From d7e6609505d1b533133414d0df77413a8257209c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
Date: Tue, 21 Mar 2023 09:06:04 +0100
Subject: [PATCH 001/102] coreutils: 9.1 -> 9.3

The changes are mostly minor; numerous bugs have been fixed and a few
new command-line options have been added.

Changelog: https://lists.gnu.org/archive/html/coreutils-announce/2023-03/msg00000.html
---
 pkgs/tools/misc/coreutils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 8ecbe342034a..bef2f422130d 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -32,11 +32,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "coreutils" + (optionalString (!minimal) "-full");
-  version = "9.1";
+  version = "9.3";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz";
-    sha256 = "sha256-YaH0ENeLp+fzelpPUObRMgrKMzdUhKMlXt3xejhYBCM=";
+    hash = "sha256-rbz8/omSNbceh2jc8HzVMlILf1T5qAZIQ/jRmakEu6o=";
   };
 
   patches = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [

From 65366c0602e2042f6bd045204dd13aa2dc5749fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
Date: Tue, 21 Mar 2023 13:16:21 +0100
Subject: [PATCH 002/102] coreutils: Re-enable hole seeking on Darwin

The bug appears to be resolved:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=61386

See also here: https://github.com/openwrt/openwrt/pull/11960#issuecomment-1443787254

And here: https://github.com/openwrt/openwrt/pull/12233
---
 pkgs/tools/misc/coreutils/default.nix         |  5 ---
 .../misc/coreutils/disable-seek-hole.patch    | 43 -------------------
 2 files changed, 48 deletions(-)
 delete mode 100644 pkgs/tools/misc/coreutils/disable-seek-hole.patch

diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index bef2f422130d..beee4241c541 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -39,11 +39,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-rbz8/omSNbceh2jc8HzVMlILf1T5qAZIQ/jRmakEu6o=";
   };
 
-  patches = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
-    # Workaround for https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51433
-    ./disable-seek-hole.patch
-  ];
-
   postPatch = ''
     # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh
diff --git a/pkgs/tools/misc/coreutils/disable-seek-hole.patch b/pkgs/tools/misc/coreutils/disable-seek-hole.patch
deleted file mode 100644
index 89503287980d..000000000000
--- a/pkgs/tools/misc/coreutils/disable-seek-hole.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-diff --git a/src/copy.c b/src/copy.c
-index cb9018f93..2a4ccc061 100644
---- a/src/copy.c
-+++ b/src/copy.c
-@@ -502,7 +502,7 @@ write_zeros (int fd, off_t n_bytes)
-   return true;
- }
-
--#ifdef SEEK_HOLE
-+#if 0
- /* Perform an efficient extent copy, if possible.  This avoids
-    the overhead of detecting holes in hole-introducing/preserving
-    copy, and thus makes copying sparse files much more efficient.
-@@ -1095,7 +1095,7 @@ infer_scantype (int fd, struct stat const *sb,
-          && ST_NBLOCKS (*sb) < sb->st_size / ST_NBLOCKSIZE))
-     return PLAIN_SCANTYPE;
-
--#ifdef SEEK_HOLE
-+#if 0
-   scan_inference->ext_start = lseek (fd, 0, SEEK_DATA);
-   if (0 <= scan_inference->ext_start)
-     return LSEEK_SCANTYPE;
-@@ -1377,7 +1377,7 @@ copy_reg (char const *src_name, char const *dst_name,
-       off_t n_read;
-       bool wrote_hole_at_eof = false;
-       if (! (
--#ifdef SEEK_HOLE
-+#if 0
-              scantype == LSEEK_SCANTYPE
-              ? lseek_copy (source_desc, dest_desc, buf, buf_size, hole_size,
-                            scan_inference.ext_start, src_open_sb.st_size,
-diff --git a/tests/seek-data-capable b/tests/seek-data-capable
-index cc6372214..6e7a9ec1e 100644
---- a/tests/seek-data-capable
-+++ b/tests/seek-data-capable
-@@ -1,5 +1,7 @@
- import sys, os, errno, platform
-
-+sys.exit(1)
-+
- # Pass an _empty_ file
- if len(sys.argv) != 2:
-     sys.exit(1)

From 6e272215fcfe088e0dd3532001173baf33341137 Mon Sep 17 00:00:00 2001
From: OPNA2608 <christoph.neidahl@gmail.com>
Date: Tue, 16 May 2023 23:24:11 +0200
Subject: [PATCH 003/102] libopenmpt: 0.6.10 -> 0.7.1

---
 .../libraries/audio/libopenmpt/default.nix         | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index ec8c36c657fe..f058be4b645d 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.10";
+  version = "0.7.1";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "wlvo3A2sI87AJUh+WPGV5NFPfZSu3dX+RrIcBPHOJ3Q=";
+    hash = "sha256-vxddJkSLsTP3RxTzqIWecAC5NSL7NXdVnf/ANxYZEPk=";
   };
 
   enableParallelBuilding = true;
@@ -39,11 +39,15 @@ stdenv.mkDerivation rec {
     portaudio
     libsndfile
     flac
-  ] ++ lib.optional usePulseAudio libpulseaudio;
+  ] ++ lib.optionals usePulseAudio [
+    libpulseaudio
+  ];
 
-  configureFlags = lib.optional (!usePulseAudio) "--without-pulseaudio";
+  configureFlags = [
+    (lib.strings.withFeature usePulseAudio "pulseaudio")
+  ];
 
-  doCheck = true;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   postFixup = ''
     moveToOutput share/doc $dev

From 0bc3481a19fb21404ba14a4d0eab8afd81052ed5 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 17 May 2023 21:52:45 +0100
Subject: [PATCH 004/102] sord: extract "dev", "doc", "man" outputs

---
 pkgs/development/libraries/sord/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/sord/default.nix b/pkgs/development/libraries/sord/default.nix
index efb8bf0b8952..54ae9261f810 100644
--- a/pkgs/development/libraries/sord/default.nix
+++ b/pkgs/development/libraries/sord/default.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-S22Szpg6iXeana5t6EpbOtRstthgrJ4Z2cBrf7a9ZBk=";
   };
 
+  outputs = [ "out" "dev" "doc" "man" ];
+
   nativeBuildInputs = [
     doxygen
     meson

From 8b0cc098433231837c24e94149e8da24af9be7c8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 17 May 2023 22:00:44 +0100
Subject: [PATCH 005/102] libcap_ng: extract dev, man outputs

---
 pkgs/os-specific/linux/libcap-ng/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 1ba14c5f4714..0f60a8655ced 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   configureFlags = [
     "--without-python"
   ];

From a7853ab93a06d5fe96ca77a17c5cbd422ea30a86 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 17 May 2023 22:03:28 +0100
Subject: [PATCH 006/102] soxr: extract dev output

---
 pkgs/applications/misc/audio/soxr/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/misc/audio/soxr/default.nix b/pkgs/applications/misc/audio/soxr/default.nix
index 45a5227404ce..604057ba65cb 100644
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     ./arm64-check.patch
   ];
 
-  outputs = [ "out" "doc" ]; # headers are just two and very small
+  outputs = [ "out" "dev" "doc" ];
 
   nativeBuildInputs = [ cmake ];
 

From 39d29247694680d7ca362026b3d6b760bd284a5e Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Fri, 19 May 2023 13:13:17 -0400
Subject: [PATCH 007/102] emscripten: 3.1.24 -> 3.1.39

---
 ...-emulate-clang-sysroot-include-logic.patch | 14 ++++----
 .../compilers/emscripten/default.nix          | 33 ++++++++-----------
 pkgs/top-level/all-packages.nix               |  2 +-
 3 files changed, 21 insertions(+), 28 deletions(-)

diff --git a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
index 9cb3ca2bf9f6..6a57e423bd72 100644
--- a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
+++ b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
@@ -1,4 +1,4 @@
-From 67f54fde2b1683aae3800f7a86a4e507c1125be8 Mon Sep 17 00:00:00 2001
+From 4bbbb640934aa653bcfec0335798b77a8935b815 Mon Sep 17 00:00:00 2001
 From: Yureka <yuka@yuka.dev>
 Date: Sat, 7 Aug 2021 09:16:46 +0200
 Subject: [PATCH] emulate clang 'sysroot + /include' logic
@@ -20,23 +20,23 @@ but it doesn't appear to work
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/emcc.py b/emcc.py
-index 999314afc..0e23c066c 100755
+index ba8d1b556..7d89644c5 100755
 --- a/emcc.py
 +++ b/emcc.py
-@@ -759,7 +759,12 @@ def emsdk_ldflags(user_args):
+@@ -883,7 +883,12 @@ def parse_s_args(args):
  
  
  def emsdk_cflags(user_args):
--  cflags = ['--sysroot=' + shared.Cache.get_sysroot(absolute=True)]
+-  cflags = ['--sysroot=' + cache.get_sysroot(absolute=True)]
 +  cflags = [
-+    '--sysroot=' + shared.Cache.get_sysroot(absolute=True),
++    '--sysroot=' + cache.get_sysroot(absolute=True),
 +    '-resource-dir=@resourceDir@',
-+    '-idirafter' + shared.Cache.get_sysroot(absolute=True) + os.path.join('/include'),
++    '-idirafter' + cache.get_sysroot(absolute=True) + os.path.join('/include'),
 +    '-iwithsysroot' + os.path.join('/include','c++','v1')
 +  ]
  
    def array_contains_any_of(hay, needles):
      for n in needles:
 -- 
-2.32.0
+2.40.0
 
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 02b1f6f03b2a..52aa8ff8fb73 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "emscripten";
-  version = "3.1.24";
+  version = "3.1.39";
 
   llvmEnv = symlinkJoin {
     name = "emscripten-llvm-${version}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     name = "emscripten-node-modules-${version}";
     inherit pname version src;
 
-    npmDepsHash = "sha256-ejuHR2BpAUStWjuvQuGE6ko4byF4GBl6FJBshxlknQk=";
+    npmDepsHash = "sha256-NSpVXssXwx+94E1qhM3tt2fN2G0EuvPZSN+Xep2IRs8=";
 
     dontBuild = true;
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "emscripten-core";
     repo = "emscripten";
-    sha256 = "sha256-1jW6ThxK6dThOO90l4Mc5yehVF3tI4HWipBWZAOztrk=";
+    sha256 = "sha256-hgndNMx+hvXyLzn6ip8Fhs+LAw98P3cqL8dJ+92jJmU=";
     rev = version;
   };
 
@@ -42,17 +42,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./0001-emulate-clang-sysroot-include-logic.patch;
-      resourceDir = "${llvmEnv}/lib/clang/${llvmPackages.release_version}/";
-    })
-    # https://github.com/emscripten-core/emscripten/pull/18219
-    (fetchpatch {
-      url = "https://github.com/emscripten-core/emscripten/commit/afbc14950f021513c59cbeaced8807ef8253530a.patch";
-      sha256 = "sha256-+gJNTQJng9rWcGN3GAcMBB0YopKPnRp/r8CN9RSTClU=";
-    })
-    # https://github.com/emscripten-core/emscripten/pull/18220
-    (fetchpatch {
-      url = "https://github.com/emscripten-core/emscripten/commit/852982318f9fb692ba1dd1173f62e1eb21ae61ca.patch";
-      sha256 = "sha256-hmIOtpRx3PD3sDAahUcreSydydqcdSqArYvyLGgUgd8=";
+      resourceDir = "${llvmEnv}/lib/clang/16/";
     })
   ];
 
@@ -108,17 +98,20 @@ stdenv.mkDerivation rec {
 
     # precompile libc (etc.) in all variants:
     pushd $TMPDIR
-    echo 'int __main_argc_argv() { return 42; }' >test.c
+    echo 'int __main_argc_argv( int a, int b ) { return 42; }' >test.c
     for LTO in -flto ""; do
       # wasm2c doesn't work with PIC
       $out/bin/emcc -s WASM2C -s STANDALONE_WASM $LTO test.c
 
       for BIND in "" "--bind"; do
-        for MT in "" "-s USE_PTHREADS"; do
-          for RELOCATABLE in "" "-s RELOCATABLE"; do
-            $out/bin/emcc $RELOCATABLE $BIND $MT $LTO test.c
-          done
-        done
+        # starting with emscripten 3.1.32+,
+        # if pthreads and relocatable are both used,
+        # _emscripten_thread_exit_joinable must be exported
+        # (see https://github.com/emscripten-core/emscripten/pull/18376)
+        # TODO: get library cache to build with both enabled and function exported
+        $out/bin/emcc $LTO $BIND test.c
+        $out/bin/emcc $LTO $BIND -s RELOCATABLE test.c
+        $out/bin/emcc $LTO $BIND -s USE_PTHREADS test.c
       done
     done
     popd
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 292360e7085c..32eb1e45f49a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7259,7 +7259,7 @@ with pkgs;
   easeprobe = callPackage ../tools/misc/easeprobe { };
 
   emscripten = callPackage ../development/compilers/emscripten {
-    llvmPackages = llvmPackages_14;
+    llvmPackages = llvmPackages_16;
   };
 
   emscriptenPackages = recurseIntoAttrs (callPackage ./emscripten-packages.nix { });

From 8392a8baa91cb35716b0b37d74542b8b44afbaf0 Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Fri, 19 May 2023 13:26:03 -0400
Subject: [PATCH 008/102] binaryen: 112 -> 113

---
 pkgs/development/compilers/binaryen/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 73f32af28e19..11716893e0f7 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "binaryen";
-  version = "112";
+  version = "113";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "binaryen";
     rev = "version_${version}";
-    hash = "sha256-xVumVmiLMHJp3SItE8eL8OBPeq58HtOOiK9LL8SP4CQ=";
+    hash = "sha256-w93LIlLRn3PmVNytjFg6KI4CQ9zQUUM9kySiWAtPbOA=";
   };
 
   nativeBuildInputs = [ cmake python3 ];

From 3ce345322d8a2f04c15ec246034db51ae3869926 Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Fri, 19 May 2023 14:30:56 -0400
Subject: [PATCH 009/102] json-c: fix build on LLVM 15+

---
 pkgs/development/libraries/json-c/default.nix | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/json-c/default.nix b/pkgs/development/libraries/json-c/default.nix
index d6aac7161d4f..785548c211a9 100644
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@@ -1,14 +1,24 @@
-{ lib, stdenv, fetchurl, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "json-c";
   version = "0.16";
 
-  src = fetchurl {
-    url    = "https://s3.amazonaws.com/json-c_releases/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-jkWsj5bsd5Hq87t+5Q6cIQC7vIe40PHQMMW6igKI2Ws=";
+  src = fetchFromGitHub {
+    owner = "json-c";
+    repo = "json-c";
+    rev = "json-c-0.16-20220414";
+    sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
   };
 
+  patches = [
+    # needed for emscripten, which uses LLVM 15+
+    (fetchpatch {
+      url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
+      sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];

From 5d0918ec3ca8035720b35a260e0318a2c92dc634 Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Mon, 22 May 2023 09:02:01 -0400
Subject: [PATCH 010/102] emscriptenPackages.libxml2: fix build on darwin

---
 pkgs/top-level/emscripten-packages.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index 15baf5ba7291..f4d2fd06a90c 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -66,7 +66,10 @@ rec {
         echo "Compiling a custom test"
         set -x
         emcc -O2 -s EMULATE_FUNCTION_POINTER_CASTS=1 xmllint.o \
-        ./.libs/libxml2.a `pkg-config zlib --cflags` `pkg-config zlib --libs` -o ./xmllint.test.js \
+        ./.libs/''
+      + pkgs.lib.optionalString pkgs.stdenv.isDarwin "libxml2.dylib "
+      + pkgs.lib.optionalString (!pkgs.stdenv.isDarwin) "libxml2.a "
+      + '' `pkg-config zlib --cflags` `pkg-config zlib --libs` -o ./xmllint.test.js \
         --embed-file ./test/xmlid/id_err1.xml
 
         echo "Using node to execute the test which basically outputs an error on stderr which we grep for"

From c59c87962d03551adac82f947caa809e973ebe8c Mon Sep 17 00:00:00 2001
From: Hubert Jasudowicz <hubert.jasudowicz@gmail.com>
Date: Mon, 22 May 2023 20:39:51 +0200
Subject: [PATCH 011/102] openconnect: 9.01 -> 9.12

---
 pkgs/tools/networking/openconnect/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 1ea893948dc5..8cce7012f028 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -5,10 +5,10 @@ let
   };
 in rec {
   openconnect = common rec {
-    version = "9.01";
+    version = "9.12";
     src = fetchurl {
       url = "ftp://ftp.infradead.org/pub/openconnect/openconnect-${version}.tar.gz";
-      sha256 = "sha256-s9f6+DDpeTKZ1qQegdhM1KPieJwUjJ5ZjkWFAQCQ5Mc=";
+      sha256 = "sha256-or7c46pN/nXjbkB+SOjovJHUbe9TNayVZPv5G9SyQT4=";
     };
   };
 

From ab59da89555ec615c641e32996452c6c477e258c Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Wed, 24 May 2023 18:38:50 +0200
Subject: [PATCH 012/102] apparmor: 3.1.3 -> 3.1.4

https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.1.4
Fixes CVE-2016-1585
---
 pkgs/os-specific/linux/apparmor/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index c71980d94373..33cdc0fb8450 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  apparmor-version = "3.1.3";
+  apparmor-version = "3.1.4";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -36,7 +36,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-6N1BStOXKui6BxSriWVoOkvyGRUJ4btsloHh/SsG/JE=";
+    hash = "sha256-YWPdIUd+2x74tqiW+YX8NKh3jxSKhD+5zdiDMjhPzpE=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''

From 2d63374a2911bebbd35f19a0af8aa75615234c23 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Wed, 24 May 2023 18:39:31 +0200
Subject: [PATCH 013/102] nixosTests.apparmor: fix after
 5252e855952c555469f081306584dd8a12959ded

---
 nixos/tests/apparmor.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/apparmor.nix b/nixos/tests/apparmor.nix
index 99a5cd558eb0..8b81c0c841d4 100644
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, ... } : {
+import ./make-test-python.nix ({ pkgs, lib, ... } : {
   name = "apparmor";
   meta.maintainers = with lib.maintainers; [ julm ];
 

From 4f64a5c1415dd1f187fa0d19b95f8271e68589f4 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Wed, 24 May 2023 19:17:26 +0200
Subject: [PATCH 014/102] nixosTests.apparmor: fix expected.rules

was probably broken by recent-ish stdenv work
---
 nixos/tests/apparmor.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/apparmor.nix b/nixos/tests/apparmor.nix
index 8b81c0c841d4..be91e9632849 100644
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@@ -27,7 +27,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... } : {
       # 4. Using `diff` against the expected output.
       with subtest("apparmorRulesFromClosure"):
           machine.succeed(
-              "${pkgs.diffutils}/bin/diff ${pkgs.writeText "expected.rules" ''
+              "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''
                   mr ${pkgs.bash}/lib/**.so*,
                   r ${pkgs.bash},
                   r ${pkgs.bash}/etc/**,
@@ -64,6 +64,12 @@ import ./make-test-python.nix ({ pkgs, lib, ... } : {
                   r ${pkgs.libunistring}/lib/**,
                   r ${pkgs.libunistring}/share/**,
                   x ${pkgs.libunistring}/foo/**,
+                  mr ${pkgs.glibc.libgcc}/lib/**.so*,
+                  r ${pkgs.glibc.libgcc},
+                  r ${pkgs.glibc.libgcc}/etc/**,
+                  r ${pkgs.glibc.libgcc}/lib/**,
+                  r ${pkgs.glibc.libgcc}/share/**,
+                  x ${pkgs.glibc.libgcc}/foo/**,
               ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
                   ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
                       pkgs.apparmorRulesFromClosure {

From 5dc3bb5e1426885f7589ec765eac31f473c2456c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 14 May 2023 19:42:35 +0200
Subject: [PATCH 015/102] gst_all_1.gst-plugins-bad: add option to build
 without gui libraries

---
 pkgs/development/libraries/gstreamer/bad/default.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 63c5b92e07ca..7861a49b565b 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -38,7 +38,6 @@
 , bluez
 , chromaprint
 , curl
-, directfb
 , fdk_aac
 , flite
 , gsm
@@ -104,6 +103,7 @@
 , microdnsSupport ? false
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
+, guiSupport ? true, directfb
 }:
 
 stdenv.mkDerivation rec {
@@ -185,7 +185,6 @@ stdenv.mkDerivation rec {
     gnutls
     libGL
     libGLU
-    gtk3
     game-music-emu
     openssl
     libxml2
@@ -220,7 +219,6 @@ stdenv.mkDerivation rec {
     mjpegtools
 
     chromaprint
-    directfb
     flite
     libdrm
     libgudev
@@ -237,6 +235,10 @@ stdenv.mkDerivation rec {
     serd
     sord
     sratom
+  ] ++ lib.optionals guiSupport [
+    gtk3
+  ] ++ lib.optionals (stdenv.isLinux && guiSupport) [
+    directfb
   ] ++ lib.optionals stdenv.isDarwin [
     # For unknown reasons the order is important, e.g. if
     # VideoToolbox is last, we get:
@@ -297,10 +299,11 @@ stdenv.mkDerivation rec {
     "-Ddoc=disabled" # needs gstcuda to be enabled which is Linux-only
     "-Dnvcodec=disabled" # Linux-only
     "-Dva=disabled" # see comment on `libva` in `buildInputs`
+  ] ++ lib.optionals (!stdenv.isLinux || !guiSupport) [
+    "-Ddirectfb=disabled"
   ]
   ++ lib.optionals stdenv.isDarwin [
     "-Dchromaprint=disabled"
-    "-Ddirectfb=disabled"
     "-Dflite=disabled"
     "-Dkms=disabled" # renders to libdrm output
     "-Dlv2=disabled"

From 94baf8bfd9110656f9fc022f12ec42ec8b1550fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 14 May 2023 19:43:25 +0200
Subject: [PATCH 016/102] nixos/no-x-libs: add gst-plugins-bad

---
 nixos/modules/config/no-x-libs.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index dac09bdf468a..0dce3b918458 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -38,6 +38,7 @@ with lib;
       gpsd = super.gpsd.override { guiSupport = false; };
       graphviz = super.graphviz-nox;
       gst_all_1 = super.gst_all_1 // {
+        gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; };
         gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableX11 = false; };
       };
       imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };

From 34cdc0a9f9c042e2b23d9fba5fb0780b090d6fae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 24 May 2023 00:57:46 +0200
Subject: [PATCH 017/102] gst_all_1.gst-plugins-rs: fix build if
 gst-plugins-base is build without gl

---
 pkgs/development/libraries/gstreamer/rs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index b50d7d45180f..084433c4045e 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -101,7 +101,7 @@ let
       "reqwest" # tests hang on darwin
       "threadshare" # tests cannot bind to localhost on darwin
       "webp" # not supported on darwin (upstream crate issue)
-    ] ++ lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
+    ] ++ lib.optionals (!gst-plugins-base.glEnabled) [
       # these require gstreamer-gl which requires darwin sdk bump
       "gtk4"
       "livesync"
@@ -205,7 +205,7 @@ stdenv.mkDerivation rec {
     export CSOUND_LIB_DIR=${lib.getLib csound}/lib
   '' + lib.optionalString (lib.mutuallyExclusive [ "webrtc" "webrtchttp" ] selectedPlugins) ''
     sed -i "/\['gstreamer-webrtc-1\.0', 'gst-plugins-bad', 'gstwebrtc_dep', 'gstwebrtc'\]/d" meson.build
-  '' + lib.optionalString (stdenv.isDarwin && !stdenv.isAarch64) ''
+  '' + lib.optionalString (!gst-plugins-base.glEnabled) ''
     sed -i "/\['gstreamer-gl-1\.0', 'gst-plugins-base', 'gst_gl_dep', 'gstgl'\]/d" meson.build
   '';
 

From 719a4274e8dc5c52113912a89f9df11d1b001c17 Mon Sep 17 00:00:00 2001
From: Dilip <igoldlip@gmail.com>
Date: Thu, 25 May 2023 15:21:22 +0530
Subject: [PATCH 018/102] mupdf: 1.21.1 -> 1.22.1

---
 pkgs/applications/misc/mupdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 812bc9a5d76d..c9523581b0a9 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -47,12 +47,12 @@ let
 
 in
 stdenv.mkDerivation rec {
-  version = "1.21.1";
+  version = "1.22.1";
   pname = "mupdf";
 
   src = fetchurl {
     url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "sha256-sk3b4SUGzILeCNXNSUYUugg0b4F12x2YvPk4/5SSWlQ=";
+    sha256 = "sha256-1i88DkVuu8QucfWkfw+M0SzsK/Co1yt541+jWmU4slo=";
   };
 
   patches = [ ./0001-Use-command-v-in-favor-of-which.patch

From 57c353f2066250847c4525a0c6774c3d724909d2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 25 May 2023 12:49:59 +0100
Subject: [PATCH 019/102] tracker: pull fix pending upstream inclusion for
 sqlite-3.42.0 support

---
 pkgs/development/libraries/tracker/default.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 4ba70506b718..1df7553e6c69 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@@ -40,6 +41,16 @@ stdenv.mkDerivation rec {
     sha256 = "+XLVCse6/czxE7HrmdyuNUBGhameVb/vFvOsg7Tel00=";
   };
 
+  patches = [
+    # Backport sqlite-3.42.0 compatibility:
+    #   https://gitlab.gnome.org/GNOME/tracker/-/merge_requests/600
+    (fetchpatch {
+      name = "sqlite-3.42.0.patch";
+      url = "https://gitlab.gnome.org/GNOME/tracker/-/commit/4cbbd1773a7367492fa3b3e3804839654e18a12a.patch";
+      hash = "sha256-w5D9I0P1DdyILhpjslh6ifojmlUiBoeFnxHPIr0rO3s=";
+    })
+  ];
+
   strictDeps = true;
 
   depsBuildBuild = [

From 8b001c38c261b638a9a1048c85091d089b819b21 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 May 2023 15:59:48 +0000
Subject: [PATCH 020/102] ell: 0.56 -> 0.57

---
 pkgs/os-specific/linux/ell/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 0dd9fcb45bf4..bde39a41b525 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.56";
+  version = "0.57";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-aCQ7I4XgxswQRfzzZG3MYe+W3dPWWex5MErMc0ZilSA=";
+    sha256 = "sha256-9d9WMCByQ1TKWpzWe5msts1LG+BKKqwCgaMBbD74/+4=";
   };
 
   nativeBuildInputs = [

From b3210448b94ae374010bb732691e1af1df145f95 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 24 May 2023 15:54:36 +0000
Subject: [PATCH 021/102] kernelPatches.fix-em-ice-bonding: remove

This was fixed in 248401cb2c46 ("ice: avoid bonding causing auxiliary
plug/unplug under RTNL lock"), which was backported to all relevant kernels.
---
 .../linux/kernel/fix-em-ice-bonding.patch     | 87 -------------------
 pkgs/os-specific/linux/kernel/patches.nix     |  5 --
 pkgs/top-level/linux-kernels.nix              |  5 --
 3 files changed, 97 deletions(-)
 delete mode 100644 pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch

diff --git a/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch b/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch
deleted file mode 100644
index 2b59a508fdac..000000000000
--- a/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 1640688018f329559c61352646f283f98938af31 Mon Sep 17 00:00:00 2001
-From: Cole Helbling <cole.helbling@determinate.systems>
-Date: Thu, 16 Feb 2023 09:30:21 -0800
-Subject: [PATCH] Revert "RDMA/irdma: Report the correct link speed"
-
-This reverts commit 425c9bd06b7a70796d880828d15c11321bdfb76d.
-
-Some Equinix Metal instances, such as a3.large.x86, m3.large.x86
-(specific hardware revisions), and n3.large.x86, use the `ice` kernel
-driver for their network cards, in conjunction with bonded devices.
-However, this commit caused a regression where these bonded devices
-would deadlock. This was initially reported by Jaroslav Pulchart on
-the netdev mailing list[1], and there were follow-up patches from Dave
-Ertman[2][3] that attempted to fix this but were not up to snuff for
-various reasons[4].
-
-Specifically, v2 of the patch ([3]) appears to fix the issue on some
-devices (tested with 8086:159B network cards), while it is still broken
-on others (such as an 8086:1593 network card).
-
-We revert the patch exposing the issue until upstream has a working
-solution in order to make Equinix Metal instances work reliably again.
-
-[1]: https://lore.kernel.org/netdev/CAK8fFZ6A_Gphw_3-QMGKEFQk=sfCw1Qmq0TVZK3rtAi7vb621A@mail.gmail.com/
-[2]: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230111183145.1497367-1-david.m.ertman@intel.com/
-[3]: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230215191757.1826508-1-david.m.ertman@intel.com/
-[4]: https://lore.kernel.org/netdev/cb31a911-ba80-e2dc-231f-851757cfd0b8@intel.com/T/#m6e53f8c43093693c10268140126abe99e082dc1c
----
- drivers/infiniband/hw/irdma/verbs.c | 35 ++++++++++++++++++++++++++---
- 1 file changed, 32 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
-index c5971a840b87..911902d2b93e 100644
---- a/drivers/infiniband/hw/irdma/verbs.c
-+++ b/drivers/infiniband/hw/irdma/verbs.c
-@@ -60,6 +60,36 @@ static int irdma_query_device(struct ib_device *ibdev,
- 	return 0;
- }
- 
-+/**
-+ * irdma_get_eth_speed_and_width - Get IB port speed and width from netdev speed
-+ * @link_speed: netdev phy link speed
-+ * @active_speed: IB port speed
-+ * @active_width: IB port width
-+ */
-+static void irdma_get_eth_speed_and_width(u32 link_speed, u16 *active_speed,
-+					  u8 *active_width)
-+{
-+	if (link_speed <= SPEED_1000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_SDR;
-+	} else if (link_speed <= SPEED_10000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_FDR10;
-+	} else if (link_speed <= SPEED_20000) {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_DDR;
-+	} else if (link_speed <= SPEED_25000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_EDR;
-+	} else if (link_speed <= SPEED_40000) {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_FDR10;
-+	} else {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_EDR;
-+	}
-+}
-+
- /**
-  * irdma_query_port - get port attributes
-  * @ibdev: device pointer from stack
-@@ -87,9 +117,8 @@ static int irdma_query_port(struct ib_device *ibdev, u32 port,
- 		props->state = IB_PORT_DOWN;
- 		props->phys_state = IB_PORT_PHYS_STATE_DISABLED;
- 	}
--
--	ib_get_eth_speed(ibdev, port, &props->active_speed,
--			 &props->active_width);
-+	irdma_get_eth_speed_and_width(SPEED_100000, &props->active_speed,
-+				      &props->active_width);
- 
- 	if (rdma_protocol_roce(ibdev, 1)) {
- 		props->gid_tbl_len = 32;
--- 
-2.39.0
-
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 2330db4e68c3..081902d3d15d 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -64,11 +64,6 @@
     patch = ./make-maple-state-reusable-after-mas_empty_area.patch;
   };
 
-  fix-em-ice-bonding = {
-    name = "fix-em-ice-bonding";
-    patch = ./fix-em-ice-bonding.patch;
-  };
-
   CVE-2023-32233 = rec {
     name = "CVE-2023-32233";
     patch = fetchpatch {
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index bbaf6f183f69..b8351f135701 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -154,7 +154,6 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
@@ -171,7 +170,6 @@ in {
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
         kernelPatches.make-maple-state-reusable-after-mas_empty_area
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
@@ -180,7 +178,6 @@ in {
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
         kernelPatches.make-maple-state-reusable-after-mas_empty_area
-        kernelPatches.fix-em-ice-bonding
         kernelPatches.export-rt-sched-migrate
       ];
     };
@@ -190,7 +187,6 @@ in {
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
         kernelPatches.make-maple-state-reusable-after-mas_empty_area
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 
@@ -199,7 +195,6 @@ in {
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
         kernelPatches.make-maple-state-reusable-after-mas_empty_area
-        kernelPatches.fix-em-ice-bonding
       ];
     };
 

From a98aaa50313a80115157aeb3ee986366c473adaf Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sat, 20 May 2023 12:07:36 -0400
Subject: [PATCH 022/102] dbus: fix build with Darwin sandbox enabled

---
 pkgs/development/libraries/dbus/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index f984f3310300..52928e1005ff 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -67,6 +67,8 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux [ audit libapparmor ];
   # ToDo: optional selinux?
 
+  __darwinAllowLocalNetworking = true;
+
   configureFlags = [
     "--enable-user-session"
     "--enable-xml-docs"

From 51a0839f725b74ccbca7d63b37b5e967329e6b3c Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Fri, 19 May 2023 16:04:13 -0400
Subject: [PATCH 023/102] openldap: fix build on Darwin with sandbox enabled

---
 pkgs/development/libraries/openldap/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 69c331698660..0f659654e243 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     "devdoc"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [

From b1e19579348b80256192941b387f15d2da98353f Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sat, 20 May 2023 12:07:53 -0400
Subject: [PATCH 024/102] libglvnd: fix build with newer clang

---
 pkgs/development/libraries/libglvnd/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 4047c7bbefd0..fa9562947f81 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -33,7 +33,10 @@ stdenv.mkDerivation rec {
     "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${addOpenGLRunpath.driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""
 
     "-Wno-error=array-bounds"
-  ] ++ lib.optional stdenv.cc.isClang "-Wno-error");
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error"
+    "-Wno-int-conversion"
+  ]);
 
   configureFlags  = []
     # Indirectly: https://bugs.freedesktop.org/show_bug.cgi?id=35268

From ea5c5d44dbe2a399e8ab6df2d9b8fac3c7f49d6b Mon Sep 17 00:00:00 2001
From: Henri Rosten <henri.rosten@unikie.com>
Date: Fri, 26 May 2023 07:15:16 +0300
Subject: [PATCH 025/102] ffmpeg_4: 4.4.3 -> 4.4.4

Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
---
 pkgs/development/libraries/ffmpeg/4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 24b7aedb3ec2..905e93de7a7f 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,6 +1,6 @@
 import ./generic.nix rec {
-  version = "4.4.3";
-  sha256 = "sha256-zZDzG1hD+0AHqElzeGR6OVm+H5wqtdktloSPmEUzT/c=";
+  version = "4.4.4";
+  sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
   extraPatches = [
     {
       name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";

From dca8139f96aec5f9435c60e85f56fda6ad4ff7af Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 26 May 2023 11:28:29 +0800
Subject: [PATCH 026/102] gnu-efi: patch to fix build for riscv64

---
 .../development/libraries/gnu-efi/default.nix | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 4da4eec78580..6a7ee0a5fb7f 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -1,5 +1,11 @@
-{ lib, stdenv, buildPackages, fetchurl, pciutils
-, gitUpdater }:
+{ lib
+, stdenv
+, buildPackages
+, fetchurl
+, fetchpatch
+, pciutils
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "gnu-efi";
@@ -10,6 +16,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-eAfpAzSTQ6ehQuu5NHA6KHIjXolojPWGwDKwoQh7yvQ=";
   };
 
+  patches = [
+    # riscv64: fix efibind.h missing/duplicate types
+    # https://sourceforge.net/p/gnu-efi/patches/88
+    (fetchpatch {
+      url = "https://sourceforge.net/p/gnu-efi/patches/88/attachment/riscv64-fix-efibind.h-missing-duplicate-types.patch";
+      hash = "sha256-fUAxj1/U9J2A1zMEdnh62+WnVmQ9hrrYwMFppBz1Y1g=";
+    })
+  ];
+
   buildInputs = [ pciutils ];
 
   hardeningDisable = [ "stackprotector" ];

From 6a6598d5be4c395a75c391362581c3921a311289 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 26 May 2023 11:29:26 +0800
Subject: [PATCH 027/102] gnu-efi: add nickcao to maintainers

---
 pkgs/development/libraries/gnu-efi/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 6a7ee0a5fb7f..340bc7d7dcd8 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -45,6 +45,6 @@ stdenv.mkDerivation rec {
     homepage = "https://sourceforge.net/projects/gnu-efi/";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ nickcao ];
   };
 }

From c5f569a09aa6b87390be253151ded5d4cee4baab Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 26 May 2023 00:47:38 +0300
Subject: [PATCH 028/102] lua5_4: 5.4.4 -> 5.4.6

---
 .../interpreters/lua-5/default.nix            | 23 +++----------------
 1 file changed, 3 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 139dd09e72a3..f4c622515d7d 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -77,29 +77,12 @@ in
 rec {
   lua5_4 = callPackage ./interpreter.nix {
     self = lua5_4;
-    version = "5.4.4";
-    hash = "sha256-Fkx4SWU7gK5nvsS3RzuIS/XMjS3KBWU0dewu0nuev2E=";
+    version = "5.4.6";
+    hash = "sha256-fV6huctqoLWco93hxq3LV++DobqOVDLA7NBr9DmzrYg=";
     makeWrapper = makeBinaryWrapper;
     inherit passthruFun;
 
-    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch
-      ++ [
-        (fetchpatch {
-          name = "CVE-2022-28805.patch";
-          url = "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa.patch";
-          sha256 = "sha256-YTwoolSnRNJIHFPVijSO6ZDw35BG5oWYralZ8qOb9y8=";
-          stripLen = 1;
-          extraPrefix = "src/";
-          excludes = [ "src/testes/*" ];
-        })
-        (fetchpatch {
-          name = "CVE-2022-33099.patch";
-          url = "https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf.patch";
-          sha256 = "sha256-qj1Dq1ojVoknALSa67jhgH3G3Kk4GtJP6ROFElVF+D0=";
-          stripLen = 1;
-          extraPrefix = "src/";
-        })
-      ];
+    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
   };
 
   lua5_4_compat = lua5_4.override({

From 6c71202df2eecd15d2b34b2f4f399a9c411bcc58 Mon Sep 17 00:00:00 2001
From: Henri Rosten <henri.rosten@unikie.com>
Date: Fri, 26 May 2023 09:26:26 +0300
Subject: [PATCH 029/102] binutils: fix CVE-2023-1972

Signed-off-by: Henri Rosten <henri.rosten@unikie.com>
---
 .../tools/misc/binutils/CVE-2023-1972.patch   | 23 +++++++++++++++++++
 .../tools/misc/binutils/default.nix           |  4 ++++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/development/tools/misc/binutils/CVE-2023-1972.patch

diff --git a/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch b/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch
new file mode 100644
index 000000000000..838fbf722761
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch
@@ -0,0 +1,23 @@
+diff --git a/bfd/elf.c b/bfd/elf.c
+index 027d0143735..185028cbd97 100644
+--- a/bfd/elf.c
++++ b/bfd/elf.c
+@@ -9030,6 +9030,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return_verdef;
+ 	}
++
++      if (amt == 0)
++	goto error_return_verdef;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return_verdef;
+@@ -9133,6 +9136,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return;
+ 	}
++      if (amt == 0)
++	goto error_return;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return;
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 0db491f225c1..0a2610ffd2e7 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -88,6 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
     # not need to know binutils' BINDIR at all. It's an absolute path
     # where libraries are stored.
     ./plugins-no-BINDIR.patch
+
+    # CVE-2023-1972 fix to bfd/elf.c from:
+    # https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57
+    ./CVE-2023-1972.patch
   ]
   ++ lib.optional targetPlatform.isiOS ./support-ios.patch
   # Adds AVR-specific options to "size" for compatibility with Atmel's downstream distribution

From a9b654ab35f3d9bd0f75e0530bda2d5dbd961c05 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Fri, 19 May 2023 15:51:26 -0400
Subject: [PATCH 030/102] meson: fix build with case-sensitive store on Darwin

Co-authored-by: Weijia Wang <9713184+wegank@users.noreply.github.com>
---
 pkgs/development/tools/build-managers/meson/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index f6004285ddb4..68520b523dc0 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -26,6 +26,12 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   patches = [
+    # Fix Meson tests that fail when the Nix store is case-sensitive APFS.
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/pull/11820.patch";
+      sha256 = "sha256-mzSEvAQl13OpFFzSvMI4kkdnW6CXXnKz2xNlXaXduhY=";
+    })
+
     # Meson is currently inspecting fewer variables than autoconf does, which
     # makes it harder for us to use setup hooks, etc.  Taken from
     # https://github.com/mesonbuild/meson/pull/6827

From 50d192213f54cae93d7536f6a8ab71b8c89a2e42 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Fri, 19 May 2023 15:53:05 -0400
Subject: [PATCH 031/102] libssh: fix build with newer clang

One of the examples attempts to use `x11_connect_display`, but libX11 is
not included in the `buildInputs`. Since the examples are not actually
included in any of the outputs, just disable them to avoid taking a
libX11 dependency.
---
 pkgs/development/libraries/libssh/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index 464aeb817cc7..504cc76269ce 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
     sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
   '';
 
+  # Don’t build examples, which are not installed and require additional dependencies not
+  # included in `buildInputs` such as libX11.
+  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
+
   # single output, otherwise cmake and .pc files point to the wrong directory
   # outputs = [ "out" "dev" ];
 

From 6f02d8f9d09991429d59976fb020f504534a6c63 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 26 May 2023 17:30:19 +0300
Subject: [PATCH 032/102] meson: save out-of-tree patches locally

---
 .../meson/darwin-case-sensitive-fs.patch      | 51 +++++++++++++++++++
 .../tools/build-managers/meson/default.nix    |  6 +--
 2 files changed, 53 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch

diff --git a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
new file mode 100644
index 000000000000..2de9484226b1
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
@@ -0,0 +1,51 @@
+From 1643ed0d8a9201732905bee51b096605d26aaaac Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Fri, 26 May 2023 00:10:45 -0400
+Subject: [PATCH] Fix test failures on Darwin on a case-sensitive fs
+
+This issue was encounetered while working on a contribution to nixpkgs.
+Nix allows the store to be installed on a separate, case-sensitive APFS
+volume. When the store is on a case-sensitive volume, these tests fail
+because they try to use `foundation` instead of `Foundation`.
+---
+ .../failing/78 framework dependency with version/meson.build    | 2 +-
+ test cases/objc/2 nsstring/meson.build                          | 2 +-
+ test cases/osx/6 multiframework/meson.build                     | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/test cases/failing/78 framework dependency with version/meson.build b/test cases/failing/78 framework dependency with version/meson.build
+index b7e04bab446..ee315ebcbd7 100644
+--- a/test cases/failing/78 framework dependency with version/meson.build	
++++ b/test cases/failing/78 framework dependency with version/meson.build	
+@@ -5,4 +5,4 @@ if host_machine.system() != 'darwin'
+ endif
+ 
+ # do individual frameworks have a meaningful version to test?  And multiple frameworks might be listed...
+-dep = dependency('appleframeworks', modules: 'foundation', version: '>0')
++dep = dependency('appleframeworks', modules: 'Foundation', version: '>0')
+diff --git a/test cases/objc/2 nsstring/meson.build b/test cases/objc/2 nsstring/meson.build
+index 94d2cf18ab4..2c483d50d68 100644
+--- a/test cases/objc/2 nsstring/meson.build	
++++ b/test cases/objc/2 nsstring/meson.build	
+@@ -1,7 +1,7 @@
+ project('nsstring', 'objc')
+ 
+ if host_machine.system() == 'darwin'
+-  dep = dependency('appleframeworks', modules : 'foundation')
++  dep = dependency('appleframeworks', modules : 'Foundation')
+ elif host_machine.system() == 'cygwin'
+   error('MESON_SKIP_TEST GNUstep is not packaged for Cygwin.')
+ else
+diff --git a/test cases/osx/6 multiframework/meson.build b/test cases/osx/6 multiframework/meson.build
+index 28846243b21..57e5d61560b 100644
+--- a/test cases/osx/6 multiframework/meson.build	
++++ b/test cases/osx/6 multiframework/meson.build	
+@@ -4,7 +4,7 @@ project('multiframework', 'objc')
+ # that causes a build failure when defining two modules. The
+ # arguments for the latter module overwrote the arguments for
+ # the first one rather than adding to them.
+-cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'foundation'])
++cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'Foundation'])
+ 
+ executable('deptester',
+   'main.m',
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 68520b523dc0..3914f6584096 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -27,10 +27,8 @@ python3.pkgs.buildPythonApplication rec {
 
   patches = [
     # Fix Meson tests that fail when the Nix store is case-sensitive APFS.
-    (fetchpatch {
-      url = "https://github.com/mesonbuild/meson/pull/11820.patch";
-      sha256 = "sha256-mzSEvAQl13OpFFzSvMI4kkdnW6CXXnKz2xNlXaXduhY=";
-    })
+    # https://github.com/mesonbuild/meson/pull/11820
+    ./darwin-case-sensitive-fs.patch
 
     # Meson is currently inspecting fewer variables than autoconf does, which
     # makes it harder for us to use setup hooks, etc.  Taken from

From 2619e47187e4c81200fd467a2bd7c4d6290a85fc Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 27 May 2023 04:20:00 +0000
Subject: [PATCH 033/102] python310Packages.verspec: init at 0.1.0

---
 .../python-modules/verspec/default.nix        | 42 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 44 insertions(+)
 create mode 100644 pkgs/development/python-modules/verspec/default.nix

diff --git a/pkgs/development/python-modules/verspec/default.nix b/pkgs/development/python-modules/verspec/default.nix
new file mode 100644
index 000000000000..05a6a446c23e
--- /dev/null
+++ b/pkgs/development/python-modules/verspec/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pretend
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "verspec";
+  version = "0.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-xFBMppeyBWzbS/pxIUYfWg6BgJJVtBwD3aS6gjY3wB4=";
+  };
+
+  nativeCheckInputs = [
+    pretend
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # Import fail
+    "test/test_specifiers.py"
+  ];
+
+  pythonImportsCheck = [
+    "verspec"
+  ];
+
+  meta = with lib; {
+    description = "Flexible version handling";
+    homepage = "https://github.com/jimporter/verspec";
+    changelog = "https://github.com/jimporter/averspec/releases/tag/v${version}";
+    license = with licenses; [ bsd2 /* and */ asl20 ];
+    maintainers = with maintainers; [ marsam ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7fef6b0d2445..4423b45336ef 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12750,6 +12750,8 @@ self: super: with self; {
 
   versiontools = callPackage ../development/python-modules/versiontools { };
 
+  verspec = callPackage ../development/python-modules/verspec { };
+
   vertica-python = callPackage ../development/python-modules/vertica-python { };
 
   veryprettytable = callPackage ../development/python-modules/veryprettytable { };

From f6209b44440106d8df224ba3a051e3a0be778e8d Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 27 May 2023 04:20:00 +0000
Subject: [PATCH 034/102] python310Packages.mike: init at 2023-05-06

---
 .../python-modules/mike/default.nix           | 60 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/development/python-modules/mike/default.nix

diff --git a/pkgs/development/python-modules/mike/default.nix b/pkgs/development/python-modules/mike/default.nix
new file mode 100644
index 000000000000..f107d8e632bd
--- /dev/null
+++ b/pkgs/development/python-modules/mike/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, git
+, importlib-metadata
+, importlib-resources
+, jinja2
+, mkdocs
+, pythonOlder
+, pyyaml
+, unittestCheckHook
+, verspec
+}:
+
+buildPythonPackage rec {
+  pname = "mike";
+  version = "unstable-2023-05-06";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "jimporter";
+    repo = pname;
+    rev = "300593c338b18f61f604d18457c351e166318020";
+    hash = "sha256-Sjj2275IJDtLjG6uO9h4FbgxXTMgqD8c/rJj6iOxfuI=";
+  };
+
+  propagatedBuildInputs = [
+    importlib-metadata
+    importlib-resources
+    jinja2
+    mkdocs
+    pyyaml
+    verspec
+  ];
+
+  nativeCheckInputs = [
+    git
+    unittestCheckHook
+  ];
+
+  preCheck = ''
+    export PATH=$out/bin:$PATH
+  '';
+
+  # Difficult to setup
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "mike"
+  ];
+
+  meta = with lib; {
+    description = "Manage multiple versions of your MkDocs-powered documentation";
+    homepage = "https://github.com/jimporter/mike";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ marsam ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4423b45336ef..863c2324bcfc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6218,6 +6218,8 @@ self: super: with self; {
 
   migen = callPackage ../development/python-modules/migen { };
 
+  mike = callPackage ../development/python-modules/mike { };
+
   milc = callPackage ../development/python-modules/milc { };
 
   milksnake = callPackage ../development/python-modules/milksnake { };

From 8939bd58931385dbfe586810a19205e9a967f45f Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 27 May 2023 04:20:00 +0000
Subject: [PATCH 035/102] python310Packages.pydantic: 1.10.7 -> 1.10.8

Diff: https://github.com/samuelcolvin/pydantic/compare/refs/tags/v1.10.7...v1.10.8

Changelog: https://github.com/pydantic/pydantic/releases/tag/v1.10.8
---
 pkgs/development/python-modules/pydantic/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 3674c0d74974..4047335a975d 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -18,6 +18,7 @@
 , withDocs ? (stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.isDarwin && pythonAtLeast "3.10")
 , ansi2html
 , markdown-include
+, mike
 , mkdocs
 , mkdocs-exclude
 , mkdocs-material
@@ -31,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "1.10.7";
+  version = "1.10.8";
   format = "setuptools";
 
   outputs = [
@@ -43,10 +44,10 @@ buildPythonPackage rec {
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
-    owner = "samuelcolvin";
+    owner = "pydantic";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7X7rlHJ5Q01CuB9FZzoUfyfwx6AMXtE1BV5t+LnZKIM=";
+    hash = "sha256-4oJoDlP1grLblF0ppqYM1GYEyNMEM9FssFQjacipmms=";
   };
 
   postPatch = ''
@@ -65,6 +66,7 @@ buildPythonPackage rec {
     ansi2html
     markdown-include
     mdx-truly-sane-lists
+    mike
     mkdocs
     mkdocs-exclude
     mkdocs-material

From 44a91fd4bb4b68644fc8950ecb178a213437d58e Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 27 May 2023 04:20:00 +0000
Subject: [PATCH 036/102] python310Packages.pydantic: add changelog to meta

---
 pkgs/development/python-modules/pydantic/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 4047335a975d..1a2851158c52 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -122,8 +122,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pydantic" ];
 
   meta = with lib; {
-    homepage = "https://github.com/samuelcolvin/pydantic";
     description = "Data validation and settings management using Python type hinting";
+    homepage = "https://github.com/pydantic/pydantic";
+    changelog = "https://github.com/pydantic/pydantic/blob/v${version}/HISTORY.md";
     license = licenses.mit;
     maintainers = with maintainers; [ wd15 ];
   };

From c78434b2cd028f808db1619c47642872f36c657b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 15 May 2023 08:43:38 +0100
Subject: [PATCH 037/102] gcc12: 12.2.0 -> 12.3.0

Added an ICE backport for `ccache` build failure.
---
 pkgs/development/compilers/gcc/12/default.nix | 20 +++--
 .../gcc/12/lambda-ICE-PR109241.patch          | 77 +++++++++++++++++++
 2 files changed, 89 insertions(+), 8 deletions(-)
 create mode 100644 pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch

diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 92bec39e7216..f0886f862c97 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -55,7 +55,7 @@ with lib;
 with builtins;
 
 let majorVersion = "12";
-    version = "${majorVersion}.2.0";
+    version = "${majorVersion}.3.0";
     disableBootstrap = !stdenv.hostPlatform.isDarwin && !profiledCompiler;
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -69,15 +69,19 @@ let majorVersion = "12";
         ../gcc-12-gfortran-driving.patch
         ../ppc-musl.patch
         ../install-info-files-serially.patch
+
+        # backport ICE fix on ccache code
+        ./lambda-ICE-PR109241.patch
       ]
       # We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
       # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
-      ++ optional (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) (fetchpatch {
-        name = "gcc-12-darwin-aarch64-support.patch";
-        url = "https://github.com/Homebrew/formula-patches/raw/1d184289/gcc/gcc-12.2.0-arm.diff";
-        sha256 = "sha256-omclLslGi/2yCV4pNBMaIpPDMW3tcz/RXdupbNbeOHA=";
-      })
-      ++ optional langD ../libphobos.patch
+      ++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) [
+        (fetchurl {
+          name = "gcc-12-darwin-aarch64-support.patch";
+          url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
+          sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
+        })
+      ] ++ optional langD ../libphobos.patch
 
       # backport fixes to build gccgo with musl libc
       ++ optionals (langGo && stdenv.hostPlatform.isMusl) [
@@ -206,7 +210,7 @@ lib.pipe (stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-5UnPnPNZSgDie2WJ1DItcOByDN0hPzm+tBgeBpJiMP8=";
+    sha256 = "sha256-lJpdT5nnhkIak7Uysi/6tVeN5zITaZdbka7Jet/ajDs=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch b/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
new file mode 100644
index 000000000000..a27a8a08d9d5
--- /dev/null
+++ b/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
@@ -0,0 +1,77 @@
+https://gcc.gnu.org/PR109241
+
+Fix ICE on ccache.
+
+From 396a4e76afec30d2461638f569cae18955eb4ad2 Mon Sep 17 00:00:00 2001
+From: Jason Merrill <jason@redhat.com>
+Date: Wed, 22 Mar 2023 16:11:47 -0400
+Subject: [PATCH] c++: local class in nested generic lambda [PR109241]
+
+In this testcase, the tree walk to look for bare parameter packs was
+confused by finding a type with no TREE_BINFO.  But it should be fine that
+it's unset; we already checked for unexpanded packs at parse time.
+
+I also tried doing the partial instantiation of the local class, which is
+probably the long-term direction we want to go, but for stage 4 let's go
+with this safer change.
+
+	PR c++/109241
+
+gcc/cp/ChangeLog:
+
+	* pt.cc (find_parameter_packs_r): Handle null TREE_BINFO.
+
+gcc/testsuite/ChangeLog:
+
+	* g++.dg/cpp1y/lambda-generic-local-class2.C: New test.
+---
+ gcc/cp/pt.cc                                        | 12 ++++++++----
+ .../g++.dg/cpp1y/lambda-generic-local-class2.C      | 13 +++++++++++++
+ 2 files changed, 21 insertions(+), 4 deletions(-)
+ create mode 100644 gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+
+diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
+index c7f4a95a723..79bc9c014c8 100644
+--- a/gcc/cp/pt.cc
++++ b/gcc/cp/pt.cc
+@@ -4106,10 +4106,14 @@ find_parameter_packs_r (tree *tp, int *walk_subtrees, void* data)
+     case TAG_DEFN:
+       t = TREE_TYPE (t);
+       if (CLASS_TYPE_P (t))
+-	/* Local class, need to look through the whole definition.  */
+-	for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
+-	  cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
+-			ppd, ppd->visited);
++	{
++	  /* Local class, need to look through the whole definition.
++	     TYPE_BINFO might be unset for a partial instantiation.  */
++	  if (TYPE_BINFO (t))
++	    for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
++	      cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
++			    ppd, ppd->visited);
++	}
+       else
+ 	/* Enum, look at the values.  */
+ 	for (tree l = TYPE_VALUES (t); l; l = TREE_CHAIN (l))
+diff --git a/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+new file mode 100644
+index 00000000000..83856de1f41
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+@@ -0,0 +1,13 @@
++// PR c++/109241
++// { dg-do compile { target c++14 } }
++// { dg-options "" } no pedantic
++
++void g() {
++  [](auto) {
++    [](auto) {
++      ({
++        struct A {};
++      });
++    };
++  }(1);
++}
+-- 
+2.40.1
+

From 5d119a26aaca516c276040dd2aa799e82289d5df Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 27 May 2023 12:32:13 +0100
Subject: [PATCH 038/102] mirrors/gcc: push 'bigsearch' lower

For some reason 'bigsearch' only partially mirrored 'gcc-12.3.0' and
still lacks the tarballs after a few weeks. Let's use next available
mirror.
---
 pkgs/build-support/fetchurl/mirrors.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index bd338473508a..3c8cc48ec7da 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -57,8 +57,8 @@
 
   # GCC
   gcc = [
-    "https://bigsearcher.com/mirrors/gcc/"
     "https://mirror.koddos.net/gcc/"
+    "https://bigsearcher.com/mirrors/gcc/"
     "ftp://ftp.nluug.nl/mirror/languages/gcc/"
     "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
     "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"

From 675a2733c5888e8393da000e36708a80764fad97 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 19 May 2023 19:58:36 +0000
Subject: [PATCH 039/102] http-parser: enable parallel building

Tested at -j64.
---
 pkgs/development/libraries/http-parser/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/http-parser/default.nix b/pkgs/development/libraries/http-parser/default.nix
index dd1ea3559d7a..327121dc6b1b 100644
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkTarget = "test";
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "An HTTP message parser written in C";
     homepage = "https://github.com/nodejs/http-parser";

From dc6fd4b5e7e6e0788448f2e8f7370aa2a163838f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 27 May 2023 21:53:50 +0300
Subject: [PATCH 040/102] graphviz: drop libdevil backend

Seems unmaintained upstream, both the backend and the library, and
the feature set is already covered by other backends.

Removes a Mesa dependency, which is especially relevant in light of #233265.
---
 pkgs/tools/graphics/graphviz/default.nix | 2 --
 pkgs/top-level/all-packages.nix          | 1 -
 2 files changed, 3 deletions(-)

diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index ee7350fbc9db..5ecb8642c5b0 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -10,7 +10,6 @@
 , fontconfig
 , gd
 , gts
-, libdevil
 , libjpeg
 , libpng
 , libtool
@@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
     fontconfig
     gd
     gts
-    libdevil
     pango
     bash
   ] ++ optionals withXorg (with xorg; [ libXrender libXaw libXpm ])
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0a798093ad86..94d0ed34a853 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8206,7 +8206,6 @@ with pkgs;
   graphviz-nox = callPackage ../tools/graphics/graphviz {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
     withXorg = false;
-    libdevil = libdevil-nox;
   };
 
   grass-sass = callPackage ../tools/misc/grass-sass { };

From 53c4a1381ff1a2c4d6e725f008da4fd1a291bbf6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 28 May 2023 14:05:08 +0300
Subject: [PATCH 041/102] qt5: update patches

Pull in some qtbase security fixes
---
 .../libraries/qt-5/5.15/srcs-generated.json   | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 03c409a38196..20649c6f83a1 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "d3b21bc8b70eaa1af848371dc1d34c4617c1f73c",
-    "sha256": "11yww09fgcqsxv4sk4cflxdsdpdqc0x9b3qw63asfpwrnv9qry0a"
+    "rev": "a196623892558623e467f20b67edb78794252a09",
+    "sha256": "0yna2k1w595xwh9bk268h31fjl2ff8cm185dmm0v5gr4w8h9yr4g"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -26,8 +26,8 @@
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "0f9e49cde3b7ca40cd94e63d2f5d29f5b586d3d6",
-    "sha256": "1iwqa98ihzqqpqgwsj0lm4zkfwgag9k634sxjnx6gxvfq0h6d4nx"
+    "rev": "e6d37133affc71451129d84790c6c22227e64aff",
+    "sha256": "1bc1d0h2f1q0xfvr8p5fq1580bl8cs0qhdncm600v590z56cyika"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "0e1bed3c3e27d44d86d6f68a8b93b96a4821575c",
-    "sha256": "0v4c3pls67ww6ffiscbp05yb2vv583zrxj8p4jcy3yxa06khniy5"
+    "rev": "039ce261b0f8061f8485f9c2eaf497a4d4395baa",
+    "sha256": "1kp2pnwfcwsxhy2w1sdg722d0kb1i6kx3a9r42gl1i9d73k8afi2"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -61,8 +61,8 @@
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "2a8a48e9101236f118c2c4f0d79fae9c9d7b3f2a",
-    "sha256": "0ajvlqkm2641ahms34kg6a2hykvql1hxlm5nsaba7233hnfv3nsy"
+    "rev": "30fb93cf8521f2c0b3803903153d9034b7d7bcc2",
+    "sha256": "1b027hfc1m2nz0v906w08srmpyci3362arxc18cin334yhgghbx1"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
@@ -101,8 +101,8 @@
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "86a84eaa74c4071e5750f23b6e9911762880d391",
-    "sha256": "1zywq3ll49bzzvl6rzn4zpp96a4mdx0b9l5ic0x6zc4dr8c8jk5m"
+    "rev": "68a48018e34322edaf611639710b3edbe389e8c2",
+    "sha256": "04hswsamjmwgn63gs3rhxygvwjfqx5f0qifzp3gp6q4fw8lkgwpf"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@@ -146,8 +146,8 @@
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "9b5ab29cbba1908fd4928e2bda2b93e418e36187",
-    "sha256": "0vnwhbkk40wj9rfy3fhjm9slra3y3j1mk67n3vnrzvmzrmpl4443"
+    "rev": "837b5163e17edbd3a9f098e9a1ab73febab419b4",
+    "sha256": "082i9q36d44g5a3jbw3ahvmmxikfai50wd2yq8xvkh8kr8xr7n5z"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",

From d6ef66212ba90dcffb1207ba86d5a85ebf02ecd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20=C5=BDlender?= <pub.git@zlender.si>
Date: Sat, 27 May 2023 12:06:30 +0200
Subject: [PATCH 042/102] lz4: fix cross compilation to linux

---
 pkgs/tools/compression/lz4/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix
index 584b000a3e29..f745f4f091ab 100644
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
   ]
     # TODO make full dictionary
     ++ lib.optional stdenv.hostPlatform.isMinGW "TARGET_OS=MINGW"
+    ++ lib.optional stdenv.hostPlatform.isLinux "TARGET_OS=Linux"
     ;
 
   doCheck = false; # tests take a very long time

From c7b1d6b8d0fd88dba90cc515956c3bba7a03c5cd Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Sun, 28 May 2023 16:59:41 +0200
Subject: [PATCH 043/102] ffmpeg: remove withLTO option

It has been broken for a while, we shouldn't pretend that we support it.

Fixes https://github.com/NixOS/nixpkgs/issues/139168
---
 pkgs/development/libraries/ffmpeg/generic.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 92772c419c1e..12e59c939afe 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -126,7 +126,6 @@
 , withMultithread ? true # Multithreading via pthreads/win32 threads
 , withNetwork ? withHeadlessDeps # Network support
 , withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
-, withLTO ? false # build with link-time optimization
 /*
  *  Program options
  */
@@ -384,7 +383,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     (enableFeature withSmallBuild "small")
     (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
-    (enableFeature withLTO "lto")
     (enableFeature withGrayscale "gray")
     (enableFeature withSwscaleAlpha "swscale-alpha")
     (enableFeature withHardcodedTables "hardcoded-tables")

From d933e2728683ea44fdc0571c8be7b62fc34b591b Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Sun, 28 May 2023 22:23:32 +0300
Subject: [PATCH 044/102] c-ares: 1.19.0 -> 1.19.1

---
 pkgs/development/libraries/c-ares/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/c-ares/default.nix b/pkgs/development/libraries/c-ares/default.nix
index 9c024211a71b..a48b6f4fa7f5 100644
--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@@ -13,14 +13,15 @@
 
 stdenv.mkDerivation rec {
   pname = "c-ares";
-  version = "1.19.0";
-  outputs = [ "out" "dev" ];
+  version = "1.19.1";
 
   src = fetchurl {
     url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-v866N+I/1TEpOCkALKwEAe9JptxVkj9/kiNlhbetHdM=";
+    sha256 = "sha256-MhcAOZty7Q4DfQB0xinndB9rLsLdqSlWq+PpZx0+Jo4=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   nativeBuildInputs = lib.optionals withCMake [ cmake ];
 
   cmakeFlags = [] ++ lib.optionals stdenv.hostPlatform.isStatic [

From 47f22c968376a2b100aab5e3ba4c2fa92ea813e6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 28 May 2023 20:33:04 +0200
Subject: [PATCH 045/102] python310Packages.anyio: 3.6.2 -> 3.7.0

https://github.com/agronholm/anyio/blob/3.7.0/docs/versionhistory.rst
---
 .../python-modules/anyio/default.nix          | 57 +++++++++++--------
 1 file changed, 32 insertions(+), 25 deletions(-)

diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 5153a2b4d262..82874b9a3132 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -3,38 +3,44 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+
+# build-system
 , setuptools
 , setuptools-scm
+
+# dependencies
+, exceptiongroup
 , idna
 , sniffio
-, typing-extensions
-, curio
+
+# optionals
+, trio
+
+# tests
 , hypothesis
-, mock
+, psutil
 , pytest-mock
 , pytest-xdist
 , pytestCheckHook
-, trio
 , trustme
 , uvloop
 }:
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "3.6.2";
+  version = "3.7.0";
   format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "agronholm";
     repo = pname;
     rev = version;
-    hash = "sha256-bootaulvx9zmobQGDirsMz5uxuLeCD9ggAvYkPaKnWo=";
+    hash = "sha256-uXPp2ycYl3T/ybZihDchImC/Yi4qgHI37ZeA+I6dg4c=";
   };
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION=${version}
-  '';
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     setuptools
@@ -44,51 +50,52 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     idna
     sniffio
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    exceptiongroup
   ];
 
+  passthru.optional-dependencies = {
+    trio = [
+      trio
+    ];
+  };
+
   # trustme uses pyopenssl
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
 
   nativeCheckInputs = [
-    curio
     hypothesis
+    psutil
     pytest-mock
     pytest-xdist
     pytestCheckHook
-    trio
     trustme
+  ] ++ lib.optionals (pythonOlder "3.12") [
     uvloop
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    mock
-  ];
+  ] ++ passthru.optional-dependencies.trio;
 
   pytestFlagsArray = [
     "-W" "ignore::trio.TrioDeprecationWarning"
+    "-m" "'not network'"
   ];
 
   disabledTests = [
-    # block devices access
-    "test_is_block_device"
     # INTERNALERROR> AttributeError: 'NonBaseMultiError' object has no attribute '_exceptions'. Did you mean: 'exceptions'?
     "test_exception_group_children"
     "test_exception_group_host"
     "test_exception_group_filtering"
-    # regression in python 3.11.3 and 3.10.11
-    # https://github.com/agronholm/anyio/issues/550
-    "TestTLSStream"
-    "TestTLSListener"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # PermissionError: [Errno 1] Operation not permitted: '/dev/console'
+    "test_is_block_device"
   ];
 
   disabledTestPaths = [
     # lots of DNS lookups
     "tests/test_sockets.py"
-  ] ++ lib.optionals stdenv.isDarwin [
-    # darwin sandboxing limitations
-    "tests/streams/test_tls.py"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "anyio" ];
 
   meta = with lib; {

From d6628cffd1d192b506aa99eda080971bfb3a8f52 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 28 May 2023 19:51:58 -0400
Subject: [PATCH 046/102] gettext: 0.21 -> 0.21.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unfortunately, there’s no release announcement for this release. From
the [NEWS][1].

> Version 0.21.1 - October 2022
>
> * Runtime behaviour:
>   - On AIX, locale names with a script or with an uppercase language are now
>     supported.
>     For example, sr_Cyrl_RS.UTF-8 is treated like sr_RS.UTF-8@cyrillic, and
>     EN_US.UTF-8 is treated like en_US.UTF-8.
>
> * The base Unicode standard is now updated to 14.0.0.
>
> * Portability:
>   - Building on macOS 11/arm64 is now supported.
>   - Building on Linux/powerpc64le with glibc ≥ 2.35 is now supported.

The vendored gnulib was also updated, which indirectly fixes a build
failure with clang 16. The version in 0.20 fails to build because it
attempts to assign an incompatible function pointer that should have but
does not have `__attribute__((noreturn))`. On clang 16, this is an error
by default.

[1]: https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=blob_plain;f=NEWS;hb=8b38ee827251cadbb90cb6cb576ae98702566288
---
 pkgs/development/libraries/gettext/default.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 5443f1eeac0d..a8e8fde96f63 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gettext";
-  version = "0.21";
+  version = "0.21.1";
 
   src = fetchurl {
     url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
-    sha256 = "04kbg1sx0ncfrsbr85ggjslqkzzb243fcw9nyh3rrv1a22ihszf7";
+    sha256 = "sha256-6MNlDh2M7odcTzVWQjgsHfgwWL1aEe6FVcDPJ21kbUU=";
   };
   patches = [
     ./absolute-paths.diff
@@ -47,14 +47,6 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.hostPlatform.isCygwin ''
     sed -i -e "s/\(cldr_plurals_LDADD = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
     sed -i -e "s/\(libgettextsrc_la_LDFLAGS = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
-  '' +
-  # This change to gettext's vendored copy of gnulib is already
-  # merged upstream; we can drop this patch on the next version
-  # bump.  It must be applied twice because gettext vendors gnulib
-  # not once, but twice!
-  ''
-    patch -p2 -d gettext-tools/gnulib-lib/ < ${gnulib.passthru.longdouble-redirect-patch}
-    patch -p2 -d gettext-tools/libgrep/    < ${gnulib.passthru.longdouble-redirect-patch}
   '';
 
   strictDeps = true;

From 43f61cf8d47009a1ff44c20fd202641b3f1de79c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 29 May 2023 02:23:31 +0000
Subject: [PATCH 047/102] libvterm-neovim: 0.3.1 -> 0.3.2

---
 pkgs/development/libraries/libvterm-neovim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index bbbceab3ab78..27ce41d20f62 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -8,11 +8,11 @@
 stdenv.mkDerivation rec {
   pname = "libvterm-neovim";
   # Releases are not tagged, look at commit history to find latest release
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchurl {
     url = "https://www.leonerd.org.uk/code/libvterm/libvterm-${version}.tar.gz";
-    sha256 = "sha256-JaitnBVIU2jf0Kip3KGuyP6lwn2j+nTsUY1dN4fww5c=";
+    sha256 = "sha256-ketQiAafTm7atp4UxCEvbaAZLmVpWVbcBIAWoNq4vPY=";
   };
 
   nativeBuildInputs = [ perl libtool ];

From d3edadc491f05f105ded0fb5c026e1a21b336ab2 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Sat, 27 May 2023 20:51:53 +0200
Subject: [PATCH 048/102] mesa_22_3: drop

---
 pkgs/development/libraries/mesa/22.3.nix                 | 4 ----
 pkgs/development/libraries/mesa/23.0.nix                 | 4 ----
 .../libraries/mesa/{generic.nix => default.nix}          | 5 +++--
 pkgs/top-level/all-packages.nix                          | 9 +--------
 4 files changed, 4 insertions(+), 18 deletions(-)
 delete mode 100644 pkgs/development/libraries/mesa/22.3.nix
 delete mode 100644 pkgs/development/libraries/mesa/23.0.nix
 rename pkgs/development/libraries/mesa/{generic.nix => default.nix} (99%)

diff --git a/pkgs/development/libraries/mesa/22.3.nix b/pkgs/development/libraries/mesa/22.3.nix
deleted file mode 100644
index 1a1127dae508..000000000000
--- a/pkgs/development/libraries/mesa/22.3.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "22.3.7";
-  hash = "sha256-iUzi9KHC52F3zdIoRiAZLQ2jBmskPuwvux18838TBCw=";
-}
diff --git a/pkgs/development/libraries/mesa/23.0.nix b/pkgs/development/libraries/mesa/23.0.nix
deleted file mode 100644
index 323e00196181..000000000000
--- a/pkgs/development/libraries/mesa/23.0.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "23.0.3";
-  hash = "sha256-OGNipdgN87CWY2tn80Dhzme3BbRHZ9W90R0u0QNxktU=";
-}
diff --git a/pkgs/development/libraries/mesa/generic.nix b/pkgs/development/libraries/mesa/default.nix
similarity index 99%
rename from pkgs/development/libraries/mesa/generic.nix
rename to pkgs/development/libraries/mesa/default.nix
index ea7c1cb8b7b5..7cd22c077a7e 100644
--- a/pkgs/development/libraries/mesa/generic.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,5 +1,3 @@
-{ version, hash }:
-
 { stdenv, lib, fetchurl, fetchpatch
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
@@ -87,6 +85,9 @@
 */
 
 let
+  version = "23.0.3";
+  hash = "sha256-OGNipdgN87CWY2tn80Dhzme3BbRHZ9W90R0u0QNxktU=";
+
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
   branch = lib.versions.major version;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2dc0031c2228..d8ee4178a4f3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23005,17 +23005,10 @@ with pkgs;
   # Default libGLU
   libGLU = mesa_glu;
 
-  # Keep Mesa 22.3 for now because 23.0 does not build on Darwin.
-  # FIXME: remove, also investigate why we even need Mesa on Darwin.
-  mesa_22_3 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/22.3.nix {
+  mesa = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa {
     inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
     inherit (darwin.apple_sdk_11_0.libs) Xplugin;
   };
-  mesa_23_0 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/23.0.nix {
-    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
-    inherit (darwin.apple_sdk_11_0.libs) Xplugin;
-  };
-  mesa = if stdenv.isDarwin then mesa_22_3 else mesa_23_0;
 
   mesa_glu =  callPackage ../development/libraries/mesa-glu {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;

From fcb01998279625e12ea6917478cb9fe18d7d504c Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Sat, 27 May 2023 20:52:18 +0200
Subject: [PATCH 049/102] mesa: mark as broken on darwin

---
 pkgs/development/libraries/mesa/default.nix | 3 +++
 pkgs/top-level/release-small.nix            | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 7cd22c077a7e..d8a6615b7f48 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -372,6 +372,9 @@ self = stdenv.mkDerivation {
     license = licenses.mit; # X11 variant, in most files
     platforms = platforms.mesaPlatforms;
     maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
+
+    # https://gitlab.freedesktop.org/mesa/mesa/-/issues/8634
+    broken = stdenv.isDarwin;
   };
 };
 
diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix
index 333e285cef0a..f2cc7ae471a4 100644
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@@ -89,7 +89,7 @@ with import ./release-lib.nix { inherit supportedSystems nixpkgsArgs; };
   man-pages = linux;
   mc = all;
   mdadm = linux;
-  mesa = mesaPlatforms;
+  mesa = linux;
   mingetty = linux;
   mktemp = all;
   monotone = linux;

From 7f7ab8be9713618c1ed5f51287b8ace58c55da84 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Sat, 27 May 2023 20:55:54 +0200
Subject: [PATCH 050/102] mesa: 23.0.3 -> 23.1.1

---
 pkgs/development/libraries/mesa/default.nix   | 21 +++++++++----------
 ...include-dri-driver-path-in-cache-key.patch |  4 +++-
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index d8a6615b7f48..38afcd174db3 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -4,7 +4,7 @@
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages_15, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
-, libglvnd, libunwind
+, libglvnd, libunwind, lm_sensors
 , vulkan-loader, glslang
 , galliumDrivers ?
   if stdenv.isLinux then
@@ -85,8 +85,8 @@
 */
 
 let
-  version = "23.0.3";
-  hash = "sha256-OGNipdgN87CWY2tn80Dhzme3BbRHZ9W90R0u0QNxktU=";
+  version = "23.1.1";
+  hash = "sha256-omeQMe1bc7KcTwQqxk2W+DsM/khYYX3jLi78GWxlOkA=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
@@ -146,11 +146,6 @@ self = stdenv.mkDerivation {
       "get_option('datadir')" "'${placeholder "out"}/share'"
     substituteInPlace src/amd/vulkan/meson.build --replace \
       "get_option('datadir')" "'${placeholder "out"}/share'"
-  ''
-  # TODO: can be removed >= 23.0.4 (most likely)
-  # https://gitlab.freedesktop.org/mesa/mesa/-/commit/035aa34ed5eb418339c0e2d2
-  + ''
-    sed '/--size_t-is-usize/d' -i src/gallium/frontends/rusticl/meson.build
   '';
 
   outputs = [ "out" "dev" "drivers" ]
@@ -198,6 +193,10 @@ self = stdenv.mkDerivation {
 
     # To enable non-mesa gbm backends to be found (e.g. Nvidia)
     "-Dgbm-backends-path=${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm"
+
+    # meson auto_features enables these features, but we do not want them
+    "-Dandroid-libbacktrace=disabled"
+
   ] ++ lib.optionals stdenv.isLinux [
     "-Dglvnd=true"
 
@@ -220,10 +219,9 @@ self = stdenv.mkDerivation {
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
     libffi libvdpau libelf libXvMC
     libpthreadstubs openssl /*or another sha1 provider*/
-    zstd
+    zstd libunwind
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev ]
-    ++ lib.optionals stdenv.isDarwin [ libunwind ]
+    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
     ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator' ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader
@@ -254,6 +252,7 @@ self = stdenv.mkDerivation {
     if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
       # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
       mv -t $drivers/lib       \
+        $out/lib/libpowervr_rogue* \
         $out/lib/libxatracker* \
         $out/lib/libvulkan_*
     fi
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index 445f26c6bd10..fe51c79d7a06 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -10,16 +10,18 @@ diff --git a/meson_options.txt b/meson_options.txt
 index b8f753e2e1a..70d9071c8be 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -452,6 +452,12 @@ option(
+@@ -452,7 +452,14 @@ option(
    value : true,
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
+ 
 +option(
 +  'disk-cache-key',
 +  type : 'string',
 +  value : '',
 +  description : 'Mesa cache key.'
 +)
++
  option('egl-lib-suffix',
    type : 'string',
    value : '',

From 061f3a192d6c0f271977768f60b8157deaa6fec5 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Sun, 28 May 2023 16:07:02 +0200
Subject: [PATCH 051/102] gst-plugins: exclude mesa dependency on darwin

---
 pkgs/development/libraries/gstreamer/bad/default.nix   | 5 +++--
 pkgs/development/libraries/gstreamer/base/default.nix  | 2 +-
 pkgs/development/libraries/gstreamer/vaapi/default.nix | 5 +++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 7861a49b565b..ccfbd892a97d 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -183,8 +183,6 @@ stdenv.mkDerivation rec {
     libwebp
     xvidcore
     gnutls
-    libGL
-    libGLU
     game-music-emu
     openssl
     libxml2
@@ -235,6 +233,9 @@ stdenv.mkDerivation rec {
     serd
     sord
     sratom
+
+    libGL
+    libGLU
   ] ++ lib.optionals guiSupport [
     gtk3
   ] ++ lib.optionals (stdenv.isLinux && guiSupport) [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 370d868ec2c7..5c70b225e526 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -87,9 +87,9 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     libjpeg
     tremor
-    libGL
     pango
   ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
     libvisual
   ] ++ lib.optionals stdenv.isDarwin [
     OpenGL
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 0662cdd8e429..c25aa55557aa 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -62,10 +62,11 @@ stdenv.mkDerivation rec {
     xorg.libXrandr
     xorg.libSM
     xorg.libICE
-    libGL
-    libGLU
     nasm
     libvpx
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
+    libGLU
   ];
 
   strictDeps = true;

From 4062535a3ef0b7f75bea95906e84a428bc9884f7 Mon Sep 17 00:00:00 2001
From: Yureka <yuka@yuka.dev>
Date: Sun, 28 May 2023 16:29:45 +0200
Subject: [PATCH 052/102] SDL2: exclude mesa dependency on darwin

---
 pkgs/development/libraries/SDL2/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 8160554a0609..7fe3fb38a1f7 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
 
   dlopenPropagatedBuildInputs = [ ]
     # Propagated for #include <GLES/gl.h> in SDL_opengles.h.
-    ++ lib.optional openglSupport libGL
+    ++ lib.optional (openglSupport && !stdenv.isDarwin) libGL
     # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
     ++ lib.optionals x11Support [ libX11 ];
 

From f2d0addab63d04e210ec82d25e3de11fa37d07db Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 29 May 2023 12:28:45 +0100
Subject: [PATCH 053/102] python3Packages.flask: 2.2.3 -> 2.2.5

---
 pkgs/development/python-modules/flask/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flask/default.nix b/pkgs/development/python-modules/flask/default.nix
index 03b1873edc5f..4bcb02880671 100644
--- a/pkgs/development/python-modules/flask/default.nix
+++ b/pkgs/development/python-modules/flask/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "flask";
-  version = "2.2.3";
+  version = "2.2.5";
 
   src = fetchPypi {
     pname = "Flask";
     inherit version;
-    hash = "sha256-frNzmEvxx3ACP86dsWTtDDNTzQtT8TD0aT2gynVqLm0=";
+    hash = "sha256-7e6bCn/yZiG9WowQ/0hK4oc3okENmbC7mmhQx/uXeqA=";
   };
 
   propagatedBuildInputs = [

From d121e1cd49613a48c3d0cc4a2fd8d2d40688c48c Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 29 May 2023 14:48:35 +0300
Subject: [PATCH 054/102] SDL2_ttf: drop libGL on darwin

---
 pkgs/development/libraries/SDL2_ttf/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/SDL2_ttf/default.nix b/pkgs/development/libraries/SDL2_ttf/default.nix
index 06793ee5e551..66f53949c245 100644
--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ SDL2 freetype libGL ]
+  buildInputs = [ SDL2 freetype ]
+    ++ lib.optional (!stdenv.isDarwin) libGL
     ++ lib.optional stdenv.isDarwin darwin.libobjc;
 
   meta = with lib; {

From b9d1dde37ba8f039c28b3d38e85aa3c919740a2a Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Wed, 10 May 2023 03:02:53 -0400
Subject: [PATCH 055/102] pkg-config: fix build with newer clang

Building pkg-config with newer versions of clang fails in the vendored
glib due to an incompatible conversion.ZZ
---
 pkgs/development/tools/misc/pkg-config/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/tools/misc/pkg-config/default.nix b/pkgs/development/tools/misc/pkg-config/default.nix
index d4feca6dfe6e..b883dab6cc14 100644
--- a/pkgs/development/tools/misc/pkg-config/default.nix
+++ b/pkgs/development/tools/misc/pkg-config/default.nix
@@ -35,6 +35,9 @@ stdenv.mkDerivation rec {
          "ac_cv_func_posix_getgrgid_r=yes"
        ];
 
+  # Silence "incompatible integer to pointer conversion passing 'gsize'" when building with Clang.
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion";
+
   enableParallelBuilding = true;
   doCheck = true;
 

From db33597286f6e47a6936e6888b78ea14252c511a Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sat, 20 May 2023 12:08:15 -0400
Subject: [PATCH 056/102] python3Packages.poetry-core: fix build with newer
 clang

Silence an integer conversion warning that newer clangs issue, causing
the build to fail.
---
 pkgs/development/python-modules/poetry-core/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index 9e7e7bd978ff..daf45528202f 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -73,6 +73,8 @@ buildPythonPackage rec {
     "poetry"
   ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion";
+
   meta = with lib; {
     changelog = "https://github.com/python-poetry/poetry-core/blob/${src.rev}/CHANGELOG.md";
     description = "Core utilities for Poetry";

From 50f1dbc5ede04954274d58aa1c21dfc0b2b0ad8d Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 21 May 2023 01:19:03 -0400
Subject: [PATCH 057/102] cairo: fix build with newer clang
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is fixed upstream, but it’s not included in a release yet.
---
 pkgs/development/libraries/cairo/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index 70a59bfa0db7..f36adbda8920 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -63,6 +63,14 @@ in {
       sha256 = "sha256-8G98nsPz3MLEWPDX9F0jKgXC4hC4NNdFQLSpmW3ay2s=";
     })
 
+    # Fix clang build failures on newer LLVM versions
+    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/119
+    (fetchpatch {
+      name = "fix-types.patch";
+      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/38e486b34d435130f2fb38c429e6016c3c82cd53.patch";
+      sha256 = "sha256-vmluOJSuTRiQHmbBBVCxOIkZ0O0ZEo0J4mgrUPn0SIo=";
+    })
+
     # Fix unexpected color addition on grayscale images (usually text).
     # Upstream fix: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114
     # Can be removed after 1.18 release
@@ -71,6 +79,7 @@ in {
       url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/4f4d89506f58a64b4829b1bb239bab9e46d63727.diff";
       sha256 = "sha256-mbTg67e7APfdELsuMAgXdY3xokWbGtHF7VDD5UyYqKM=";
     })
+
   ];
 
   outputs = [ "out" "dev" "devdoc" ];

From 56480a72c917b020ee8d1ae64f30ef349a513675 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sat, 27 May 2023 14:18:34 -0400
Subject: [PATCH 058/102] darwin.adv_cmds: fix implicit int, which is an error
 in clang 16

---
 .../darwin/apple-source-releases/adv_cmds/boot.nix         | 7 +++++++
 .../darwin/apple-source-releases/adv_cmds/default.nix      | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
index 910b42b0c9d4..7d1066a25915 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
@@ -32,6 +32,9 @@ in appleDerivation {
 
     substituteInPlace Makefile --replace perl true
 
+    substituteInPlace colldef.tproj/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
+
     for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
       substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
         --replace /usr/share/locale "" \
@@ -42,6 +45,10 @@ in appleDerivation {
 
   preBuild = ''
     cp -r --no-preserve=all ${recentAdvCmds}/colldef .
+
+    substituteInPlace colldef/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
+
     pushd colldef
     mv locale/collate.h .
     flex -t -8 -i scan.l > scan.c
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index 9c7d4f7702fb..e44241171c60 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -6,6 +6,8 @@ appleDerivation {
   patchPhase = ''
     substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
       --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
+    substituteInPlace colldef/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
   '';
 
   # pkill requires special private headers that are unavailable in

From c9b9378674d6c75c5c190da56e66a04bdc80258b Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 28 May 2023 09:40:12 -0400
Subject: [PATCH 059/102] libidn2: drop Darwin error patch

This patch is no longer needed to build libidn2 on Darwin, which can use
the implementation of `error` from gnulib. This fixes compliation with
clang 16, which fails due to other uses of implicity-declared `error`
that it rejects (due to the removal of `#include "error.h"` in the patch).
---
 .../development/libraries/libidn2/default.nix |  2 --
 .../libraries/libidn2/fix-error-darwin.patch  | 20 -------------------
 2 files changed, 22 deletions(-)
 delete mode 100644 pkgs/development/libraries/libidn2/fix-error-darwin.patch

diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix
index 2c4041a9cfa7..0782f94f41e5 100644
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@@ -18,8 +18,6 @@ stdenv.mkDerivation rec {
   # Beware: non-bootstrap libidn2 is overridden by ./hack.nix
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];
 
-  patches = lib.optional stdenv.isDarwin ./fix-error-darwin.patch;
-
   enableParallelBuilding = true;
 
   # The above patch causes the documentation to be regenerated, so the
diff --git a/pkgs/development/libraries/libidn2/fix-error-darwin.patch b/pkgs/development/libraries/libidn2/fix-error-darwin.patch
deleted file mode 100644
index e2202abd947c..000000000000
--- a/pkgs/development/libraries/libidn2/fix-error-darwin.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/src/idn2.c b/src/idn2.c
-index 6abbc72..804f0f2 100644
---- a/src/idn2.c
-+++ b/src/idn2.c
-@@ -31,7 +31,6 @@
- #include <unistr.h>
- 
- /* Gnulib headers. */
--#include "error.h"
- #include "gettext.h"
- #define _(String) dgettext (PACKAGE, String)
- #include "progname.h"
-@@ -222,7 +219,7 @@ main (int argc, char *argv[])
-     }
- 
-   if (ferror (stdin))
--    error (EXIT_FAILURE, errno, "%s", _("input error"));
-+    perror (_("input error"));
- 
-   cmdline_parser_free (&args_info);

From e10c33986ce73f4b103e9ab3203a5e11f4c850a1 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 29 May 2023 21:30:31 +0100
Subject: [PATCH 060/102] nss_esr: backport gcc-13 fix

Without the change `nss` build on `gcc-13 `fails as:

    ../../cpputil/databuffer.h:20:20: error: 'uint8_t' does not name a type
       20 |   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
          |                    ^~~~~~~
    ../../cpputil/databuffer.h:14:1: note: 'uint8_t' is defined in header '<cstdint>'; did you forget to '#include <cstdint>'?
       13 | #include <iostream>
      +++ |+#include <cstdint>
       14 |
---
 .../libraries/nss/gcc-13-esr.patch            | 44 +++++++++++++++++++
 pkgs/development/libraries/nss/generic.nix    |  5 +++
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/development/libraries/nss/gcc-13-esr.patch

diff --git a/pkgs/development/libraries/nss/gcc-13-esr.patch b/pkgs/development/libraries/nss/gcc-13-esr.patch
new file mode 100644
index 000000000000..547ee0bd3761
--- /dev/null
+++ b/pkgs/development/libraries/nss/gcc-13-esr.patch
@@ -0,0 +1,44 @@
+https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
+https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+
+# HG changeset patch
+# User Sergei Trofimovich <slyich@gmail.com>
+# Date 1653552519 0
+# Node ID 21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+# Parent  ad1046e9eee5f5dc17dac7c9343e2f7f0da44b4e
+Bug 1771273 - cpputil/databuffer.h: add missing <cstdint> include r=nss-reviewers,mt
+
+Without the change build fails on this week's gcc-13 snapshot as:
+
+    ../../cpputil/databuffer.h:20:20: error: 'uint8_t' does not name a type
+       20 |   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
+          |                    ^~~~~~~
+    ../../cpputil/databuffer.h:14:1: note: 'uint8_t' is defined in header '<cstdint>'; did you forget to '#include <cstdint>'?
+       13 | #include <iostream>
+      +++ |+#include <cstdint>
+       14 |
+
+Differential Revision: https://phabricator.services.mozilla.com/D147404
+
+diff --git a/cpputil/databuffer.h b/cpputil/databuffer.h
+--- nss/cpputil/databuffer.h
++++ nss/cpputil/databuffer.h
+@@ -6,16 +6,17 @@
+ 
+ #ifndef databuffer_h__
+ #define databuffer_h__
+ 
+ #include <algorithm>
+ #include <cstring>
+ #include <iomanip>
+ #include <iostream>
++#include <cstdint>
+ 
+ namespace nss_test {
+ 
+ class DataBuffer {
+  public:
+   DataBuffer() : data_(nullptr), len_(0) {}
+   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
+     Assign(d, l);
+
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index be2196d6d2fc..b2d1c1e15fd8 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -47,6 +47,11 @@ stdenv.mkDerivation rec {
       ./85_security_load_3.85+.patch
     )
     ./fix-cross-compilation.patch
+  ] ++ lib.optionals (lib.versionOlder version "3.89") [
+    # Backport gcc-13 build fix:
+    #  https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
+    #  https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+    ./gcc-13-esr.patch
   ];
 
   patchFlags = [ "-p0" ];

From 1a29857b8a93f5259f0c2e919becc0bf9db24f85 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Mon, 29 May 2023 23:07:38 +0200
Subject: [PATCH 061/102] stdenv/setup.sh: deal with Nix < 2.4 structured attrs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nix does not (as far it is documented) guarantee that NIX_ATTRS_*_FILE
is set, the only [documented] guarantee seems to be:

> […] made available to the builder via the file .attrs.json in the
> builder’s temporary directory.

This guarantee is of course affected by https://github.com/NixOS/nix/issues/6736,
so it seems to be prudent to fall back to the Nix 2.3 style ATTRS_*_FILE
env vars before defaulting to the expected location in case neither is
available.

See also:

- https://github.com/NixOS/nixpkgs/pull/214937#discussion_r1178101895
- https://github.com/nixos/nixpkgs/commit/afef6588e250

[documented]: https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-structuredAttrs
---
 pkgs/stdenv/generic/setup.sh | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 734abb890c24..d3009ae572a2 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -29,13 +29,23 @@ if [ -n "$__structuredAttrs" ]; then
         export "$outputName=${outputs[$outputName]}"
     done
 
+    # Before Nix 2.4, $NIX_ATTRS_*_FILE was named differently:
+    # https://github.com/NixOS/nix/commit/27ce722
+    if [[ -n "${ATTRS_JSON_FILE:-}" ]]; then
+        export NIX_ATTRS_JSON_FILE="$ATTRS_JSON_FILE"
+    fi
+
+    if [[ -n "${ATTRS_SH_FILE:-}" ]]; then
+        export NIX_ATTRS_SH_FILE="$ATTRS_SH_FILE"
+    fi
+
     # $NIX_ATTRS_JSON_FILE pointed to the wrong location in sandbox
     # https://github.com/NixOS/nix/issues/6736; please keep around until the
     # fix reaches *every patch version* that's >= lib/minver.nix
-    if ! [[ -e "$NIX_ATTRS_JSON_FILE" ]]; then
+    if ! [[ -e "${NIX_ATTRS_JSON_FILE:-}" ]]; then
         export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
     fi
-    if ! [[ -e "$NIX_ATTRS_SH_FILE" ]]; then
+    if ! [[ -e "${NIX_ATTRS_SH_FILE:-}" ]]; then
         export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
     fi
 else

From 0b499eb86239cae23e52ba7c8ad2c3d30e6ed5b8 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sat, 20 May 2023 21:53:33 -0400
Subject: [PATCH 062/102] python3Packages.cffi: fix build with newer clang

cffi uses a technique to find the offset of a struct that causes newer
clangs to issue a warning regarding null pointer subtraction. This
patch silences the warning, so cffi can build.
---
 .../cffi/clang-pointer-substraction-warning.diff      | 11 +++++++++++
 pkgs/development/python-modules/cffi/default.nix      |  6 ++++++
 2 files changed, 17 insertions(+)
 create mode 100644 pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff

diff --git a/pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff b/pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff
new file mode 100644
index 000000000000..75b2677e380e
--- /dev/null
+++ b/pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff
@@ -0,0 +1,11 @@
+diff -r c649a735cf82 testing/support.py
+--- a/testing/support.py	Thu Feb 23 05:42:01 2023 +0100
++++ b/testing/support.py	Sat May 20 21:46:56 2023 -0400
+@@ -112,6 +112,7 @@
+                               '-Wno-unreachable-code']
+         # special things for clang
+         extra_compile_args.append('-Qunused-arguments')
++        extra_compile_args.append('-Wno-null-pointer-subtraction')
+     else:
+         # assume a standard gcc
+         extra_compile_args = ['-Werror', '-Wall', '-Wextra', '-Wconversion',
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 5d3e220e98de..0d93941b974d 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -50,6 +50,12 @@ if isPyPy then null else buildPythonPackage rec {
       ];
       hash = "sha256-+2daRTvxtyrCPimOEAmVbiVm1Bso9hxGbaAbd03E+ws=";
     })
+  ] ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc) "13") [
+    # -Wnull-pointer-subtraction is enabled with -Wextra. Suppress it to allow the following tests
+    # to run and pass when cffi is built with newer versions of clang:
+    # - testing/cffi1/test_verify1.py::test_enum_usage
+    # - testing/cffi1/test_verify1.py::test_named_pointer_as_argument
+    ./clang-pointer-substraction-warning.diff
   ] ++  lib.optionals (pythonAtLeast "3.11") [
     # Fix test that failed because python seems to have changed the exception format in the
     # final release. This patch should be included in the next version and can be removed when

From 6f554cca37c21fe8b48f030a36d9b252ac87e713 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 17 May 2023 12:50:55 +1000
Subject: [PATCH 063/102] sqlite: 3.41.2 -> 3.42.0

Changelog: https://www.sqlite.org/releaselog/3_42_0.html
---
 pkgs/development/libraries/sqlite/default.nix | 4 ++--
 pkgs/development/libraries/sqlite/tools.nix   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 961a0c9e3195..a3006e1236a6 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.41.2";
+  version = "3.42.0";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-6YwQDdHaTjD6Rgdh2rfAuRpQt4XhZ/jFesxGUU+ulJk=";
+    hash = "sha256-erz9FhxuJ0LKXGwIldH4U8lA8gMwSgtJ2k4eyl0IjKY=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 9943184bd1f3..c30ce8d45d9a 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.41.2";
+    version = "3.42.0";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-hxkfzsuLcH2aEO2xNgdoYxfXFpwIC5vcXTnQY1g3bMw=";
+      hash = "sha256-OMpWoxe+N/sAvZK8KA2bkgm9QAiyl9SDxB7B9geb+20=";
     };
 
     nativeBuildInputs = [ unzip ];

From dd0dee4c97bc517e6c9bc1964778eb61651a1180 Mon Sep 17 00:00:00 2001
From: Guillaume Maudoux <guillaume.maudoux@tweag.io>
Date: Mon, 28 Mar 2022 19:40:23 +0200
Subject: [PATCH 064/102] autoPatchelfHook: Add support for single files

---
 .../setup-hooks/auto-patchelf.py              | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.py b/pkgs/build-support/setup-hooks/auto-patchelf.py
index bb13d2473f6d..965384b876fc 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.py
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -109,7 +109,14 @@ def osabi_are_compatible(wanted: str, got: str) -> bool:
 
 
 def glob(path: Path, pattern: str, recursive: bool) -> Iterator[Path]:
-    return path.rglob(pattern) if recursive else path.glob(pattern)
+    if path.is_dir():
+        return path.rglob(pattern) if recursive else path.glob(pattern)
+    else:
+        # path.glob won't return anything if the path is not a directory.
+        # We extend that behavior by matching the file name against the pattern.
+        # This allows to pass single files instead of dirs to auto_patchelf,
+        # for greater control on the files to consider.
+        return [path] if path.match(pattern) else []
 
 
 cached_paths: Set[Path] = set()
@@ -305,16 +312,21 @@ def main() -> None:
         "--no-recurse",
         dest="recursive",
         action="store_false",
-        help="Patch only the provided paths, and ignore their children")
+        help="Disable the recursive traversal of paths to patch.")
     parser.add_argument(
         "--paths", nargs="*", type=Path,
-        help="Paths whose content needs to be patched.")
+        help="Paths whose content needs to be patched."
+             " Single files and directories are accepted."
+             " Directories are traversed recursively by default.")
     parser.add_argument(
         "--libs", nargs="*", type=Path,
-        help="Paths where libraries are searched for.")
+        help="Paths where libraries are searched for."
+             " Single files and directories are accepted."
+             " Directories are not searched recursively.")
     parser.add_argument(
         "--runtime-dependencies", nargs="*", type=Path,
-        help="Paths to prepend to the runtime path of executable binaries.")
+        help="Paths to prepend to the runtime path of executable binaries."
+             " Subject to deduplication, which may imply some reordering.")
     parser.add_argument(
         "--append-rpaths",
         nargs="*",

From 1aa68d1d21c2101ed003bc55a45730226ac30c2a Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 11 May 2023 17:57:55 -0400
Subject: [PATCH 065/102] xnu: fix build with newer clang

Newer clangs require also including `-lc++abi` to build kextsymboltool.
---
 pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 262cb3d6a387..62003a6e4a6c 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -34,7 +34,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
       --replace "-Werror " ""
 
     substituteInPlace SETUP/kextsymboltool/Makefile \
-      --replace "-lstdc++" "-lc++"
+      --replace "-lstdc++" "-lc++ -lc++abi"
 
     substituteInPlace libsyscall/xcodescripts/mach_install_mig.sh \
       --replace "/usr/include" "/include" \

From 73e5ebfce572c12c71b4a6131cf8b3d9348d4ef2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <mweinelt@users.noreply.github.com>
Date: Tue, 30 May 2023 22:31:19 +0200
Subject: [PATCH 066/102] openssl: 3.0.8 -> 3.0.9 (#235006)

https://github.com/openssl/openssl/blob/openssl-3.0.9/NEWS.md

Fixes: CVE-2023-2650, CVE-2023-1255, CVE-2023-0466, CVE-2023-0465
       CVE-2023-0464
---
 pkgs/development/libraries/openssl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 303016ab8698..0449651090fe 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -240,8 +240,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.8";
-    sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4=";
+    version = "3.0.9";
+    sha256 = "sha256-6xqwR4FHQ2D3fDGKuJ2MWgOrw45j1lpgPKu/GwCh3JA=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 

From a91f6eba1e40545e9b323988fda4cd27561c6009 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 28 May 2023 11:44:54 +1000
Subject: [PATCH 067/102] buildGoPackage: remove `ldflags` and `with builtins`

as done for buildGoModule in abd5dfa01396942cf65cea34829e448ed4263950 and 3be02ada9e31503a779b5f79320ca80d5e8aee8c
---
 pkgs/build-support/go/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index 9dd1cf151294..f9e6c14ab271 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -7,9 +7,6 @@
 , preFixup ? ""
 , shellHook ? ""
 
-# Go linker flags, passed to go via -ldflags
-, ldflags ? []
-
 # Go tags, passed to go via -tag
 , tags ? []
 
@@ -49,9 +46,6 @@
 
 , meta ? {}, ... } @ args:
 
-
-with builtins;
-
 let
   dep2src = goDep:
     {

From aea73adfddadfd4df2d6851991a45a9fb603c9d7 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <shamrocklee@posteo.net>
Date: Fri, 26 May 2023 00:21:04 +0800
Subject: [PATCH 068/102] buildGo{Module,Package}: remove input argument "tags"

Unify how ldflags and tags are passed
---
 pkgs/build-support/go/module.nix  | 5 +----
 pkgs/build-support/go/package.nix | 5 +----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 2432ac3a4982..61abd040a46f 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -6,9 +6,6 @@
 , passthru ? { }
 , patches ? [ ]
 
-  # Go tags, passed to go via -tag
-, tags ? [ ]
-
   # A function to override the go-modules derivation
 , overrideModAttrs ? (_oldAttrs: { })
 
@@ -201,7 +198,7 @@ let
 
         declare -a flags
         flags+=($buildFlags "''${buildFlagsArray[@]}")
-        flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
+        flags+=(''${tags:+-tags=''${tags// /,}})
         flags+=(''${ldflags:+-ldflags="$ldflags"})
         flags+=("-p" "$NIX_BUILD_CORES")
 
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index f9e6c14ab271..b4cb264d9f24 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -7,9 +7,6 @@
 , preFixup ? ""
 , shellHook ? ""
 
-# Go tags, passed to go via -tag
-, tags ? []
-
 # We want parallel builds by default
 , enableParallelBuilding ? true
 
@@ -166,7 +163,7 @@ let
 
         declare -a flags
         flags+=($buildFlags "''${buildFlagsArray[@]}")
-        flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
+        flags+=(''${tags:+-tags=''${tags// /,}})
         flags+=(''${ldflags:+-ldflags="$ldflags"})
         flags+=("-p" "$NIX_BUILD_CORES")
 

From 6727bab05eb516fa3c6ec53c39c4b7499ee55539 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Tue, 30 May 2023 18:42:50 -0400
Subject: [PATCH 069/102] systemd-boot: Patch for firmwares that fail to load
 large files

---
 .../systemd-boot-ovmf-broken-fat-driver.patch | 25 +++++++++++++++++++
 nixos/tests/systemd-boot.nix                  | 25 +++++++++++++++++++
 pkgs/os-specific/linux/systemd/default.nix    | 10 ++++++++
 3 files changed, 60 insertions(+)
 create mode 100644 nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch

diff --git a/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch b/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch
new file mode 100644
index 000000000000..ef547c02f918
--- /dev/null
+++ b/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch
@@ -0,0 +1,25 @@
+From d87a7513c6f2f2824203032ef27caeb84892ed7e Mon Sep 17 00:00:00 2001
+From: Will Fancher <elvishjerricco@gmail.com>
+Date: Tue, 30 May 2023 16:53:20 -0400
+Subject: [PATCH] Intentionally break the fat driver
+
+---
+ FatPkg/EnhancedFatDxe/ReadWrite.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/FatPkg/EnhancedFatDxe/ReadWrite.c b/FatPkg/EnhancedFatDxe/ReadWrite.c
+index 8f525044d1f1..32c62ff7817b 100644
+--- a/FatPkg/EnhancedFatDxe/ReadWrite.c
++++ b/FatPkg/EnhancedFatDxe/ReadWrite.c
+@@ -216,6 +216,11 @@ FatIFileAccess (
+   Volume = OFile->Volume;
+   Task   = NULL;
+ 
++  if (*BufferSize > (10U * 1024U * 1024U)) {
++    IFile->Position += 10U * 1024U * 1024U;
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
+   //
+   // Write to a directory is unsupported
+   //
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index 94e269ff37bb..19034b299999 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -251,4 +251,29 @@ in
           machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/netbootxyz/netboot.xyz.efi")
     '';
   };
+
+  # See: [Firmware file size bug] in systemd/default.nix
+  uefiLargeFileWorkaround = makeTest {
+    name = "uefi-large-file-workaround";
+
+    nodes.machine = { pkgs, ... }: {
+      imports = [common];
+      virtualisation.efi.OVMF = pkgs.OVMF.overrideAttrs (old: {
+        # This patch deliberately breaks the FAT driver in EDK2 to
+        # exhibit (part of) the firmware bug that we are testing
+        # for. Files greater than 10MiB will fail to be read in a
+        # single Read() call, so systemd-boot will fail to load the
+        # initrd without a workaround. The number 10MiB was chosen
+        # because if it were smaller than the kernel size, even the
+        # LoadImage call would fail, which is not the failure mode
+        # we're testing for. It needs to be between the kernel size
+        # and the initrd size.
+        patches = old.patches or [] ++ [ ./systemd-boot-ovmf-broken-fat-driver.patch ];
+      });
+    };
+
+    testScript = ''
+      machine.wait_for_unit("multi-user.target")
+    '';
+  };
 }
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index fbf56b8c30af..7275d275f74b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -190,6 +190,16 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-inherit-systemd-environment-when-calling-generators.patch
     ./0018-core-don-t-taint-on-unmerged-usr.patch
     ./0019-tpm2_context_init-fix-driver-name-checking.patch
+
+    (fetchpatch {
+      # https://github.com/systemd/systemd/pull/25948
+      #
+      # [Firmware file size bug]: Some UEFI firmwares fail on large
+      # reads. Now that systemd-boot loads initrd itself, systems with
+      # such firmware won't boot without this fix
+      url = "https://github.com/systemd/systemd/commit/3ed1d966f00b002ed822ca9de116252bd91fe6c3.patch";
+      hash = "sha256-pwXrLTScqgnvfddlzUBZpwsoMrvRLcZPp6e4whMcyL4=";
+    })
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {

From df7b182922671c0b83a080084c475ab91450efcd Mon Sep 17 00:00:00 2001
From: fetsorn <fetsorn@gmail.com>
Date: Wed, 31 May 2023 03:58:48 +0400
Subject: [PATCH 070/102] tetraproc: fix typo

---
 pkgs/applications/audio/tetraproc/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/audio/tetraproc/default.nix b/pkgs/applications/audio/tetraproc/default.nix
index b5012029480e..806f01dc1217 100644
--- a/pkgs/applications/audio/tetraproc/default.nix
+++ b/pkgs/applications/audio/tetraproc/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    # Make sure Jack is avalable in $PATH for tetraproc
+    # Make sure Jack is available in $PATH for tetraproc
     wrapProgram $out/bin/tetraproc --prefix PATH : "${jack2}/bin"
   '';
 

From 2f85a3ce1c4da94727cc3e25b367de6c0793edf3 Mon Sep 17 00:00:00 2001
From: fetsorn <fetsorn@gmail.com>
Date: Wed, 31 May 2023 03:59:07 +0400
Subject: [PATCH 071/102] tig: fix typo

---
 pkgs/applications/version-management/tig/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/version-management/tig/default.nix b/pkgs/applications/version-management/tig/default.nix
index ada5f9fea640..188a0b115fdd 100644
--- a/pkgs/applications/version-management/tig/default.nix
+++ b/pkgs/applications/version-management/tig/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     cp contrib/vim.tigrc $out/etc/
 
     # Note: Until https://github.com/jonas/tig/issues/940 is resolved it is best
-    # not to install the ZSH completion so that the fallback implemenation from
+    # not to install the ZSH completion so that the fallback implementation from
     # ZSH can be used (Completion/Unix/Command/_git: "_tig () { _git-log }"):
     #install -D contrib/tig-completion.zsh $out/share/zsh/site-functions/_tig
 

From 3565fdf30c0bd455a8d99c6a09a393a25c25fd9f Mon Sep 17 00:00:00 2001
From: fetsorn <fetsorn@gmail.com>
Date: Wed, 31 May 2023 04:00:14 +0400
Subject: [PATCH 072/102] pkgs/build-support: fix typos

---
 pkgs/build-support/setup-hooks/role.bash | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/role.bash b/pkgs/build-support/setup-hooks/role.bash
index b2d34a1f8606..bfd6b61f0aed 100644
--- a/pkgs/build-support/setup-hooks/role.bash
+++ b/pkgs/build-support/setup-hooks/role.bash
@@ -1,8 +1,8 @@
-# Since the same derivation can be depend on in multiple ways, we need to
+# Since the same derivation can be depended on in multiple ways, we need to
 # accumulate *each* role (i.e. host and target platforms relative the depending
 # derivation) in which the derivation is used.
 #
-# The role is intened to be use as part of other variables names like
+# The role is intended to be used as part of other variables names like
 #  - $NIX_SOMETHING${role_post}
 
 function getRole() {
@@ -49,7 +49,7 @@ function getTargetRoleEnvHook() {
     getRole "$depTargetOffset"
 }
 
-# This variant is inteneded specifically for code-prodocing tool wrapper scripts
+# This variant is intended specifically for code-producing tool wrapper scripts
 # `NIX_@wrapperName@_TARGET_*_@suffixSalt@` tracks this (needs to be an exported
 # env var so can't use fancier data structures).
 function getTargetRoleWrapper() {

From 29f3903f622bf206d479cfd536392104af8e4f45 Mon Sep 17 00:00:00 2001
From: fetsorn <fetsorn@gmail.com>
Date: Wed, 31 May 2023 04:00:32 +0400
Subject: [PATCH 073/102] nix-prefetch-git: fix typo

---
 pkgs/build-support/fetchgit/nix-prefetch-git | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 1a0b3bc56919..ba2dfa2fb2c4 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -17,8 +17,8 @@ branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 out=${out:-}
 http_proxy=${http_proxy:-}
 
-# allow overwritting cacert's ca-bundle.crt with a custom one
-# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE enviroment variables for the nix-daemon
+# allow overwriting cacert's ca-bundle.crt with a custom one
+# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE environment variables for the nix-daemon
 GIT_SSL_CAINFO=${NIX_GIT_SSL_CAINFO:-$GIT_SSL_CAINFO}
 
 # populated by clone_user_rev()

From 0eb3ea39970441d5468e05d380226ed928743a85 Mon Sep 17 00:00:00 2001
From: fetsorn <fetsorn@gmail.com>
Date: Wed, 31 May 2023 04:00:54 +0400
Subject: [PATCH 074/102] xen: fix typo

---
 pkgs/applications/virtualization/xen/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix
index dd84f642e32d..826cd8a3d9d8 100644
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation (rec {
     # Remove in-tree qemu stuff in case we build from a tar-ball
     rm -rf tools/qemu-xen tools/qemu-xen-traditional
 
-    # Fix shebangs, mainly for build-scipts
+    # Fix shebangs, mainly for build-scripts
     # We want to do this before getting prefetched stuff to speed things up
     # (prefetched stuff has lots of files)
     find . -type f | xargs sed -i 's@/usr/bin/\(python\|perl\)@/usr/bin/env \1@g'

From 58f559cdb0de5c88f75b397f9ed7229bec898034 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Tue, 30 May 2023 00:14:43 -0400
Subject: [PATCH 075/102] gperf: fix build with clang 16
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clang 16 defaults to C++17, which does not allow the `register` storage
class specifier. This is fixed upstream, but the change doesn’t apply
cleanly to the 3.1 release. Fortunately, the fix is trivial (remove the
disallowed keyword).
---
 pkgs/development/tools/misc/gperf/default.nix       |  5 +++++
 .../tools/misc/gperf/gperf-c++17-register-fix.patch | 13 +++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch

diff --git a/pkgs/development/tools/misc/gperf/default.nix b/pkgs/development/tools/misc/gperf/default.nix
index d836e5a973ae..c6b6e89495c0 100644
--- a/pkgs/development/tools/misc/gperf/default.nix
+++ b/pkgs/development/tools/misc/gperf/default.nix
@@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "1qispg6i508rq8pkajh26cznwimbnj06wq9sd85vg95v8nwld1aq";
   };
 
+  patches = [
+    # Clang 16 defaults to C++17, which does not allow `register` as a storage class specifier.
+    ./gperf-c++17-register-fix.patch
+  ];
+
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch b/pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch
new file mode 100644
index 000000000000..bb8c414a1a26
--- /dev/null
+++ b/pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/getline.cc b/lib/getline.cc
+index c57c633..0984a7c 100644
+--- a/lib/getline.cc
++++ b/lib/getline.cc
+@@ -55,7 +55,7 @@ getstr (char **lineptr, size_t *n, FILE *stream, char terminator, size_t offset)
+ 
+   for (;;)
+     {
+-      register int c = getc (stream);
++      int c = getc (stream);
+ 
+       /* We always want at least one char left in the buffer, since we
+          always (unless we get an error while reading the first char)

From 259b15f25d4d98ac8c097cb5d9b2aa76482ceb40 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Wed, 10 May 2023 12:06:54 -0400
Subject: [PATCH 076/102] rewrite-tbd: avoid infinite recursion when cmake is
 not cmakeMinimal

This was found while working on the Darwin stdenv rework. This change
allows rewrite-tbd to use the provided Makefile instead of depending on
cmake and pkg-config.

Co-authored-by: Weijia Wang <9713184+wegank@users.noreply.github.com>
---
 pkgs/os-specific/darwin/rewrite-tbd/default.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/rewrite-tbd/default.nix b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
index e5ef118e514c..5cf63754dfbb 100644
--- a/pkgs/os-specific/darwin/rewrite-tbd/default.nix
+++ b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, libyaml }:
+{ stdenv, lib, fetchFromGitHub, libyaml }:
 
 stdenv.mkDerivation {
   pname = "rewrite-tbd";
@@ -11,9 +11,17 @@ stdenv.mkDerivation {
     sha256 = "08sk91zwj6n9x2ymwid2k7y0rwv5b7p6h1b25ipx1dv0i43p6v1a";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  # Nix takes care of these paths. Avoiding the use of `pkg-config` prevents an infinite recursion.
+  postPatch = ''
+    substituteInPlace Makefile.boot \
+      --replace '$(shell pkg-config --cflags yaml-0.1)' "" \
+      --replace '$(shell pkg-config --libs yaml-0.1)' "-lyaml"
+  '';
+
   buildInputs = [ libyaml ];
 
+  makeFlags = [ "-f" "Makefile.boot" "PREFIX=${placeholder "out"}"];
+
   meta = with lib; {
     homepage = "https://github.com/thefloweringash/rewrite-tbd/";
     description = "Rewrite filepath in .tbd to Nix applicable format";

From 268a7bab34430c5b6f50e379653ccbda4fff4a9b Mon Sep 17 00:00:00 2001
From: Charlotte Van Petegem <charlotte@vanpetegem.me>
Date: Wed, 31 May 2023 10:08:09 +0200
Subject: [PATCH 077/102] libssh2: 1.10.0 -> 1.11.0

https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.0
---
 .../development/libraries/libssh2/default.nix | 10 ++-----
 ...openssl_add_support_for_libressl_3_5.patch | 26 -------------------
 2 files changed, 2 insertions(+), 34 deletions(-)
 delete mode 100644 pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch

diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index ce496637fcc2..ba1455350e60 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -2,21 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh2";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://www.libssh2.org/download/libssh2-${version}.tar.gz";
-    sha256 = "sha256-LWTpDz3tOUuR06LndMogOkF59prr7gMAPlpvpiHkHVE=";
+    sha256 = "sha256-NzYWHkHiaTMk3rOMJs/cPv5iCdY0ukJY2xzs/2pa1GE=";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
 
-  patches = [
-    # https://github.com/libssh2/libssh2/pull/700
-    # openssl: add support for LibreSSL 3.5.x
-    ./openssl_add_support_for_libressl_3_5.patch
-  ];
-
   buildInputs = [ openssl zlib ]
     ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;
 
diff --git a/pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch b/pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch
deleted file mode 100644
index d72a67a63403..000000000000
--- a/pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From f0681a4573d7c7f7484d3157ddff7063a200295b Mon Sep 17 00:00:00 2001
-From: Viktor Szakats <commit@vsz.me>
-Date: Thu, 19 May 2022 13:25:06 +0000
-Subject: [PATCH] openssl: add support for LibreSSL 3.5.x
-
-LibreSSL 3.5.0 made more structures opaque, so let's enable existing
-support for that when building against these LibreSSL versions.
-
-Ref: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.0-relnotes.txt
----
- src/openssl.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/openssl.h b/src/openssl.h
-index 658b040..1733b9e 100644
---- a/src/openssl.h
-+++ b/src/openssl.h
-@@ -58,7 +58,8 @@
- #include <openssl/rand.h>
-
- #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
--    !defined(LIBRESSL_VERSION_NUMBER)
-+    !defined(LIBRESSL_VERSION_NUMBER) || \
-+    LIBRESSL_VERSION_NUMBER >= 0x3050000fL
- # define HAVE_OPAQUE_STRUCTS 1
- #endif

From 0ad178d902aee02c3538098aafe8a75ed619a8c6 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 31 May 2023 22:59:33 +0200
Subject: [PATCH 078/102] tk: hardcode path to TK_LIBRARY

---
 pkgs/development/libraries/tk/8.6.nix         |  4 +++
 .../libraries/tk/tk-8_6_13-find-library.patch | 25 +++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 pkgs/development/libraries/tk/tk-8_6_13-find-library.patch

diff --git a/pkgs/development/libraries/tk/8.6.nix b/pkgs/development/libraries/tk/8.6.nix
index 3e3d8ad54011..fbf456051754 100644
--- a/pkgs/development/libraries/tk/8.6.nix
+++ b/pkgs/development/libraries/tk/8.6.nix
@@ -14,4 +14,8 @@ callPackage ./generic.nix (args // {
     sha256 = "sha256-LmX6BpojNlRAo8VsVWuGc7XjKig4ANjZslfj9YTOBnU=";
   };
 
+  patches = [
+    ./tk-8_6_13-find-library.patch
+  ];
+
 })
diff --git a/pkgs/development/libraries/tk/tk-8_6_13-find-library.patch b/pkgs/development/libraries/tk/tk-8_6_13-find-library.patch
new file mode 100644
index 000000000000..a055ade80cc0
--- /dev/null
+++ b/pkgs/development/libraries/tk/tk-8_6_13-find-library.patch
@@ -0,0 +1,25 @@
+diff --git a/generic/tkWindow.c b/generic/tkWindow.c
+index fa25553..ad45598 100644
+--- a/generic/tkWindow.c
++++ b/generic/tkWindow.c
+@@ -1045,6 +1045,7 @@ TkCreateMainWindow(
+ 
+     Tcl_SetVar2(interp, "tk_patchLevel", NULL, TK_PATCH_LEVEL, TCL_GLOBAL_ONLY);
+     Tcl_SetVar2(interp, "tk_version",    NULL, TK_VERSION,     TCL_GLOBAL_ONLY);
++    Tcl_SetVar2(interp, "tk_library",    NULL, TK_LIBRARY,     TCL_GLOBAL_ONLY);
+ 
+     tsdPtr->numMainWindows++;
+     return tkwin;
+diff --git a/unix/Makefile.in b/unix/Makefile.in
+index e98070e..f417753 100644
+--- a/unix/Makefile.in
++++ b/unix/Makefile.in
+@@ -1033,7 +1033,7 @@ tkVisual.o: $(GENERIC_DIR)/tkVisual.c
+ 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkVisual.c
+ 
+ tkWindow.o: $(GENERIC_DIR)/tkWindow.c tkUuid.h
+-	$(CC) -c $(CC_SWITCHES) -I. $(GENERIC_DIR)/tkWindow.c
++	$(CC) -c $(CC_SWITCHES) -I. -DTK_LIBRARY=\"${TK_LIBRARY}\" $(GENERIC_DIR)/tkWindow.c
+ 
+ tkButton.o: $(GENERIC_DIR)/tkButton.c
+ 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkButton.c

From 8a6917f715543d7ca3480ef15770c595241d7a87 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 31 May 2023 22:59:51 +0200
Subject: [PATCH 079/102] thonny: drop TK_LIBRARY

---
 pkgs/applications/editors/thonny/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/thonny/default.nix b/pkgs/applications/editors/thonny/default.nix
index 40ba0701ce71..a6d698b65a13 100644
--- a/pkgs/applications/editors/thonny/default.nix
+++ b/pkgs/applications/editors/thonny/default.nix
@@ -42,7 +42,6 @@ buildPythonApplication rec {
 
   preFixup = ''
     wrapProgram "$out/bin/thonny" \
-       --set TK_LIBRARY "${tk}/lib/${tk.libPrefix}" \
        --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath ${python3.pkgs.jedi})
   '';
 
@@ -64,6 +63,6 @@ buildPythonApplication rec {
     homepage = "https://www.thonny.org/";
     license = licenses.mit;
     maintainers = with maintainers; [ leenaars ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }

From 0c813b23401e2472028e23e8c0111512e6396882 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Wed, 31 May 2023 22:11:15 +0100
Subject: [PATCH 080/102] opencv: add patches for CVE-2023-2617 & CVE-2023-2618

---
 pkgs/development/libraries/opencv/4.x.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 5f9948848618..3f120e2558f3 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , unzip
@@ -275,6 +276,21 @@ stdenv.mkDerivation {
   # Ensures that we use the system OpenEXR rather than the vendored copy of the source included with OpenCV.
   patches = [
     ./cmake-don-t-use-OpenCVFindOpenEXR.patch
+  ] ++ lib.optionals enableContrib [
+    (fetchpatch {
+      name = "CVE-2023-2617.patch";
+      url = "https://github.com/opencv/opencv_contrib/commit/ccc277247ac1a7aef0a90353edcdec35fbc5903c.patch";
+      stripLen = 2;
+      extraPrefix = [ "opencv_contrib/" ];
+      sha256 = "sha256-drZ+DVn+Pk4zAZJ+LgX5u3Tz7MU0AEI/73EVvxDP3AU=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-2618.patch";
+      url = "https://github.com/opencv/opencv_contrib/commit/ec406fa4748fb4b0630c1b986469e7918d5e8953.patch";
+      stripLen = 2;
+      extraPrefix = [ "opencv_contrib/" ];
+      sha256 = "sha256-cB5Tsh2fDOsc0BNtSzd6U/QoCjkd9yMW1QutUU69JJ0=";
+    })
   ] ++ lib.optional enableCuda ./cuda_opt_flow.patch;
 
   # This prevents cmake from using libraries in impure paths (which

From 01e06549c6db0a7fc54da02d4ed19f63bf1d336d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 1 Jun 2023 11:13:04 +0300
Subject: [PATCH 081/102] util-linux: backport patches fixing mount on older
 kernels

---
 pkgs/os-specific/linux/util-linux/default.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 3b8d5f53e787..7b98c6bcd9d2 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, zlib, shadow
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, zlib, shadow
 , capabilitiesSupport ? stdenv.isLinux
 , libcap_ng
 , libxcrypt
@@ -28,6 +28,16 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
+
+    # FIXME: backport mount fixes for older kernels, remove in next release
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/f94a7760ed7ce81389a6059f020238981627a70d.diff";
+      hash = "sha256-UorqDeECK8pBePkmpo2x90p/jP3rCMshyPCyijSX1wo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/1bd85b64632280d6bf0e86b4ff29da8b19321c5f.diff";
+      hash = "sha256-dgu4de5ul/si7Vzwe8lr9NvsdI1CWfDQKuqvARaY6sE=";
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "lib" "man" ];

From 31b198ad6fc85ee8af80771063dda06a99de043f Mon Sep 17 00:00:00 2001
From: Otavio Salvador <otavio@ossystems.com.br>
Date: Wed, 31 May 2023 11:24:33 -0300
Subject: [PATCH 082/102] dtc: fix linker options so it also works in Darwin

We dropped two simple patches which were changing the version in
meson.build as the "dtc: Fix linker options so it also works in Darwin"
is bigger.

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
---
 pkgs/development/compilers/dtc/default.nix | 24 +++++++++++-----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index 8669a3c7894b..4dbfd6f2bb90 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -31,23 +31,17 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-C7OzwY0zq+2CV3SB5unI7Ill2M3deF7FXeQE3B/Kx2s=";
     })
 
-    # meson.build: bump version to 1.7.0
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/64a907f08b9bedd89833c1eee674148cff2343c6.patch";
-      sha256 = "sha256-p2KGS5GW+3uIPgXfuIx6aDC54csM+5FZDkK03t58AL8=";
-    })
-
-    # Fix version in libfdt/meson.build
-    (fetchpatch {
-      url = "https://github.com/dgibson/dtc/commit/723545ebe9933b90ea58dc125e4987c6bcb04ade.patch";
-      sha256 = "sha256-5Oq7q+62ZObj3e7rguN9jhSpYoQkwjSfo/N893229dQ=";
-    })
-
     # Use #ifdef NO_VALGRIND
     (fetchpatch {
       url = "https://github.com/dgibson/dtc/commit/41821821101ad8a9f83746b96b163e5bcbdbe804.patch";
       sha256 = "sha256-7QEFDtap2DWbUGqtyT/RgJZJFldKB8oSubKiCtLZ0w4=";
     })
+
+    # dtc: Fix linker options so it also works in Darwin
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/3acde70714df3623e112cf3ec99fc9b5524220b8.patch";
+      sha256 = "sha256-uLXL0Sjcn+bnMuF+A6PjUW1Rq6uNg1dQl58zbeYpP/U=";
+    })
   ];
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -69,6 +63,12 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs setup.py
+
+    # meson.build: bump version to 1.7.0
+    substituteInPlace libfdt/meson.build \
+      --replace "version: '1.6.0'," "version: '${version}',"
+    substituteInPlace meson.build \
+      --replace "version: '1.6.0'," "version: '${version}',"
   '';
 
   # Required for installation of Python library and is innocuous otherwise.

From 219b397071617fb3a71be757f64f0586be971ad4 Mon Sep 17 00:00:00 2001
From: Otavio Salvador <otavio@ossystems.com.br>
Date: Thu, 1 Jun 2023 10:32:24 -0300
Subject: [PATCH 083/102] dtc: avoid building tests in case doCheck is disabled

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
---
 pkgs/development/compilers/dtc/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index 4dbfd6f2bb90..04c56d0d4253 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -42,6 +42,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/dgibson/dtc/commit/3acde70714df3623e112cf3ec99fc9b5524220b8.patch";
       sha256 = "sha256-uLXL0Sjcn+bnMuF+A6PjUW1Rq6uNg1dQl58zbeYpP/U=";
     })
+
+    # meson: allow disabling tests
+    (fetchpatch {
+      url = "https://github.com/dgibson/dtc/commit/35f26d2921b68d97fefbd5a2b6e821a2f02ff65d.patch";
+      sha256 = "sha256-cO4f/jJX/pQL7kk4jpKUhsCVESW2ZuWaTr7z3BuvVkw=";
+    })
   ];
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -77,6 +83,7 @@ stdenv.mkDerivation rec {
   mesonAutoFeatures = "auto";
   mesonFlags = [
     (lib.mesonBool "static-build" stdenv.hostPlatform.isStatic)
+    (lib.mesonBool "tests" doCheck)
   ];
 
   postFixup = lib.optionalString stdenv.isDarwin ''

From 54216d1f5a51d00dd18c4a2817d008f27657d54d Mon Sep 17 00:00:00 2001
From: Otavio Salvador <otavio@ossystems.com.br>
Date: Thu, 1 Jun 2023 12:15:47 -0300
Subject: [PATCH 084/102] dtc: remove postFixup as meson installs the dylib
 properly

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
---
 pkgs/development/compilers/dtc/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index 04c56d0d4253..44d98d8e36bd 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -86,10 +86,6 @@ stdenv.mkDerivation rec {
     (lib.mesonBool "tests" doCheck)
   ];
 
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -id $out/lib/libfdt.dylib $out/lib/libfdt-${version}.dylib
-  '';
-
   # Checks are broken on aarch64 darwin
   # https://github.com/NixOS/nixpkgs/pull/118700#issuecomment-885892436
   doCheck = !stdenv.isDarwin;

From 84fb288f46faa746b0718060f396a875529eae14 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 1 Jun 2023 13:13:30 +0200
Subject: [PATCH 085/102] cups: fix nixos test references

The tests were split up in two, but the references were not updated.
---
 pkgs/misc/cups/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index d9f136f81389..f1ffb1f8e149 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -134,7 +134,12 @@ stdenv.mkDerivation rec {
         --replace "Exec=htmlview" "Exec=xdg-open"
     '';
 
-  passthru.tests.nixos = nixosTests.printing;
+  passthru.tests = {
+    inherit (nixosTests)
+      printing-service
+      printing-socket
+    ;
+  };
 
   meta = with lib; {
     homepage = "https://openprinting.github.io/cups/";

From 2ca22f6b823eb38c8e182e5bae39d40ebbe87c59 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 2 Jun 2023 02:05:30 +0200
Subject: [PATCH 086/102] cups: 2.4.2 -> 2.4.3

Resolves a heap buffer overflow in the log formatter, when the log level
is set to DEBUG.

https://github.com/OpenPrinting/cups/releases/tag/v2.4.3

Fixes: CVE-2023-32234
---
 pkgs/misc/cups/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index f1ffb1f8e149..abff4d817975 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cups";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchurl {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "sha256-8DzLQLCH0eMJQKQOAUHcu6Jj85l0wg658lIQZsnGyQg=";
+    sha256 = "sha256-nd65jyDpyfSvEhwrEFPnQgt5vWdw8a3tKGYwPSdSb28=";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];

From 2a5125b4f725c06899a3234b47a4b4a90d64b9f8 Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Wed, 31 May 2023 11:31:25 -0400
Subject: [PATCH 087/102] llvmPackages_16: 16.0.1 -> 16.0.5

---
 pkgs/development/compilers/llvm/16/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 1304ef2bdbc0..392dd7535868 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -25,7 +25,7 @@
   #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
   #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
   # }
-, officialRelease ? { version = "16.0.1"; sha256 = "sha256-Vr978ZY0i0NkdE/uuwcTccshfAT61KIN6KNq0TdwBNE="; }
+, officialRelease ? { version = "16.0.5"; sha256 = "sha256-JwL9EeKNhqnI1qD2mPZne3fM7xm6cWVDpiB9Ugc2CA4="; }
   # i.e.:
   # {
   #   version = /* i.e. "15.0.0" */;

From cc3ee6d82b575a5f105124498ebf01abcdf98604 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 2 Jun 2023 21:24:54 +0200
Subject: [PATCH 088/102] Revert #230601: "gnu-efi: 3.0.15 -> 3.0.17"

This reverts commit 6efc3981aab2b94545beef6e17a467bedfe748cf.
https://github.com/NixOS/nixpkgs/pull/230601#issuecomment-1567081935
https://github.com/NixOS/nixpkgs/pull/234796#issuecomment-1574199486
---
 pkgs/development/libraries/gnu-efi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 340bc7d7dcd8..380905f31336 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnu-efi";
-  version = "3.0.17";
+  version = "3.0.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnu-efi/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-eAfpAzSTQ6ehQuu5NHA6KHIjXolojPWGwDKwoQh7yvQ=";
+    sha256 = "sha256-kxole5xcG6Zf9Rnxg3PEOKJoJfLbeGaxY+ltGxaPIOo=";
   };
 
   patches = [

From 6bd9402c5ff2e6450689666e5fd6ae8c8ef3c70a Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Sat, 3 Jun 2023 01:35:10 +0200
Subject: [PATCH 089/102] cups: fix build on darwin

---
 pkgs/misc/cups/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index abff4d817975..44e46355d0bf 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchurl
-, fetchpatch
 , pkg-config
 , removeReferencesTo
 , zlib
@@ -41,6 +40,9 @@ stdenv.mkDerivation rec {
       # service would stop the socket and break subsequent socket activations.
       # See https://github.com/apple/cups/issues/6005
       sed -i '/PartOf=cups.service/d' scheduler/cups.socket.in
+  '' + lib.optionalString (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "12") ''
+    substituteInPlace backend/usb-darwin.c \
+      --replace "kIOMainPortDefault" "kIOMasterPortDefault"
   '';
 
   nativeBuildInputs = [ pkg-config removeReferencesTo ];

From 9ea7d9a4ce244f36598cbe83270a37c05818a1a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sat, 3 Jun 2023 10:03:07 +0200
Subject: [PATCH 090/102] Revert Merge #234128: gnu-efi: patch to fix build for
 riscv64

This reverts commit 4d743b102ab49469214a9570787ff8d373428116, reversing
changes made to f48f2c81b7eaba4df6ea1d6eb4494a94854bdc45.

After reverting the update in cc3ee6d82b5 this won't apply
and it's probably not needed.
---
 .../development/libraries/gnu-efi/default.nix | 21 +++----------------
 1 file changed, 3 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 380905f31336..1bdd6890ab21 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -1,11 +1,5 @@
-{ lib
-, stdenv
-, buildPackages
-, fetchurl
-, fetchpatch
-, pciutils
-, gitUpdater
-}:
+{ lib, stdenv, buildPackages, fetchurl, pciutils
+, gitUpdater }:
 
 stdenv.mkDerivation rec {
   pname = "gnu-efi";
@@ -16,15 +10,6 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-kxole5xcG6Zf9Rnxg3PEOKJoJfLbeGaxY+ltGxaPIOo=";
   };
 
-  patches = [
-    # riscv64: fix efibind.h missing/duplicate types
-    # https://sourceforge.net/p/gnu-efi/patches/88
-    (fetchpatch {
-      url = "https://sourceforge.net/p/gnu-efi/patches/88/attachment/riscv64-fix-efibind.h-missing-duplicate-types.patch";
-      hash = "sha256-fUAxj1/U9J2A1zMEdnh62+WnVmQ9hrrYwMFppBz1Y1g=";
-    })
-  ];
-
   buildInputs = [ pciutils ];
 
   hardeningDisable = [ "stackprotector" ];
@@ -45,6 +30,6 @@ stdenv.mkDerivation rec {
     homepage = "https://sourceforge.net/projects/gnu-efi/";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nickcao ];
+    maintainers = with maintainers; [ ];
   };
 }

From 46f30a032e1d83c552e1d50356f0ff4ff596e285 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 4 Jun 2023 16:20:58 +0200
Subject: [PATCH 091/102] libvlc: fix build by providing openssl

I don't know why or when this started exactly;
possibly with libssh2 update merged in 95884fec777.
Feel free to investigate and improve.
---
 pkgs/applications/video/vlc/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index fd263557d48a..c8f3a8b0954f 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -54,6 +54,7 @@
 , lua5
 , mpeg2dec
 , ncurses
+, openssl
 , perl
 , pkg-config
 , removeReferencesTo
@@ -158,6 +159,7 @@ stdenv.mkDerivation rec {
     libXvMC
     xcbutilkeysyms
   ])
+  ++ optional onlyLibVLC openssl # not sure why
   ++ optional (!stdenv.hostPlatform.isAarch && !onlyLibVLC) live555
   ++ optional jackSupport libjack2
   ++ optionals chromecastSupport [ libmicrodns protobuf ]

From 7da24051923f23ebe22ea176a7b826b07bd77eef Mon Sep 17 00:00:00 2001
From: Florian <florian.brandes@posteo.de>
Date: Sun, 4 Jun 2023 17:03:00 +0200
Subject: [PATCH 092/102] python3Packages.apsw: 3.41.0 -> 3.42.0 (#233027)

---
 pkgs/development/python-modules/apsw/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/apsw/default.nix b/pkgs/development/python-modules/apsw/default.nix
index 4da1eea51c22..5964274881c6 100644
--- a/pkgs/development/python-modules/apsw/default.nix
+++ b/pkgs/development/python-modules/apsw/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.41.0.0";
+  version = "3.42.0.0";
   format = "setuptools";
 
   disabled = isPyPy;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "rogerbinns";
     repo = "apsw";
     rev = "refs/tags/${version}";
-    hash = "sha256-U7NhC83wBaUONLsQbL+j9866u4zs58O6AQxwzS3e0qM=";
+    hash = "sha256-pLkYTyf2BGRLs4bChb+eo2i5gRRUUJDFyfCBTSJ1RkQ=";
   };
 
   buildInputs = [

From 1dbc3047591787a4b8cd4001124ee0a3389d77d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 4 Jun 2023 20:46:53 +0200
Subject: [PATCH 093/102] google-cloud-cpp: extend .meta.platforms

The default is x86_64-linux only, but we build many packages
for aarch64-linux on Hydra that depend on this (possibly indirectly),
and it can be cumbersome when a dependency doesn't have its own job.
---
 pkgs/development/libraries/google-cloud-cpp/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 1e5271d47709..e7445bd53e1a 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -126,6 +126,7 @@ stdenv.mkDerivation rec {
     license = with licenses; [ asl20 ];
     homepage = "https://github.com/googleapis/google-cloud-cpp";
     description = "C++ Idiomatic Clients for Google Cloud Platform services";
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ cpcloud ];
   };
 }

From efd6f2ac3085883b07b539227180550fc2456838 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 4 Jun 2023 20:49:10 +0200
Subject: [PATCH 094/102] google-cloud-cpp: downgrade a warning on
 aarch64-linux

I don't know why it started now, but it only happens in tests,
and generally -Werror is more suitable for upstreams than downstreams.
---
 pkgs/development/libraries/google-cloud-cpp/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index e7445bd53e1a..1be64b11d991 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -68,6 +68,9 @@ stdenv.mkDerivation rec {
     protobuf
   ];
 
+  # https://hydra.nixos.org/build/222679737/nixlog/3/tail
+  NIX_CFLAGS_COMPILE = if stdenv.isAarch64 then "-Wno-error=maybe-uninitialized" else null;
+
   doInstallCheck = true;
 
   preInstallCheck =

From add8dd840205aa9539d37591829eff3b48dd1359 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 4 Jun 2023 20:52:13 +0200
Subject: [PATCH 095/102] google-cloud-cpp: schedule on big-parallel machines

Otherwise it often takes 1-2 hours on Hydra, which seems unnecessary.
---
 pkgs/development/libraries/google-cloud-cpp/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 1be64b11d991..ea27c372b66f 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -130,6 +130,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/googleapis/google-cloud-cpp";
     description = "C++ Idiomatic Clients for Google Cloud Platform services";
     platforms = [ "x86_64-linux" "aarch64-linux" ];
+    requiredSystemFeatures = [ "big-parallel" ];
     maintainers = with maintainers; [ cpcloud ];
   };
 }

From 07310e59a62ae8e5b7e15580e06e085cd9ea0a70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 4 Jun 2023 21:47:55 +0200
Subject: [PATCH 096/102] Revert "google-cloud-cpp: schedule on big-parallel
 machines"

This reverts commit add8dd840205aa9539d37591829eff3b48dd1359.
This attribute doesn't belong into meta and has no effect there.
---
 pkgs/development/libraries/google-cloud-cpp/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index ea27c372b66f..1be64b11d991 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -130,7 +130,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/googleapis/google-cloud-cpp";
     description = "C++ Idiomatic Clients for Google Cloud Platform services";
     platforms = [ "x86_64-linux" "aarch64-linux" ];
-    requiredSystemFeatures = [ "big-parallel" ];
     maintainers = with maintainers; [ cpcloud ];
   };
 }

From 7789efcfd34c29d217e1a29dbe715de6ef1e3093 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 5 Jun 2023 06:30:56 +0200
Subject: [PATCH 097/102] Revert "Merge #235219: llvmPackages_16: 16.0.1 ->
 16.0.5"

This reverts commit c8d485b29b4c7dca5fd5bbc96ad073343a13626a, reversing
changes made to 4a640f8bb68caa0c33eb671c16ed189573c717a3.

llvm_16 won't even apply patches successfully, so backing out for now.
---
 pkgs/development/compilers/llvm/16/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 392dd7535868..1304ef2bdbc0 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -25,7 +25,7 @@
   #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
   #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
   # }
-, officialRelease ? { version = "16.0.5"; sha256 = "sha256-JwL9EeKNhqnI1qD2mPZne3fM7xm6cWVDpiB9Ugc2CA4="; }
+, officialRelease ? { version = "16.0.1"; sha256 = "sha256-Vr978ZY0i0NkdE/uuwcTccshfAT61KIN6KNq0TdwBNE="; }
   # i.e.:
   # {
   #   version = /* i.e. "15.0.0" */;

From a49f2aa0450a6681ef6aaf4fc62562d475103513 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 5 Jun 2023 09:33:19 +0300
Subject: [PATCH 098/102] python310Packages.imageio: unbreak on darwin

---
 pkgs/development/python-modules/imageio/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/imageio/default.nix b/pkgs/development/python-modules/imageio/default.nix
index d919c00e74a6..6989a12bf865 100644
--- a/pkgs/development/python-modules/imageio/default.nix
+++ b/pkgs/development/python-modules/imageio/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     hash = "sha256-XbUIe+XIFOz34sfTChoVyX7Kl9jCbzHdxU12fUpDvOg=";
   };
 
-  patches = [
+  patches = lib.optionals (!stdenv.isDarwin) [
     (substituteAll {
       src = ./libgl-path.patch;
       libgl = "${libGL.out}/lib/libGL${stdenv.hostPlatform.extensions.sharedLibrary}";

From f3e5af3683d16e1fc1ae928f0a41f333f2e64f68 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 5 Jun 2023 11:09:19 +0300
Subject: [PATCH 099/102] alacritty: unbreak on darwin

---
 pkgs/applications/terminal-emulators/alacritty/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index dcddc2f5e187..9f20a2d0576e 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -35,6 +35,7 @@ let
     expat
     fontconfig
     freetype
+  ] ++ lib.optionals stdenv.isLinux [
     libGL
     xorg.libX11
     xorg.libXcursor
@@ -42,7 +43,6 @@ let
     xorg.libXrandr
     xorg.libXxf86vm
     xorg.libxcb
-  ] ++ lib.optionals stdenv.isLinux [
     libxkbcommon
     wayland
   ];

From 522463b4f22f04ee870cff8b8eb1c80b0ae3b6a9 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 5 Jun 2023 12:09:18 +0300
Subject: [PATCH 100/102] python310Packages.pyopengl: unbreak on darwin

---
 pkgs/development/python-modules/pyopengl/default.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index ecc0e307e7f3..94b5d38d3fc8 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -18,17 +18,14 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ pillow ];
 
   patchPhase = let
-    ext = stdenv.hostPlatform.extensions.sharedLibrary; in ''
+    ext = stdenv.hostPlatform.extensions.sharedLibrary; in lib.optionalString (!stdenv.isDarwin) ''
     # Theses lines are patching the name of dynamic libraries
     # so pyopengl can find them at runtime.
     substituteInPlace OpenGL/platform/glx.py \
       --replace "'GL'" "'${pkgs.libGL}/lib/libGL${ext}'" \
       --replace "'GLU'" "'${pkgs.libGLU}/lib/libGLU${ext}'" \
       --replace "'glut'" "'${pkgs.freeglut}/lib/libglut${ext}'"
-    substituteInPlace OpenGL/platform/darwin.py \
-      --replace "'OpenGL'" "'${pkgs.libGL}/lib/libGL${ext}'" \
-      --replace "'GLUT'" "'${pkgs.freeglut}/lib/libglut${ext}'"
-
+  '' + ''
     # https://github.com/NixOS/nixpkgs/issues/76822
     # pyopengl introduced a new "robust" way of loading libraries in 3.1.4.
     # The later patch of the filepath does not work anymore because

From fe6850b67cbe820997532fa2021e323d04740b3d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 5 Jun 2023 13:32:20 +0200
Subject: [PATCH 101/102] Revert "binaryen: 112 -> 113" (part of PR #229718)

This reverts commit 8392a8baa91cb35716b0b37d74542b8b44afbaf0.
It's needed for emscripten revert; see the next commit.
---
 pkgs/development/compilers/binaryen/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 11716893e0f7..73f32af28e19 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "binaryen";
-  version = "113";
+  version = "112";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "binaryen";
     rev = "version_${version}";
-    hash = "sha256-w93LIlLRn3PmVNytjFg6KI4CQ9zQUUM9kySiWAtPbOA=";
+    hash = "sha256-xVumVmiLMHJp3SItE8eL8OBPeq58HtOOiK9LL8SP4CQ=";
   };
 
   nativeBuildInputs = [ cmake python3 ];

From ba9cb93813ec9e912f6f1ba9b13eddbabe476299 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 5 Jun 2023 13:23:50 +0200
Subject: [PATCH 102/102] Revert "emscripten: 3.1.24 -> 3.1.39" (part of PR
 #229718)

This reverts commit 39d29247694680d7ca362026b3d6b760bd284a5e.
Now it will at least fetch sources FIXME correctly and build on *-linux.
---
 ...-emulate-clang-sysroot-include-logic.patch | 14 ++++----
 .../compilers/emscripten/default.nix          | 33 +++++++++++--------
 pkgs/top-level/all-packages.nix               |  2 +-
 3 files changed, 28 insertions(+), 21 deletions(-)

diff --git a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
index 6a57e423bd72..9cb3ca2bf9f6 100644
--- a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
+++ b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
@@ -1,4 +1,4 @@
-From 4bbbb640934aa653bcfec0335798b77a8935b815 Mon Sep 17 00:00:00 2001
+From 67f54fde2b1683aae3800f7a86a4e507c1125be8 Mon Sep 17 00:00:00 2001
 From: Yureka <yuka@yuka.dev>
 Date: Sat, 7 Aug 2021 09:16:46 +0200
 Subject: [PATCH] emulate clang 'sysroot + /include' logic
@@ -20,23 +20,23 @@ but it doesn't appear to work
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/emcc.py b/emcc.py
-index ba8d1b556..7d89644c5 100755
+index 999314afc..0e23c066c 100755
 --- a/emcc.py
 +++ b/emcc.py
-@@ -883,7 +883,12 @@ def parse_s_args(args):
+@@ -759,7 +759,12 @@ def emsdk_ldflags(user_args):
  
  
  def emsdk_cflags(user_args):
--  cflags = ['--sysroot=' + cache.get_sysroot(absolute=True)]
+-  cflags = ['--sysroot=' + shared.Cache.get_sysroot(absolute=True)]
 +  cflags = [
-+    '--sysroot=' + cache.get_sysroot(absolute=True),
++    '--sysroot=' + shared.Cache.get_sysroot(absolute=True),
 +    '-resource-dir=@resourceDir@',
-+    '-idirafter' + cache.get_sysroot(absolute=True) + os.path.join('/include'),
++    '-idirafter' + shared.Cache.get_sysroot(absolute=True) + os.path.join('/include'),
 +    '-iwithsysroot' + os.path.join('/include','c++','v1')
 +  ]
  
    def array_contains_any_of(hay, needles):
      for n in needles:
 -- 
-2.40.0
+2.32.0
 
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 52aa8ff8fb73..02b1f6f03b2a 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "emscripten";
-  version = "3.1.39";
+  version = "3.1.24";
 
   llvmEnv = symlinkJoin {
     name = "emscripten-llvm-${version}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     name = "emscripten-node-modules-${version}";
     inherit pname version src;
 
-    npmDepsHash = "sha256-NSpVXssXwx+94E1qhM3tt2fN2G0EuvPZSN+Xep2IRs8=";
+    npmDepsHash = "sha256-ejuHR2BpAUStWjuvQuGE6ko4byF4GBl6FJBshxlknQk=";
 
     dontBuild = true;
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "emscripten-core";
     repo = "emscripten";
-    sha256 = "sha256-hgndNMx+hvXyLzn6ip8Fhs+LAw98P3cqL8dJ+92jJmU=";
+    sha256 = "sha256-1jW6ThxK6dThOO90l4Mc5yehVF3tI4HWipBWZAOztrk=";
     rev = version;
   };
 
@@ -42,7 +42,17 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./0001-emulate-clang-sysroot-include-logic.patch;
-      resourceDir = "${llvmEnv}/lib/clang/16/";
+      resourceDir = "${llvmEnv}/lib/clang/${llvmPackages.release_version}/";
+    })
+    # https://github.com/emscripten-core/emscripten/pull/18219
+    (fetchpatch {
+      url = "https://github.com/emscripten-core/emscripten/commit/afbc14950f021513c59cbeaced8807ef8253530a.patch";
+      sha256 = "sha256-+gJNTQJng9rWcGN3GAcMBB0YopKPnRp/r8CN9RSTClU=";
+    })
+    # https://github.com/emscripten-core/emscripten/pull/18220
+    (fetchpatch {
+      url = "https://github.com/emscripten-core/emscripten/commit/852982318f9fb692ba1dd1173f62e1eb21ae61ca.patch";
+      sha256 = "sha256-hmIOtpRx3PD3sDAahUcreSydydqcdSqArYvyLGgUgd8=";
     })
   ];
 
@@ -98,20 +108,17 @@ stdenv.mkDerivation rec {
 
     # precompile libc (etc.) in all variants:
     pushd $TMPDIR
-    echo 'int __main_argc_argv( int a, int b ) { return 42; }' >test.c
+    echo 'int __main_argc_argv() { return 42; }' >test.c
     for LTO in -flto ""; do
       # wasm2c doesn't work with PIC
       $out/bin/emcc -s WASM2C -s STANDALONE_WASM $LTO test.c
 
       for BIND in "" "--bind"; do
-        # starting with emscripten 3.1.32+,
-        # if pthreads and relocatable are both used,
-        # _emscripten_thread_exit_joinable must be exported
-        # (see https://github.com/emscripten-core/emscripten/pull/18376)
-        # TODO: get library cache to build with both enabled and function exported
-        $out/bin/emcc $LTO $BIND test.c
-        $out/bin/emcc $LTO $BIND -s RELOCATABLE test.c
-        $out/bin/emcc $LTO $BIND -s USE_PTHREADS test.c
+        for MT in "" "-s USE_PTHREADS"; do
+          for RELOCATABLE in "" "-s RELOCATABLE"; do
+            $out/bin/emcc $RELOCATABLE $BIND $MT $LTO test.c
+          done
+        done
       done
     done
     popd
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d3dbcac60bcb..23650035f060 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7326,7 +7326,7 @@ with pkgs;
   easeprobe = callPackage ../tools/misc/easeprobe { };
 
   emscripten = callPackage ../development/compilers/emscripten {
-    llvmPackages = llvmPackages_16;
+    llvmPackages = llvmPackages_14;
   };
 
   emscriptenPackages = recurseIntoAttrs (callPackage ./emscripten-packages.nix { });