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kxmlgui-5.114.0.tar.xz";
+      sha256 = "0gvjf32ssc0r0bdpb1912ldsr5rjls8vrscwy5gm9g5gw504hmmr";
+      name = "kxmlgui-5.114.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kxmlrpcclient-5.113.0.tar.xz";
-      sha256 = "141vlxxnyll5q0wg2va5prg0wf0hpymlzfkg37h1ngjwjs2x2yc1";
-      name = "kxmlrpcclient-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kxmlrpcclient-5.114.0.tar.xz";
+      sha256 = "1fgjai3vj3yk67ynhd7blilyrdhdn5nvma3v3j1sbdg98pr7qzar";
+      name = "kxmlrpcclient-5.114.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/modemmanager-qt-5.113.0.tar.xz";
-      sha256 = "069irg7ckws06qzq5mwkxvzx4r2xqwagwif6dq284hjihrz38l8b";
-      name = "modemmanager-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/modemmanager-qt-5.114.0.tar.xz";
+      sha256 = "16jqhmcpsffl9a7c0bb4hwjy3bw5rakdsnc5n6y8djc6237jl9pi";
+      name = "modemmanager-qt-5.114.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/networkmanager-qt-5.113.0.tar.xz";
-      sha256 = "03wdbw6dr9a49qcs1j2lm9q894rvdl8xqjpwm3yrrjb866yyhcg1";
-      name = "networkmanager-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/networkmanager-qt-5.114.0.tar.xz";
+      sha256 = "10anjsnrzawrfjlznjvvl2sbxrajl2ddnq2kgl314b5dk7z3yk4n";
+      name = "networkmanager-qt-5.114.0.tar.xz";
     };
   };
   oxygen-icons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/oxygen-icons-5.113.0.tar.xz";
-      sha256 = "0grdn0gz59lfp4n5mmlan71x3iwgm87dnhk8mla02dn7hv0fl0xx";
-      name = "oxygen-icons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/oxygen-icons-5.114.0.tar.xz";
+      sha256 = "0f6hv5g8y2ggagrq9x9b78bqxqg6bqcpm1xxhf69ybgjikrqdf2r";
+      name = "oxygen-icons-5.114.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/plasma-framework-5.113.0.tar.xz";
-      sha256 = "0iijawnh9ri1n6qgdrraf3lq5sy7z0jy5ihmfzk22pn10ba992ky";
-      name = "plasma-framework-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/plasma-framework-5.114.0.tar.xz";
+      sha256 = "058hl76q35bw3rzmv348azk1lmhkpgmfrxr3jd9s1hphijr8sgcx";
+      name = "plasma-framework-5.114.0.tar.xz";
     };
   };
   prison = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/prison-5.113.0.tar.xz";
-      sha256 = "18y4gxj5zml59a8i7gzr5cbbzi5wyknbva2ihfdpqf85vw3x2wdp";
-      name = "prison-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/prison-5.114.0.tar.xz";
+      sha256 = "1wbr1lryxmrx65ilq1bhqsdhhikrih977nhpb02fq0cqnvv7v9i7";
+      name = "prison-5.114.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/purpose-5.113.0.tar.xz";
-      sha256 = "0p5zcvrkaw71w8795x2a4lx3z977j6jcnwbi9wi1956gcx4avhhf";
-      name = "purpose-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/purpose-5.114.0.tar.xz";
+      sha256 = "1lj67f0x4gvbh9by3c3crbbwwnx7b9ifjna9ggziya4m6zj0m4z1";
+      name = "purpose-5.114.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/qqc2-desktop-style-5.113.0.tar.xz";
-      sha256 = "0sk0sk7cq511m0rjmgsg1z8s4sy064qmbql472ljyblafm71wj6p";
-      name = "qqc2-desktop-style-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/qqc2-desktop-style-5.114.0.tar.xz";
+      sha256 = "1y5g91vybjvhwmzpfwrc70q5j7jxf5b972f9fh2vzb930jir6c8g";
+      name = "qqc2-desktop-style-5.114.0.tar.xz";
     };
   };
   solid = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/solid-5.113.0.tar.xz";
-      sha256 = "0vhhkn15axfvlwrf9np91hnipw1lb2x9zh0ajpngvxzcnj6kvn7r";
-      name = "solid-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/solid-5.114.0.tar.xz";
+      sha256 = "1slxlj5jhp8g745l328932934633nl81sq3n8fd73h655hymsk4s";
+      name = "solid-5.114.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/sonnet-5.113.0.tar.xz";
-      sha256 = "17v3a2j0vhx7mzv0wfgqky248m57gasyv1xbjqpzjdr3x2f1zhy6";
-      name = "sonnet-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/sonnet-5.114.0.tar.xz";
+      sha256 = "0zxi96i3gfpx759qc1nyz7jqlswg5ivgr1w9gbbsm1x5fi9ikadx";
+      name = "sonnet-5.114.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/syndication-5.113.0.tar.xz";
-      sha256 = "1nzcfk4qsjvrgci3vk78jjpbig61pm0y73h3qs83yld1zw3az3jx";
-      name = "syndication-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/syndication-5.114.0.tar.xz";
+      sha256 = "13rjb1zm9yd8vbm9h7avqih5v0rr2srqwglm29l7mcnankqlh4n7";
+      name = "syndication-5.114.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/syntax-highlighting-5.113.0.tar.xz";
-      sha256 = "1blifnqikvrlkcskwjdk54mvh8yd4r0vzz282mi64w7alimlilgl";
-      name = "syntax-highlighting-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/syntax-highlighting-5.114.0.tar.xz";
+      sha256 = "1skblg2m0sar63qrgkjsg0w9scixggm5qj7lp4gzjn4hwq6m3n63";
+      name = "syntax-highlighting-5.114.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/threadweaver-5.113.0.tar.xz";
-      sha256 = "1x7i7mdg5v22y04m720k9fqj7xagm8qnlssb1xjs9nj0aqif8jgp";
-      name = "threadweaver-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/threadweaver-5.114.0.tar.xz";
+      sha256 = "1y07g58w6z3i11y3djg3aaxanhp9hzaciq61l4dn1gqwghn09xgh";
+      name = "threadweaver-5.114.0.tar.xz";
     };
   };
 }

From c806c71ce050e29b5271b7734b0ebb0cda783f72 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Sat, 13 Jan 2024 13:09:32 -0500
Subject: [PATCH 105/175] maturin: 1.3.0 -> 1.4.0

---
 pkgs/development/tools/rust/maturin/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 37cec14ee4c4..fa17f4f03624 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-MVmu9m+9XhWuPBEEoaYmsSbMFziSZaM5Gg5kOr1DT54=";
+    hash = "sha256-mD/7wWeclV5Xqii9hcZMustvR6tf7MoyTZ3WsvEc61U=";
   };
 
-  cargoHash = "sha256-hrdrGFtL2vGczINnvDa4rclkXsNWnEqtTt3NVaRay8w=";
+  cargoHash = "sha256-w8XpCJ8GS2VszW/9/O2suy82zVO1UpWTrU1lFGYwhvw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 

From 63973dee0a2fb79f68b53b2bdb4781a64f1b1b24 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 9 Jan 2024 23:23:41 +0000
Subject: [PATCH 106/175] autoconf271, autoreconfHook271: hold back a version

Some package will require significant rework to support autoconf-2.72.
Example are `firebird` and `python3Packages.awslambdaric`. Let's leave
them on previous version until it's sorted upstream.
---
 pkgs/development/tools/misc/autoconf/2.71.nix | 69 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  8 ++-
 2 files changed, 74 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/development/tools/misc/autoconf/2.71.nix

diff --git a/pkgs/development/tools/misc/autoconf/2.71.nix b/pkgs/development/tools/misc/autoconf/2.71.nix
new file mode 100644
index 000000000000..1fcb819bd4b7
--- /dev/null
+++ b/pkgs/development/tools/misc/autoconf/2.71.nix
@@ -0,0 +1,69 @@
+{ lib, stdenv, fetchurl, m4, perl, texinfo }:
+
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
+stdenv.mkDerivation rec {
+  pname = "autoconf";
+  version = "2.71";
+  outputs = [ "out" "doc" ];
+
+  src = fetchurl {
+    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
+    sha256 = "197sl23irn6s9pd54rxj5vcp5y8dv65jb9yfqgr2g56cxg7q6k7i";
+  };
+  patches = [
+    # fix stale autom4te cache race condition:
+    #  https://savannah.gnu.org/support/index.php?110521
+    ./2.71-fix-race.patch
+  ];
+
+  strictDeps = true;
+  nativeBuildInputs = [ m4 perl texinfo ];
+  buildInputs = [ m4 ];
+  postBuild = "
+    make html
+  ";
+
+  postInstall = "
+    make install-html
+  ";
+
+  # Work around a known issue in Cygwin.  See
+  # http://thread.gmane.org/gmane.comp.sysutils.autoconf.bugs/6822 for
+  # details.
+  # There are many test failures on `i386-pc-solaris2.11'.
+  doCheck = ((!stdenv.isCygwin) && (!stdenv.isSunOS));
+
+  # Don't fixup "#! /bin/sh" in Autoconf, otherwise it will use the
+  # "fixed" path in generated files!
+  dontPatchShebangs = true;
+
+  enableParallelBuilding = true;
+
+  # Make the Autotest test suite run in parallel.
+  preCheck =''
+    export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
+  '';
+
+  meta = {
+    homepage = "https://www.gnu.org/software/autoconf/";
+    description = "Part of the GNU Build System";
+
+    longDescription = ''
+      GNU Autoconf is an extensible package of M4 macros that produce
+      shell scripts to automatically configure software source code
+      packages.  These scripts can adapt the packages to many kinds of
+      UNIX-like systems without manual user intervention.  Autoconf
+      creates a configuration script for a package from a template
+      file that lists the operating system features that the package
+      can use, in the form of M4 macro calls.
+    '';
+
+    license = lib.licenses.gpl3Plus;
+
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1f86bfebd832..0c56530fe638 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -184,6 +184,9 @@ with pkgs;
   autoreconfHook269 = autoreconfHook.override {
     autoconf = autoconf269;
   };
+  autoreconfHook271 = autoreconfHook.override {
+    autoconf = autoconf271;
+  };
 
   autorestic = callPackage ../tools/backup/autorestic { };
 
@@ -18478,14 +18481,13 @@ with pkgs;
 
   autobuild = callPackage ../development/tools/misc/autobuild { };
 
-  autoconf = autoconf271;
-
   autoconf-archive = callPackage ../development/tools/misc/autoconf-archive { };
 
+  autoconf = callPackage ../development/tools/misc/autoconf { };
   autoconf213 = callPackage ../development/tools/misc/autoconf/2.13.nix { };
   autoconf264 = callPackage ../development/tools/misc/autoconf/2.64.nix { };
   autoconf269 = callPackage ../development/tools/misc/autoconf/2.69.nix { };
-  autoconf271 = callPackage ../development/tools/misc/autoconf { };
+  autoconf271 = callPackage ../development/tools/misc/autoconf/2.71.nix { };
 
   acr  = callPackage ../development/tools/misc/acr { };
 

From 24f0289b18ed4e0b32b3e55ddbcf87d93692f278 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 10 Jan 2024 09:49:28 +0000
Subject: [PATCH 107/175] python3Packages.awslambdaric: pin to `autoconf-2.71`

Without the change `python3Packages.awslambdaric` fails the build
against `autoconf-2.72` as:

    python3.11-awslambdaric> checking curl version... 7.83.1
    python3.11-awslambdaric> ./configure: line 6673: syntax error near unexpected token `;;'
    python3.11-awslambdaric> ./configure: line 6673: ` ;;'

`python3Packages.awslambdaric` embeds tarballs of external dependencies
and is a bit tricky to patch. Let's pin it to a working version.
---
 pkgs/development/python-modules/awslambdaric/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/awslambdaric/default.nix b/pkgs/development/python-modules/awslambdaric/default.nix
index 3e20875ac15d..788148d5e441 100644
--- a/pkgs/development/python-modules/awslambdaric/default.nix
+++ b/pkgs/development/python-modules/awslambdaric/default.nix
@@ -5,7 +5,7 @@
 , fetchpatch
 , isPy27
 , pytestCheckHook
-, autoconf
+, autoconf271
 , automake
 , cmake
 , gcc
@@ -44,7 +44,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ simplejson ];
 
-  nativeBuildInputs = [ autoconf automake cmake libtool perl setuptools ];
+  nativeBuildInputs = [ autoconf271 automake cmake libtool perl setuptools ];
 
   buildInputs = [ gcc ];
 

From 7684034cd99d49da0dbb90853c1c5df6f4a94aa8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 10 Jan 2024 10:19:58 +0000
Subject: [PATCH 108/175] firebird: pin to `autoconf-2.71`

Without the change `firebird` builds fail against `autconf-2.72` as:

    checking for cc_r... gcc
    ./configure: line 5894: syntax error near unexpected token `;;'
    ./configure: line 5894: `printf "%s\n" "$as_me: WARNING: --with-system-editline specified, not found. Using bundled editline" >&2;} ;;'

Upstream switched to `cmake` for new releases. Let's pin older ones to
`autoconf-2.71`.
---
 pkgs/servers/firebird/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/firebird/default.nix b/pkgs/servers/firebird/default.nix
index e49f683da877..7e7387819ab0 100644
--- a/pkgs/servers/firebird/default.nix
+++ b/pkgs/servers/firebird/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, libedit, autoreconfHook, zlib, unzip, libtommath, libtomcrypt, icu, superServer ? false }:
+{ lib, stdenv, fetchFromGitHub, libedit, autoreconfHook271, zlib, unzip, libtommath, libtomcrypt, icu, superServer ? false }:
 
 let base = {
   pname = "firebird";
@@ -13,7 +13,7 @@ let base = {
     maintainers = with maintainers; [ marcweber ];
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook271 ];
 
   buildInputs = [ libedit icu ];
 

From 62abc91b9fa2bd651bb7bb0a7f7fecb9285130c0 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 9 Sep 2022 11:40:22 +0100
Subject: [PATCH 109/175] autoconf: 2.71 -> 2.72

Changes: https://lists.gnu.org/archive/html/info-gnu/2023-12/msg00002.html
---
 pkgs/development/tools/misc/autoconf/default.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix
index 1fcb819bd4b7..8039e36a4f20 100644
--- a/pkgs/development/tools/misc/autoconf/default.nix
+++ b/pkgs/development/tools/misc/autoconf/default.nix
@@ -7,18 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "autoconf";
-  version = "2.71";
+  version = "2.72";
   outputs = [ "out" "doc" ];
 
   src = fetchurl {
     url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
-    sha256 = "197sl23irn6s9pd54rxj5vcp5y8dv65jb9yfqgr2g56cxg7q6k7i";
+    hash = "sha256-uohcExlXjWyU1G6bDc60AUyq/iSQ5Deg28o/JwoiP1o=";
   };
-  patches = [
-    # fix stale autom4te cache race condition:
-    #  https://savannah.gnu.org/support/index.php?110521
-    ./2.71-fix-race.patch
-  ];
 
   strictDeps = true;
   nativeBuildInputs = [ m4 perl texinfo ];

From bf6e25382e5ecb9ba8732b062cc4fac8c7c4e8e6 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sat, 13 Jan 2024 21:50:23 +0200
Subject: [PATCH 110/175] python311Packages.pythran: 0.14.0 -> 0.15.0

Diff: https://github.com/serge-sans-paille/pythran/compare/0.14.0...0.15.0
---
 pkgs/development/python-modules/pythran/default.nix | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/pythran/default.nix b/pkgs/development/python-modules/pythran/default.nix
index 047a4ea1af07..1851eb3bbf23 100644
--- a/pkgs/development/python-modules/pythran/default.nix
+++ b/pkgs/development/python-modules/pythran/default.nix
@@ -25,14 +25,14 @@ let
 
 in buildPythonPackage rec {
   pname = "pythran";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "serge-sans-paille";
     repo = "pythran";
     rev = version;
-    hash = "sha256-in0ty0aBAIx7Is13hjiHZGS8eKbhxb6TL3bENzfx5vQ=";
+    hash = "sha256-TpD8YZnnv48PKYrUqR0/qvJG1XRbcMBcrkcERh6Q4q0=";
   };
 
   patches = [
@@ -41,17 +41,12 @@ in buildPythonPackage rec {
       src = ./0001-hardcode-path-to-libgomp.patch;
       gomp = "${if stdenv.cc.isClang then openmp else stdenv.cc.cc.lib}/lib/libgomp${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
-    (fetchpatch {
-      # Python 3.12 support
-      url = "https://github.com/serge-sans-paille/pythran/commit/258ab9aaf26172f669eab1bf2a346b5f65db3ac0.patch";
-      hash = "sha256-T+FLptDYIgzHBSXShULqHr/G8ttBFamq1M5JlB2HxDM=";
-    })
   ];
 
   # xsimd: unvendor this header-only C++ lib
   postPatch = ''
-    rm -r third_party/xsimd
-    ln -s '${lib.getDev xsimd}'/include/xsimd third_party/
+    rm -r pythran/xsimd
+    ln -s '${lib.getDev xsimd}'/include/xsimd pythran/
   '';
 
   nativeBuildInputs = [

From 4edb91cc2f59fa4795de48d47ef4f1c3f2951d7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 28 Sep 2023 20:17:14 +0200
Subject: [PATCH 111/175] python3Packages.fonttools: remove interpolatable
 feature from tests

This just skips two tests but reduces the amount of dependencies by 270
including scipy which is very big and might not be build reliable on all
platforms.
---
 pkgs/development/python-modules/fonttools/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index db66e46f3d9d..e07ab3c0d953 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ lib.concatLists (lib.attrVals ([
     "woff"
-    "interpolatable"
+    # "interpolatable" is not included because it only contains 2 tests at the time of writing but adds 270 extra dependencies
     "ufo"
   ] ++ lib.optionals (!skia-pathops.meta.broken) [
     "pathops" # broken

From 15fe8361be36665b4e96e6df56567fe1f3f9d889 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 14 Jan 2024 19:19:16 +0000
Subject: [PATCH 112/175] lttng-ust: 2.13.6 -> 2.13.7

Changes: https://lore.kernel.org/lkml/26640415-9822-45d3-a713-060726de2166@efficios.com/T/
---
 pkgs/development/tools/misc/lttng-ust/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/lttng-ust/default.nix b/pkgs/development/tools/misc/lttng-ust/default.nix
index 0c19b59c5c35..b1fb9c83e8d0 100644
--- a/pkgs/development/tools/misc/lttng-ust/default.nix
+++ b/pkgs/development/tools/misc/lttng-ust/default.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "2.13.6";
-  sha256 = "sha256-5+BFlt1zrHqpnifNAA+UnbsP7VG9KQmfmwiiXB3wztU=";
+  version = "2.13.7";
+  sha256 = "sha256-X7TxfDB8jBt5xoVh6JvpVi0H50Jb9A5yjE1mdVNCpes=";
 }

From e07a2fab7f065c3fa084027f07dcf8cafbd19394 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Thu, 12 Oct 2023 23:43:03 +0200
Subject: [PATCH 113/175] stdenv: substituteStream: deprecate --replace in
 favor of --replace-{fail,warn,quiet}

---
 .../emscripten.section.md                     |  6 ++---
 doc/languages-frameworks/rust.section.md      |  2 +-
 doc/stdenv/platform-notes.chapter.md          |  2 +-
 doc/stdenv/stdenv.chapter.md                  | 23 +++++++++++-----
 .../manual/release-notes/rl-2405.section.md   |  2 ++
 pkgs/stdenv/generic/setup.sh                  | 27 ++++++++++++++++++-
 6 files changed, 50 insertions(+), 12 deletions(-)

diff --git a/doc/languages-frameworks/emscripten.section.md b/doc/languages-frameworks/emscripten.section.md
index 20d358f2e9e3..9ce48db2c2de 100644
--- a/doc/languages-frameworks/emscripten.section.md
+++ b/doc/languages-frameworks/emscripten.section.md
@@ -86,9 +86,9 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
 
   postPatch = pkgs.lib.optionalString pkgs.stdenv.isDarwin ''
     substituteInPlace configure \
-      --replace '/usr/bin/libtool' 'ar' \
-      --replace 'AR="libtool"' 'AR="ar"' \
-      --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
+      --replace-fail '/usr/bin/libtool' 'ar' \
+      --replace-fail 'AR="libtool"' 'AR="ar"' \
+      --replace-fail 'ARFLAGS="-o"' 'ARFLAGS="-r"'
   '';
 })
 ```
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 9be381c0bfe2..8191722071e9 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -700,7 +700,7 @@ with import <nixpkgs> {};
     hello = attrs: lib.optionalAttrs (lib.versionAtLeast attrs.version "1.0")  {
       postPatch = ''
         substituteInPlace lib/zoneinfo.rs \
-          --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+          --replace-fail "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
       '';
     };
   };
diff --git a/doc/stdenv/platform-notes.chapter.md b/doc/stdenv/platform-notes.chapter.md
index b47f5af349b8..409c9f2e7b2e 100644
--- a/doc/stdenv/platform-notes.chapter.md
+++ b/doc/stdenv/platform-notes.chapter.md
@@ -54,7 +54,7 @@ Some common issues when packaging software for Darwin:
     # ...
     prePatch = ''
       substituteInPlace Makefile \
-          --replace '/usr/bin/xcrun clang' clang
+          --replace-fail '/usr/bin/xcrun clang' clang
     '';
   }
   ```
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index c66301bcb1c8..c9c30fde172d 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -230,9 +230,9 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     substituteInPlace $out/bin/solo5-virtio-mkimage \
-      --replace "/usr/lib/syslinux" "${syslinux}/share/syslinux" \
-      --replace "/usr/share/syslinux" "${syslinux}/share/syslinux" \
-      --replace "cp " "cp --no-preserve=mode "
+      --replace-fail "/usr/lib/syslinux" "${syslinux}/share/syslinux" \
+      --replace-fail "/usr/share/syslinux" "${syslinux}/share/syslinux" \
+      --replace-fail "cp " "cp --no-preserve=mode "
 
     wrapProgram $out/bin/solo5-virtio-mkimage \
       --prefix PATH : ${lib.makeBinPath [ dosfstools mtools parted syslinux ]}
@@ -1253,9 +1253,20 @@ postInstall = ''
 
 Performs string substitution on the contents of \<infile\>, writing the result to \<outfile\>. The substitutions in \<subs\> are of the following form:
 
-#### `--replace` \<s1\> \<s2\> {#fun-substitute-replace}
+#### `--replace-fail` \<s1\> \<s2\> {#fun-substitute-replace-fail}
 
 Replace every occurrence of the string \<s1\> by \<s2\>.
+Will error if no change is made.
+
+#### `--replace-warn` \<s1\> \<s2\> {#fun-substitute-replace-warn}
+
+Replace every occurrence of the string \<s1\> by \<s2\>.
+Will print a warning if no change is made.
+
+#### `--replace-quiet` \<s1\> \<s2\> {#fun-substitute-replace-quiet}
+
+Replace every occurrence of the string \<s1\> by \<s2\>.
+Will do nothing if no change can be made.
 
 #### `--subst-var` \<varName\> {#fun-substitute-subst-var}
 
@@ -1269,8 +1280,8 @@ Example:
 
 ```shell
 substitute ./foo.in ./foo.out \
-    --replace /usr/bin/bar $bar/bin/bar \
-    --replace "a string containing spaces" "some other text" \
+    --replace-fail /usr/bin/bar $bar/bin/bar \
+    --replace-fail "a string containing spaces" "some other text" \
     --subst-var someVar
 ```
 
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index aba4d3d72d1d..65980e3052e9 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -160,6 +160,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - The option [`services.nextcloud.config.dbport`] of the Nextcloud module was removed to match upstream.
   The port can be specified in [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost).
 
+- `stdenv`: The `--replace` flag in `substitute`, `substituteInPlace`, `substituteAll`, `substituteAllStream`, and `substituteStream` is now deprecated if favor of the new `--replace-fail`, `--replace-warn` and `--replace-quiet`. The deprecated `--replace` equates to `--replace-warn`.
+
 - The Yama LSM is now enabled by default in the kernel, which prevents ptracing
   non-child processes. This means you will not be able to attach gdb to an
   existing process, but will need to start that process from gdb (so it is a
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index ec8df76f2c79..aa519cce4be8 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -815,6 +815,8 @@ fi
 ######################################################################
 # Textual substitution functions.
 
+# only log once, due to max logging limit on hydra
+_substituteStream_has_warned_replace_deprecation=""
 
 substituteStream() {
     local var=$1
@@ -822,8 +824,24 @@ substituteStream() {
     shift 2
 
     while (( "$#" )); do
+        local is_required=1
+        local is_quiet=""
         case "$1" in
+            --replace-quiet)
+                is_quiet=1
+                ;&
             --replace)
+                # deprecated 2023-11-22
+                # this will either get removed, or switch to the behaviour of --replace-fail in the future
+                if [ -z "$_substituteStream_has_warned_replace_deprecation" ]; then
+                    echo "substituteStream(): WARNING: '--replace' is deprecated, use --replace-{fail,warn,quiet}. ($description)" >&2
+                    _substituteStream_has_warned_replace_deprecation=1
+                fi
+                ;&
+            --replace-warn)
+                is_required=""
+                ;&
+            --replace-fail)
                 pattern="$2"
                 replacement="$3"
                 shift 3
@@ -832,7 +850,14 @@ substituteStream() {
                 eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
                 if [ "$pattern" != "$replacement" ]; then
                     if [ "${!var}" == "$savedvar" ]; then
-                        echo "substituteStream(): WARNING: pattern '$pattern' doesn't match anything in $description" >&2
+                        if [ -z "$is_required" ]; then
+                            if [ -z "$is_quiet" ]; then
+                                echo "substituteStream(): WARNING: pattern '$pattern' doesn't match anything in $description" >&2
+                            fi
+                        else
+                            echo "substituteStream(): ERROR: pattern '$pattern' doesn't match anything in $description" >&2
+                            return 1
+                        fi
                     fi
                 fi
                 ;;

From 4c1b74bac7712f825e7682d39e8f010bbc50cd08 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Wed, 22 Nov 2023 19:48:45 +0100
Subject: [PATCH 114/175] stdenv: substituteStream: escape echoed pattern in
 --replace mismatch warning

---
 pkgs/stdenv/generic/setup.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index aa519cce4be8..efb233312b57 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -852,10 +852,10 @@ substituteStream() {
                     if [ "${!var}" == "$savedvar" ]; then
                         if [ -z "$is_required" ]; then
                             if [ -z "$is_quiet" ]; then
-                                echo "substituteStream(): WARNING: pattern '$pattern' doesn't match anything in $description" >&2
+                                printf "substituteStream(): WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
                             fi
                         else
-                            echo "substituteStream(): ERROR: pattern '$pattern' doesn't match anything in $description" >&2
+                            printf "substituteStream(): ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
                             return 1
                         fi
                     fi

From 5cd9b0a6ba85d41061779de6b11d0d079cda0804 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 14 Jan 2024 23:15:38 +0100
Subject: [PATCH 115/175] redis: fix oom-score-adj test due to no permission

---
 pkgs/servers/nosql/redis/default.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index c3ac0ebbf969..796490a1ffd1 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, lua, jemalloc, pkg-config, nixosTests
+{ lib, stdenv, fetchurl, fetchpatch, lua, jemalloc, pkg-config, nixosTests
 , tcl, which, ps, getconf
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
 # dependency ordering is broken at the moment when building with openssl
@@ -19,7 +19,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-PisZbW603bnnQwiL/CkVzLtC1A9aij7djLaccW7DS+c=";
   };
 
-  patches = lib.optionals useSystemJemalloc [
+  patches = [
+    # fixes: make test [exception]: Executing test client: permission denied
+    # https://github.com/redis/redis/issues/12792
+    (fetchpatch {
+      url = "https://github.com/redis/redis/pull/12887.diff";
+      hash = "sha256-VZEMShW7Ckn5hLJHffQvE94Uly41WZW1bwvxny+Y3W8=";
+    })
+  ] ++ lib.optionals useSystemJemalloc [
     # use system jemalloc
     (fetchurl {
       url = "https://gitlab.archlinux.org/archlinux/packaging/packages/redis/-/raw/102cc861713c796756abd541bf341a4512eb06e6/redis-5.0-use-system-jemalloc.patch";

From ffe149b1c41b1f3b75114fd0184674a38988489c Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Mon, 15 Jan 2024 09:21:47 +0100
Subject: [PATCH 116/175] buildRubyGem: only use major minor in name (#229469)

This is similar to what pythonXxxPackages does and reduces the noise
`nix store diff-closure`
---
 pkgs/development/ruby-modules/gem/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index 7ae9168975ab..409c2c9d027b 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -34,7 +34,7 @@ lib.makeOverridable (
 , stdenv ? ruby.stdenv
 , namePrefix ? (let
     rubyName = builtins.parseDrvName ruby.name;
-  in "${rubyName.name}${rubyName.version}-")
+  in "${rubyName.name}${lib.versions.majorMinor rubyName.version}-")
 , nativeBuildInputs ? []
 , buildInputs ? []
 , meta ? {}

From 9de711cf62e9a5093b414cbbaca36747ce6f937a Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <1962985+xworld21@users.noreply.github.com>
Date: Sun, 26 Nov 2023 19:41:02 +0000
Subject: [PATCH 117/175] makeFontsConf: add impureFontDirectories argument

---
 .../libraries/fontconfig/make-fonts-conf.nix  | 21 +++++++++++++++----
 .../libraries/fontconfig/make-fonts-conf.xsl  | 20 ++++++++----------
 2 files changed, 26 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
index aa84de4dcecd..cfe0a21e1d35 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
@@ -1,16 +1,29 @@
-{ runCommand, stdenv, lib, libxslt, fontconfig, dejavu_fonts, fontDirectories }:
+{ runCommand, stdenv, lib, libxslt, fontconfig, dejavu_fonts, fontDirectories
+, impureFontDirectories ? [
+    # nix user profile
+    "~/.nix-profile/lib/X11/fonts" "~/.nix-profile/share/fonts"
+  ]
+  ++ lib.optional stdenv.isDarwin "~/Library/Fonts"
+  ++ [
+    # FHS paths for non-NixOS platforms
+    "/usr/share/fonts" "/usr/local/share/fonts"
+  ]
+  # darwin paths
+  ++ lib.optionals stdenv.isDarwin [ "/Library/Fonts" "/System/Library/Fonts" ]
+  # nix default profile
+  ++ [ "/nix/var/nix/profiles/default/lib/X11/fonts" "/nix/var/nix/profiles/default/share/fonts" ] }:
 
 runCommand "fonts.conf"
   {
     nativeBuildInputs = [ libxslt ];
     buildInputs = [ fontconfig ];
+    inherit fontDirectories;
     # Add a default font for non-nixos systems, <1MB and in nixos defaults.
-    fontDirectories = fontDirectories ++ [ dejavu_fonts.minimal ]
-      # further non-nixos fonts on darwin
-      ++ lib.optionals stdenv.isDarwin [ "/System/Library/Fonts" "/Library/Fonts" "~/Library/Fonts" ];
+    impureFontDirectories = impureFontDirectories ++ [ dejavu_fonts.minimal ];
   }
   ''
     xsltproc --stringparam fontDirectories "$fontDirectories" \
+      --stringparam impureFontDirectories "$impureFontDirectories" \
       --path ${fontconfig.out}/share/xml/fontconfig \
       ${./make-fonts-conf.xsl} ${fontconfig.out}/etc/fonts/fonts.conf \
       > $out
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
index ed51b62a1d08..d04e4ffab967 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
@@ -15,6 +15,7 @@
   <xsl:output method='xml' encoding="UTF-8" doctype-system="urn:fontconfig:fonts.dtd" />
 
   <xsl:param name="fontDirectories" />
+  <xsl:param name="impureFontDirectories" />
 
   <xsl:template match="/fontconfig">
 
@@ -23,29 +24,26 @@
 
       <!-- the first cachedir will be used to store the cache -->
       <cachedir prefix="xdg">fontconfig</cachedir>
+      <xsl:text>&#0010;</xsl:text>
       <!-- /var/cache/fontconfig is useful for non-nixos systems -->
       <cachedir>/var/cache/fontconfig</cachedir>
+      <xsl:text>&#0010;</xsl:text>
 
       <!-- system-wide config -->
       <include ignore_missing="yes">/etc/fonts/conf.d</include>
+      <xsl:text>&#0010;</xsl:text>
 
       <dir prefix="xdg">fonts</dir>
+      <xsl:text>&#0010;</xsl:text>
       <xsl:for-each select="str:tokenize($fontDirectories)">
         <dir><xsl:value-of select="." /></dir>
         <xsl:text>&#0010;</xsl:text>
       </xsl:for-each>
 
-      <!-- nix user profile -->
-      <dir>~/.nix-profile/lib/X11/fonts</dir>
-      <dir>~/.nix-profile/share/fonts</dir>
-
-      <!-- FHS paths for non-NixOS platforms -->
-      <dir>/usr/share/fonts</dir>
-      <dir>/usr/local/share/fonts</dir>
-
-      <!-- nix default profile -->
-      <dir>/nix/var/nix/profiles/default/lib/X11/fonts</dir>
-      <dir>/nix/var/nix/profiles/default/share/fonts</dir>
+      <xsl:for-each select="str:tokenize($impureFontDirectories)">
+        <dir><xsl:value-of select="." /></dir>
+        <xsl:text>&#0010;</xsl:text>
+      </xsl:for-each>
 
     </fontconfig>
 

From 0a599528c7d9f92f2803c105b1fa5ac06af235d8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 15 Jan 2024 17:25:18 +0000
Subject: [PATCH 118/175] pam: re-enable `pam_lastlog` module

Without the chnage login fails at least in VM tests as:

    $ nix build --no-link -f. gjs.tests -L
    ...
    vm-test-run-gjs> machine # [    6.331514] lightdm[1069]: PAM unable to dlopen(/nix/store/9p9ya5n7zi0smc3fb95ck2yvjma26dn5-linux-pam-1.5.3/lib/security/pam_lastlog.so): /nix/store/9p9ya5n7zi0smc3fb95ck2yvjma26dn5-linux-pam-1.5.3/lib/security/pam_lastlog.so: cannot open shared object file: No such file or directory
    vm-test-run-gjs> machine # [    6.332529] lightdm[1069]: PAM adding faulty module: /nix/store/9p9ya5n7zi0smc3fb95ck2yvjma26dn5-linux-pam-1.5.3/lib/security/pam_lastlog.so
---
 pkgs/os-specific/linux/pam/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 3b4c9cd0ad23..241f33f1e00a 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -57,6 +57,9 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--includedir=${placeholder "out"}/include/security"
     "--enable-sconfigdir=/etc/security"
+    # The module is deprecated. We re-enable it explicitly until NixOS
+    # module stops using it.
+    "--enable-lastlog"
   ];
 
   installFlags = [

From 74385d58d557f4ce8ece3ba1be870ed947e46fe2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 15 Jan 2024 21:53:21 +0000
Subject: [PATCH 119/175] libdrm: 2.4.119 -> 2.4.120

Changes: https://lists.x.org/archives/xorg-announce/2024-January/003441.html
---
 pkgs/development/libraries/libdrm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 5cb8f2cbad8e..8d8a932f4994 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.119";
+  version = "2.4.120";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-CknxLwm1tuaOqq/z8Cynz/mqkmk5shLTQxYdPorFYpE=";
+    hash = "sha256-O/VTY/dsclCUZEGrUdOmzArlGAVcD/AXMkq3bN77Mno=";
   };
 
   outputs = [ "out" "dev" "bin" ];

From fdc784172978c251bdd6f600d9e2ebd585844249 Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Mon, 15 Jan 2024 18:16:44 +0100
Subject: [PATCH 120/175] python3Packages.sip: 6.8.0 -> 6.8.1

---
 pkgs/development/python-modules/sip/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sip/default.nix b/pkgs/development/python-modules/sip/default.nix
index 4053e20a08d0..b36e64e632cf 100644
--- a/pkgs/development/python-modules/sip/default.nix
+++ b/pkgs/development/python-modules/sip/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "sip";
-  version = "6.8.0";
+  version = "6.8.1";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LtGQSCDLZhtyB+sdzPrr7BpUY9ytkDukSK0ZRVAtCJw=";
+    hash = "sha256-MALfQV4WisP/45OULbxxMcuCreUAAOFSb0aoit4m9Zg=";
   };
 
   nativeBuildInputs = [

From c4be1f71a512cbb4bd68ef8da99025023048f6d3 Mon Sep 17 00:00:00 2001
From: Matthieu Coudron <886074+teto@users.noreply.github.com>
Date: Mon, 15 Jan 2024 17:13:04 +0100
Subject: [PATCH 121/175] neovim-unwrapped: use finalAttrs

finalAttrs is more discoverable via REPL, hence I
- referenced doCheck via finalAttrs
---
 pkgs/applications/editors/neovim/default.nix | 27 ++++++++++----------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 60035e3f1b58..82bb404fd24a 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -12,11 +12,10 @@
 
 # now defaults to false because some tests can be flaky (clipboard etc), see
 # also: https://github.com/neovim/neovim/issues/16233
-, doCheck ? false
 , nodejs ? null, fish ? null, python3 ? null
 }:
-
-let
+stdenv.mkDerivation (finalAttrs:
+  let
   nvim-lpeg-dylib = luapkgs: if stdenv.isDarwin
     then (luapkgs.lpeg.overrideAttrs (oa: {
       preConfigure = ''
@@ -42,7 +41,7 @@ let
     (nvim-lpeg-dylib ps)
     luabitop
     mpack
-  ] ++ lib.optionals doCheck [
+  ] ++ lib.optionals finalAttrs.doCheck [
     luv
     coxpcall
     busted
@@ -64,17 +63,15 @@ let
         in deterministicLuajit.withPackages(ps: [ ps.mpack (nvim-lpeg-dylib ps) ])
       else lua.luaOnBuild;
 
-  pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
 
-in
-  stdenv.mkDerivation rec {
+in {
     pname = "neovim-unwrapped";
     version = "0.9.5";
 
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
-      rev = "v${version}";
+      rev = "v${finalAttrs.version}";
       hash = "sha256-CcaBqA0yFCffNPmXOJTo8c9v1jrEBiqAl8CG5Dj5YxE=";
     };
 
@@ -105,15 +102,17 @@ in
       tree-sitter
       unibilium
     ] ++ lib.optionals stdenv.isDarwin [ libiconv CoreServices ]
-      ++ lib.optionals doCheck [ glibcLocales procps ]
+      ++ lib.optionals finalAttrs.doCheck [ glibcLocales procps ]
     ;
 
-    inherit doCheck;
+    doCheck = false;
 
     # to be exhaustive, one could run
     # make oldtests too
     checkPhase = ''
+      runHook preCheck
       make functionaltest
+      runHook postCheck
     '';
 
     nativeBuildInputs = [
@@ -123,7 +122,9 @@ in
     ];
 
     # extra programs test via `make functionaltest`
-    nativeCheckInputs = [
+    nativeCheckInputs = let
+      pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
+    in [
       fish
       nodejs
       pyEnv      # for src/clint.py
@@ -166,7 +167,7 @@ in
         ln -s \
           ${tree-sitter.buildGrammar {
             inherit language src;
-            version = "neovim-${version}";
+            version = "neovim-${finalAttrs.version}";
           }}/parser \
           $out/lib/nvim/parser/${language}.so
       '')
@@ -199,4 +200,4 @@ in
       maintainers = with maintainers; [ manveru rvolosatovs ];
       platforms   = platforms.unix;
     };
-  }
+  })

From cbb7b09bad82e5a7b8a1dce70948652da05276fc Mon Sep 17 00:00:00 2001
From: Matthieu Coudron <886074+teto@users.noreply.github.com>
Date: Mon, 15 Jan 2024 17:34:43 +0100
Subject: [PATCH 122/175] neovim-unwrapped: enable structuredAttrs

To make treesitter-parsers referencable via finalAttrs, making it easier to modify/explore via repl
---
 pkgs/applications/editors/neovim/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 82bb404fd24a..aa5b007c4d1b 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -68,6 +68,8 @@ in {
     pname = "neovim-unwrapped";
     version = "0.9.5";
 
+    __structuredAttrs = true;
+
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
@@ -84,7 +86,7 @@ in {
 
     dontFixCmake = true;
 
-    inherit lua;
+    inherit lua treesitter-parsers;
 
     buildInputs = [
       gperf
@@ -171,7 +173,7 @@ in {
           }}/parser \
           $out/lib/nvim/parser/${language}.so
       '')
-      treesitter-parsers);
+      finalAttrs.treesitter-parsers);
 
     shellHook=''
       export VIMRUNTIME=$PWD/runtime

From 7abc6d260be68d9e55b085a53138dfdceedc417a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 15 Jan 2024 18:17:48 +0100
Subject: [PATCH 123/175] nixos/doc: add missing anchor for Linux Rust

Fixes: ec2016dda402 ("doc: explain how to enable Rust support in the Linux kernel")
---
 nixos/doc/manual/configuration/linux-kernel.chapter.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/doc/manual/configuration/linux-kernel.chapter.md b/nixos/doc/manual/configuration/linux-kernel.chapter.md
index 99c94fe64e82..31d8d1a7d0cf 100644
--- a/nixos/doc/manual/configuration/linux-kernel.chapter.md
+++ b/nixos/doc/manual/configuration/linux-kernel.chapter.md
@@ -92,7 +92,7 @@ To use your custom kernel package in your NixOS configuration, set
 boot.kernelPackages = pkgs.linuxPackagesFor yourCustomKernel;
 ```
 
-## Rust
+## Rust {#sec-linux-rust}
 
 The Linux kernel does not have Rust language support enabled by
 default. For kernel versions 6.7 or newer, experimental Rust support

From 1a9b407e593cddb112ba772578dfc2298c8a4983 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 17 Jan 2024 07:18:59 +0100
Subject: [PATCH 124/175] gnutls: 3.8.2 -> 3.8.3

Fixes CVE-2024-0553 and CVE-2024-0567
https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html
---
 pkgs/development/libraries/gnutls/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index bbbdf19a1909..b8c95653e366 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -35,11 +35,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    hash = "sha256-52XlAW/6m53SQ+NjoEYNV3B0RE7iSRJn2y6WycKt73c=";
+    hash = "sha256-90/FlUsn1Oxt+7Ed6ph4iLWxJCiaNwOvytoO5SD0Fz4=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];

From ee7012951002d6570e34e792497b29e40d75aba3 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 11:26:21 +0300
Subject: [PATCH 125/175] qt5, qt6: use versioned QML import paths in wrappers

Qt is smart enough to figure out the target Qt version for native plugins.
However, Qt is _not_ smart enough to figure out the target Qt version for
QML imports, which causes all kinds of funny breakage when you start running
Qt 5 applications from Qt 6 ones and vice versa.

So, do some minimally invasive surgery to make different Qt versions pick up
different QML import path variables, so they don't mess with each other.

This is kind of very cursed, but what can you do.
---
 .../libraries/qt-5/5.15/default.nix           |  2 ++
 .../qt-5/5.15/qtdeclarative-qml-paths.patch   | 33 +++++++++++++++++++
 .../libraries/qt-5/hooks/wrap-qt-apps-hook.sh |  2 +-
 .../libraries/qt-6/hooks/wrap-qt-apps-hook.sh |  2 +-
 .../libraries/qt-6/modules/qtdeclarative.nix  |  2 ++
 .../patches/qtdeclarative-qml-paths.patch     | 12 +++++++
 6 files changed, 51 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
 create mode 100644 pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch

diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 7a5ff60c9acb..b0e92290fe5b 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -51,6 +51,8 @@ let
       ./qtdeclarative.patch
       # prevent headaches from stale qmlcache data
       ./qtdeclarative-default-disable-qmlcache.patch
+      # add version specific QML import path
+      ./qtdeclarative-qml-paths.patch
     ];
     qtlocation = lib.optionals stdenv.cc.isClang [
       # Fix build with Clang 16
diff --git a/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
new file mode 100644
index 000000000000..2ea3554df7d2
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
@@ -0,0 +1,33 @@
+diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
+index 289f11d006..80c422403c 100644
+--- a/src/qml/qml/qqmlimport.cpp
++++ b/src/qml/qml/qqmlimport.cpp
+@@ -1897,17 +1897,22 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+     addImportPath(installImportsPath);
+ 
+     // env import paths
+-    if (Q_UNLIKELY(!qEnvironmentVariableIsEmpty("QML2_IMPORT_PATH"))) {
+-        const QString envImportPath = qEnvironmentVariable("QML2_IMPORT_PATH");
++    auto addEnvImportPath = [this](const char *var) {
+ #if defined(Q_OS_WIN)
+         QLatin1Char pathSep(';');
+ #else
+         QLatin1Char pathSep(':');
+ #endif
+-        QStringList paths = envImportPath.split(pathSep, Qt::SkipEmptyParts);
+-        for (int ii = paths.count() - 1; ii >= 0; --ii)
+-            addImportPath(paths.at(ii));
+-    }
++        if (Q_UNLIKELY(!qEnvironmentVariableIsEmpty(var))) {
++            const QString envImportPath = qEnvironmentVariable(var);
++            QStringList paths = envImportPath.split(pathSep, Qt::SkipEmptyParts);
++            for (int ii = paths.count() - 1; ii >= 0; --ii)
++                addImportPath(paths.at(ii));
++        }
++    };
++
++    addEnvImportPath("NIXPKGS_QT5_QML_IMPORT_PATH");
++    addEnvImportPath("QML2_IMPORT_PATH");
+ 
+     addImportPath(QStringLiteral("qrc:/qt-project.org/imports"));
+     addImportPath(QCoreApplication::applicationDirPath());
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index 2127be5e0a2a..94df0a1a8e66 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -31,7 +31,7 @@ qtHostPathHook() {
     local qmlDir="$1/${qtQmlPrefix:?}"
     if [ -d "$qmlDir" ]
     then
-        qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
+        qtWrapperArgs+=(--prefix NIXPKGS_QT5_QML_IMPORT_PATH : "$qmlDir")
     fi
 }
 addEnvHooks "$targetOffset" qtHostPathHook
diff --git a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
index 8b135a7d7492..2d858055693c 100644
--- a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
@@ -31,7 +31,7 @@ if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
 
         local qmlDir="$1/${qtQmlPrefix:?}"
         if [ -d "$qmlDir" ]; then
-            qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
+            qtWrapperArgs+=(--prefix NIXPKGS_QT6_QML_IMPORT_PATH : "$qmlDir")
         fi
     }
     addEnvHooks "$targetOffset" qtHostPathHook
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
index afdb24d1d291..697556e30edc 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
@@ -12,5 +12,7 @@ qtModule {
   patches = [
     # prevent headaches from stale qmlcache data
     ../patches/qtdeclarative-default-disable-qmlcache.patch
+    # add version specific QML import path
+    ../patches/qtdeclarative-qml-paths.patch
   ];
 }
diff --git a/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch b/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
new file mode 100644
index 000000000000..7c6694eb48a3
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
@@ -0,0 +1,12 @@
+diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
+index a7d1a3f77f..aac7392d4f 100644
+--- a/src/qml/qml/qqmlimport.cpp
++++ b/src/qml/qml/qqmlimport.cpp
+@@ -1515,6 +1515,7 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+     };
+ 
+     // env import paths
++    addEnvImportPath("NIXPKGS_QT6_QML_IMPORT_PATH");
+     addEnvImportPath("QML_IMPORT_PATH");
+     addEnvImportPath("QML2_IMPORT_PATH");
+ 

From aa1078442af22fde4aa70c72e97b09f78f878f04 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 17 Jan 2024 10:56:20 +0000
Subject: [PATCH 126/175] readline: 8.2p7 -> 8.2p10

---
 pkgs/development/libraries/readline/readline-8.2-patches.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/readline/readline-8.2-patches.nix b/pkgs/development/libraries/readline/readline-8.2-patches.nix
index bc075df237c7..77d5c495bac1 100644
--- a/pkgs/development/libraries/readline/readline-8.2-patches.nix
+++ b/pkgs/development/libraries/readline/readline-8.2-patches.nix
@@ -8,4 +8,7 @@ patch: [
 (patch "005" "16ac25jz1a1mgkpfp1sydqf6qpsfh0s0dcmrnjpqbhg5va3s6av2")
 (patch "006" "18gmh6y3klh0vv28cyqz4is3rlb32pl7f1kf5r482kfjq3w5zd67")
 (patch "007" "1xmnpahs983n4w0gn3j0wr8nh1dpva33yj7fvfmhm46ph2wsa4ar")
+(patch "008" "0smjjzhwxi2ibpdisnk53lh1pzgka6rhlqyh3662xy69v34ysxx1")
+(patch "009" "05m1fwbs7mbs3pz3pg87gbbayandrrcgaqawzliqb6g1jbk8b61x")
+(patch "010" "0k3vyrjs2g6y2cfs03l2gp37fhxgqpiwvxb1c7z4q88cbb32x3km")
 ]

From b7420a771c4675a46f07b1333c04052a8068982a Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Tue, 16 Jan 2024 22:16:13 +0100
Subject: [PATCH 127/175] qrencode: move test into passthru

This is needed to break a dependency for systemd.
---
 pkgs/development/libraries/qrencode/default.nix | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/qrencode/default.nix b/pkgs/development/libraries/qrencode/default.nix
index a0e23813ade2..83c20fcd5120 100644
--- a/pkgs/development/libraries/qrencode/default.nix
+++ b/pkgs/development/libraries/qrencode/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, SDL2, libpng, libiconv, libobjc }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: rec {
   pname = "qrencode";
   version = "4.1.1";
 
@@ -16,13 +16,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ libiconv libpng ]
     ++ lib.optionals stdenv.isDarwin [ libobjc ];
 
-  configureFlags = [
-    "--with-tests"
-  ];
-
   nativeCheckInputs = [ SDL2 ];
 
-  doCheck = true;
+  doCheck = false;
 
   checkPhase = ''
     runHook preCheck
@@ -34,6 +30,11 @@ stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
+  passthru.tests = finalAttrs.finalPackage.overrideAttrs (_: {
+    configureFlags = [ "--with-tests" ];
+    doCheck = true;
+  });
+
   meta = with lib; {
     homepage = "https://fukuchi.org/works/qrencode/";
     description = "C library for encoding data in a QR Code symbol";
@@ -47,4 +48,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     mainProgram = "qrencode";
   };
-}
+})

From 329de0f51e692cb6b226faad96915f1a7e071f2e Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Thu, 16 Nov 2023 22:37:05 +0100
Subject: [PATCH 128/175] systemd: remove unused bindings

---
 pkgs/os-specific/linux/systemd/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 23f875d2dc46..c05e9d2046dc 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,7 +5,6 @@
 , nixosTests
 , pkgsCross
 , fetchFromGitHub
-, fetchpatch
 , fetchzip
 , buildPackages
 , makeBinaryWrapper
@@ -20,7 +19,6 @@
 
   # glib is only used during tests (test-bus-gvariant, test-bus-marshal)
 , glib
-, substituteAll
 , gettext
 , python3Packages
 
@@ -52,7 +50,6 @@
 , intltool
 , bzip2
 , pcre2
-, e2fsprogs
 , elfutils
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
 , gnutls

From 748378a3ec83bf64d130c4744d9fdbe3065f89bb Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Sun, 19 Nov 2023 02:35:57 +0100
Subject: [PATCH 129/175] systemd: 254.6 -> 255.2

Removed patches:

- 0007-Fix-hwdb-paths.patch

  The directory we want seems to already be included in the list. Is there
  a reason why we want to restrict it further?

- 0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch

  This patch has little to do with how the meson.build file looks now. The
  new patch 0017 is the successor to this one.

- 0015-pkg-config-derive-prefix-from-prefix.patch

  This is fixed upstream. We don't need this anymore.
---
 nixos/modules/system/boot/luksroot.nix        |   4 +-
 nixos/modules/system/boot/systemd/initrd.nix  |   3 +
 ...ts-for-uninitialised-encrypted-devic.patch |   4 +-
 ...on-t-try-to-unmount-nix-or-nix-store.patch |   6 +-
 .../systemd/0003-Fix-NixOS-containers.patch   |   6 +-
 ...some-NixOS-specific-unit-directories.patch |  27 +-
 ...f-a-useless-message-in-user-sessions.patch |   4 +-
 ...d-timedated-disable-methods-that-cha.patch |  12 +-
 ...-usr-share-zoneinfo-to-etc-zoneinfo.patch} |  26 +-
 .../linux/systemd/0007-Fix-hwdb-paths.patch   |  24 --
 ...alectl-use-etc-X11-xkb-for-list-x11.patch} |   2 +-
 ...-add-rootprefix-to-lookup-dir-paths.patch} |  16 +-
 ...te-statedir-and-don-t-touch-prefixdi.patch |  23 --
 ...execute-scripts-in-etc-systemd-syst.patch} |   4 +-
 ...cute-scripts-in-etc-systemd-system-.patch} |   4 +-
 ...placeholder-for-DEFAULT_PATH_NORMAL.patch} |  20 +-
 ...environment-when-calling-generators.patch} |   4 +-
 ...14-core-don-t-taint-on-unmerged-usr.patch} |  15 +-
 ...pkg-config-derive-prefix-from-prefix.patch |  30 --
 ...ntext_init-fix-driver-name-checking.patch} |   6 +-
 ...ggest-systemdctl-edit-runtime-on-sy.patch} |   4 +-
 ....build-do-not-create-systemdstatedir.patch |  21 ++
 ...-NSCD-when-DNSSEC-validation-is-dis.patch} |   0
 pkgs/os-specific/linux/systemd/default.nix    | 318 ++++++++++--------
 pkgs/top-level/all-packages.nix               |   4 +
 25 files changed, 287 insertions(+), 300 deletions(-)
 rename pkgs/os-specific/linux/systemd/{0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch => 0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch} (86%)
 delete mode 100644 pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
 rename pkgs/os-specific/linux/systemd/{0009-localectl-use-etc-X11-xkb-for-list-x11.patch => 0008-localectl-use-etc-X11-xkb-for-list-x11.patch} (95%)
 rename pkgs/os-specific/linux/systemd/{0011-add-rootprefix-to-lookup-dir-paths.patch => 0009-add-rootprefix-to-lookup-dir-paths.patch} (77%)
 delete mode 100644 pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
 rename pkgs/os-specific/linux/systemd/{0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch => 0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch} (89%)
 rename pkgs/os-specific/linux/systemd/{0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch => 0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch} (89%)
 rename pkgs/os-specific/linux/systemd/{0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch => 0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch} (53%)
 rename pkgs/os-specific/linux/systemd/{0016-inherit-systemd-environment-when-calling-generators.patch => 0013-inherit-systemd-environment-when-calling-generators.patch} (94%)
 rename pkgs/os-specific/linux/systemd/{0017-core-don-t-taint-on-unmerged-usr.patch => 0014-core-don-t-taint-on-unmerged-usr.patch} (82%)
 delete mode 100644 pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
 rename pkgs/os-specific/linux/systemd/{0018-tpm2_context_init-fix-driver-name-checking.patch => 0015-tpm2_context_init-fix-driver-name-checking.patch} (91%)
 rename pkgs/os-specific/linux/systemd/{0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch => 0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch} (95%)
 create mode 100644 pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
 rename pkgs/os-specific/linux/systemd/{0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch => 0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch} (100%)

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 221e90b6f38f..86a3875e2c67 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -1076,7 +1076,7 @@ in
     boot.initrd.systemd = {
       contents."/etc/crypttab".source = stage1Crypttab;
 
-      extraBin.systemd-cryptsetup = "${config.boot.initrd.systemd.package}/lib/systemd/systemd-cryptsetup";
+      extraBin.systemd-cryptsetup = "${config.boot.initrd.systemd.package}/bin/systemd-cryptsetup";
 
       additionalUpstreamUnits = [
         "cryptsetup-pre.target"
@@ -1084,7 +1084,7 @@ in
         "remote-cryptsetup.target"
       ];
       storePaths = [
-        "${config.boot.initrd.systemd.package}/lib/systemd/systemd-cryptsetup"
+        "${config.boot.initrd.systemd.package}/bin/systemd-cryptsetup"
         "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-cryptsetup-generator"
       ];
 
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 4ae07944afc3..26cc016869b3 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -70,6 +70,7 @@ let
     "systemd-tmpfiles-setup.service"
     "timers.target"
     "umount.target"
+    "systemd-bsod.service"
   ] ++ cfg.additionalUpstreamUnits;
 
   upstreamWants = [
@@ -424,6 +425,7 @@ in {
 
       storePaths = [
         # systemd tooling
+        "${cfg.package}/lib/systemd/systemd-executor"
         "${cfg.package}/lib/systemd/systemd-fsck"
         "${cfg.package}/lib/systemd/systemd-hibernate-resume"
         "${cfg.package}/lib/systemd/systemd-journald"
@@ -433,6 +435,7 @@ in {
         "${cfg.package}/lib/systemd/systemd-shutdown"
         "${cfg.package}/lib/systemd/systemd-sulogin-shell"
         "${cfg.package}/lib/systemd/systemd-sysctl"
+        "${cfg.package}/lib/systemd/systemd-bsod"
 
         # generators
         "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index 104a9dad959a..b08026278edb 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,10 +13,10 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index c0defc31de..8f80235731 100644
+index 0d68f31d36..6b52f7ed4b 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
-@@ -20,10 +20,6 @@ SUBSYSTEM=="block", TAG+="systemd"
+@@ -22,10 +22,6 @@ SUBSYSTEM=="block", TAG+="systemd"
  SUBSYSTEM=="block", ENV{DM_SUSPENDED}=="1", IMPORT{db}="SYSTEMD_READY", GOTO="systemd_end"
  SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
  
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index dda8524c498d..8507bb583c8a 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -14,10 +14,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index 4ffec25c75..b99031c54e 100644
+index 55e76b6e16..015a608035 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -43,6 +43,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -66,6 +66,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -27,7 +27,7 @@ index 4ffec25c75..b99031c54e 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 1586c2e214..fcae95f824 100644
+index 1a9b99d761..04ef9af1ea 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
 @@ -170,8 +170,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 2d86d1e6957a..535ca3d86457 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index e170958fc5..898a674631 100644
+index 38196ef3d6..57d1750b00 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5648,6 +5648,7 @@ static int run(int argc, char *argv[]) {
+@@ -5602,6 +5602,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index e170958fc5..898a674631 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5662,6 +5663,7 @@ static int run(int argc, char *argv[]) {
+@@ -5618,6 +5619,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index c905a4d812af..d2232765f71d 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -11,12 +11,12 @@ Also, remove /usr and /lib as these don't exist on NixOS.
 
 Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
 ---
- src/basic/path-lookup.c | 17 ++---------------
+ src/basic/path-lookup.c | 18 ++----------------
  src/core/systemd.pc.in  |  8 ++++----
- 2 files changed, 6 insertions(+), 19 deletions(-)
+ 2 files changed, 6 insertions(+), 20 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 7d158a8295..f9bd62b631 100644
+index 4e3d59fc56..0d18b9a2d0 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
@@ -31,7 +31,7 @@ index 7d158a8295..f9bd62b631 100644
          NULL
  };
  
-@@ -617,15 +613,13 @@ int lookup_paths_init(
+@@ -613,16 +609,13 @@ int lookup_paths_init(
                                          persistent_config,
                                          SYSTEM_CONFIG_UNIT_DIR,
                                          "/etc/systemd/system",
@@ -44,11 +44,12 @@ index 7d158a8295..f9bd62b631 100644
 -                                        "/usr/local/lib/systemd/system",
                                          SYSTEM_DATA_UNIT_DIR,
 -                                        "/usr/lib/systemd/system",
+-                                        /* To be used ONLY for images which might be legacy split-usr */
 -                                        STRV_IFNOTNULL(flags & LOOKUP_PATHS_SPLIT_USR ? "/lib/systemd/system" : NULL),
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -641,14 +635,11 @@ int lookup_paths_init(
+@@ -638,14 +631,11 @@ int lookup_paths_init(
                                          persistent_config,
                                          USER_CONFIG_UNIT_DIR,
                                          "/etc/systemd/user",
@@ -64,7 +65,7 @@ index 7d158a8295..f9bd62b631 100644
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -808,7 +799,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+@@ -805,7 +795,6 @@ char **generator_binary_paths(RuntimeScope scope) {
                  case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-generators",
                                         "/etc/systemd/system-generators",
@@ -72,7 +73,7 @@ index 7d158a8295..f9bd62b631 100644
                                         SYSTEM_GENERATOR_DIR);
                          break;
  
-@@ -816,7 +806,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+@@ -813,7 +802,6 @@ char **generator_binary_paths(RuntimeScope scope) {
                  case RUNTIME_SCOPE_USER:
                          add = strv_new("/run/systemd/user-generators",
                                         "/etc/systemd/user-generators",
@@ -80,7 +81,7 @@ index 7d158a8295..f9bd62b631 100644
                                         USER_GENERATOR_DIR);
                          break;
  
-@@ -855,14 +844,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
+@@ -852,14 +840,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
                  case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-environment-generators",
                                          "/etc/systemd/system-environment-generators",
@@ -96,10 +97,10 @@ index 7d158a8295..f9bd62b631 100644
                          break;
  
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 693433b34b..5932a21b5b 100644
+index f3b85b0190..8ae544b495 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
-@@ -38,10 +38,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
+@@ -43,10 +43,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
  systemd_user_conf_dir=${sysconfdir}/systemd/user
  systemduserconfdir=${systemd_user_conf_dir}
  
@@ -111,8 +112,8 @@ index 693433b34b..5932a21b5b 100644
 +systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
  systemduserunitpath=${systemd_user_unit_path}
  
- systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
-@@ -50,10 +50,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
+ systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
+@@ -55,10 +55,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
  systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
  systemdusergeneratordir=${systemd_user_generator_dir}
  
@@ -124,4 +125,4 @@ index 693433b34b..5932a21b5b 100644
 +systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:${systemd_user_generator_dir}
  systemdusergeneratorpath=${systemd_user_generator_path}
  
- systemd_sleep_dir=${root_prefix}/lib/systemd/system-sleep
+ systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index 0a80d5ac4e83..a0bcc6afaa12 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 22ec6e79b1..771e8e7f16 100644
+index e61ebee253..22cc5cc843 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1559,7 +1559,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1562,7 +1562,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index abc6c24dbf51..b350e36bc5c2 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,7 +11,7 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 9ef45f8e75..99b1ec2e36 100644
+index e1d53f2395..a224e6dadc 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
 @@ -1053,6 +1053,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
@@ -35,7 +35,7 @@ index 9ef45f8e75..99b1ec2e36 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index f544a73580..ce00c262cc 100644
+index 5d96237fae..9af35cd29c 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
 @@ -229,6 +229,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
@@ -69,10 +69,10 @@ index f544a73580..ce00c262cc 100644
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index ad1d492d6b..331af34505 100644
+index c7be30f563..50f8aa8675 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -659,6 +659,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index ad1d492d6b..331af34505 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -743,6 +747,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -737,6 +741,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index ad1d492d6b..331af34505 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -923,6 +930,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -917,6 +924,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
similarity index 86%
rename from pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
rename to pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 3150d97be2e1..30178675f7f9 100644
--- a/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 1db630003a..31744c3e68 100644
+index f9014dc560..3ee0363369 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1350,7 +1350,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1412,7 +1412,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 1db630003a..31744c3e68 100644
          if (!f)
                  return -errno;
  
-@@ -1391,7 +1391,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1453,7 +1453,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 1db630003a..31744c3e68 100644
          if (!f)
                  return -errno;
  
-@@ -1503,7 +1503,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1565,7 +1565,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 1db630003a..31744c3e68 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1563,7 +1563,7 @@ int get_timezone(char **ret) {
+@@ -1625,7 +1625,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -75,10 +75,10 @@ index 1db630003a..31744c3e68 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 1956ab3b13..9ef356f8af 100644
+index f77a5f6266..63bac85b29 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -630,7 +630,7 @@ static int process_timezone(int rfd) {
+@@ -632,7 +632,7 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -88,10 +88,10 @@ index 1956ab3b13..9ef356f8af 100644
          r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
          if (r < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 898a674631..c41a416e04 100644
+index e48ebe8342..41796f3358 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1924,8 +1924,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1845,8 +1845,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,10 +103,10 @@ index 898a674631..c41a416e04 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 331af34505..722c4b5b4f 100644
+index 50f8aa8675..aff156ab42 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -282,7 +282,7 @@ static int context_read_data(Context *c) {
+@@ -276,7 +276,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -115,7 +115,7 @@ index 331af34505..722c4b5b4f 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -306,7 +306,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -300,7 +300,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
@@ -124,7 +124,7 @@ index 331af34505..722c4b5b4f 100644
  
                          if (unlink("/etc/localtime") < 0 && errno != ENOENT)
                                  return -errno;
-@@ -314,9 +314,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -308,9 +308,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
diff --git a/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
deleted file mode 100644
index 7777ba7e4259..000000000000
--- a/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nikolay Amiantov <ab@fmap.me>
-Date: Thu, 7 Jul 2016 02:47:13 +0300
-Subject: [PATCH] Fix hwdb paths
-
-Patch by vcunat.
----
- src/libsystemd/sd-hwdb/hwdb-internal.h | 6 +-----
- 1 file changed, 1 insertion(+), 5 deletions(-)
-
-diff --git a/src/libsystemd/sd-hwdb/hwdb-internal.h b/src/libsystemd/sd-hwdb/hwdb-internal.h
-index 5302679a62..39e59a527f 100644
---- a/src/libsystemd/sd-hwdb/hwdb-internal.h
-+++ b/src/libsystemd/sd-hwdb/hwdb-internal.h
-@@ -83,8 +83,4 @@ struct trie_value_entry2_f {
- } _packed_;
- 
- #define hwdb_bin_paths                          \
--        "/etc/systemd/hwdb/hwdb.bin\0"          \
--        "/etc/udev/hwdb.bin\0"                  \
--        "/usr/lib/systemd/hwdb/hwdb.bin\0"      \
--        _CONF_PATHS_SPLIT_USR_NULSTR("systemd/hwdb/hwdb.bin") \
--        UDEVLIBEXECDIR "/hwdb.bin\0"
-+        "/etc/udev/hwdb.bin\0"
diff --git a/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
similarity index 95%
rename from pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
rename to pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
index c0f6afd7fc7b..fe0dca1863dd 100644
--- a/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,7 +10,7 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index d8db9d9d22..4601bb5431 100644
+index 32354027f1..1d231f1afc 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
 @@ -297,7 +297,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
diff --git a/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
similarity index 77%
rename from pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
rename to pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
index fa201126ae27..15fe403c28fc 100644
--- a/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,16 +12,16 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 3f96786da9..6e8fb40c08 100644
+index 6bb5f3c281..678d13737d 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -74,13 +74,15 @@
+@@ -65,13 +65,15 @@
+         "/etc/" n "\0"                          \
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
-         "/usr/lib/" n "\0"                      \
--        _CONF_PATHS_SPLIT_USR_NULSTR(n)
-+        _CONF_PATHS_SPLIT_USR_NULSTR(n)         \
-+        ROOTPREFIX "/lib/" n "\0"
+-        "/usr/lib/" n "\0"
++        "/usr/lib/" n "\0"                      \
++        PREFIX "/lib/" n "\0"
  
  #define CONF_PATHS_USR(n)                       \
          "/etc/" n,                              \
@@ -29,7 +29,7 @@ index 3f96786da9..6e8fb40c08 100644
          "/usr/local/lib/" n,                    \
 -        "/usr/lib/" n
 +        "/usr/lib/" n,                          \
-+        ROOTPREFIX "/lib/" n
++        PREFIX "/lib/" n
  
  #define CONF_PATHS(n)                           \
-         CONF_PATHS_USR(n)                       \
+         CONF_PATHS_USR(n)
diff --git a/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
deleted file mode 100644
index b8f97308acfb..000000000000
--- a/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Franz Pletz <fpletz@fnordicwalking.de>
-Date: Sun, 11 Feb 2018 04:37:44 +0100
-Subject: [PATCH] build: don't create statedir and don't touch prefixdir
-
----
- meson.build | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 395eca1943..082cd748bb 100644
---- a/meson.build
-+++ b/meson.build
-@@ -4707,9 +4707,6 @@ install_data('LICENSE.GPL2',
- install_subdir('LICENSES',
-                install_dir : docdir)
- 
--meson.add_install_script('sh', '-c', mkdir_p.format(systemdstatedir))
--meson.add_install_script('sh', '-c', 'touch $DESTDIR@0@'.format(prefixdir))
--
- ############################################################
- 
- # Ensure that changes to the docs/ directory do not break the
diff --git a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
similarity index 89%
rename from pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
rename to pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index fde1e2b276c5..6f0b81a32aa7 100644
--- a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 8395bb429d..14fbc85bb4 100644
+index b976b7d8cf..b1c02df6fd 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -334,6 +334,7 @@ static void init_watchdog(void) {
+@@ -336,6 +336,7 @@ static void init_watchdog(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
similarity index 89%
rename from pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
rename to pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index d91150cfc490..a5ed574afa24 100644
--- a/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index de1f6c7ec1..d0cdebd80a 100644
+index 21af3e9e52..6d096e3c78 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -224,6 +224,7 @@ static int execute(
+@@ -215,6 +215,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
similarity index 53%
rename from pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
rename to pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 13dec1070ffc..55e556288c08 100644
--- a/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,21 +10,19 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 97175bee11..3839704901 100644
+index 6d943e967f..d4380aa7e3 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -25,11 +25,11 @@
+@@ -25,9 +25,9 @@
  #  define PATH_SBIN_BIN_NULSTR(x) PATH_NORMAL_SBIN_BIN_NULSTR(x)
  #endif
  
--#define DEFAULT_PATH_NORMAL PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
--#define DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
-+#define DEFAULT_PATH_NORMAL "@defaultPathNormal@"
-+#define DEFAULT_PATH_NORMAL_NULSTR "@defaultPathNormal@\0"
- #define DEFAULT_PATH_SPLIT_USR DEFAULT_PATH_NORMAL ":" PATH_SBIN_BIN("/")
- #define DEFAULT_PATH_SPLIT_USR_NULSTR DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/")
+-#define DEFAULT_PATH PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
+-#define DEFAULT_PATH_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
 -#define DEFAULT_PATH_COMPAT PATH_SPLIT_SBIN_BIN("/usr/local/") ":" PATH_SPLIT_SBIN_BIN("/usr/") ":" PATH_SPLIT_SBIN_BIN("/")
-+#define DEFAULT_PATH_COMPAT DEFAULT_PATH_NORMAL
++#define DEFAULT_PATH "@defaultPathNormal@"
++#define DEFAULT_PATH_NULSTR "@defaultPathNormal@\0"
++#define DEFAULT_PATH_COMPAT DEFAULT_PATH
  
- #if HAVE_SPLIT_USR
- #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
+ #ifndef DEFAULT_USER_PATH
+ #  define DEFAULT_USER_PATH DEFAULT_PATH
diff --git a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
similarity index 94%
rename from pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
rename to pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
index d6640c87454a..8bccf5539058 100644
--- a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 771e8e7f16..acf3ead8d7 100644
+index 22cc5cc843..5dc7d4504f 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3899,9 +3899,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3914,9 +3914,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
similarity index 82%
rename from pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
rename to pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
index 73b237a29602..8b862918500e 100644
--- a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
@@ -13,21 +13,20 @@ so showing the taint isn't really helpful.
 
 See also: https://github.com/systemd/systemd/issues/24191
 ---
- src/core/manager.c | 4 ----
- 1 file changed, 4 deletions(-)
+ src/core/manager.c | 3 ---
+ 1 file changed, 3 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index acf3ead8d7..bdbab16829 100644
+index 5dc7d4504f..6208c9aa31 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4754,10 +4754,6 @@ char* manager_taint_string(const Manager *m) {
-         if (m->taint_usr)
-                 stage[n++] = "split-usr";
+@@ -4800,9 +4800,6 @@ char* manager_taint_string(const Manager *m) {
+         const char* stage[12] = {};
+         size_t n = 0;
  
 -        _cleanup_free_ char *usrbin = NULL;
 -        if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin"))
 -                stage[n++] = "unmerged-usr";
--
+ 
          if (access("/proc/cgroups", F_OK) < 0)
                  stage[n++] = "cgroups-missing";
- 
diff --git a/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch b/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
deleted file mode 100644
index 3fbfd7f10ab4..000000000000
--- a/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Sun, 6 Dec 2020 08:34:19 +0100
-Subject: [PATCH] pkg-config: derive prefix from --prefix
-
-Point prefix to the one configured, instead of `/usr` `systemd` has limited
-support for making the pkgconfig prefix overridable, and interpolates those
-values later down.
-
-So we only need to patch this one value to get the correct paths.
-See systemd/systemd@bc4e6e27922a2873985ab9367d79fb099f70b505 for details.
-
-Co-Authored-By: Florian Klink <flokli@flokli.de>
----
- src/core/systemd.pc.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 5932a21b5b..20bf8e316d 100644
---- a/src/core/systemd.pc.in
-+++ b/src/core/systemd.pc.in
-@@ -11,7 +11,7 @@
- # considered deprecated (though there is no plan to remove them). New names
- # shall have underscores.
- 
--prefix=/usr
-+prefix={{PREFIX}}
- root_prefix={{ROOTPREFIX_NOSLASH}}
- rootprefix=${root_prefix}
- sysconf_dir={{SYSCONF_DIR}}
diff --git a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
similarity index 91%
rename from pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
rename to pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
index 6de01a0ae802..768f57e1335b 100644
--- a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,15 +27,15 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index ae8a8bc073..c284b244f8 100644
+index 5e07b88a89..8dd7315009 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -582,7 +582,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -654,7 +654,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
 -                if (!filename_is_valid(fn))
 +                if (!path_is_valid(fn))
-                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
+                         return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
  
                  context->tcti_dl = dlopen(fn, RTLD_NOW);
diff --git a/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
similarity index 95%
rename from pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
rename to pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
index dd9af6738c4e..96cd420221e5 100644
--- a/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+++ b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -30,10 +30,10 @@ are written into `$XDG_CONFIG_HOME/systemd/user`.
  1 file changed, 3 insertions(+)
 
 diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
-index e3f25d52d5..81c9c6f6b7 100644
+index 367afa20f7..5777154d01 100644
 --- a/src/systemctl/systemctl-edit.c
 +++ b/src/systemctl/systemctl-edit.c
-@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+@@ -322,6 +322,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
          sd_bus *bus;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
new file mode 100644
index 000000000000..fd38aa9a2850
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
@@ -0,0 +1,21 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: nikstur <nikstur@outlook.com>
+Date: Mon, 6 Nov 2023 22:51:38 +0100
+Subject: [PATCH] meson.build: do not create systemdstatedir
+
+---
+ meson.build | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 7419e2b0b0..c82a527976 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2497,7 +2497,6 @@ install_data('LICENSE.GPL2',
+ install_subdir('LICENSES',
+                install_dir : docdir)
+ 
+-install_emptydir(systemdstatedir)
+ 
+ ############################################################
+ 
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
similarity index 100%
rename from pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
rename to pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index c05e9d2046dc..a87858ff2027 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -65,6 +65,8 @@
 , libmicrohttpd
 , libfido2
 , p11-kit
+, libpwquality
+, qrencode
 
   # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to be available during build time.
   # Only libbpf should be a runtime dependency.
@@ -99,6 +101,7 @@
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
+, withIptables ? true
 , withKmod ? true
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
     && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
@@ -117,10 +120,11 @@
 , withNss ? !stdenv.hostPlatform.isMusl
 , withOomd ? true
 , withPam ? true
-, withPasswordQuality ? false
+, withPasswordQuality ? true
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? !stdenv.hostPlatform.isMusl
+, withQrencode ? true
 , withRemote ? !stdenv.hostPlatform.isMusl
 , withResolved ? true
 , withShellCompletions ? true
@@ -132,6 +136,7 @@
 , withUkify ? false  # adds python to closure which is too much by default
 , withUserDb ? true
 , withUtmp ? !stdenv.hostPlatform.isMusl
+, withVmspawn ? true
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
   # build only libudev and libsystemd
@@ -154,19 +159,17 @@ assert withHomed -> withPam;
 assert withUkify -> (withEfi && withBootloader);
 assert withRepart -> withCryptsetup;
 assert withBootloader -> withEfi;
-# passwdqc is not packaged in nixpkgs yet, if you want to fix this, please submit a PR.
-assert !withPasswordQuality;
 
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "254.6";
+  version = "255.2";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1690536449";
+  releaseTimestamp = "1701895110";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
@@ -177,7 +180,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-Ku24ecDeQt0t7A8/adR3Jm47QZ19+wdMPyJRzCxU4uU=";
+    hash = "sha256-8SfJY/pcH4yrDeJi0GfIUpetTbpMwyswvSu+RSfgqfY=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -192,21 +195,19 @@ stdenv.mkDerivation (finalAttrs: {
     ./0004-Add-some-NixOS-specific-unit-directories.patch
     ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch
     ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
-    ./0007-Fix-hwdb-paths.patch
-    ./0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
-    ./0009-localectl-use-etc-X11-xkb-for-list-x11.patch
-    ./0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0011-add-rootprefix-to-lookup-dir-paths.patch
-    ./0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0015-pkg-config-derive-prefix-from-prefix.patch
-    ./0016-inherit-systemd-environment-when-calling-generators.patch
-    ./0017-core-don-t-taint-on-unmerged-usr.patch
-    ./0018-tpm2_context_init-fix-driver-name-checking.patch
-    ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0008-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0009-add-rootprefix-to-lookup-dir-paths.patch
+    ./0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0013-inherit-systemd-environment-when-calling-generators.patch
+    ./0014-core-don-t-taint-on-unmerged-usr.patch
+    ./0015-tpm2_context_init-fix-driver-name-checking.patch
+    ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0017-meson.build-do-not-create-systemdstatedir.patch
   ] ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
-    ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+    ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -290,14 +291,17 @@ stdenv.mkDerivation (finalAttrs: {
           { name = "libbpf.so.1"; pkg = opt withLibBPF libbpf; }
           { name = "libbpf.so.0"; pkg = null; }
 
-          # We did never provide support for libxkbcommon & qrencode
+          # We did never provide support for libxkbcommon
           { name = "libxkbcommon.so.0"; pkg = null; }
-          { name = "libqrencode.so.4"; pkg = null; }
+
+          # qrencode
+          { name = "libqrencode.so.4"; pkg = opt withQrencode qrencode; }
           { name = "libqrencode.so.3"; pkg = null; }
 
-          # We did not provide libpwquality before so it is safe to disable it for
-          # now.
-          { name = "libpwquality.so.1"; pkg = null; }
+          # Password quality
+          # We currently do not package passwdqc, only libpwquality.
+          { name = "libpwquality.so.1"; pkg = opt withPasswordQuality libpwquality; }
+          { name = "libpasswdqc.so.1"; pkg = null; }
 
           # Only include cryptsetup if it is enabled. We might not be able to
           # provide it during "bootstrap" in e.g. the minimal systemd build as
@@ -329,8 +333,7 @@ stdenv.mkDerivation (finalAttrs: {
           # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
           { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
 
-          # Password quality support
-          { name = "libpasswdqc.so.1"; pkg = opt withPasswordQuality null; }
+          { name = "libip4tc.so.2"; pkg = opt withIptables iptables; }
         ];
 
       patchDlOpen = dl:
@@ -425,14 +428,14 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withApparmor libapparmor
     ++ lib.optional withAudit audit
     ++ lib.optional wantCurl (lib.getDev curl)
-    ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
+    ++ lib.optionals withCompression [ zlib bzip2 lz4 xz zstd ]
     ++ lib.optional withCoredump elfutils
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
     ++ lib.optional withKexectools kexec-tools
     ++ lib.optional withKmod kmod
     ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
-    ++ lib.optional withNetworkd iptables
+    ++ lib.optional withIptables iptables
     ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
@@ -442,132 +445,167 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals withLibBPF [ libbpf ]
     ++ lib.optional withTpm2Tss tpm2-tss
     ++ lib.optional withUkify (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
+    ++ lib.optionals withPasswordQuality [ libpwquality ]
+    ++ lib.optionals withQrencode [ qrencode ]
   ;
 
   mesonBuildType = "release";
 
   mesonFlags = [
-    "-Dversion-tag=${version}"
+    # Options
+
     # We bump this variable on every (major) version change to ensure
     # that we have known-good value for a timestamp that is in the (not so distant) past.
     # This serves as a lower bound for valid system timestamps during startup. Systemd will
     # reset the system timestamp if this date is +- 15 years from the system time.
     # See the systemd v250 release notes for further details:
     # https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
-    "-Dtime-epoch=${releaseTimestamp}"
-
-    "-Dmode=release"
-    "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
-    "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
-    "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
-    "-Dpam=${lib.boolToString withPam}"
-    "-Dpamconfdir=${placeholder "out"}/etc/pam.d"
-    "-Drootprefix=${placeholder "out"}"
-    "-Dpkgconfiglibdir=${placeholder "dev"}/lib/pkgconfig"
-    "-Dpkgconfigdatadir=${placeholder "dev"}/share/pkgconfig"
-    "-Dloadkeys-path=${kbd}/bin/loadkeys"
-    "-Dsetfont-path=${kbd}/bin/setfont"
-    "-Dtty-gid=3" # tty in NixOS has gid 3
-    "-Ddebug-shell=${bashInteractive}/bin/bash"
-    "-Dglib=${lib.boolToString withTests}"
-    # while we do not run tests we should also not build them. Removes about 600 targets
-    "-Dtests=false"
-    "-Dacl=${lib.boolToString withAcl}"
-    "-Danalyze=${lib.boolToString withAnalyze}"
-    "-Daudit=${lib.boolToString withAudit}"
-    "-Dgcrypt=${lib.boolToString wantGcrypt}"
-    "-Dimportd=${lib.boolToString withImportd}"
-    "-Dlz4=${lib.boolToString withCompression}"
-    "-Dhomed=${lib.boolToString withHomed}"
-    "-Dlogind=${lib.boolToString withLogind}"
-    "-Dlocaled=${lib.boolToString withLocaled}"
-    "-Dhostnamed=${lib.boolToString withHostnamed}"
-    "-Dmachined=${lib.boolToString withMachined}"
-    "-Dnetworkd=${lib.boolToString withNetworkd}"
-    "-Doomd=${lib.boolToString withOomd}"
-    "-Dpolkit=${lib.boolToString withPolkit}"
-    "-Dlibcryptsetup=${lib.boolToString withCryptsetup}"
-    "-Dportabled=${lib.boolToString withPortabled}"
-    "-Dhwdb=${lib.boolToString withHwdb}"
-    "-Dremote=${lib.boolToString withRemote}"
-    "-Dtimedated=${lib.boolToString withTimedated}"
-    "-Dtimesyncd=${lib.boolToString withTimesyncd}"
-    "-Duserdb=${lib.boolToString withUserDb}"
-    "-Dcoredump=${lib.boolToString withCoredump}"
-    "-Dfirstboot=false"
-    "-Dresolve=${lib.boolToString withResolved}"
-    "-Dsplit-usr=false"
-    "-Dlibcurl=${lib.boolToString wantCurl}"
-    "-Dlibidn=false"
-    "-Dlibidn2=${lib.boolToString withLibidn2}"
-    "-Dfirstboot=${lib.boolToString withFirstboot}"
-    "-Dsysusers=${lib.boolToString withSysusers}"
-    "-Drepart=${lib.boolToString withRepart}"
-    "-Dsysupdate=${lib.boolToString withSysupdate}"
-    "-Dquotacheck=false"
-    "-Dldconfig=false"
-    "-Dsmack=true"
-    "-Db_pie=true"
-    "-Dinstall-sysconfdir=false"
-    "-Dsbat-distro=nixos"
-    "-Dsbat-distro-summary=NixOS"
-    "-Dsbat-distro-url=https://nixos.org/"
-    "-Dsbat-distro-pkgname=${pname}"
-    "-Dsbat-distro-version=${version}"
-    /*
-      As of now, systemd doesn't allow runtime configuration of these values. So
-      the settings in /etc/login.defs have no effect on it. Many people think this
-      should be supported however, see
-      - https://github.com/systemd/systemd/issues/3855
-      - https://github.com/systemd/systemd/issues/4850
-      - https://github.com/systemd/systemd/issues/9769
-      - https://github.com/systemd/systemd/issues/9843
-      - https://github.com/systemd/systemd/issues/10184
-    */
-    "-Dsystem-uid-max=999"
-    "-Dsystem-gid-max=999"
-
-    "-Dsysvinit-path="
-    "-Dsysvrcnd-path="
-
-    "-Dsulogin-path=${util-linux.login}/bin/sulogin"
-    "-Dnologin-path=${util-linux.login}/bin/nologin"
-    "-Dmount-path=${lib.getOutput "mount" util-linux}/bin/mount"
-    "-Dumount-path=${lib.getOutput "mount" util-linux}/bin/umount"
-    "-Dcreate-log-dirs=false"
+    (lib.mesonOption "time-epoch" releaseTimestamp)
 
+    (lib.mesonOption "version-tag" version)
+    (lib.mesonOption "mode" "release")
+    (lib.mesonOption "tty-gid" "3") # tty in NixOS has gid 3
+    (lib.mesonOption "debug-shell" "${bashInteractive}/bin/bash")
+    (lib.mesonOption "pamconfdir" "${placeholder "out"}/etc/pam.d")
     # Use cgroupsv2. This is already the upstream default, but better be explicit.
-    "-Ddefault-hierarchy=unified"
-    # Upstream defaulted to disable manpages since they optimize for the much
-    # more frequent development builds
-    "-Dman=true"
+    (lib.mesonOption "default-hierarchy" "unified")
+    (lib.mesonOption "kmod-path" "${kmod}/bin/kmod")
 
-    "-Defi=${lib.boolToString withEfi}"
-    "-Dbootloader=${lib.boolToString withBootloader}"
+    # D-Bus
+    (lib.mesonOption "dbuspolicydir" "${placeholder "out"}/share/dbus-1/system.d")
+    (lib.mesonOption "dbussessionservicedir" "${placeholder "out"}/share/dbus-1/services")
+    (lib.mesonOption "dbussystemservicedir" "${placeholder "out"}/share/dbus-1/system-services")
+
+    # pkgconfig
+    (lib.mesonOption "pkgconfiglibdir" "${placeholder "dev"}/lib/pkgconfig")
+    (lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig")
+
+    # Keyboard
+    (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
+    (lib.mesonOption "setfont-path" "${kbd}/bin/setfont")
+
+    # SBAT
+    (lib.mesonOption "sbat-distro" "nixos")
+    (lib.mesonOption "sbat-distro-summary" "NixOS")
+    (lib.mesonOption "sbat-distro-url" "https://nixos.org/")
+    (lib.mesonOption "sbat-distro-pkgname" pname)
+    (lib.mesonOption "sbat-distro-version" version)
+
+    # Users
+    (lib.mesonOption "system-uid-max" "999")
+    (lib.mesonOption "system-gid-max" "999")
+
+    # SysVinit
+    (lib.mesonOption "sysvinit-path" "")
+    (lib.mesonOption "sysvrcnd-path" "")
+
+    # Login
+    (lib.mesonOption "sulogin-path" "${util-linux.login}/bin/sulogin")
+    (lib.mesonOption "nologin-path" "${util-linux.login}/bin/nologin")
+
+    # Mount
+    (lib.mesonOption "mount-path" "${lib.getOutput "mount" util-linux}/bin/mount")
+    (lib.mesonOption "umount-path" "${lib.getOutput "mount" util-linux}/bin/umount")
+
+
+    # Features
+
+    # Tests
+    (lib.mesonBool "tests" withTests)
+    (lib.mesonEnable "glib" withTests)
+    (lib.mesonEnable "dbus" withTests)
+
+    # Compression
+    (lib.mesonEnable "bzip2" withCompression)
+    (lib.mesonEnable "lz4" withCompression)
+    (lib.mesonEnable "xz" withCompression)
+    (lib.mesonEnable "zstd" withCompression)
+    (lib.mesonEnable "zlib" withCompression)
+
+    # NSS
+    (lib.mesonEnable "nss-mymachines" withNss)
+    (lib.mesonEnable "nss-resolve" withNss)
+    (lib.mesonBool "nss-myhostname" withNss)
+    (lib.mesonBool "nss-systemd" withNss)
+
+    # Cryptsetup
+    (lib.mesonEnable "libcryptsetup" withCryptsetup)
+    (lib.mesonEnable "libcryptsetup-plugins" withCryptsetup)
+    (lib.mesonEnable "p11kit" (withHomed || withCryptsetup))
+
+    # FIDO2
+    (lib.mesonEnable "libfido2" withFido2)
+    (lib.mesonEnable "openssl" withFido2)
+
+    # Password Quality
+    (lib.mesonEnable "pwquality" withPasswordQuality)
+    (lib.mesonEnable "passwdqc" false)
+
+    # Remote
+    (lib.mesonEnable "remote" withRemote)
+    (lib.mesonEnable "microhttpd" withRemote)
+
+    (lib.mesonEnable "pam" withPam)
+    (lib.mesonEnable "acl" withAcl)
+    (lib.mesonEnable "audit" withAudit)
+    (lib.mesonEnable "apparmor" withApparmor)
+    (lib.mesonEnable "gcrypt" wantGcrypt)
+    (lib.mesonEnable "importd" withImportd)
+    (lib.mesonEnable "homed" withHomed)
+    (lib.mesonEnable "polkit" withPolkit)
+    (lib.mesonEnable "elfutils" withCoredump)
+    (lib.mesonEnable "libcurl" wantCurl)
+    (lib.mesonEnable "libidn" false)
+    (lib.mesonEnable "libidn2" withLibidn2)
+    (lib.mesonEnable "libiptc" withIptables)
+    (lib.mesonEnable "repart" withRepart)
+    (lib.mesonEnable "sysupdate" withSysupdate)
+    (lib.mesonEnable "selinux" withSelinux)
+    (lib.mesonEnable "tpm2" withTpm2Tss)
+    (lib.mesonEnable "pcre2" withPCRE2)
+    (lib.mesonEnable "bpf-framework" withLibBPF)
+    (lib.mesonEnable "bootloader" withBootloader)
+    (lib.mesonEnable "ukify" withUkify)
+    (lib.mesonEnable "kmod" withKmod)
+    (lib.mesonEnable "qrencode" withQrencode)
+    (lib.mesonEnable "vmspawn" withVmspawn)
+    (lib.mesonEnable "xenctrl" false)
+    (lib.mesonEnable "gnutls" false)
+    (lib.mesonEnable "xkbcommon" false)
+    (lib.mesonEnable "man" true)
+
+    (lib.mesonBool "analyze" withAnalyze)
+    (lib.mesonBool "logind" withLogind)
+    (lib.mesonBool "localed" withLocaled)
+    (lib.mesonBool "hostnamed" withHostnamed)
+    (lib.mesonBool "machined" withMachined)
+    (lib.mesonBool "networkd" withNetworkd)
+    (lib.mesonBool "oomd" withOomd)
+    (lib.mesonBool "portabled" withPortabled)
+    (lib.mesonBool "hwdb" withHwdb)
+    (lib.mesonBool "timedated" withTimedated)
+    (lib.mesonBool "timesyncd" withTimesyncd)
+    (lib.mesonBool "userdb" withUserDb)
+    (lib.mesonBool "coredump" withCoredump)
+    (lib.mesonBool "firstboot" withFirstboot)
+    (lib.mesonBool "resolve" withResolved)
+    (lib.mesonBool "sysusers" withSysusers)
+    (lib.mesonBool "efi" withEfi)
+    (lib.mesonBool "utmp" withUtmp)
+    (lib.mesonBool "log-trace" withLogTrace)
+    (lib.mesonBool "quotacheck" false)
+    (lib.mesonBool "ldconfig" false)
+    (lib.mesonBool "install-sysconfdir" false)
+    (lib.mesonBool "create-log-dirs" false)
+    (lib.mesonBool "smack" true)
+    (lib.mesonBool "b_pie" true)
 
-    "-Dukify=${lib.boolToString withUkify}"
   ] ++ lib.optionals (withShellCompletions == false) [
-    "-Dbashcompletiondir=no"
-    "-Dzshcompletiondir=no"
-  ] ++ lib.optionals (!withNss) [
-    "-Dnss-myhostname=false"
-    "-Dnss-mymachines=false"
-    "-Dnss-resolve=false"
-    "-Dnss-systemd=false"
-  ] ++ lib.optionals withLibBPF [
-    "-Dbpf-framework=true"
-  ] ++ lib.optionals withTpm2Tss [
-    "-Dtpm2=true"
-  ] ++ lib.optionals (!withUtmp) [
-    "-Dutmp=false"
+    (lib.mesonOption "bashcompletiondir" "no")
+    (lib.mesonOption "zshcompletiondir" "no")
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-    "-Dgshadow=false"
-    "-Didn=false"
-  ] ++ lib.optionals withKmod [
-    "-Dkmod=true"
-    "-Dkmod-path=${kmod}/bin/kmod"
-  ] ++ lib.optionals withLogTrace [
-    "-Dlog-trace=true"
+    (lib.mesonBool "gshadow" false)
+    (lib.mesonBool "idn" false)
   ];
   preConfigure =
     let
@@ -744,7 +782,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Wrap in the correct path for LUKS2 tokens.
   postFixup = lib.optionalString withCryptsetup ''
-    for f in lib/systemd/systemd-cryptsetup bin/systemd-cryptenroll; do
+    for f in bin/systemd-cryptsetup bin/systemd-cryptenroll; do
       # This needs to be in LD_LIBRARY_PATH because rpath on a binary is not propagated to libraries using dlopen, in this case `libcryptsetup.so`
       wrapProgram $out/$f --prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib/cryptsetup
     done
@@ -754,7 +792,7 @@ stdenv.mkDerivation (finalAttrs: {
     # To cross compile a derivation that builds a UKI with ukify, we need to wrap
     # ukify with the correct binutils. When wrapping, no splicing happens so we
     # have to explicitly pull binutils from targetPackages.
-    wrapProgram $out/lib/systemd/ukify --prefix PATH : ${lib.makeBinPath [ targetPackages.stdenv.cc.bintools ] }:${placeholder "out"}/lib/systemd
+    wrapProgram $out/bin/ukify --prefix PATH : ${lib.makeBinPath [ targetPackages.stdenv.cc.bintools ] }:${placeholder "out"}/lib/systemd
   '';
 
   disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 13561c4ebe2a..339c5cba9001 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28721,6 +28721,7 @@ with pkgs;
     withHomed = false;
     withHwdb = false;
     withImportd = false;
+    withIptables = false;
     withLibBPF = false;
     withLibidn2 = false;
     withLocaled = false;
@@ -28744,6 +28745,9 @@ with pkgs;
     withUserDb = false;
     withUkify = false;
     withBootloader = false;
+    withPasswordQuality = false;
+    withVmspawn = false;
+    withQrencode = false;
   };
   systemdLibs = systemdMinimal.override {
     pname = "systemd-minimal-libs";

From 0a5933400ea215833ef7e2564610b42e21ebfeb6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:40:06 +0300
Subject: [PATCH 130/175] vulkan-volk: init at 1.3.275.0

---
 .../libraries/vulkan-headers/update.sh        |  1 +
 .../libraries/vulkan-volk/default.nix         | 26 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  1 +
 3 files changed, 28 insertions(+)
 create mode 100644 pkgs/development/libraries/vulkan-volk/default.nix

diff --git a/pkgs/development/libraries/vulkan-headers/update.sh b/pkgs/development/libraries/vulkan-headers/update.sh
index da4e42ded84a..dd3fac2ee4dd 100755
--- a/pkgs/development/libraries/vulkan-headers/update.sh
+++ b/pkgs/development/libraries/vulkan-headers/update.sh
@@ -11,6 +11,7 @@ SDK_PACKAGES=(
     "vulkan-tools-lunarg"
     "vulkan-extension-layer"
     "vulkan-utility-libraries"
+    "vulkan-volk"
     "spirv-headers"
     "spirv-cross"
     "spirv-tools"
diff --git a/pkgs/development/libraries/vulkan-volk/default.nix b/pkgs/development/libraries/vulkan-volk/default.nix
new file mode 100644
index 000000000000..1164fd2921e2
--- /dev/null
+++ b/pkgs/development/libraries/vulkan-volk/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, cmake, vulkan-headers }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "volk";
+  version = "1.3.275.0";
+
+  src = fetchFromGitHub {
+    owner = "zeux";
+    repo = "volk";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-uTjLgJMGN8nOVhVIl/GNhO2jXe9ebhc9vzAwCDwfuf4=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ vulkan-headers ];
+
+  cmakeFlags = ["-DVOLK_INSTALL=1"];
+
+  meta = with lib; {
+    description = " Meta loader for Vulkan API";
+    homepage = "https://github.com/zeux/volk";
+    platforms = platforms.all;
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 13561c4ebe2a..c639a09f5964 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25529,6 +25529,7 @@ with pkgs;
   vulkan-tools-lunarg = callPackage ../tools/graphics/vulkan-tools-lunarg { };
   vulkan-utility-libraries = callPackage ../development/libraries/vulkan-utility-libraries { };
   vulkan-validation-layers = callPackage ../development/tools/vulkan-validation-layers { };
+  vulkan-volk = callPackage ../development/libraries/vulkan-volk { };
 
   vxl = callPackage ../development/libraries/vxl { };
 

From 2a8f51face14173e235e097dfcc597825fc47218 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:15:15 +0300
Subject: [PATCH 131/175] glslang: 13.1.1 -> 14.0.0

Diff: https://github.com/KhronosGroup/glslang/compare/13.1.1...14.0.0
---
 pkgs/development/compilers/glslang/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index ff55201ebd03..5387eb15b713 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "13.1.1";
+  version = "14.0.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    hash = "sha256-fuzNsVYdnThMzd4tLN/sTbCBXg6qXKLDJRziOKyOBGg=";
+    hash = "sha256-7kIIU45pe+IF7lGltpIKSvQBmcXR+TWFvmx7ztMNrpc=";
   };
 
   # These get set at all-packages, keep onto them for child drvs

From 0dec9ac7772bb700af880f978c861bb967aa45f7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:15:19 +0300
Subject: [PATCH 132/175] vulkan-headers: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/Vulkan-Headers/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0
---
 pkgs/development/libraries/vulkan-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index f6c9dcb953e3..dc17404c8480 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-CDjWTXXnUgj9QaLDNuSVy+wf8If5LehwOZ0t0Fuh2Ro=";
+    hash = "sha256-kBOkj7mr4stPXUCBhNJpNL3A+9BebEwrIBEIroxdH8Y=";
   };
 
   passthru.updateScript = ./update.sh;

From ca785c26a93a5f071de28dfc74cac7c58b55d9f4 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:15:23 +0300
Subject: [PATCH 133/175] vulkan-loader: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/Vulkan-Loader/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0
---
 pkgs/development/libraries/vulkan-loader/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 068c1d3d2c2a..958cc2dadc7b 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-TDn8eVz1fhGfvUiGcxqOk2BN9tuIF5+ssIXtOo3weS0=";
+    hash = "sha256-53PUXAWiK38ciV6oMvD7ZHdXi4RU4r0RmDWUUHU3mE0=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];

From 7e0afaf597cdee90539014fdd27b7e4ac207fd4f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:15:29 +0300
Subject: [PATCH 134/175] vulkan-validation-layers: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/Vulkan-ValidationLayers/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0
---
 pkgs/development/tools/vulkan-validation-layers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 09a11cef84f4..1d0a39fb2b8b 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-DwkSUclStYKe54tC1H3jMv1KOSScgqf25tR5ajQZ6os=";
+    hash = "sha256-hJx8gn0zCN3+DhO6niylZJXPHgQ+VhQV5tL8qAeRaUg=";
   };
 
   nativeBuildInputs = [

From 9346cae320191f052632f55f3fbdad965fa0c776 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:15:33 +0300
Subject: [PATCH 135/175] vulkan-tools: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/Vulkan-Tools/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0
---
 pkgs/tools/graphics/vulkan-tools/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index d590ac7d340c..087326f71322 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -14,6 +14,7 @@
 , libXrandr
 , vulkan-headers
 , vulkan-loader
+, vulkan-volk
 , wayland
 , wayland-protocols
 , moltenvk
@@ -23,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-IsMxiAR4ak6kC3BNYhtI+JVNkEka4ZceSElxk39THXg=";
+    hash = "sha256-0sAwO8gXzpMst+7l7LS1oiDLo9E6otDktCti+v8jwDw=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
     glslang
     vulkan-headers
     vulkan-loader
+    vulkan-volk
   ] ++ lib.optionals (!stdenv.isDarwin) [
     libffi
     libX11

From 0afd1dcf3e3ac1903d87634d80dc55f7b5f3de0c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:15:55 +0300
Subject: [PATCH 136/175] vulkan-tools-lunarg: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/LunarG/VulkanTools/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0
---
 pkgs/tools/graphics/vulkan-tools-lunarg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 0db3cf159771..778b13655886 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
    owner = "LunarG";
    repo = "VulkanTools";
    rev = "vulkan-sdk-${version}";
-   hash = "sha256-2ZUD+RBsl35QV3250JOPCIoJb4sJcBsiRE4SZaS6ROs=";
+   hash = "sha256-MEQX90HL90jyVBWWcvOF7QLzm1+fNE5TW3MWdK4w53M=";
  };
 
   nativeBuildInputs = [ cmake python3 jq which pkg-config libsForQt5.qt5.wrapQtAppsHook ];

From 5cb62285ca985e346740d7e5f2982d13b650a919 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:16:00 +0300
Subject: [PATCH 137/175] vulkan-extension-layer: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/Vulkan-ExtensionLayer/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0
---
 pkgs/tools/graphics/vulkan-extension-layer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index dae55225a0b3..336c31811aa2 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-rSKPTeTDOz6IeJGRt9aIu1VH8VfVzXNYZfjdiSXEJxg=";
+    hash = "sha256-zQycF3yKoa54KBUIuG1BqFGB00yc6oZQzdcDel2rXN0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config jq ];

From 8023641f15d1f1f739ffdfb7fa8fb66083ba628a Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:18:21 +0300
Subject: [PATCH 138/175] vulkan-utility-libraries: 1.3.268 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/Vulkan-Utility-Libraries/compare/vulkan-sdk-1.3.268...vulkan-sdk-1.3.275.0
---
 .../libraries/vulkan-utility-libraries/default.nix          | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/vulkan-utility-libraries/default.nix b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
index 41d1854692fd..301311e12412 100644
--- a/pkgs/development/libraries/vulkan-utility-libraries/default.nix
+++ b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.3.268";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-l6PiHCre/JQg8PSs1k/0Zzfwwv55AqVdZtBbjeKLS6E=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-gvia+Xb9BpOjPARKo3Sgp85Bfh1roFZ2PzCtXVFYeIU=";
   };
 
   nativeBuildInputs = [ cmake python3 ];

From b52d8522e53dd887e438f4d11bab610b0fbbc597 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:18:24 +0300
Subject: [PATCH 139/175] spirv-headers: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/SPIRV-Headers/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0
---
 pkgs/development/libraries/spirv-headers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 3e18424d6b74..64362243229b 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-uOnSTih14bUPtrJgp7vVb3/UfdKsF6jFQqjlFeJ81AI=";
+    hash = "sha256-/I9dJlBE0kvFvqooKuqMETtOE72Jmva3zIGnq0o4+aE=";
   };
 
   nativeBuildInputs = [ cmake ];

From 77037208859cbf320db3c72663d52695fe68c4c0 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:18:30 +0300
Subject: [PATCH 140/175] spirv-cross: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/SPIRV-Cross/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0

Changelog: https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/24.05pre-git
---
 pkgs/tools/graphics/spirv-cross/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index cd7489be9aec..73413c1aee4c 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-UIk5hihUPjXNzEeO2laS4dUef/rEExxXAZjMcftx+3A=";
+    hash = "sha256-Mhr3Yxm5MeLLQFmxWmtXLsq+ZcOE+KMs+3iiTYF8t30=";
   };
 
   nativeBuildInputs = [ cmake python3 ];

From 3eb5040f0c7cfbdde36c04b3f807464e584f9967 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 17 Jan 2024 20:18:35 +0300
Subject: [PATCH 141/175] spirv-tools: 1.3.268.0 -> 1.3.275.0

Diff: https://github.com/KhronosGroup/SPIRV-Tools/compare/vulkan-sdk-1.3.268.0...vulkan-sdk-1.3.275.0
---
 pkgs/development/tools/spirv-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 8827d6b709e7..648b2615166c 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-Bned5Pa6zCFByfNvqD0M5t3l4uAJYkDlpe6wu8e7a3U=";
+    hash = "sha256-RzGvoDt1Qc+f6mZsfs99MxX4YB3yFc5FP92Yx/WGrsI=";
   };
 
   # The cmake options are sufficient for turning on static building, but not

From 1cf2d7357c61b9c9ca5c92cb0e810571edee948a Mon Sep 17 00:00:00 2001
From: Uri Baghin <uri@canva.com>
Date: Thu, 29 Jun 2023 09:11:55 +1000
Subject: [PATCH 142/175] gcc: fix c++ headers when same triplet cross
 compiling

When build platform and host platform differ, but have the same
triple, the code in nixpkgs will consider it a cross compilation,
but gcc won't. This will lead some derivations to look for c++
headers in the wrong place. To solve this always output the headers
in the non-cross location, like we do for the other gcc headers
already.
---
 pkgs/development/compilers/gcc/common/configure-flags.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index cbe38f1127f3..75204a91273f 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -135,6 +135,8 @@ let
       # We pick "/" path to effectively avoid sysroot offset and make it work
       # as a native case.
       "--with-build-sysroot=/"
+      # Same with the stdlibc++ headers embedded in the gcc output
+      "--with-gxx-include-dir=${placeholder "out"}/include/c++/${version}/"
     ]
 
     # Basic configuration

From 0c3d9f28c6220e97db0e741d554d7754e524b549 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Wed, 8 Nov 2023 22:53:22 -0800
Subject: [PATCH 143/175] cc-wrapper: drop no-longer-necessary hack

The commit prior to this one, "gcc: fix c++ headers when same
triplet cross compiling" causes gcc's c++ headers to be in the same
outpath subdirectory regardless of whether the gcc build is a
host==target or host!=target compiler.

As a result of that change, the hack in cc-wrapper which adapted to
the different paths is no longer needed.  And, in fact, it must be
removed, since if it is left in place builds such as
pkgsCross.aarch64-multiplatform.firefox will fail as shown below.

```
firefox-unwrapped>  0:02.01(B checking the host C compiler works... yes(B(B
firefox-unwrapped>  0:02.01(B checking for the host C++ compiler... /nix/store/1asqji9djmdlapzs70q7jw2j308ry7cn-clang-wrapper-16.0.6/bin/c++(B(B
firefox-unwrapped>  0:02.14(B checking whether the host C++ compiler can be used... yes(B(B
firefox-unwrapped>  0:02.14(B checking the host C++ compiler version... 16.0.6(B(B
firefox-unwrapped>  0:02.21(B checking the host C++ compiler works... yes(B(B
firefox-unwrapped>  0:02.40(B checking for target linker... lld(B(B
firefox-unwrapped>  0:02.51(B checking for host linker... lld(B(B
firefox-unwrapped>  0:02.60(B checking for 64-bit OS... yes(B(B
firefox-unwrapped>  0:02.67(B checking for new enough STL headers from libstdc++...(B(B
firefox-unwrapped>  0:02.67(B DEBUG: <truncated - see config.log for full output>(B(B
firefox-unwrapped>  0:02.67(B DEBUG: |                 #if defined(__GLIBCXX__) && !defined(_GLIBCXX_RELEASE)(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #  error libstdc++ not new enough(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #endif(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #if defined(_GLIBCXX_RELEASE)(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #  if _GLIBCXX_RELEASE < 8(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #    error libstdc++ not new enough(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #  else(B(B
firefox-unwrapped>  0:02.67(B DEBUG: |      (void) 0(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #  endif(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #endif(B(B
firefox-unwrapped>  0:02.67(B DEBUG: |                   ;(B(B
firefox-unwrapped>  0:02.67(B DEBUG: |                   return 0;(B(B
firefox-unwrapped>  0:02.67(B DEBUG: |                 }(B(B
firefox-unwrapped>  0:02.67(B DEBUG: Executing: `/nix/store/7v4bi4q334yircaznwm353h1l5i7k98f-aarch64-unknown-linux-gnu-clang-wrapper-16.0.6/bin/aarch64-unknown-linux-gnu-clang++ /build/conftest.qvbo58dv.cpp -c`(B(B
firefox-unwrapped>  0:02.67(B DEBUG: The command returned non-zero exit status 1.(B(B
firefox-unwrapped>  0:02.67(B DEBUG: Its error output was:(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | /build/conftest.qvbo58dv.cpp:1:10: fatal error: 'cstddef' file not found(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | #include <cstddef>(B(B
firefox-unwrapped>  0:02.67(B DEBUG: |          ^~~~~~~~~(B(B
firefox-unwrapped>  0:02.67(B DEBUG: | 1 error generated.(B(B
firefox-unwrapped>  0:02.67(B ERROR: The libstdc++ in use is not new enough.  Please run ./mach bootstrap to update your compiler, or update your system libstdc++ installation.(B(B
firefox-unwrapped> *** Fix above errors and then restart with "./mach build"
error: build of '/nix/store/5in7xkji5hzqkl14ygwq3vxnni54lykk-firefox-unwrapped-aarch64-unknown-linux-gnu-119.0.1.drv' on 'ssh://root@192.168.22.103' failed: builder for '/nix/store/5in7xkji5hzqkl14ygwq3vxnni54lykk-firefox-unwrapped-aarch64-unknown-linux-gnu-119.0.1.drv' failed with exit code 1
error: builder for '/nix/store/5in7xkji5hzqkl14ygwq3vxnni54lykk-firefox-unwrapped-aarch64-unknown-linux-gnu-119.0.1.drv' failed with exit code 1;
```
---
 pkgs/build-support/cc-wrapper/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 0b25d70b14a2..57a090b1976c 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -551,10 +551,10 @@ stdenv.mkDerivation {
     # additional -isystem flags will confuse gfortran (see
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
     + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
-      for dir in ${gccForLibs}${lib.optionalString (hostPlatform != targetPlatform) "/${targetPlatform.config}"}/include/c++/*; do
+      for dir in ${gccForLibs}/include/c++/*; do
         echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
       done
-      for dir in ${gccForLibs}${lib.optionalString (hostPlatform != targetPlatform) "/${targetPlatform.config}"}/include/c++/*/${targetPlatform.config}; do
+      for dir in ${gccForLibs}/include/c++/*/${targetPlatform.config}; do
         echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
       done
     ''

From 6695a11e785fdc840d9a5d1b029f60542aba08bf Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 19 Jan 2024 04:20:00 +0000
Subject: [PATCH 144/175] ruby.rubygems: 3.5.4 -> 3.5.5

Changelog: https://github.com/rubygems/rubygems/blob/v3.5.5/CHANGELOG.md
---
 pkgs/development/interpreters/ruby/rubygems/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index a7f44a7b62dd..dd89e0cd41d7 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.5.4";
+  version = "3.5.5";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-v3D+6NzBHr6nbTE5nDtu6pBZCwbBxYfO8bblPsMrASg=";
+    hash = "sha256-ErKsKMIEvs4oA8eS9v1ASfqlMOJOxeTVfCA99AIcTh0=";
   };
 
   patches = [

From 0a97ca4a0a04a3acd0bf10ebe5ca291fa6b43980 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Fri, 19 Jan 2024 04:20:00 +0000
Subject: [PATCH 145/175] bundler: 2.5.4 -> 2.5.5

Changelog: https://github.com/rubygems/rubygems/blob/bundler-v2.5.5/bundler/CHANGELOG.md
---
 pkgs/development/ruby-modules/bundler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index d3f66b570019..04e6a6d35a11 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.5.4";
-  source.sha256 = "sha256-97nwjEfoxmVhOmaKobYz32P4GLmRg87kt5dwSoFu3v4=";
+  version = "2.5.5";
+  source.sha256 = "sha256-E8f+JpAw4qZAKmVMBt7/Aa72dM7WSds76YtVA6CApGI=";
   dontPatchShebangs = true;
 
   postFixup = ''

From e3995661b1f157b5f55a5083ec28bb966dc9dfe7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 19 Jan 2024 11:56:54 +0300
Subject: [PATCH 146/175] spirv-llvm-translator: cherry-pick a patch to fix
 build with latest spirv-headers

---
 .../compilers/spirv-llvm-translator/default.nix          | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index 4db3b93217d7..fb5b5b0b7ba5 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -48,7 +48,14 @@ disable-warnings-if-gcc13 (stdenv.mkDerivation {
     inherit (branch) rev hash;
   };
 
-  patches = lib.optionals (llvmMajor == "16") [
+  patches = [
+    # Fixes build after spirv-headers breaking change
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/0166a0fb86dc6c0e8903436bbc3a89bc3273ebc0.patch";
+      excludes = ["spirv-headers-tag.conf"];
+      hash = "sha256-17JJG8eCFVphElY5fVT/79hj0bByWxo8mVp1ZNjQk/M=";
+    })
+  ] ++ lib.optionals (llvmMajor == "16") [
     # Fixes builds that link against external LLVM dynamic library
     (fetchpatch {
       url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/f3b9b604d7eda18d0d1029d94a6eebd33aa3a3fe.patch";

From e44cf032bc2c516e41a41cb58dbd6575bf85a221 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 19 Jan 2024 12:52:59 +0300
Subject: [PATCH 147/175] qt5, qt6: fix QML path search order

QQmlImportDatabase::addImportPath _prepends_ to the search path,
so our version specific search paths need to be added in last.
---
 .../libraries/qt-5/5.15/qtdeclarative-qml-paths.patch  |  4 ++--
 .../qt-6/patches/qtdeclarative-qml-paths.patch         | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
index 2ea3554df7d2..e207fa4df3bd 100644
--- a/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
@@ -1,5 +1,5 @@
 diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
-index 289f11d006..80c422403c 100644
+index 289f11d006..9b0a48c6c7 100644
 --- a/src/qml/qml/qqmlimport.cpp
 +++ b/src/qml/qml/qqmlimport.cpp
 @@ -1897,17 +1897,22 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
@@ -26,8 +26,8 @@ index 289f11d006..80c422403c 100644
 +        }
 +    };
 +
-+    addEnvImportPath("NIXPKGS_QT5_QML_IMPORT_PATH");
 +    addEnvImportPath("QML2_IMPORT_PATH");
++    addEnvImportPath("NIXPKGS_QT5_QML_IMPORT_PATH");
  
      addImportPath(QStringLiteral("qrc:/qt-project.org/imports"));
      addImportPath(QCoreApplication::applicationDirPath());
diff --git a/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch b/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
index 7c6694eb48a3..39b7a30892cf 100644
--- a/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
+++ b/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
@@ -1,12 +1,12 @@
 diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
-index a7d1a3f77f..aac7392d4f 100644
+index 2e482c220d..4873809bec 100644
 --- a/src/qml/qml/qqmlimport.cpp
 +++ b/src/qml/qml/qqmlimport.cpp
-@@ -1515,6 +1515,7 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
-     };
- 
+@@ -1517,6 +1517,7 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
      // env import paths
-+    addEnvImportPath("NIXPKGS_QT6_QML_IMPORT_PATH");
      addEnvImportPath("QML_IMPORT_PATH");
      addEnvImportPath("QML2_IMPORT_PATH");
++    addEnvImportPath("NIXPKGS_QT6_QML_IMPORT_PATH");
  
+     addImportPath(QStringLiteral("qrc:/qt/qml"));
+     addImportPath(QStringLiteral("qrc:/qt-project.org/imports"));

From ec37b23b3294d5ba5d150e421f032b5ba7a7f5cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 20 Jan 2024 22:44:02 -0800
Subject: [PATCH 148/175] python311Packages.rapidfuzz: 3.6.0 -> 3.6.1

Diff: https://github.com/maxbachmann/RapidFuzz/compare/refs/tags/v3.6.0...v3.6.1

Changelog: https://github.com/maxbachmann/RapidFuzz/blob/refs/tags/v3.6.1/CHANGELOG.rst
---
 pkgs/development/python-modules/rapidfuzz/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index a7c816b4a33f..3dcffdd2ecc5 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,8 +18,8 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.6.0";
-  format = "pyproject";
+  version = "3.6.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OO8ztnildJ8nmI1crGW4FfA8uKVo7MZPlDguEatOzyA=";
+    hash = "sha256-QJVRT+d/IIGxkWfSNoXFSmbW017+8CTKuWD4W+TzvBs=";
   };
 
   postPatch = ''

From 29d9badd5101208da53f1cb25d0bc99f71fe84c7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 21 Jan 2024 12:41:24 +0300
Subject: [PATCH 149/175] ffmpeg: build with shaderc instead of glslang

It actually builds and seems to be preferred upstream anyway:
https://github.com/FFmpeg/FFmpeg/commit/da72aca7b02503cdcdacd915dcf11929d29eecd1
---
 pkgs/development/libraries/ffmpeg/generic.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 360c7759cd2a..146fe4202f5a 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -44,7 +44,6 @@
 , withFreetype ? withHeadlessDeps # Needed for drawtext filter
 , withFrei0r ? withFullDeps # frei0r video filtering
 , withFribidi ? withFullDeps # Needed for drawtext filter
-, withGlslang ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
 , withGme ? withFullDeps # Game Music Emulator
 , withGnutls ? withHeadlessDeps
 , withGsm ? withFullDeps # GSM de/encoder
@@ -73,6 +72,7 @@
 , withRtmp ? false # RTMP[E] support
 , withSamba ? withFullDeps && !stdenv.isDarwin # Samba protocol
 , withSdl2 ? withSmallDeps
+, withShaderc ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
 , withSoxr ? withHeadlessDeps # Resampling via soxr
 , withSpeex ? withHeadlessDeps # Speex de/encoder
 , withSrt ? withHeadlessDeps # Secure Reliable Transport (SRT) protocol
@@ -189,7 +189,6 @@
 , frei0r
 , fribidi
 , game-music-emu
-, glslang
 , gnutls
 , gsm
 , intel-media-sdk
@@ -245,6 +244,7 @@
 , rtmpdump
 , samba
 , SDL2
+, shaderc
 , soxr
 , speex
 , srt
@@ -525,7 +525,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withZimg "libzimg")
     (enableFeature withZlib "zlib")
     (enableFeature withVulkan "vulkan")
-    (enableFeature withGlslang "libglslang")
+    (enableFeature withShaderc "libshaderc")
     (enableFeature withSamba "libsmbclient")
     /*
      * Developer flags
@@ -578,7 +578,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withFreetype [ freetype ]
   ++ optionals withFrei0r [ frei0r ]
   ++ optionals withFribidi [ fribidi ]
-  ++ optionals withGlslang [ glslang ]
   ++ optionals withGme [ game-music-emu ]
   ++ optionals withGnutls [ gnutls ]
   ++ optionals withGsm [ gsm ]
@@ -605,6 +604,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withRtmp [ rtmpdump ]
   ++ optionals withSamba [ samba ]
   ++ optionals withSdl2 [ SDL2 ]
+  ++ optionals withShaderc [ shaderc ]
   ++ optionals withSoxr [ soxr ]
   ++ optionals withSpeex [ speex ]
   ++ optionals withSrt [ srt ]

From 099029fae624c17068a72172f5b09fe71eec4152 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 21 Jan 2024 13:15:48 +0300
Subject: [PATCH 150/175] libplacebo_5, vulkan-volk: move to by-name

Fixes the pkgs/by-name check
---
 .../libplacebo/5.nix => by-name/li/libplacebo_5/package.nix}    | 0
 .../default.nix => by-name/vu/vulkan-volk/package.nix}          | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 3 files changed, 2 deletions(-)
 rename pkgs/{development/libraries/libplacebo/5.nix => by-name/li/libplacebo_5/package.nix} (100%)
 rename pkgs/{development/libraries/vulkan-volk/default.nix => by-name/vu/vulkan-volk/package.nix} (100%)

diff --git a/pkgs/development/libraries/libplacebo/5.nix b/pkgs/by-name/li/libplacebo_5/package.nix
similarity index 100%
rename from pkgs/development/libraries/libplacebo/5.nix
rename to pkgs/by-name/li/libplacebo_5/package.nix
diff --git a/pkgs/development/libraries/vulkan-volk/default.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
similarity index 100%
rename from pkgs/development/libraries/vulkan-volk/default.nix
rename to pkgs/by-name/vu/vulkan-volk/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 66d25d7a6c16..12277b1bb7f0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23358,7 +23358,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Foundation;
   };
 
-  libplacebo_5 = callPackage ../development/libraries/libplacebo/5.nix { };
   libplacebo = callPackage ../development/libraries/libplacebo { };
 
   libpng = callPackage ../development/libraries/libpng { };
@@ -25525,7 +25524,6 @@ with pkgs;
   vulkan-tools-lunarg = callPackage ../tools/graphics/vulkan-tools-lunarg { };
   vulkan-utility-libraries = callPackage ../development/libraries/vulkan-utility-libraries { };
   vulkan-validation-layers = callPackage ../development/tools/vulkan-validation-layers { };
-  vulkan-volk = callPackage ../development/libraries/vulkan-volk { };
 
   vxl = callPackage ../development/libraries/vxl { };
 

From 3b238ed60ab203f7ad9490db7d216be0e06cc6dd Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 21 Jan 2024 09:04:28 +0200
Subject: [PATCH 151/175] xsimd: Add doronbehar as maintainer

---
 pkgs/development/libraries/xsimd/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/xsimd/default.nix b/pkgs/development/libraries/xsimd/default.nix
index 87da2c546b86..d775cef4d673 100644
--- a/pkgs/development/libraries/xsimd/default.nix
+++ b/pkgs/development/libraries/xsimd/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "C++ wrappers for SIMD intrinsics";
     homepage = "https://github.com/xtensor-stack/xsimd";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ tobim ];
+    maintainers = with maintainers; [ tobim doronbehar ];
     platforms = platforms.all;
   };
 })

From 6ae36a5a9f7165177a6c735f398d64738c039aef Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 21 Jan 2024 09:04:50 +0200
Subject: [PATCH 152/175] python310Packages.meson-python: add doronbehar as
 maintainer

---
 pkgs/development/python-modules/meson-python/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 9d34cb27c8cd..deaab05a6574 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -48,6 +48,6 @@ buildPythonPackage rec {
     description = "Meson Python build backend (PEP 517)";
     homepage = "https://github.com/mesonbuild/meson-python";
     license = [ lib.licenses.mit ];
-    maintainers = [ lib.maintainers.fridh ];
+    maintainers = with lib.maintainers; [ fridh doronbehar ];
   };
 }

From d69f99aaf866ed3b7fabd58740425c60f1d61a77 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 21 Jan 2024 09:05:10 +0200
Subject: [PATCH 153/175] python310Packages.pythran: add doronbehar as
 maintainer

---
 pkgs/development/python-modules/pythran/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/pythran/default.nix b/pkgs/development/python-modules/pythran/default.nix
index 1851eb3bbf23..3e62fa882cc9 100644
--- a/pkgs/development/python-modules/pythran/default.nix
+++ b/pkgs/development/python-modules/pythran/default.nix
@@ -79,5 +79,6 @@ in buildPythonPackage rec {
     description = "Ahead of Time compiler for numeric kernels";
     homepage = "https://github.com/serge-sans-paille/pythran";
     license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ doronbehar ];
   };
 }

From a23ee294e595fecb44b084841a21b559c0fcea33 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sat, 13 Jan 2024 23:00:59 +0200
Subject: [PATCH 154/175] python311Packages.scipy: 1.11.4 -> 1.12.0

---
 .../development/python-modules/scipy/default.nix | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index caca48153b72..d180e12265ee 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -13,6 +13,9 @@
 , pkg-config
 , pythran
 , wheel
+, nose
+, setuptools
+, hypothesis
 , pytestCheckHook
 , pytest-xdist
 , numpy
@@ -31,8 +34,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.11.4";
-  srcHash = "sha256-hNAZOMDFYqZpb67Pzg/WALWagFYvqYO1jOmcipDDRbE=";
+  version = "1.12.0";
+  srcHash = "sha256-PuiyYTgSegDTV9Kae5N68FOXT1jyJrNv9p2aFP70Z20=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
@@ -75,13 +78,11 @@ in buildPythonPackage {
     })
   ];
 
-  # Relax deps a bit
+  # Upstream complicated numpy version pinning is causing issues in the
+  # configurePhase, so we pass on it.
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'meson-python>=0.12.1,<0.15.0' 'meson-python' \
       --replace 'numpy==' 'numpy>=' \
-      --replace "pybind11>=2.10.4,<2.11.1" "pybind11>=2.10.4,<2.12.0" \
-      --replace 'wheel<0.41.0' 'wheel'
   '';
 
   nativeBuildInputs = [
@@ -91,6 +92,7 @@ in buildPythonPackage {
     pythran
     pkg-config
     wheel
+    setuptools
   ];
 
   buildInputs = [
@@ -108,6 +110,8 @@ in buildPythonPackage {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
+    nose
+    hypothesis
     pytestCheckHook
     pytest-xdist
   ];

From 8bd97eccd21fc0cdf1dc88710b6bbe4709d37b62 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sat, 13 Jan 2024 23:09:04 +0200
Subject: [PATCH 155/175] python311Packages.scipy: actually use pytestCheckHook

---
 .../python-modules/scipy/default.nix          | 37 +------------------
 1 file changed, 2 insertions(+), 35 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index d180e12265ee..1908131e097e 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -161,42 +161,9 @@ in buildPythonPackage {
   #
   hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
 
-  checkPhase = ''
-    runHook preCheck
-
-    # Adapted from pytestCheckHook because scipy uses a custom check phase.
-    # It needs to pass `$args` as a Python list to `scipy.test` rather than as
-    # arguments to pytest on the command-line.
-    args=""
-    if [ -n "$disabledTests" ]; then
-      disabledTestsString=$(_pytestComputeDisabledTestsString "''${disabledTests[@]}")
-      args+="'-k','$disabledTestsString'"
-    fi
-
-    if [ -n "''${disabledTestPaths-}" ]; then
-        eval "disabledTestPaths=($disabledTestPaths)"
-    fi
-
-    for path in ''${disabledTestPaths[@]}; do
-      if [ ! -e "$path" ]; then
-        echo "Disabled tests path \"$path\" does not exist. Aborting"
-        exit 1
-      fi
-      args+="''${args:+,}'--ignore=\"$path\"'"
-    done
-    args+="''${args:+,}$(printf \'%s\', "''${pytestFlagsArray[@]}")"
-    args=''${args%,}
-
-    pushd "$out"
+  preCheck = ''
     export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
-    ${python.interpreter} -c "import scipy, sys; sys.exit(scipy.test(
-        'fast',
-        verbose=10,
-        extra_argv=[$args],
-        parallel=$NIX_BUILD_CORES
-    ) != True)"
-    popd
-    runHook postCheck
+    cd $out
   '';
 
   requiredSystemFeatures = [ "big-parallel" ]; # the tests need lots of CPU time

From 83fc2070ecf18ff85d5560150bdb0ccb082a0d70 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 21 Jan 2024 13:09:24 +0200
Subject: [PATCH 156/175] python311Packages.scipy: use --replace-fail in numpy
 dep substitution

---
 pkgs/development/python-modules/scipy/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 1908131e097e..ec6e966d79bf 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -82,7 +82,7 @@ in buildPythonPackage {
   # configurePhase, so we pass on it.
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'numpy==' 'numpy>=' \
+      --replace-fail 'numpy==' 'numpy>=' \
   '';
 
   nativeBuildInputs = [

From 3ceff466768669f09244731f5d5721c7672cf4e7 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 21 Jan 2024 21:31:36 -0500
Subject: [PATCH 157/175] Revert "desktopToDarwinBundle: use imagemagick_light"

This reverts commit 674a5019a494cf67c615ad250b0209ba15013375.
---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0a5755ef0451..cf19e329c2e5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1427,7 +1427,7 @@ with pkgs;
 
   desktopToDarwinBundle = makeSetupHook {
     name = "desktop-to-darwin-bundle-hook";
-    propagatedBuildInputs = [ writeDarwinBundle librsvg imagemagick_light python3Packages.icnsutil ];
+    propagatedBuildInputs = [ writeDarwinBundle librsvg imagemagick python3Packages.icnsutil ];
   } ../build-support/setup-hooks/desktop-to-darwin-bundle.sh;
 
   keepBuildTree = makeSetupHook {

From 78b0905b1bfbbfc6879ecb23813966ad1b9639b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 22 Jan 2024 10:48:22 +0100
Subject: [PATCH 158/175] ffmpeg_4: avoid unknown configure option

This broke with 29d9badd51012 (PR #282536)
---
 pkgs/development/libraries/ffmpeg/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 146fe4202f5a..12347318696c 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -525,7 +525,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withZimg "libzimg")
     (enableFeature withZlib "zlib")
     (enableFeature withVulkan "vulkan")
-    (enableFeature withShaderc "libshaderc")
+    (optionalString (lib.versionAtLeast version "5") (enableFeature withShaderc "libshaderc"))
     (enableFeature withSamba "libsmbclient")
     /*
      * Developer flags

From e629f662fb1cef6cb9aa69c135f1a3a7cbfc6278 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 22 Jan 2024 09:53:06 +0000
Subject: [PATCH 159/175] rav1e: fix `strip` option mangling on x86_64-darwin

`rav1e-0.7.1` slightly changes `strip` option construction in
    https://github.com/xiph/rav1e/commit/43fb165e5e07ac047dd59d9d2278bed5da95deb4

Update mangling part to restore stripping.
---
 pkgs/tools/video/rav1e/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 4f62161b0189..406276977c52 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
   # Darwin uses `llvm-strip`, which results in link errors when using `-x` to strip the asm library
   # and linking it with cctools ld64.
   postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
-    substituteInPlace build.rs --replace 'cmd.arg("-x")' 'cmd.arg("-S")'
+    substituteInPlace build.rs --replace-fail '.arg("-x")' '.arg("-S")'
   '';
 
   checkType = "debug";

From dd2399ded79ec00604ce2dc1112acec1193af884 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 22 Jan 2024 18:16:52 +0100
Subject: [PATCH 160/175] catch2_3: 3.5.1 -> 3.5.2

https://github.com/catchorg/Catch2/releases/tag/v3.5.2

This addresses an issue shown when compiling tests in tiledb package:
include/catch2/internal/catch_clara.hpp:676:24:
  error: cannot bind non-const lvalue reference of type 'Catch::Clara::Parser&'
    to an rvalue of type 'Catch::Clara::Parser'
---
 pkgs/development/libraries/catch2/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/catch2/3.nix b/pkgs/development/libraries/catch2/3.nix
index a6b51710e615..6bf982aa75fb 100644
--- a/pkgs/development/libraries/catch2/3.nix
+++ b/pkgs/development/libraries/catch2/3.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    hash = "sha256-OyYNUfnu6h1+MfCF8O+awQ4Usad0qrdCtdZhYgOY+Vw=";
+    hash = "sha256-xGPfXjk+oOnR7JqTrZd2pKJxalrlS8CMs7HWDClXaS8=";
   };
 
   nativeBuildInputs = [

From 9fd4379ed110dc3ecb021a6d00f5a98bdc735e88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 22 Jan 2024 18:19:10 +0100
Subject: [PATCH 161/175] tiledb: fixup build

https://cache.nixos.org/log/4d5lf8dr8g2p4mhpi872156x5fbwdjn6-tiledb-2.18.2.drv
---
 pkgs/development/libraries/tiledb/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/tiledb/default.nix b/pkgs/development/libraries/tiledb/default.nix
index f8540d4ffaa0..28b14d3a8a5b 100644
--- a/pkgs/development/libraries/tiledb/default.nix
+++ b/pkgs/development/libraries/tiledb/default.nix
@@ -58,6 +58,9 @@ stdenv.mkDerivation rec {
       cmake/Modules/FindOpenSSL_EP.cmake
   '';
 
+  # upstream will hopefully fix this in some newer release
+  env.CXXFLAGS = "-include random";
+
   # (bundled) blosc headers have a warning on some archs that it will be using
   # unaccelerated routines.
   cmakeFlags = [

From ba4747bd8efe5967d00493fc0561bd24bee2692e Mon Sep 17 00:00:00 2001
From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Date: Tue, 23 Jan 2024 08:03:07 +0100
Subject: [PATCH 162/175] mkosi: remove systemd patches included in v255

---
 pkgs/tools/virtualization/mkosi/default.nix | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/pkgs/tools/virtualization/mkosi/default.nix b/pkgs/tools/virtualization/mkosi/default.nix
index cf3a934b0bef..12f752432e4d 100644
--- a/pkgs/tools/virtualization/mkosi/default.nix
+++ b/pkgs/tools/virtualization/mkosi/default.nix
@@ -30,20 +30,7 @@
 let
   # For systemd features used by mkosi, see
   # https://github.com/systemd/mkosi/blob/19bb5e274d9a9c23891905c4bcbb8f68955a701d/action.yaml#L64-L72
-  systemdForMkosi = (systemd.overrideAttrs (oldAttrs: {
-    patches = oldAttrs.patches ++ [
-      # Enable setting a deterministic verity seed for systemd-repart. Remove when upgrading to systemd 255.
-      (fetchpatch {
-        url = "https://github.com/systemd/systemd/commit/81e04781106e3db24e9cf63c1d5fdd8215dc3f42.patch";
-        hash = "sha256-KO3poIsvdeepPmXWQXNaJJCPpmBb4sVmO+ur4om9f5k=";
-      })
-      # repart: make sure rewinddir() is called before readdir() when performing rm -rf. Remove when upgrading to systemd 255.
-      (fetchpatch {
-        url = "https://github.com/systemd/systemd/commit/6bbb893b90e2dcb05fb310ba4608f9c9dc587845.patch";
-        hash = "sha256-A6cF2QAeYHGc0u0V1JMxIcV5shzf5x3Q6K+blZOWSn4=";
-      })
-    ];
-  })).override {
+  systemdForMkosi = systemd.override {
     withRepart = true;
     withBootloader = true;
     withSysusers = true;

From 573dc719f2b2b36666fc23b734e6e30e7857ad9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 23 Jan 2024 16:58:45 +0100
Subject: [PATCH 163/175] pkgsi686Linux.xapian: fixup build

https://hydra.nixos.org/build/247284127/nixlog/3/tail
I don't feel like looking into a proper fix for 32-bit-only issues;
it even looks like it's only a problem in tests themselves.
---
 pkgs/development/libraries/xapian/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/xapian/default.nix b/pkgs/development/libraries/xapian/default.nix
index 243ec53a3234..f9fe5bac07fe 100644
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -28,7 +28,12 @@ let
     enableParallelBuilding = true;
 
     doCheck = true;
-    env.AUTOMATED_TESTING = true; # https://trac.xapian.org/changeset/8be35f5e1/git
+
+    env = {
+      AUTOMATED_TESTING = true; # https://trac.xapian.org/changeset/8be35f5e1/git
+    } // lib.optionalAttrs stdenv.is32bit {
+      NIX_CFLAGS_COMPILE = "-fpermissive";
+    };
 
     # the configure script thinks that Darwin has ___exp10
     # but it’s not available on my systems (or hydra apparently)

From 6f441b4f153877493656c54cbb028bc958dc66b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jan 2024 15:27:01 -0800
Subject: [PATCH 164/175] python311Packages.sip: add poppler-qt5 to
 passthru.tests

It breaks on sip 6.8.0 with

    NameError: name 'SocstringSignature' is not defined. Did you mean: 'DocstringSignature'?
---
 pkgs/development/python-modules/sip/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/sip/default.nix b/pkgs/development/python-modules/sip/default.nix
index b36e64e632cf..c36e3acc30ea 100644
--- a/pkgs/development/python-modules/sip/default.nix
+++ b/pkgs/development/python-modules/sip/default.nix
@@ -9,6 +9,7 @@
 , ply
 , toml
 , tomli
+, poppler-qt5
 }:
 
 buildPythonPackage rec {
@@ -36,6 +37,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "sipbuild" ];
 
+  passthru.tests = {
+    inherit poppler-qt5;
+  };
+
   meta = with lib; {
     description = "Creates C++ bindings for Python modules";
     homepage    = "https://riverbankcomputing.com/";

From 6882fc4950e392831ea76fd645fd095608958a42 Mon Sep 17 00:00:00 2001
From: Bryan Lai <bryanlais@gmail.com>
Date: Thu, 25 Jan 2024 12:52:22 +0800
Subject: [PATCH 165/175] python311Packages.scikit-learn: 1.3.2 -> 1.4.0

Fix pytest failure: https://hydra.nixos.org/build/247211840/nixlog/1
See upstream PR 27628 for details.

Changelog: https://scikit-learn.org/stable/whats_new/v1.4.html
---
 pkgs/development/python-modules/scikit-learn/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index cd66ed54be76..4b33027fb99b 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-learn";
-  version = "1.3.2";
+  version = "1.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ovVMdqzMFaNL+5Bm5selbB5yNd2ldiuZB5IzC1LM+wU=";
+    hash = "sha256-1Dc8mE66IOOTIW7dUaPj7t5Wy+k9QkdRbSBWQ8O5MSE=";
   };
 
   buildInputs = [

From 24db4fbcb81d80e8e74b3580736dedebada317cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 25 Jan 2024 09:12:08 +0100
Subject: [PATCH 166/175] octopus: fixup build by adding `which`

https://hydra.nixos.org/build/247364187/nixlog/1/tail
---
 pkgs/applications/science/chemistry/octopus/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/science/chemistry/octopus/default.nix b/pkgs/applications/science/chemistry/octopus/default.nix
index c32f4b8a5f9b..db08de018804 100644
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, gfortran, perl, procps
+{ lib, stdenv, fetchFromGitLab, gfortran, which, perl, procps
 , libyaml, libxc, fftw, blas, lapack, gsl, netcdf, arpack, autoreconfHook
 , python3
 , enableFma ? stdenv.hostPlatform.fmaSupport
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
+    which
     perl
     procps
     autoreconfHook

From a7630267808ebd4116c0823327ae56d51aabab26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 25 Jan 2024 09:16:25 +0100
Subject: [PATCH 167/175] linux-pam: fixup build on musl

In particular, nixStatic was blocked by this.
https://hydra.nixos.org/build/247250976/nixlog/46/tail
---
 pkgs/os-specific/linux/pam/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 241f33f1e00a..8660313a7189 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -24,7 +24,13 @@ stdenv.mkDerivation rec {
       url = "https://github.com/linux-pam/linux-pam/commit/77bd338125cde583ecdfb9fd69619bcd2baf15c2.patch";
       hash = "sha256-tlc9RcLZpEH315NFD4sdN9yOco8qhC6+bszl4OHm+AI=";
     })
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isMusl (fetchpatch {
+      name = "missing-termio.patch";
+      url = "https://github.com/linux-pam/linux-pam/commit/5374f677e4cae669eb9accf2449178b602e8a40a.patch";
+      hash = "sha256-b6n8f16ETSNj5h+5/Yhn32XMfVO8xEnZRRhw+nuLP/8=";
+    })
+  ;
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
   postPatch = if stdenv.buildPlatform.isDarwin && stdenv.buildPlatform != stdenv.hostPlatform then ''

From efe7c87c4de672603442fe4755c5e76c4bec6cb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 25 Jan 2024 10:28:15 +0100
Subject: [PATCH 168/175] llvmPackages_11: pin to gcc12 to fix builds

Just like many other llvmPackages versions.  Example issues:
https://hydra.nixos.org/build/247233740/nixlog/3/tail
---
 pkgs/top-level/all-packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 66db08ac74b1..2026a49e9d8e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16676,6 +16676,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_11.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_11.libraries or llvmPackages_11.libraries;
     targetLlvm = targetPackages.llvmPackages_11.llvm or llvmPackages_11.llvm;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   }));
 
   llvmPackages_12 = recurseIntoAttrs (callPackage ../development/compilers/llvm/12 ({

From 8a2f9b24143cd5e0ef7aaf7d2f38ba8174e87b4d Mon Sep 17 00:00:00 2001
From: Bryan Lai <bryanlais@gmail.com>
Date: Thu, 25 Jan 2024 17:38:44 +0800
Subject: [PATCH 169/175] python311Packages.levenshtein: fetch submodules

This allows access to the vendored dependency `rapidfuzz-cpp`, which is
older (2.0.0) than the nixpkgs version (3.0.0).

The nixpkgs `rapidfuzz-cpp` is kept in buildInputs, which enables us to
seamlessly switch back to it when levenshtein catches up in the future.
---
 pkgs/development/python-modules/levenshtein/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/levenshtein/default.nix b/pkgs/development/python-modules/levenshtein/default.nix
index 037ae3cda69f..2a297571b3f1 100644
--- a/pkgs/development/python-modules/levenshtein/default.nix
+++ b/pkgs/development/python-modules/levenshtein/default.nix
@@ -22,7 +22,8 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "Levenshtein";
     rev = "refs/tags/v${version}";
-    hash = "sha256-O39Xe26WKAGcv6DEvwuOL8NZJBem5SYZDX1TPAY7/uA=";
+    hash = "sha256-xQimslz/G6nf2uYerLSaRAK5gvmfDmWTzEx/fh+nqg0=";
+    fetchSubmodules = true; ## for vendored `rapidfuzz-cpp`
   };
 
   nativeBuildInputs = [

From b9b58d1c46ca234dd18102cdc1222f383554189f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 25 Jan 2024 11:04:51 +0100
Subject: [PATCH 170/175] libreswan: patch build after gcc upgrade

---
 pkgs/tools/networking/libreswan/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 368189abe15d..49e4df298bc7 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , nixosTests
 , pkg-config
 , systemd
@@ -114,6 +115,14 @@ stdenv.mkDerivation rec {
         -i configs/Makefile
   '';
 
+  patches = [
+    (fetchpatch {
+      name = "ignoring-return-value.patch";
+      url = "https://github.com/libreswan/libreswan/commit/ba5bad09f55959872022fa506d5ac06eafe3a314.diff";
+      hash = "sha256-xJ8rZWoRtJixamGY8sjOS+63Lw3RX7620HlRWYfvSxc=";
+    })
+  ];
+
   makeFlags = [
     "PREFIX=$(out)"
     "INITSYSTEM=systemd"

From 0c10ec9d2c0e1993798f70ad58e18a62352f3b21 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 25 Jan 2024 13:37:47 +0300
Subject: [PATCH 171/175] flashmq: 1.4.5 -> 1.8.4

Diff: https://github.com/halfgaar/FlashMQ/compare/v1.4.5...v1.8.4
---
 pkgs/servers/mqtt/flashmq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/mqtt/flashmq/default.nix b/pkgs/servers/mqtt/flashmq/default.nix
index 7ecad55000ab..eb4c607b7804 100644
--- a/pkgs/servers/mqtt/flashmq/default.nix
+++ b/pkgs/servers/mqtt/flashmq/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flashmq";
-  version = "1.4.5";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "halfgaar";
     repo = "FlashMQ";
     rev = "v${version}";
-    hash = "sha256-DcxwwUNpnMeK8A3LuyfrWAMCng0yIcX9bKxNGY0uDSo=";
+    hash = "sha256-CMZim7FSTzjUaViVFq5OABOAUX3Aee+I3/HQhNIdIVM=";
   };
 
   nativeBuildInputs = [ cmake installShellFiles ];

From 1f37e33af51568e615afc93e5d4047bc52b92358 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 25 Jan 2024 11:49:52 +0100
Subject: [PATCH 172/175] llvmPackages_12: pin to gcc12 to fix builds

Just like many other llvmPackages versions.  Example issues:
https://hydra.nixos.org/build/247275023/nixlog/3/tail
---
 pkgs/top-level/all-packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2026a49e9d8e..ef7ee1bd9ebd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16684,6 +16684,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_12.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_12.libraries or llvmPackages_12.libraries;
     targetLlvm = targetPackages.llvmPackages_12.llvm or llvmPackages_12.llvm;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # .libcxxabi does not build with gcc13
   }));
 
   llvmPackages_13 = recurseIntoAttrs (callPackage ../development/compilers/llvm/13 ({

From 3f258b8e445577ad47b566bceeb40c1a89d98b05 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 25 Jan 2024 13:58:23 +0300
Subject: [PATCH 173/175] catch2_3: fix build on i686

---
 pkgs/development/libraries/catch2/3.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/catch2/3.nix b/pkgs/development/libraries/catch2/3.nix
index 6bf982aa75fb..dff36cbc3d3a 100644
--- a/pkgs/development/libraries/catch2/3.nix
+++ b/pkgs/development/libraries/catch2/3.nix
@@ -29,6 +29,11 @@ stdenv.mkDerivation rec {
     "-DCMAKE_CTEST_ARGUMENTS=-E;ApprovalTests"
   ];
 
+  # Tests fail on x86_32 if compiled with x87 floats: https://github.com/catchorg/Catch2/issues/2796
+  env = lib.optionalAttrs stdenv.isx86_32 {
+    NIX_CFLAGS_COMPILE = "-msse2 -mfpmath=sse";
+  };
+
   doCheck = true;
 
   nativeCheckInputs = [

From 4567be8aa5a29e4489e601326820d0ae4b1a16cb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 25 Jan 2024 14:01:53 +0300
Subject: [PATCH 174/175] ffmpeg: always use version from finalAttrs

In case of overrides and such
---
 pkgs/development/libraries/ffmpeg/generic.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 12347318696c..0f5d88984566 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -350,14 +350,14 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   patches = map (patch: fetchpatch patch) (extraPatches
-    ++ (lib.optional (lib.versionAtLeast version "6" && lib.versionOlder version "6.1")
+    ++ (lib.optional (lib.versionAtLeast finalAttrs.version "6" && lib.versionOlder finalAttrs.version "6.1")
       { # this can be removed post 6.1
         name = "fix_aacps_tablegen";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/814178f92647be2411516bbb82f48532373d2554";
         hash = "sha256-FQV9/PiarPXCm45ldtCsxGHjlrriL8DKpn1LaKJ8owI=";
       }
     )
-    ++ (lib.optional (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
+    ++ (lib.optional (lib.versionAtLeast finalAttrs.version "6.1" && lib.versionOlder finalAttrs.version "6.2")
       { # this can be removed post 6.1
         name = "fix_build_failure_due_to_PropertyKey_EncoderID";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
@@ -417,7 +417,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature buildAvdevice "avdevice")
     (enableFeature buildAvfilter "avfilter")
     (enableFeature buildAvformat "avformat")
-  ] ++ optionals (lib.versionOlder version "5") [
+  ] ++ optionals (lib.versionOlder finalAttrs.version "5") [
     # Ffmpeg > 4 doesn't know about the flag anymore
     (enableFeature buildAvresample "avresample")
   ] ++ [
@@ -477,7 +477,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withModplug "libmodplug")
     (enableFeature withMysofa "libmysofa")
     (enableFeature withOpus "libopus")
-    (optionalString (versionAtLeast version "5.0" && withLibplacebo) "--enable-libplacebo")
+    (optionalString (versionAtLeast finalAttrs.version "5.0" && withLibplacebo) "--enable-libplacebo")
     (enableFeature withSvg "librsvg")
     (enableFeature withSrt "libsrt")
     (enableFeature withSsh "libssh")
@@ -525,7 +525,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withZimg "libzimg")
     (enableFeature withZlib "zlib")
     (enableFeature withVulkan "vulkan")
-    (optionalString (lib.versionAtLeast version "5") (enableFeature withShaderc "libshaderc"))
+    (optionalString (lib.versionAtLeast finalAttrs.version "5") (enableFeature withShaderc "libshaderc"))
     (enableFeature withSamba "libsmbclient")
     /*
      * Developer flags
@@ -561,7 +561,7 @@ stdenv.mkDerivation (finalAttrs: {
   # TODO This was always in buildInputs before, why?
   buildInputs = optionals withFullDeps [ libdc1394 ]
   ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
-  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
+  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast finalAttrs.version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
   ++ optionals withAribcaption [ libaribcaption ]
@@ -584,7 +584,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
   ++ optionals withJack [ libjack2 ]
   ++ optionals withLadspa [ ladspaH ]
-  ++ optionals withLibplacebo [ (if (lib.versionAtLeast version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
+  ++ optionals withLibplacebo [ (if (lib.versionAtLeast finalAttrs.version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withLzma [ xz ]
   ++ optionals withMfx [ intel-media-sdk ]
   ++ optionals withModplug [ libmodplug ]
@@ -693,7 +693,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "A complete, cross-platform solution to record, convert and stream audio and video";
     homepage = "https://www.ffmpeg.org/";
-    changelog = "https://github.com/FFmpeg/FFmpeg/blob/n${version}/Changelog";
+    changelog = "https://github.com/FFmpeg/FFmpeg/blob/n${finalAttrs.version}/Changelog";
     longDescription = ''
       FFmpeg is the leading multimedia framework, able to decode, encode, transcode,
       mux, demux, stream, filter and play pretty much anything that humans and machines

From e4a8ae547c7cd2875116767c4c952c491213c1df Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 25 Jan 2024 14:04:07 +0300
Subject: [PATCH 175/175] jellyfin-ffmpeg: clobber patches

They are (currently) already applied upstream
---
 pkgs/development/libraries/jellyfin-ffmpeg/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
index 7109a5d6dfd1..942f23cb10e6 100644
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@@ -15,6 +15,9 @@ ffmpeg_6-full.overrideAttrs (old: rec {
     hash = "sha256-LMwGxx++z6TpZLnpeRGraid4653Mp8T4pY5EP4Z7GXY=";
   };
 
+  # Clobber upstream patches as they don't apply to the Jellyfin fork
+  patches = [];
+
   buildInputs = old.buildInputs ++ [ chromaprint ];
 
   configureFlags = old.configureFlags ++ [