staging-next 2025-03-03 (#386822)

2025-03-11 18:52:14 +01:00
parent 5a59e705cc cc157d6c94
commit 0d534853a5
211 changed files with 1656 additions and 5076 deletions
@@ -58,15 +58,12 @@ let

  configPackages = cfg.configPackages;

-  extraConfigPkg =
-    extraConfigPkgFromFiles [ "pipewire" "client" "client-rt" "jack" "pipewire-pulse" ]
-      (
-        mapToFiles "pipewire" cfg.extraConfig.pipewire
-        // mapToFiles "client" cfg.extraConfig.client
-        // mapToFiles "client-rt" cfg.extraConfig.client-rt
-        // mapToFiles "jack" cfg.extraConfig.jack
-        // mapToFiles "pipewire-pulse" cfg.extraConfig.pipewire-pulse
-      );
+  extraConfigPkg = extraConfigPkgFromFiles [ "pipewire" "client" "jack" "pipewire-pulse" ] (
+    mapToFiles "pipewire" cfg.extraConfig.pipewire
+    // mapToFiles "client" cfg.extraConfig.client
+    // mapToFiles "jack" cfg.extraConfig.jack
+    // mapToFiles "pipewire-pulse" cfg.extraConfig.pipewire-pulse
+  );

  configs = pkgs.buildEnv {
    name = "pipewire-configs";
@@ -205,27 +202,6 @@ in
            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-client
          '';
        };
-        client-rt = mkOption {
-          type = attrsOf json.type;
-          default = { };
-          example = {
-            "10-alsa-linear-volume" = {
-              "alsa.properties" = {
-                "alsa.volume-method" = "linear";
-              };
-            };
-          };
-          description = ''
-            Additional configuration for the PipeWire client library, used by real-time applications and legacy ALSA clients.
-
-            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/client-rt.conf.d`.
-
-            See the [PipeWire wiki][wiki] for examples of general configuration, and [PipeWire wiki - ALSA][wiki-alsa] for ALSA clients.
-
-            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-client
-            [wiki-alsa]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-ALSA
-          '';
-        };
        jack = mkOption {
          type = attrsOf json.type;
          default = { };
@@ -341,6 +317,10 @@ in
      pipewire-media-session is no longer supported upstream and has been removed.
      Please switch to `services.pipewire.wireplumber` instead.
    '')
+    (mkRemovedOptionModule [ "services" "pipewire" "extraConfig" "client-rt" ] ''
+      `services.pipewire.extraConfig.client-rt` is no longer applicable, as `client-rt.conf` has been
+      removed upstream. Please move your customizations to `services.pipewire.extraConfig.client`.
+    '')
  ];

  ###### implementation
@@ -88,6 +88,7 @@ let
      "sys-fs-fuse-connections.mount"
      ] ++ (optional (!config.boot.isContainer) "sys-kernel-config.mount") ++ [
      "sys-kernel-debug.mount"
+      "sys-kernel-tracing.mount"

      # Maintaining state across reboots.
      "systemd-random-seed.service"
@@ -1,22 +1,32 @@
-{ pkgs, makeInstalledTest, ... }:
+{
+  lib,
+  pkgs,
+  makeInstalledTest,
+  ...
+}:

 makeInstalledTest {
  tested = pkgs.xdg-desktop-portal;

-  # Red herring
-  # Failed to load RealtimeKit property: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.RealtimeKit1 was not provided by any .service files
-  # Maybe a red herring, enabling PipeWire doesn't fix the location test.
-  # Failed connect to PipeWire: Couldn't connect to PipeWire
  testConfig = {
    environment.variables = {
-      TEST_IN_CI = 1;
-      XDG_DATA_DIRS = "${pkgs.xdg-desktop-portal.installedTests}/share/installed-tests/xdg-desktop-portal/share";
+      GI_TYPELIB_PATH = lib.makeSearchPath "lib/girepository-1.0" [
+        pkgs.glib.out
+        pkgs.umockdev.out
+      ];
+      # need to set this ourselves, because the tests will set LD_PRELOAD=libumockdev-preload.so,
+      # which can't be found because it's not in default rpath
+      LD_PRELOAD = "${pkgs.umockdev.out}/lib/libumockdev-preload.so";
+      XDP_TEST_IN_CI = 1;
    };
-    # Broken, see comment in the package file.
-    #services.geoclue2 = {
-    #  enable = true;
-    #  enableDemoAgent = true;
-    #};
-    #location.provider = "geoclue2";
+    environment.systemPackages = with pkgs; [
+      umockdev
+      wireless-regdb
+    ];
+    services.geoclue2 = {
+      enable = true;
+      enableDemoAgent = true;
+    };
+    location.provider = "geoclue2";
  };
 }
@@ -52,7 +52,7 @@
  soundtouch,
  sratom,
  suil,
-  taglib,
+  taglib_1,
  vamp-plugin-sdk,
  wafHook,
  xjadeo,
@@ -166,7 +166,7 @@ stdenv.mkDerivation rec {
      soundtouch
      sratom
      suil
-      taglib
+      taglib_1
      vamp-plugin-sdk
    ]
    ++ lib.optionals videoSupport [
@@ -11,7 +11,7 @@
  qtbase,
  qtx11extras,
  qttools,
-  taglib,
+  taglib_1,
  fftw,
  glew,
  qjson,
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
      qtx11extras
      qttools
      sqlite
-      taglib
+      taglib_1
      alsa-lib
    ]
    # gst_plugins needed for setup-hooks
@@ -19,7 +19,7 @@
  kxmlgui,
  qtbase,
  phonon,
-  taglib,
+  taglib_1,
  # optional backends
  withCD ? true,
  cdparanoia,
@@ -131,7 +131,7 @@ mkDerivation rec {
    qtbase
    phonon
  ];
-  buildInputs = [ taglib ] ++ runtimeDeps;
+  buildInputs = [ taglib_1 ] ++ runtimeDeps;
  # encoder plugins go to ${out}/lib so they're found by kbuildsycoca5
  cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=$out" ];
  sourceRoot = "${src.name}/src";
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1046";
+  version = "9.1.1122";

  outputs = [
    "out"
@@ -11,7 +11,7 @@ rec {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-bH3p78fWUNQRhluUvqQ5uJ+PxNhz7T7wA/4zxUDH130=";
+    hash = "sha256-Eaxia/FLRCnr8MVDvt+ZUFwIQD5Pqq7SsmWZeQdjuXs=";
  };

  enableParallelBuilding = true;
@@ -445,6 +445,9 @@ let
        ./patches/cross-compile.patch
        # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed):
        ./patches/no-build-timestamps.patch
+        # Fix build with Pipewire 1.4
+        # Submitted upstream: https://webrtc-review.googlesource.com/c/src/+/380500
+        ./patches/webrtc-pipewire-1.4.patch
      ]
      ++ lib.optionals (packageName == "chromium") [
        # This patch is limited to chromium and ungoogled-chromium because electron-source sets
@@ -0,0 +1,20 @@
+--- a/third_party/webrtc/modules/video_capture/linux/pipewire_session.cc
+++ b/third_party/webrtc/modules/video_capture/linux/pipewire_session.cc
+@@ -87,7 +87,7 @@ PipeWireNode::PipeWireNode(PipeWireSession* session,
+       .param = OnNodeParam,
+   };
+ 
+-  pw_node_add_listener(proxy_, &node_listener_, &node_events, this);
+  pw_node_add_listener(reinterpret_cast<pw_node*>(proxy_), &node_listener_, &node_events, this);
+ }
+ 
+ // static
+@@ -119,7 +119,7 @@ void PipeWireNode::OnNodeInfo(void* data, const pw_node_info* info) {
+       uint32_t id = info->params[i].id;
+       if (id == SPA_PARAM_EnumFormat &&
+           info->params[i].flags & SPA_PARAM_INFO_READ) {
+-        pw_node_enum_params(that->proxy_, 0, id, 0, UINT32_MAX, nullptr);
+        pw_node_enum_params(reinterpret_cast<pw_node*>(that->proxy_), 0, id, 0, UINT32_MAX, nullptr);
+         break;
+       }
+     }
@@ -0,0 +1,20 @@
+--- a/src/modules/video_capture/linux/pipewire_session.cc
+++ b/src/modules/video_capture/linux/pipewire_session.cc
+@@ -87,7 +87,7 @@ PipeWireNode::PipeWireNode(PipeWireSession* session,
+       .param = OnNodeParam,
+   };
+ 
+-  pw_node_add_listener(proxy_, &node_listener_, &node_events, this);
+  pw_node_add_listener(reinterpret_cast<pw_node*>(proxy_), &node_listener_, &node_events, this);
+ }
+ 
+ // static
+@@ -119,7 +119,7 @@ void PipeWireNode::OnNodeInfo(void* data, const pw_node_info* info) {
+       uint32_t id = info->params[i].id;
+       if (id == SPA_PARAM_EnumFormat &&
+           info->params[i].flags & SPA_PARAM_INFO_READ) {
+-        pw_node_enum_params(that->proxy_, 0, id, 0, UINT32_MAX, nullptr);
+        pw_node_enum_params(reinterpret_cast<pw_node*>(that->proxy_), 0, id, 0, UINT32_MAX, nullptr);
+         break;
+       }
+     }
@@ -43,6 +43,12 @@ stdenv.mkDerivation {
    fetchSubmodules = true;
  };

+  patches = [
+    # Fix build with Pipewire 1.4
+    # Submitted upstream: https://webrtc-review.googlesource.com/c/src/+/380500
+    ./tg_owt-pipewire-1.4.patch
+  ];
+
  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
    substituteInPlace src/modules/desktop_capture/linux/wayland/egl_dmabuf.cc \
      --replace-fail '"libEGL.so.1"' '"${lib.getLib libGL}/lib/libEGL.so.1"' \
@@ -39,11 +39,11 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.9";
+    version = "6.9.1";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-YpYEKT3yvoFx7IVr9Pi0+qjkMFrxNgfc4PifdBMoNtY=";
+      hash = "sha256-5XdXfumpep+E08NNU8y4uTVCY9arlkR1JQlPPgpWcnA=";
    };

    format = "other";
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchzip
+{ stdenv, lib, fetchFromGitHub, fetchzip, fetchpatch
 , autoconf, automake, libtool, makeWrapper
 , pkg-config, cmake, yasm, python3Packages
 , libxcrypt, libgcrypt, libgpg-error, libunistring
@@ -97,6 +97,15 @@ in stdenv.mkDerivation (finalAttrs: {
      hash  = "sha256-RdTJcq6FPerQx05dU3r8iyaorT4L7162hg5RdywsA88=";
    };

+    patches = [
+      # Backport to fix build with Pipewire 1.4
+      # FIXME: remove in the next update
+      (fetchpatch {
+        url = "https://github.com/xbmc/xbmc/commit/269053ebbfd3cc4a3156a511f54ab7f08a09a730.patch";
+        hash = "sha256-JzzrMJvAufrxTxtWnzknUS9JLJEed+qdtVnIYYe9LCw=";
+      })
+    ];
+
    # make  derivations declared in the let binding available here, so
    # they can be overridden
    inherit libdvdcss libdvdnav libdvdread groovy
@@ -6,7 +6,6 @@
  cmake,
  zlib,
  curl,
-  taglib,
  dbus,
  pkg-config,
  qtbase,
@@ -27,7 +26,6 @@ stdenv.mkDerivation (finalAttrs: {
    qtbase
    zlib
    curl
-    taglib
    dbus
  ];

@@ -70,11 +70,11 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString nixosTestRunner "-for-vm-tests"
    + lib.optionalString toolsOnly "-utils"
    + lib.optionalString userOnly "-user";
-  version = "9.2.0";
+  version = "9.2.2";

  src = fetchurl {
    url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+FnwvGXh9TPQQLvoySvP7O5a8skhpmh8ZS+0TQib2JQ=";
+    hash = "sha256-dS6u63cpI6c9U2sjHgW8wJybH1FpCkGtmXPZAOTsn78=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ]
@@ -198,7 +198,7 @@ def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_
    crate_tree = crate_manifest_path.parent

    eprint(f"Copying to {crate_out_dir}")
-    shutil.copytree(crate_tree, crate_out_dir)
+    shutil.copytree(crate_tree, crate_out_dir, ignore_dangling_symlinks=True)
    crate_out_dir.chmod(0o755)

    with open(crate_manifest_path, "r") as f:
@@ -195,7 +195,7 @@ let
        echo Found crate ${pkg.name} at $crateCargoTOML
        tree=$(dirname $crateCargoTOML)

-        cp -prvL "$tree/" $out
+        ${python3Packages.python.interpreter} -c 'import sys, shutil; shutil.copytree(sys.argv[1], sys.argv[2], ignore_dangling_symlinks=True)' "$tree" "$out"
        chmod u+w $out

        if grep -q workspace "$out/Cargo.toml"; then
@@ -1,7 +1,5 @@
 let
-  # This can be made unconditional once jq is available in the bootstrap tools. If corecrypto is  not removed from
-  # the umbrella framework, linking will fail in stage 1 because it can’t find the tbd.
-  disallowedPackages' = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
+  disallowedPackages = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
 in

 {
@@ -10,13 +8,6 @@ in
  stdenv,
 }:

-let
-  disallowedPackages =
-    if jq == null then
-      lib.filter (p: p.package != "corecrypto") disallowedPackages'
-    else
-      disallowedPackages';
-in
 self: super: {
  # Remove headers and stubs for packages that are available in nixpkgs.
  buildPhase =
@@ -390,18 +390,6 @@
  },
  {
    "package": "openldap",
-    "headers": [
-      "lber.h",
-      "lber_types.h",
-      "ldap.h",
-      "ldap_cdefs.h",
-      "ldap_features.h",
-      "ldap_schema.h",
-      "ldap_utf8.h",
-      "ldif.h",
-      "openldap.h",
-      "slapi-plugin.h"
-    ],
    "libraries": [
      "liblber.*",
      "liblber_r.*",
@@ -36,12 +36,8 @@ let
      (callPackage ./common/passthru-private-frameworks.nix { inherit sdkVersion; })
      (callPackage ./common/passthru-source-release-files.nix { inherit sdkVersion; })
      (callPackage ./common/remove-disallowed-packages.nix { })
+      (callPackage ./common/process-stubs.nix { })
    ]
-    # Only process stubs and convert them to tbd-v4 if jq is available. This can be made unconditional once
-    # the bootstrap tools have jq and llvm-readtapi.
-    ++ lib.optional (jq != null && lib.getName llvm != "bootstrap-stage0-llvm") (
-      callPackage ./common/process-stubs.nix { }
-    )
    # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
    ++ lib.optionals (!enableBootstrap) [
      (callPackage ./common/propagate-inputs.nix { })
@@ -1,7 +1,7 @@
 {
  lib,
-  python3,
-  fetchPypi,
+  python3Packages,
+  fetchFromGitHub,
  groff,
  less,
  nix-update-script,
@@ -10,36 +10,38 @@
 }:

 let
-  self = python3.pkgs.buildPythonApplication rec {
+  self = python3Packages.buildPythonApplication rec {
    pname = "awscli";
    # N.B: if you change this, change botocore and boto3 to a matching version too
    # check e.g. https://github.com/aws/aws-cli/blob/1.33.21/setup.py
-    version = "1.36.40";
+    version = "1.37.21";
    pyproject = true;

-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-4qiPiNwW1cDyY3mv1vJUCX5T6LNMghZOWfQWXbbubfo=";
+    src = fetchFromGitHub {
+      owner = "aws";
+      repo = "aws-cli";
+      tag = version;
+      hash = "sha256-gKRWhOhZjGhPVIG6KgCyDqxuyBGbaS8bHD7vnJ4gA+o=";
    };

    pythonRelaxDeps = [
      # botocore must not be relaxed
-      "colorama"
      "docutils"
      "rsa"
    ];

-    build-system = [
-      python3.pkgs.setuptools
+    build-system = with python3Packages; [
+      setuptools
    ];

-    dependencies = with python3.pkgs; [
+    dependencies = with python3Packages; [
      botocore
-      s3transfer
-      colorama
      docutils
-      rsa
+      s3transfer
      pyyaml
+      colorama
+      rsa
+
      groff
      less
    ];
@@ -59,14 +61,14 @@ let
    installCheckPhase = ''
      runHook preInstallCheck

-      $out/bin/aws --version | grep "${python3.pkgs.botocore.version}"
+      $out/bin/aws --version | grep "${python3Packages.botocore.version}"
      $out/bin/aws --version | grep "${version}"

      runHook postInstallCheck
    '';

    passthru = {
-      python = python3; # for aws_shell
+      python = python3Packages.python; # for aws_shell
      updateScript = nix-update-script {
        extraArgs = [ "--version=skip" ];
      };
@@ -57,6 +57,12 @@ stdenv.mkDerivation rec {
    "--with-asl-lib=-lipoptamplinterface -lamplsolver"
  ];

+  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
+  postConfigure = ''
+    substituteInPlace libtool \
+      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
+  '';
+
  # Fix doc install. Should not be necessary after next release
  # ref https://github.com/coin-or/Bonmin/commit/4f665bc9e489a73cb867472be9aea518976ecd28
  sourceRoot = "${src.name}/Bonmin";
@@ -10,7 +10,9 @@
 , curl
 , jq
 , common-updater-scripts
+, cctools
 , darwin
+, rcodesign
 }:

 stdenvNoCC.mkDerivation rec {
@@ -43,8 +45,9 @@ stdenvNoCC.mkDerivation rec {
  postPhases = [ "postPatchelf"];
  postPatchelf =
    lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
-      wrapProgram $out/bin/bun \
-        --prefix DYLD_LIBRARY_PATH : ${lib.makeLibraryPath [ darwin.ICU ]}
+      '${lib.getExe' cctools "${cctools.targetPrefix}install_name_tool"}' $out/bin/bun \
+        -change /usr/lib/libicucore.A.dylib '${lib.getLib darwin.ICU}/lib/libicucore.A.dylib'
+      '${lib.getExe rcodesign}' sign --code-signature-flags linker-signed $out/bin/bun
    ''
    # We currently cannot generate completions for x86_64-darwin because bun requires avx support to run, which is:
    # 1. Not currently supported by the version of Rosetta on our aarch64 builders
@@ -19,7 +19,7 @@
  libmusicbrainz5,

  withTaglib ? true,
-  taglib,
+  taglib_1,
  taglib_extras,
  withHttpStream ? true,
  withReplaygain ? true,
@@ -139,7 +139,7 @@ let
      ];
      enable = withTaglib;
      pkgs = [
-        taglib
+        taglib_1
        taglib_extras
      ];
    }
@@ -9,12 +9,12 @@

 stdenv.mkDerivation rec {
  pname = "checkpolicy";
-  version = "3.7";
+  version = "3.8";
  inherit (libsepol) se_url;

  src = fetchurl {
    url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
-    sha256 = "sha256-/T4ZJUd9SZRtERaThmGvRMH4bw1oFGb9nwLqoGACoH8=";
+    sha256 = "sha256-ZforqKJR1tQvAwZGcU5eLegHrhbgIx3isDuUCq2636U=";
  };

  nativeBuildInputs = [
@@ -53,14 +53,14 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "curl";
-  version = "8.12.0";
+  version = "8.12.1";

  src = fetchurl {
    urls = [
      "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
      "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
    ];
-    hash = "sha256-mkYox2S+axqZCVZ8E+jncQQWCd9DshWPysTgXqcJfl0=";
+    hash = "sha256-A0Hx7ZeibIEauuvTfWK4M5VnkrdgfqPxXQAWE8dt4gI=";
  };

  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "double-conversion";
-  version = "3.3.0";
+  version = "3.3.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "double-conversion";
    rev = "v${version}";
-    sha256 = "sha256-DkMoHHoHwV4p40IINEqEPzKsCa0LHrJAFw2Yftw7zHo=";
+    sha256 = "sha256-M80H+azCzQYa4/gBLWv5GNNhEuHsH7LbJ/ajwmACnrM=";
  };

  nativeBuildInputs = [ cmake ];
@@ -8,7 +8,7 @@
  glib,
  libid3tag,
  id3lib,
-  taglib,
+  taglib_1,
  libvorbis,
  libogg,
  opusfile,
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    glib
    libid3tag
    id3lib
-    taglib
+    taglib_1
    libvorbis
    libogg
    opusfile
@@ -41,6 +41,13 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    autoreconfHook
  ];
+
+  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
+  postConfigure = ''
+    substituteInPlace libtool \
+      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
+  '';
+
  doCheck = true;
  meta = with lib; {
    description = "Elliptic curve tools";
@@ -106,6 +106,12 @@ stdenv.mkDerivation rec {
    substituteInPlace src/global.cc --replace 'browser="mozilla"' 'browser="xdg-open"'
  '';

+  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
+  postConfigure = ''
+    substituteInPlace libtool \
+      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
+  '';
+
  nativeBuildInputs = [
    autoreconfHook
    texliveSmall
@@ -159,6 +159,12 @@ stdenv.mkDerivation rec {
    "--localstatedir=/var"
  ];

+  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
+  postConfigure = ''
+    substituteInPlace libtool \
+      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
+  '';
+
  nativeBuildInputs = [
    autoconf
    automake
@@ -12,26 +12,31 @@

 stdenv.mkDerivation rec {
  pname = "gnupg-pkcs11-scd";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchurl {
-    url = "https://github.com/alonbl/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Kb8p53gPkhxtOhH2COKwSDwbtRDFr6hHMJAkndV8Ukk=";
+    url = "https://github.com/alonbl/gnupg-pkcs11-scd/releases/download/gnupg-pkcs11-scd-${version}/gnupg-pkcs11-scd-${version}.tar.bz2";
+    hash = "sha256-lUeH5WLys9kpQhLDLdDYGizTesolDmaFAC0ok7uVkIc=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
  buildInputs = [
+    libassuan
+    libgcrypt
+    libgpg-error
    pkcs11helper
    openssl
  ];

  configureFlags = [
-    "--with-libgpg-error-prefix=${libgpg-error.dev}"
-    "--with-libassuan-prefix=${libassuan.dev}"
    "--with-libgcrypt-prefix=${libgcrypt.dev}"
  ];

  meta = with lib; {
+    changelog = "https://github.com/alonbl/gnupg-pkcs11-scd/blob/gnupg-pkcs11-scd-${version}/ChangeLog";
    description = "Smart-card daemon to enable the use of PKCS#11 tokens with GnuPG";
    mainProgram = "gnupg-pkcs11-scd";
    longDescription = ''
@@ -4,7 +4,7 @@
  fetchurl,
  intltool,
  pkg-config,
-  gtk2,
+  gtk3,
  gpgme,
  libgpg-error,
  libassuan,
@@ -12,25 +12,29 @@

 stdenv.mkDerivation rec {
  pname = "gpa";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchurl {
    url = "mirror://gnupg/gpa/gpa-${version}.tar.bz2";
-    sha256 = "1cbpc45f8qbdkd62p12s3q2rdq6fa5xdzwmcwd3xrj55bzkspnwm";
+    hash = "sha256-Jqj6W/cFQct0Hwxxt8/ikbHqVuq2jusHqpYs71zfM8w=";
  };

  nativeBuildInputs = [
    intltool
    pkg-config
  ];
+
  buildInputs = [
-    gtk2
+    gtk3
    gpgme
    libgpg-error
    libassuan
  ];

+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
  meta = with lib; {
+    changelog = "https://dev.gnupg.org/source/gpa/browse/master/NEWS;gpa-${version}?view=raw";
    description = "Graphical user interface for the GnuPG";
    homepage = "https://www.gnupg.org/related_software/gpa/";
    license = licenses.gpl3Plus;
@@ -1,12 +1,13 @@
 {
  lib,
-  buildGoModule,
+  # broken with go 1.24 for some reason
+  buildGo123Module,
  fetchFromGitHub,
  gitMinimal,
  installShellFiles,
 }:

-buildGoModule rec {
+buildGo123Module rec {
  pname = "ko";
  version = "0.15.4";

@@ -15,10 +15,6 @@
 }:

 let
-  # ld64 uses `#embed` to embed `compile_stubs`, which is only implemented in Clang 19.
-  # This can be done unconditionally once the bootstrap tools have been updated.
-  hasEmbed = lib.versionAtLeast (lib.getVersion stdenv.cc) "19";
-
  # Copy the files from their original sources instead of using patches to reduce the size of the patch set in nixpkgs.
  otherSrcs = {
    # The last version of ld64 to have dyldinfo
@@ -55,31 +51,28 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-CVIyL2J9ISZnI4+r+wp4QtOb3+3Tmz2z2Z7/qeRqHS0=";
  };

-  patches =
-    [
-      # These patches are vendored from https://github.com/reckenrode/ld64/tree/ld64-951.9-nixpkgs.
-      # See their comments for more on what they do.
-      ./patches/0001-Always-use-write-instead-of-mmap.patch
-      ./patches/0003-Inline-missing-definitions-instead-of-using-private-.patch
-      ./patches/0004-Removed-unused-Blob-clone-method.patch
-      ./patches/0005-Use-std-atomics-and-std-mutex-for-portability.patch
-      ./patches/0006-Add-Meson-build-system.patch
-      ./patches/0007-Add-CrashReporterClient-header.patch
-      ./patches/0008-Provide-mach-compatibility-headers-based-on-LLVM-s-h.patch
-      ./patches/0009-Support-LTO-in-nixpkgs.patch
-      ./patches/0010-Add-vendored-libtapi-to-the-ld64-build.patch
-      ./patches/0011-Modify-vendored-libtapi-to-build-with-upstream-LLVM.patch
-      ./patches/0012-Move-libcodedirectory-to-its-own-subproject.patch
-      ./patches/0013-Set-the-version-string-in-the-build.patch
-      ./patches/0014-Replace-corecrypto-and-CommonCrypto-with-OpenSSL.patch
-      ./patches/0015-Add-libcd_is_blob_a_linker_signature-implementation.patch
-      ./patches/0016-Add-dyldinfo-to-the-ld64-build.patch
-      ./patches/0017-Fix-dyldinfo-build.patch
-      ./patches/0018-Use-STL-containers-instead-of-LLVM-containers.patch
-    ]
-    ++ lib.optionals (hasEmbed) [
-      ./patches/0002-Add-compile_stubs.h-using-Clang-s-embed-extension-fo.patch
-    ];
+  patches = [
+    # These patches are vendored from https://github.com/reckenrode/ld64/tree/ld64-951.9-nixpkgs.
+    # See their comments for more on what they do.
+    ./patches/0001-Always-use-write-instead-of-mmap.patch
+    ./patches/0002-Add-compile_stubs.h-using-Clang-s-embed-extension-fo.patch
+    ./patches/0003-Inline-missing-definitions-instead-of-using-private-.patch
+    ./patches/0004-Removed-unused-Blob-clone-method.patch
+    ./patches/0005-Use-std-atomics-and-std-mutex-for-portability.patch
+    ./patches/0006-Add-Meson-build-system.patch
+    ./patches/0007-Add-CrashReporterClient-header.patch
+    ./patches/0008-Provide-mach-compatibility-headers-based-on-LLVM-s-h.patch
+    ./patches/0009-Support-LTO-in-nixpkgs.patch
+    ./patches/0010-Add-vendored-libtapi-to-the-ld64-build.patch
+    ./patches/0011-Modify-vendored-libtapi-to-build-with-upstream-LLVM.patch
+    ./patches/0012-Move-libcodedirectory-to-its-own-subproject.patch
+    ./patches/0013-Set-the-version-string-in-the-build.patch
+    ./patches/0014-Replace-corecrypto-and-CommonCrypto-with-OpenSSL.patch
+    ./patches/0015-Add-libcd_is_blob_a_linker_signature-implementation.patch
+    ./patches/0016-Add-dyldinfo-to-the-ld64-build.patch
+    ./patches/0017-Fix-dyldinfo-build.patch
+    ./patches/0018-Use-STL-containers-instead-of-LLVM-containers.patch
+  ];

  prePatch = ''
    # Copy dyldinfo source files
@@ -106,16 +99,6 @@ stdenv.mkDerivation (finalAttrs: {
    done
  '';

-  # Clang 16 doesn’t support C23, but the patchset expects a compiler that supports it. Only `#embed` is used, so stub
-  # out its usage and request an older C standard version. This can be dropped once the bootstrap tools are updated.
-  postPatch = lib.optionalString (!hasEmbed) ''
-    for meson_build in meson.build subprojects/libcodedirectory/meson.build subprojects/libtapi/meson.build; do
-      substituteInPlace $meson_build --replace-fail c23 c2x
-    done
-    echo '#pragma once' > src/ld/compile_stubs.h
-    echo 'static const char compile_stubs[] = "";' >> src/ld/compile_stubs.h
-  '';
-
  xcodeHash = "sha256-qip/1eiGn8PdLThonhPq3oq2veN4E1zOiamDPBfTeNE=";
  xcodeProject = "ld64.xcodeproj";

@@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "libassuan";
-  version = "2.5.7";
+  version = "3.0.2";

  src = fetchurl {
-    url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-AQMIH/wng4ouUEeRU8oQXoc9PWXYqVkygunJTH5q+3Y=";
+    url = "mirror://gnupg/libassuan/libassuan-${version}.tar.bz2";
+    hash = "sha256-0pMc2tJm5jNRD5lw4aLzRgVeNRuxn5t4kSR1uAdMNvY=";
  };

  outputs = [
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
    ignoredVersions = ".*-base";
  };

-  meta = with lib; {
+  meta = {
    description = "IPC library used by GnuPG and related software";
    mainProgram = "libassuan-config";
    longDescription = ''
@@ -60,8 +60,8 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://gnupg.org/software/libassuan/";
    changelog = "https://dev.gnupg.org/source/libassuan/browse/master/NEWS;libassuan-${version}";
-    license = licenses.lgpl2Plus;
-    platforms = platforms.all;
+    license = lib.licenses.lgpl2Plus;
+    platforms = lib.platforms.all;
    maintainers = [ ];
  };
 }
@@ -12,11 +12,14 @@
  makeWrapper,
  removeReferencesTo,
  replaceVars,
-  go,
+  go_1_23,
  applyPatches,
  nvidia-modprobe,
 }:
 let
+  # https://github.com/NVIDIA/libnvidia-container/pull/297
+  go = go_1_23;
+
  modprobeVersion = "550.54.14";
  patchedModprobe = applyPatches {
    src = nvidia-modprobe.src.override {
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  buildPackages,
  pcre2,
  pkg-config,
@@ -19,7 +18,7 @@ assert enablePython -> swig != null && python3 != null;
 stdenv.mkDerivation (
  rec {
    pname = "libselinux";
-    version = "3.7";
+    version = "3.8";
    inherit (libsepol) se_url;

    outputs = [
@@ -31,7 +30,7 @@ stdenv.mkDerivation (

    src = fetchurl {
      url = "${se_url}/${version}/libselinux-${version}.tar.gz";
-      hash = "sha256-6gP0LROk+VdXmX26jPCyYyH6xdLxZEGLTMhWqS0rF70=";
+      hash = "sha256-DDdWvKBHyScCgdfE3N7NAAty44oYPJMGYeupaQg5tUE=";
    };

    patches = [
@@ -45,8 +44,8 @@ stdenv.mkDerivation (
      # This is a static email, so we shouldn't have to worry about
      # normalizing the patch.
      (fetchurl {
-        url = "https://lore.kernel.org/selinux/20211113141616.361640-1-hi@alyssa.is/raw";
-        hash = "sha256-dqxiupaJK4o00YERGWGIEIhM7sPelxBFQomAFKXQQpk=";
+        url = "https://lore.kernel.org/selinux/20250211211651.1297357-3-hi@alyssa.is/raw";
+        hash = "sha256-a0wTSItj5vs8GhIkfD1OPSjGmAJlK1orptSE7T3Hx20=";
        postFetch = ''
          mv "$out" $TMPDIR/patch
          ${buildPackages.patchutils_0_3_3}/bin/filterdiff \
@@ -58,13 +57,6 @@ stdenv.mkDerivation (
        url = "https://git.yoctoproject.org/meta-selinux/plain/recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch?id=62b9c816a5000dc01b28e78213bde26b58cbca9d";
        hash = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
      })
-
-      # libselinux: fix swig bindings for 4.3.0
-      (fetchpatch {
-        url = "https://github.com/SELinuxProject/selinux/commit/8e0e718bae53fff30831b92cd784151d475a20da.patch";
-        stripLen = 1;
-        hash = "sha256-8Nd6ketQ7/r5W0sRdheqyGWHJRZ1RfGC4ehTqnHau04=";
-      })
    ];

    nativeBuildInputs =
@@ -7,7 +7,7 @@
  ffmpeg,
  libebur128,
  libresample,
-  taglib,
+  taglib_1,
  zlib,
 }:

@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    ffmpeg
    libebur128
    libresample
-    taglib
+    taglib_1
    zlib
  ];

@@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "lzip";
-  version = "1.24.1";
+  version = "1.25";
  outputs = [
    "out"
    "man"
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://savannah/lzip/${pname}-${version}.tar.gz";
-    hash = "sha256-MMnLagYF9HnElsN262KaSLChaW0WfjweCQxd76SBsWI=";
+    hash = "sha256-CUGKbY+4P1ET9b2FbglwPfXTe64DCMZo0PNG49PwpW8=";
  };

  patches = lib.optionals stdenv.hostPlatform.isMinGW [
@@ -1,30 +0,0 @@
-diff --git a/mesonbuild/compilers/mixins/clang.py b/mesonbuild/compilers/mixins/clang.py
-index d99dc3abf..6b8f75165 100644
--- a/mesonbuild/compilers/mixins/clang.py
-+++ b/mesonbuild/compilers/mixins/clang.py
-@@ -54,11 +54,7 @@ class ClangCompiler(GnuLikeCompiler):
-             {OptionKey('b_colorout'), OptionKey('b_lto_threads'), OptionKey('b_lto_mode'), OptionKey('b_thinlto_cache'),
-              OptionKey('b_thinlto_cache_dir')})
- 
-        # TODO: this really should be part of the linker base_options, but
-        # linkers don't have base_options.
-        if isinstance(self.linker, AppleDynamicLinker):
-            self.base_options.add(OptionKey('b_bitcode'))
-        elif isinstance(self.linker, MSVCDynamicLinker):
-+        if isinstance(self.linker, MSVCDynamicLinker):
-             self.base_options.add(OptionKey('b_vscrt'))
-         # All Clang backends can also do LLVM IR
-         self.can_compile_suffixes.add('ll')
-diff --git a/mesonbuild/linkers/linkers.py b/mesonbuild/linkers/linkers.py
-index 4eec82edd..6db5c6af0 100644
--- a/mesonbuild/linkers/linkers.py
-+++ b/mesonbuild/linkers/linkers.py
-@@ -796,7 +796,7 @@ class AppleDynamicLinker(PosixDynamicLinkerMixin, DynamicLinker):
-         return self._apply_prefix('-headerpad_max_install_names')
- 
-     def bitcode_args(self) -> T.List[str]:
-        return self._apply_prefix('-bitcode_bundle')
-+        raise MesonException('Nixpkgs cctools does not support bitcode bundles')
- 
-     def fatal_warnings(self) -> T.List[str]:
-         return self._apply_prefix('-fatal_warnings')
@@ -4,11 +4,8 @@
  fetchFromGitHub,
  installShellFiles,
  coreutils,
-  darwin,
  libblocksruntime,
  llvmPackages,
-  libxcrypt,
-  openldap,
  ninja,
  pkg-config,
  python3,
@@ -16,16 +13,6 @@
  zlib,
 }:

-let
-  inherit (darwin.apple_sdk.frameworks)
-    AppKit
-    Cocoa
-    Foundation
-    LDAP
-    OpenAL
-    OpenGL
-    ;
-in
 python3.pkgs.buildPythonApplication rec {
  pname = "meson";
  version = "1.7.0";
@@ -75,17 +62,10 @@ python3.pkgs.buildPythonApplication rec {
    # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
    ./005-boost-Do-not-add-system-paths-on-nix.patch

-    # Nixpkgs cctools does not have bitcode support.
-    ./006-disable-bitcode.patch
-
    # This edge case is explicitly part of meson but is wrong for nix
    ./007-freebsd-pkgconfig-path.patch
  ];

-  buildInputs = lib.optionals (python3.pythonOlder "3.9") [
-    libxcrypt
-  ];
-
  nativeBuildInputs = [ installShellFiles ];

  nativeCheckInputs = [
@@ -97,15 +77,6 @@ python3.pkgs.buildPythonApplication rec {
    [
      zlib
    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
-      Foundation
-      LDAP
-      OpenAL
-      OpenGL
-      openldap
-    ]
    ++ lib.optionals (stdenv.cc.isClang && !stdenv.hostPlatform.isDarwin) [
      # https://github.com/mesonbuild/meson/blob/bd3f1b2e0e70ef16dfa4f441686003212440a09b/test%20cases/common/184%20openmp/meson.build
      llvmPackages.openmp
@@ -4,18 +4,18 @@
  fetchFromGitHub,
 }:

-buildGoModule rec {
+buildGoModule {
  pname = "nilaway";
-  version = "0-unstable-2024-10-10";
+  version = "0-unstable-2025-03-07";

  src = fetchFromGitHub {
    owner = "uber-go";
    repo = "nilaway";
-    rev = "ba14292918d814eeaea4de62da2ad0daae92f8b0";
-    hash = "sha256-HAfuhGxmnMJvkz2vxBZ5kWsgSIw5KKlZp36HCLfCRxo=";
+    rev = "19305c7c699bd0d370acd26d6769df1d7af8fb29";
+    hash = "sha256-99L9dF76vZbh1NdXtKu5Bcnnca94Roybm3q18SDmZAk=";
  };

-  vendorHash = "sha256-5qaEvQoK5S0svqzFAbJb8wy8yApyRpz4QE8sOhcjdaA=";
+  vendorHash = "sha256-pthCLpy5pISKwdmeaJxPq8BxJLUwLwS2/hGMBt6/O4I=";

  subPackages = [ "cmd/nilaway" ];
  excludedPackages = [ "tools" ];
@@ -0,0 +1,13 @@
+diff --git a/pkg/apis/options/load_test.go b/pkg/apis/options/load_test.go
+index 32d52fb8..ef343fd1 100644
+--- a/pkg/apis/options/load_test.go
+++ b/pkg/apis/options/load_test.go
+@@ -470,7 +470,7 @@ func(in loadYAMLTableInput) {
+ 				configFile:     []byte(`stringSliceOption: "a"`),
+ 				input:          &TestOptions{},
+ 				expectedOutput: &TestOptions{},
+-				expectedErr:    errors.New("error unmarshalling config: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string into Go struct field TestOptions.StringSliceOption of type []string"),
+				expectedErr:    errors.New("error unmarshalling config: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string into Go struct field TestOptions.TestOptionSubStruct.StringSliceOption of type []string"),
+ 			}),
+ 			Entry("with a config file containing environment variable references", loadYAMLTableInput{
+ 				configFile: []byte("stringOption: ${TESTUSER}"),
@@ -15,6 +15,10 @@ buildGoModule rec {
    rev = "v${version}";
  };

+  patches = [
+    ./fix-tests-go-1.24.diff
+  ];
+
  vendorHash = "sha256-t/SJjh9bcsIevr3S0ysDlvtaIGzkks+qvfXF5/SEidE=";

  # Taken from https://github.com/oauth2-proxy/oauth2-proxy/blob/master/Makefile
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openh264";
-  version = "2.5.0";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "cisco";
    repo = "openh264";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-K8p94P4XO6bUWCJuT6jR5Kmz3lamNDyclGWgsV6Lf9I=";
+    hash = "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=";
  };

  outputs = [
@@ -26,10 +26,6 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
  ];

-  postPatch = ''
-    substituteInPlace meson.build --replace-fail "'-Werror'," ""
-  '';
-
  nativeBuildInputs = [
    meson
    nasm
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  buildNpmPackage,
  nodejs_20,
  nixosTests,
@@ -35,6 +36,14 @@ let
    hash = "sha256-p3eUEb/ZPK11NbqE4LU+3TE1Xny9sjfYvVVmABkoAEQ=";
  };

+  patches = [
+    # Fix frontend tests in March (yes, it's date dependent)
+    (fetchpatch {
+      url = "https://github.com/paperless-ngx/paperless-ngx/commit/bc90ccc5551f184a683128def772652ad74c65e3.patch";
+      hash = "sha256-KArPyKZLi5LfaTDTY3DxA3cdQYYadpQo052Xk9eH14c=";
+    })
+  ];
+
  # subpath installation is broken with uvicorn >= 0.26
  # https://github.com/NixOS/nixpkgs/issues/298719
  # https://github.com/paperless-ngx/paperless-ngx/issues/5494
@@ -78,7 +87,7 @@ let

  frontend = buildNpmPackage {
    pname = "paperless-ngx-frontend";
-    inherit version src;
+    inherit version src patches;

    nodejs = nodejs_20; # does not build with 22

@@ -134,7 +143,7 @@ python.pkgs.buildPythonApplication rec {
  pname = "paperless-ngx";
  pyproject = false;

-  inherit version src;
+  inherit version src patches;

  postPatch = ''
    # pytest-xdist with to many threads makes the tests flaky
@@ -11,12 +11,12 @@

 stdenv.mkDerivation rec {
  pname = "policycoreutils";
-  version = "3.7";
+  version = "3.8";
  inherit (libsepol) se_url;

  src = fetchurl {
    url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
-    hash = "sha256-WP5OSB7ftEVsEUklRC4ROJ3xc5SSWs26PeIRFFzl6pg=";
+    hash = "sha256-LEMLhmKq+zp1clHp2NYuyqvBwkvisqasbofT+giwTiI=";
  };

  postPatch = ''
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "publicsuffix-list";
-  version = "0-unstable-2025-01-16";
+  version = "0-unstable-2025-02-12";

  src = fetchFromGitHub {
    owner = "publicsuffix";
    repo = "list";
-    rev = "4f2d3b20034a6c7a0ad4400716f1e0f752e2c737";
-    hash = "sha256-1U+CS5ER4b/mI9Ox2gJQfEOVeDHBt1C3UbG5sDAs8Mk=";
+    rev = "560007a8aea8267f15cad9abcdbcff7848186bd8";
+    hash = "sha256-/5O0ac0mJZzOgy8h1NE0dTt0jzAEkymBbh5hJmc1+qk=";
  };

  dontBuild = true;
@@ -7,13 +7,13 @@
 }:

 let
-  version = "1.1.392";
+  version = "1.1.394";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "pyright";
    tag = version;
-    hash = "sha256-/Js9w6wxoJLqJxcRkpdwk2i9bR7jw/dtGkUvwxkv/qA=";
+    hash = "sha256-zOJtv9ETolo3XmH+ztNJEmX319rV/CABDIw2crSxqqw=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@@ -44,7 +44,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-xGEX6Dvhhch0PWjO+LDQqTH3IRRfVbQPMXUjbL/KYpE=";
+    npmDepsHash = "sha256-RE1ZwMKgWu686/ejMB0E1CRix8MLv6lNoEkyAkvOC6U=";
    dontNpmBuild = true;
    installPhase = ''
      runHook preInstall
@@ -58,7 +58,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-TK05a3Ys3Q8s/2c2HOjh1EdnL1jFttjdApggeZLQUzw=";
+  npmDepsHash = "sha256-sQeHXfhm6u0at4vhFjGPwMmTdDomU6cJnolOFO6ynXA=";

  postPatch = ''
    chmod +w ../../
@@ -13,13 +13,13 @@ let
  arch = if stdenv.system == "x86_64-linux" then "x86_64" else "i386";

 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "samsung-unified-linux-driver";
  version = "1.00.36";

  src = fetchurl {
    sha256 = "1a7ngd03x0bkdl7pszy5zqqic0plxvdxqm5w7klr6hbdskx1lir9";
-    url = "http://www.bchemnet.com/suldr/driver/UnifiedLinuxDriver-${version}.tar.gz";
+    url = "http://www.bchemnet.com/suldr/driver/UnifiedLinuxDriver-${finalAttrs.version}.tar.gz";
  };

  buildInputs = [
@@ -112,16 +112,16 @@ stdenv.mkDerivation rec {
  # we did this in prefixup already
  dontPatchELF = true;

-  meta = with lib; {
+  meta = {
    description = "Unified Linux Driver for Samsung printers and scanners";
    homepage = "http://www.bchemnet.com/suldr";
    downloadPage = "http://www.bchemnet.com/suldr/driver/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;

    # Tested on linux-x86_64. Might work on linux-i386.
    # Probably won't work on anything else.
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
    maintainers = [ ];
  };
-}
+})
@@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "socat";
-  version = "1.8.0.2";
+  version = "1.8.0.3";

  src = fetchurl {
    url = "http://www.dest-unreach.org/socat/download/${pname}-${version}.tar.bz2";
-    hash = "sha256-rcB6nCcjUnz2Vo0vuWVZeUz5wlSkvC7dNvfzeJ6fdiU=";
+    hash = "sha256-AesBc2HZW7OmlB6EC1nkRjo/q/kt9BVO0CsWou1qAJU=";
  };

  postPatch = ''
@@ -6,19 +6,17 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sphinxygen";
-  version = "1.0.4";
+  version = "1.0.10";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "drobilla";
    repo = "sphinxygen";
-    rev = "v${version}";
-    hash = "sha256-TIACg89E/BaMwPgFqj6JUncq7BI5xQ9jUDe4nQ9YiI4=";
+    tag = "v${version}";
+    hash = "sha256-Xii5pDa1eHrHUKERC2gDif/NIkpab/IZYBRvMq9YKtE=";
  };

-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];

  pythonImportsCheck = [ "sphinxygen" ];

@@ -3,33 +3,33 @@
  stdenv,
  fetchFromGitHub,
  cmake,
+  utf8cpp,
  zlib,
  testers,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "taglib";
-  version = "1.13.1";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "taglib";
    repo = "taglib";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-QX0EpHGT36UsgIfRf5iALnwxe0jjLpZvCTbk8vSMFF4=";
+    hash = "sha256-3cJwCo2nUSRYkk8H8dzyg7UswNPhjfhyQ704Fn9yNV8=";
  };

  strictDeps = true;

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ zlib ];
+  buildInputs = [
+    zlib
+    utf8cpp
+  ];

  cmakeFlags = [
    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
-    # Workaround unconditional ${prefix} until upstream is fixed:
-    #   https://github.com/taglib/taglib/issues/1098
-    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
-    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
  ];

  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  zlib,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "taglib";
+  version = "1.13.1";
+
+  src = fetchFromGitHub {
+    owner = "taglib";
+    repo = "taglib";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-QX0EpHGT36UsgIfRf5iALnwxe0jjLpZvCTbk8vSMFF4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ zlib ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    # Workaround unconditional ${prefix} until upstream is fixed:
+    #   https://github.com/taglib/taglib/issues/1098
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
+  ];
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    homepage = "https://taglib.org/";
+    description = "Library for reading and editing audio file metadata";
+    mainProgram = "taglib-config";
+    longDescription = ''
+      TagLib is a library for reading and editing the meta-data of several
+      popular audio formats. Currently it supports both ID3v1 and ID3v2 for MP3
+      files, Ogg Vorbis comments and ID3 tags and Vorbis comments in FLAC, MPC,
+      Speex, WavPack, TrueAudio, WAV, AIFF, MP4 and ASF files.
+    '';
+    license = with lib.licenses; [
+      lgpl21Only
+      mpl11
+    ];
+    maintainers = with lib.maintainers; [ ttuegel ];
+    pkgConfigModules = [
+      "taglib"
+      "taglib_c"
+    ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchpatch,
  cmake,
  taglib,
  zlib,
@@ -11,9 +12,18 @@ stdenv.mkDerivation rec {
  pname = "taglib-extras";
  version = "1.0.1";
  src = fetchurl {
-    url = "https://ftp.rz.uni-wuerzburg.de/pub/unix/kde/taglib-extras/${version}/src/${pname}-${version}.tar.gz";
+    url = "https://download.kde.org/stable/taglib-extras/${version}/src/taglib-extras-${version}.tar.gz";
    sha256 = "0cln49ws9svvvals5fzxjxlzqm0fzjfymn7yfp4jfcjz655nnm7y";
  };
+
+  patches = [
+    (fetchurl {
+      name = "2001-taglib-extras-Fix-taglib-2.x-compat.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/taglib-2.0.diff?h=taglib-extras&id=5826657b841b138c501e0633d1c9333fe9197b00";
+      hash = "sha256-yhme2KcIS5SPXz+mx/R2OiLV57WHz6WW8LJtYab4h5I=";
+    })
+  ];
+
  buildInputs = [ taglib ];
  nativeBuildInputs = [
    cmake
@@ -49,6 +49,12 @@ buildGoModule {
      url = "https://github.com/tailscale/tailscale/commit/325ca13c4549c1af58273330744d160602218af9.patch";
      hash = "sha256-SMwqZiGNVflhPShlHP+7Gmn0v4b6Gr4VZGIF/oJAY8M=";
    })
+    # Fix build with Go 1.24
+    (fetchpatch {
+      url = "https://github.com/tailscale/tailscale/commit/836c01258de01a38fdd267957eeedab7faf0f4f2.patch";
+      includes = ["cmd/testwrapper/*" "cmd/tsconnect/*"];
+      hash = "sha256-e+IQB2nlJmJCzCTbASiqX2sXKmwVNXb+d87DdwTdJ+I=";
+    })
  ];

  vendorHash = "sha256-81UOjoC5GJqhNs4vWcQ2/B9FMaDWtl0rbuFXmxbu5dI=";
@@ -4,18 +4,18 @@
  fetchFromGitHub,
 }:

-buildGoModule rec {
+buildGoModule {
  pname = "unparam";
-  version = "0-unstable-2024-05-28";
+  version = "0-unstable-2025-03-01";

  src = fetchFromGitHub {
    owner = "mvdan";
    repo = "unparam";
-    rev = "8a5130ca722ffad18c95cc467b561f1668b9b0d2";
-    hash = "sha256-CYCXTriGUd4bNY6ZPfkX4puE1imcqYHnX1SXVdnXPGM=";
+    rev = "0df0534333a487d07b143c1b2c2e0046671d2d63";
+    hash = "sha256-k/BgHvjB3fXz4CWTHRFja/EiGlof/c80jhRb91FaINs=";
  };

-  vendorHash = "sha256-2lNC4V1WQkJdkagIlBu6tj4SA4KJKstHXc+B4emKu6s=";
+  vendorHash = "sha256-Q7q0NZgofxChaSpYL5dS4NDadwfrXlLtkG/F7tGJuhA=";

  subPackages = [ "." ];

@@ -81,7 +81,7 @@
  srt,
  stdenv,
  systemd,
-  taglib,
+  taglib_1,
  unzip,
  wayland,
  wayland-protocols,
@@ -194,7 +194,7 @@ stdenv.mkDerivation (finalAttrs: {
      speex
      srt
      systemd
-      taglib
+      taglib_1
      xcbutilkeysyms
      wayland-scanner # only required for configure script
      zlib
@@ -1,20 +1,21 @@
-{ stdenv
-, lib
-, fetchFromGitLab
-, nasm
-, enableShared ? !stdenv.hostPlatform.isStatic
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  nasm,
+  enableShared ? !stdenv.hostPlatform.isStatic,
 }:

 stdenv.mkDerivation rec {
  pname = "x264";
-  version = "0-unstable-2023-10-01";
+  version = "0-unstable-2025-01-03";

  src = fetchFromGitLab {
    domain = "code.videolan.org";
    owner = "videolan";
    repo = pname;
-    rev = "31e19f92f00c7003fa115047ce50978bc98c3a0d";
-    hash = "sha256-7/FaaDFmoVhg82BIhP3RbFq4iKGNnhviOPxl3/8PWCM=";
+    rev = "373697b467f7cd0af88f1e9e32d4f10540df4687";
+    hash = "sha256-WWtS/UfKA4i1yakHErUnyT/3/+Wy2H5F0U0CmxW4ick=";
  };

  patches = [
@@ -29,18 +30,27 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  outputs = [ "out" "lib" "dev" ];
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];

-  preConfigure = lib.optionalString stdenv.hostPlatform.isx86 ''
-    # `AS' is set to the binutils assembler, but we need nasm
-    unset AS
-  '' + lib.optionalString stdenv.hostPlatform.isAarch ''
-    export AS=$CC
-  '';
+  preConfigure =
+    lib.optionalString stdenv.hostPlatform.isx86 ''
+      # `AS' is set to the binutils assembler, but we need nasm
+      unset AS
+    ''
+    + lib.optionalString stdenv.hostPlatform.isAarch ''
+      export AS=$CC
+    '';

-  configureFlags = lib.optional enableShared "--enable-shared"
+  configureFlags =
+    lib.optional enableShared "--enable-shared"
    ++ lib.optional (!stdenv.hostPlatform.isi686) "--enable-pic"
-    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "--cross-prefix=${stdenv.cc.targetPrefix}";
+    ++ lib.optional (
+      stdenv.buildPlatform != stdenv.hostPlatform
+    ) "--cross-prefix=${stdenv.cc.targetPrefix}";

  makeFlags = [
    "BASHCOMPLETIONSDIR=$(out)/share/bash-completion/completions"
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  autoreconfHook,
  pcre,
  pkg-config,
@@ -21,23 +20,15 @@

 stdenv.mkDerivation rec {
  pname = "yara";
-  version = "4.5.0";
+  version = "4.5.2";

  src = fetchFromGitHub {
    owner = "VirusTotal";
    repo = "yara";
    tag = "v${version}";
-    hash = "sha256-AecHsUBtBleUkWuYMQ4Tx/PY8cs9j7JwqncBziJD0hA=";
+    hash = "sha256-ryRbLXnhC7nAxtlhr4bARxmNdtPhpvGKwlOiYPYPXOE=";
  };

-  patches = [
-    (fetchpatch {
-      name = "LFS64.patch";
-      url = "https://github.com/VirusTotal/yara/commit/833a580430abe0fbc9bc17a21fb95bf36dacf367.patch";
-      hash = "sha256-EmwyDsxaNd9zfpAOu6ZB9kzg04qB7LAD7UJB3eAuKd8=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
@@ -12,7 +12,7 @@
  ffmpeg_6,
  libvlc,
  qt6Packages,
-  taglib,
+  taglib_1,
  SDL2,
  gst_all_1,
 }:
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
      qt6Packages.qtmultimedia
      ffmpeg_6
      libvlc
-      taglib
+      taglib_1
      SDL2
    ]
    ++ (with gst_all_1; [
@@ -11,7 +11,7 @@
  deepin-pdfium,
  qt5integration,
  qt5platform-plugins,
-  taglib,
+  taglib_1,
  ffmpeg,
  ffmpegthumbnailer,
  pcre,
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    deepin-pdfium
    qt5integration
    qt5platform-plugins
-    taglib
+    taglib_1
    ffmpeg
    ffmpegthumbnailer
    pcre
@@ -2,6 +2,7 @@
  stdenv,
  lib,
  fetchFromGitLab,
+  fetchpatch,
  gitUpdater,
  nixosTests,
  testers,
@@ -48,6 +49,14 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  patches = [
+    # Fix compat with taglib 2.x
+    # Remove when version > 3.0.4
+    (fetchpatch {
+      name = "0001-lomiri-thumbnailer-Fix-taglib-2.x-compat.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-thumbnailer/-/commit/b7f1055e36cd6e33314bb9f6648f93e977a33267.patch";
+      hash = "sha256-9RHtxqsgdMkgIyswaeL5yS6+o/YvzT+HgRD8KL/RfNM=";
+    })
+
    # Remove when https://gitlab.com/ubports/development/core/lomiri-thumbnailer/-/merge_requests/23 merged & in release
    ./1001-doc-liblomiri-thumbnailer-qt-Honour-CMAKE_INSTALL_DO.patch
    ./1002-Re-enable-documentation.patch
@@ -52,6 +52,14 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://gitlab.com/ubports/development/core/mediascanner2/-/commit/1e65b32e32a0536b9e2f283ba563fa78b6ef6d61.patch";
      hash = "sha256-Xhm5+/E/pP+mn+4enqdsor1oRqfYTzabg1ODVfIhra4=";
    })
+
+    # Fix taglib 2.x compat
+    # Remove when version > 0.117
+    (fetchpatch {
+      name = "0002-mediascanner2-Fix-taglib-2.x-compat.patch";
+      url = "https://gitlab.com/ubports/development/core/mediascanner2/-/commit/0ce744ecb32abb39516d1b9f98d47c3e86690158.patch";
+      hash = "sha256-hz/EB83yNoxhxkEcg7ZMezknpKajhH1BNkYD3wrf/eY=";
+    })
  ];

  postPatch = ''
@@ -46,6 +46,12 @@ stdenv.mkDerivation rec {

  configureFlags = [ "--disable-update-mimedb" ];

+  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
+  postConfigure = ''
+    substituteInPlace libtool \
+      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
+  '';
+
  enableParallelBuilding = true;

  passthru.updateScript = mateUpdateScript { inherit pname; };
@@ -188,10 +188,10 @@ in
    old: (addToBuildInputs [ pkgs.ncurses pkgs.stfl ] old) // (addToCscOptions "-L -lncurses" old);
  taglib =
    old:
-    (addToBuildInputs [ pkgs.zlib pkgs.taglib ] old)
+    (addToBuildInputs [ pkgs.zlib pkgs.taglib_1 ] old)
    // (
      # needed for tablib-config to be in PATH
-      addToNativeBuildInputs pkgs.taglib old
+      addToNativeBuildInputs pkgs.taglib_1 old
    );
  uuid-lib = addToBuildInputs pkgs.libuuid;
  webview = addToBuildInputsWithPkgConfig pkgs.webkitgtk_4_0;
@@ -3,13 +3,16 @@
  stdenv,
  enableMultilib,
  targetConfig,
-  withoutTargetLibc,
 }:

 let
  forceLibgccToBuildCrtStuff = import ./libgcc-buildstuff.nix { inherit lib stdenv; };
+  isCross = with stdenv; targetPlatform.config != hostPlatform.config;
 in

+# We don't support multilib and cross at the same time
+assert !(enableMultilib && isCross);
+
 originalAttrs:
 (stdenv.mkDerivation (
  finalAttrs:
@@ -210,64 +213,94 @@ originalAttrs:
    '';

    preInstall =
+      # What follows is a horribly cursed hack.
+      #
+      # GCC will install its libraries to $out/lib, $out/lib32, $out/lib64,
+      # $out/$targetConfig/lib, $out/$targetConfig/lib32 or $out/$targetConfig/lib64,
+      # depending on whether it's built as native or cross, and the exact target spec.
+      #
+      # We can't predict what it's actually going to do, and we also can't just tell it
+      # to always install to lib, but we want everything to end up in lib
+      # for consistency (multilib weirdness aside).
+      #
+      # So, we create a bunch of symlinks before we run GCC's install phase,
+      # redirecting every possible directory it may want to write to to the place
+      # we actually want things to be installed.
+      # We will then nuke the symlinks in postInstall.
+      #
+      # FIXME: there must be a better way to do this.
      ''
-        mkdir -p "$out/''${targetConfig}/lib"
-        mkdir -p "''${!outputLib}/''${targetConfig}/lib"
+        declare -ga compatibilitySymlinks=()
+
+        makeCompatibilitySymlink() {
+          declare -a outputsToLink=("$out")
+
+          if [ -n "$lib" ]; then
+            outputsToLink+=("$lib")
+          fi
+
+          for output in "''${outputsToLink[@]}"; do
+            local linkTarget="$1"
+            local linkName="$output/$2"
+
+            echo "Creating compatibility symlink: $linkTarget -> $linkName"
+
+            mkdir -p "$(dirname "$linkName")"
+            ln -s "$linkTarget" "$linkName"
+            compatibilitySymlinks+=("$linkName")
+          done
+        }
      ''
      +
-        # if cross-compiling, link from $lib/lib to $lib/${targetConfig}.
-        # since native-compiles have $lib/lib as a directory (not a
-        # symlink), this ensures that in every case we can assume that
-        # $lib/lib contains the .so files
-        lib.optionalString (with stdenv; targetPlatform.config != hostPlatform.config) ''
-          ln -Ts "''${!outputLib}/''${targetConfig}/lib" $lib/lib
+        # This will redirect $output/lib{32,64} to $output/lib.
+        # Multilib is special, because it creates $out/lib (for 32-bit)
+        # and $out/lib64 (for 64-bit). No other targets can have both.
+        lib.optionalString (!enableMultilib) ''
+          makeCompatibilitySymlink lib lib32
+          makeCompatibilitySymlink lib lib64
        ''
      +
-        # Make `lib64` symlinks to `lib`.
-        lib.optionalString
-          (!enableMultilib && stdenv.hostPlatform.is64bit && !stdenv.hostPlatform.isMips64n32)
-          ''
-            ln -s lib "$out/''${targetConfig}/lib64"
-            ln -s lib "''${!outputLib}/''${targetConfig}/lib64"
-          ''
-      +
-        # On mips platforms, gcc follows the IRIX naming convention:
-        #
-        #  $PREFIX/lib   = mips32
-        #  $PREFIX/lib32 = mips64n32
-        #  $PREFIX/lib64 = mips64
-        #
-        # Make `lib32` symlinks to `lib`.
-        lib.optionalString (!enableMultilib && stdenv.targetPlatform.isMips64n32) ''
-          ln -s lib "$out/''${targetConfig}/lib32"
-          ln -s lib "''${!outputLib}/''${targetConfig}/lib32"
+        # This will redirect $output/$targetConfig/lib{,32,64} to $output/$targetConfig/lib.
+        lib.optionalString isCross ''
+          makeCompatibilitySymlink lib $targetConfig/lib32
+          makeCompatibilitySymlink lib $targetConfig/lib64
        '';

    postInstall = ''
-      # Move runtime libraries to lib output.
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.so*" "''${!outputLib}"
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.la"  "''${!outputLib}"
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dylib" "''${!outputLib}"
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dll.a" "''${!outputLib}"
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dll" "''${!outputLib}"
+      # Clean up our compatibility symlinks (see above)
+      for link in "''${compatibilitySymlinks[@]}"; do
+        echo "Removing compatibility symlink: $link"
+        rm -f "$link"
+      done
+
+      # Move target runtime libraries to lib output.
+      # For non-cross, they're in $out/lib; for cross, they're in $out/$targetConfig/lib.
+      targetLibDir="''${targetConfig+$targetConfig/}lib"
+
+      moveToOutput "$targetLibDir/lib*.so*" "''${!outputLib}"
+      moveToOutput "$targetLibDir/lib*.la"  "''${!outputLib}"
+      moveToOutput "$targetLibDir/lib*.dylib" "''${!outputLib}"
+      moveToOutput "$targetLibDir/lib*.dll.a" "''${!outputLib}"
+      moveToOutput "$targetLibDir/lib*.dll" "''${!outputLib}"
      moveToOutput "share/gcc-*/python" "''${!outputLib}"

      if [ -z "$enableShared" ]; then
-          moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.a" "''${!outputLib}"
+          moveToOutput "$targetLibDir/lib*.a" "''${!outputLib}"
      fi

-      for i in "''${!outputLib}/''${targetConfig}"/lib/*.{la,py}; do
+      for i in "''${!outputLib}"/$targetLibDir/*.{la,py}; do
          substituteInPlace "$i" --replace "$out" "''${!outputLib}"
      done

+      # Multilib and cross can't exist at the same time, so just use lib64 here
      if [ -n "$enableMultilib" ]; then
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.so*" "''${!outputLib}"
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.la"  "''${!outputLib}"
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dylib" "''${!outputLib}"
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dll.a" "''${!outputLib}"
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dll" "''${!outputLib}"
+          moveToOutput "lib64/lib*.so*" "''${!outputLib}"
+          moveToOutput "lib64/lib*.la"  "''${!outputLib}"
+          moveToOutput "lib64/lib*.dylib" "''${!outputLib}"
+          moveToOutput "lib64/lib*.dll.a" "''${!outputLib}"
+          moveToOutput "lib64/lib*.dll" "''${!outputLib}"

-          for i in "''${!outputLib}/''${targetConfig}"/lib64/*.{la,py}; do
+          for i in "''${!outputLib}"/lib64/*.{la,py}; do
              substituteInPlace "$i" --replace "$out" "''${!outputLib}"
          done
      fi
@@ -313,9 +346,15 @@ originalAttrs:
              ln -sf "$man_prefix"gcc.1 "$i"
          fi
      done
+    ''
+    # if cross-compiling, link from $lib/lib to $lib/${targetConfig}.
+    # since native-compiles have $lib/lib as a directory (not a
+    # symlink), this ensures that in every case we can assume that
+    # $lib/lib contains the .so files
+    + lib.optionalString isCross ''
+      if [ -e "$lib/$targetConfig/lib" ]; then
+        ln -s "$lib/$targetConfig/lib" "$lib/lib"
+      fi
    '';
  }
-  // lib.optionalAttrs ((stdenv.targetPlatform.config != stdenv.hostPlatform.config) && withoutTargetLibc) {
-    dontCheckForBrokenSymlinks = true;
-  }
 ))
@@ -391,13 +391,5 @@ pipe ((callFile ./common/builder.nix {}) ({
  (callPackage ./common/libgcc.nix   { inherit version langC langCC langJit targetPlatform hostPlatform withoutTargetLibc enableShared libcCross; })
 ] ++ optionals atLeast11 [
  (callPackage ./common/checksum.nix { inherit langC langCC; })
-]
-  # This symlink points to itself, and we disallow that now by noBrokenSymlinks (#370750)
-  # TODO: find how exactly this happens and solve it in a better way.
-  ++ optional langJit (pkg: pkg.overrideAttrs (attrs: {
-    postInstall = attrs.postInstall or "" + ''
-      rm "$out/lib/lib"
-    '';
-  }))
-)
+])

@@ -7,6 +7,9 @@
  pkg-config,
  openssl,
  erlang,
+  nodejs,
+  bun,
+  deno,
  Security,
  nix-update-script,
  SystemConfiguration,
@@ -14,24 +17,27 @@

 rustPlatform.buildRustPackage rec {
  pname = "gleam";
-  version = "1.8.1";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = pname;
    tag = "v${version}";
-    hash = "sha256-Qt2VQhbiNNORrGUR5LHeBb0q/EIqPNPz/adljj6xpS4=";
+    hash = "sha256-6vYVUdQST49TNctO9Y/XrRFyJ6hXng85SsO+4JBn1GA=";
  };

  nativeBuildInputs = [
    git
    pkg-config
+    erlang
+    nodejs
+    bun
+    deno
  ];

  buildInputs =
    [
      openssl
-      erlang
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      Security
@@ -39,7 +45,12 @@ rustPlatform.buildRustPackage rec {
    ];

  useFetchCargoVendor = true;
-  cargoHash = "sha256-7oawxv1s8BJsOxGuADKjf4XqJ/UT+zYOrPQCbQljArM=";
+  cargoHash = "sha256-arVtNxcYDVKRTGe9won6zb30wCxMD6MtsGs25UmOPjM=";
+
+  checkFlags = [
+    # Makes a network request
+    "--skip=tests::echo::echo_dict"
+  ];

  passthru.updateScript = nix-update-script { };

@@ -5,7 +5,6 @@
  tzdata,
  replaceVars,
  iana-etc,
-  xcbuild,
  mailcap,
  buildPackages,
  pkgsBuildTarget,
@@ -62,10 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

-  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [
-    xcbuild
-  ];
-
  depsBuildTarget = lib.optional isCross targetCC;

  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
@@ -168,7 +163,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall
    mkdir -p $GOROOT_FINAL
-    cp -a bin pkg src lib misc api doc go.env $GOROOT_FINAL
+    cp -a bin pkg src lib misc api doc go.env VERSION $GOROOT_FINAL
    mkdir -p $out/bin
    ln -s $GOROOT_FINAL/bin/* $out/bin
    runHook postInstall
@@ -5,7 +5,6 @@
  tzdata,
  replaceVars,
  iana-etc,
-  xcbuild,
  mailcap,
  buildPackages,
  pkgsBuildTarget,
@@ -49,11 +48,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.23.6";
+  version = "1.23.7";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-A5xbBOZSedrO7opvcecL0Fz1uAF4K293xuGeLtBREiI=";
+    hash = "sha256-fPq9Rrc+tMJrGdaVFd0EPXGDplWazM1c/bJetrJmpFg=";
  };

  strictDeps = true;
@@ -62,10 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

-  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [
-    xcbuild
-  ];
-
  depsBuildTarget = lib.optional isCross targetCC;

  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
@@ -166,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall
    mkdir -p $out/share/go
-    cp -a bin pkg src lib misc api doc go.env $out/share/go
+    cp -a bin pkg src lib misc api doc go.env VERSION $out/share/go
    mkdir -p $out/bin
    ln -s $out/share/go/bin/* $out/bin
    runHook postInstall
@@ -5,7 +5,6 @@
  tzdata,
  replaceVars,
  iana-etc,
-  xcbuild,
  mailcap,
  buildPackages,
  pkgsBuildTarget,
@@ -62,10 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

-  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [
-    xcbuild
-  ];
-
  depsBuildTarget = lib.optional isCross targetCC;

  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
@@ -166,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall
    mkdir -p $out/share/go
-    cp -a bin pkg src lib misc api doc go.env $out/share/go
+    cp -a bin pkg src lib misc api doc go.env VERSION $out/share/go
    mkdir -p $out/bin
    ln -s $out/share/go/bin/* $out/bin
    runHook postInstall
@@ -176,6 +176,17 @@ stdenv.mkDerivation (finalAttrs: {
            stripLen = 1;
          }
        )
+    ++
+      lib.optional (lib.versionAtLeast release_version "12" && lib.versionOlder release_version "19")
+        # Add missing include headers to build against gcc-15:
+        #   https://github.com/llvm/llvm-project/pull/101761
+        (
+          fetchpatch {
+            url = "https://github.com/llvm/llvm-project/commit/7e44305041d96b064c197216b931ae3917a34ac1.patch";
+            hash = "sha256-1htuzsaPHbYgravGc1vrR8sqpQ/NSQ8PUZeAU8ucCFk=";
+            stripLen = 1;
+          }
+        )
    ++
      lib.optional (lib.versionOlder release_version "16")
        # Fix musl build.
@@ -14,9 +14,6 @@
  lib,
  newScope,
  callPackage,
-  CoreFoundation,
-  Security,
-  SystemConfiguration,
  pkgsBuildTarget,
  pkgsBuildBuild,
  pkgsBuildHost,
@@ -28,6 +25,7 @@
  llvm_19,
  wrapCCWith,
  overrideCC,
+  fetchpatch,
 }@args:
 let
  llvmSharedFor =
@@ -47,8 +45,18 @@ let
 in
 import ./default.nix
  {
-    rustcVersion = "1.84.1";
-    rustcSha256 = "Xi+11JYopUn3Zxssz5hVqzef1EKDGnwq8W4M3MMbs3U=";
+    rustcVersion = "1.85.0";
+    rustcSha256 = "L08xQv+3yEAhOc+geW4kuqrIuf0/lrLe7DuUtARcaoo=";
+
+    rustcPatches = [
+      # Fix for including no_std targets by default, shipping in Rust 1.87
+      # https://github.com/rust-lang/rust/pull/137073
+      (fetchpatch {
+        name = "bootstrap-skip-nostd-docs";
+        url = "https://github.com/rust-lang/rust/commit/97962d7643300b91c102496ba3ab6d9279d2c536.patch";
+        hash = "sha256-DKl9PWqJP3mX4B1pFeRLQ8/sO6mx1JhbmVLTOOMLZI4=";
+      })
+    ];

    llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
    llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -106,26 +114,26 @@ import ./default.nix
    # Note: the version MUST be the same version that we are building. Upstream
    # ensures that each released compiler can compile itself:
    # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.84.1";
+    bootstrapVersion = "1.85.0";

    # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
    bootstrapHashes = {
-      i686-unknown-linux-gnu = "9a2f107b35ca55439a7de0a74a893ff285766e086f96fb1d7049301b196c5da8";
-      x86_64-unknown-linux-gnu = "106c89f23ce1c763fcbea8e2714b2ba869bf7af70804813987a4483896398933";
-      x86_64-unknown-linux-musl = "e52236e269ce8f713691d78895365a376002980c011b4bbdd27e4bee0ec1ee9a";
-      arm-unknown-linux-gnueabihf = "02273a6326639dedf0c627421851f85b88884d3811de2a7390f189575d23b4b4";
-      armv7-unknown-linux-gnueabihf = "434895ed6cf922a3c0fe11a6af7f4e382093cc9edf6c250e49fbfcecd25ada59";
-      aarch64-unknown-linux-gnu = "be89f6ad9b70cc4b25182ae299f94ab047a713a51fddf95284823c8afe4aef85";
-      aarch64-unknown-linux-musl = "8a80398ed1942e8020599b8f1c53ae9775a6c8bed6af252c48a5fb967accd5f1";
-      x86_64-apple-darwin = "c2c80ffef15946abfb08dac6ad54c07f9d95ae56c65fc94c4c10e07b60acb883";
-      aarch64-apple-darwin = "49be10fa1a1de14e36d37cc412b7c44e01896c0a86a2d0d35ee26704a59adba7";
-      powerpc64le-unknown-linux-gnu = "7c56d9b5e2dfbd6a0a18307d96b703d6d70d1cf7bb337ea8865dfdd5e0a38d84";
-      riscv64gc-unknown-linux-gnu = "0e07fe7a0df2220cea37581061ed52576a44dec10866ec8f860f71a98bf41412";
-      s390x-unknown-linux-gnu = "9d6ab731c0cb315349cf5cbbeb88149adbd7165dbeec76f7c723d0b9796c4422";
-      x86_64-unknown-freebsd = "7aa4089315d3ac9eefd7f885283df99b2c4cb930316f0be3bf867d41217b6d05";
+      i686-unknown-linux-gnu = "bbfdbd15ee6a8414baad487c98d448805d2fa7074107e4eded770926ff5f2545";
+      x86_64-unknown-linux-gnu = "be4ba7b777100c851ab268e95f70f405d28d7813ba60a9bdcf4e88c88acf8602";
+      x86_64-unknown-linux-musl = "aec38e0eb03cde68f255959cfb389cccf321c7a020d103ea9174d01ab5acba65";
+      arm-unknown-linux-gnueabihf = "8a716247a8fe15a6c820d64d25d19c7d0b899a2dadd812bc080e92ebff4fdea5";
+      armv7-unknown-linux-gnueabihf = "91d0c9693b218fac740449fa9c3f37e71a680e4be5d27135ac1385f40eb148e0";
+      aarch64-unknown-linux-gnu = "0306c30bee00469fbec4b07bb04ea0308c096454354c3dc96a92b729f1c2acd1";
+      aarch64-unknown-linux-musl = "390de2f3aff938d04275302d6cb47c92f425b141c9cb68cb6cf237f702298627";
+      x86_64-apple-darwin = "69a36d239e38cc08c6366d1d85071847406645346c6f2d2e0dfaf64b58050d3d";
+      aarch64-apple-darwin = "3ff45cefaf9a002069902acf3a6332113b76b530bb31803fe5cfd30f7ef8ba03";
+      powerpc64le-unknown-linux-gnu = "d0761bf0e1786a46dddfe60cc9397b899f680b86e6aebd7ca16b2a70a9dd631b";
+      riscv64gc-unknown-linux-gnu = "5f27e7ed95ccd49fd53e92d6be62042dfdd2861faecad20bf61b0c186ff24df1";
+      s390x-unknown-linux-gnu = "7f6ee970e31e448c31c92175684380a73ec7078b15d7a99eac5d445bef1c4b3a";
+      x86_64-unknown-freebsd = "6ad090d188079450b1d65e4d539833affac54cfeb504e022b1b56d6d98bb4cbe";
    };

-    selectRustPackage = pkgs: pkgs.rust_1_84;
+    selectRustPackage = pkgs: pkgs.rust_1_85;
  }

  (
@@ -135,5 +143,6 @@ import ./default.nix
      "wrapCCWith"
      "overrideCC"
      "pkgsHostTarget"
+      "fetchpatch"
    ]
  )
@@ -53,16 +53,21 @@ rec {
      patchShebangs .
    '';

-    installPhase = ''
-      ./install.sh --prefix=$out \
-        --components=${installComponents}
+    installPhase =
+      ''
+        ./install.sh --prefix=$out \
+          --components=${installComponents}

-      # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
-      # (or similar) here. It causes strange effects where rustc loads
-      # the wrong libraries in a bootstrap-build causing failures that
-      # are very hard to track down. For details, see
-      # https://github.com/rust-lang/rust/issues/34722#issuecomment-232164943
-    '';
+        # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
+        # (or similar) here. It causes strange effects where rustc loads
+        # the wrong libraries in a bootstrap-build causing failures that
+        # are very hard to track down. For details, see
+        # https://github.com/rust-lang/rust/issues/34722#issuecomment-232164943
+      ''
+      + lib.optionalString stdenv.hostPlatform.isDarwin ''
+        install_name_tool -change "/usr/lib/libcurl.4.dylib" \
+        "${lib.getLib curl}/lib/libcurl.4.dylib" "$out/bin/cargo"
+      '';

    # The strip tool in cctools 973.0.1 and up appears to break rlibs in the
    # binaries. The lib.rmeta object inside the ar archive should contain an
@@ -166,7 +171,7 @@ rec {
      ''
      + lib.optionalString stdenv.hostPlatform.isDarwin ''
        install_name_tool -change "/usr/lib/libcurl.4.dylib" \
-          "${curl.out}/lib/libcurl.4.dylib" "$out/bin/cargo"
+          "${lib.getLib curl}/lib/libcurl.4.dylib" "$out/bin/cargo"
      ''
      + ''
        wrapProgram "$out/bin/cargo" \
@@ -1,7 +1,6 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, rustPlatform, rustc
-, CoreFoundation, Security
 , auditable ? !cargo-auditable.meta.broken
 , cargo-auditable
 , pkgsBuildBuild
@@ -32,8 +31,7 @@ rustPlatform.buildRustPackage.override {
    (lib.getDev pkgsHostHost.curl)
    zlib
  ];
-  buildInputs = [ file curl python3 openssl zlib ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreFoundation Security ];
+  buildInputs = [ file curl python3 openssl zlib ];

  # cargo uses git-rs which is made for a version of libgit2 from recent master that
  # is not compatible with the current version in nixpkgs.
@@ -3,7 +3,6 @@
  lib,
  rustPlatform,
  rustc,
-  Security,
 }:

 rustPlatform.buildRustPackage {
@@ -19,7 +18,7 @@ rustPlatform.buildRustPackage {
  # changes hash of vendor directory otherwise
  dontUpdateAutotoolsGnuConfigScripts = true;

-  buildInputs = [ rustc.llvm ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ rustc.llvm ];

  # fixes: error: the option `Z` is only accepted on the nightly compiler
  RUSTC_BOOTSTRAP = 1;
@@ -13,7 +13,6 @@
 }:
 { stdenv, lib
 , newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
 , pkgsBuildBuild
 , pkgsBuildHost
 , pkgsBuildTarget
@@ -87,13 +86,11 @@ in
        sysroot = if fastCross then self.rustc-unwrapped else null;
      };
      rustfmt = self.callPackage ./rustfmt.nix {
-        inherit Security;
        inherit (self.buildRustPackages) rustc;
      };
      cargo = if (!fastCross) then self.callPackage ./cargo.nix {
        # Use boot package set to break cycle
        rustPlatform = bootRustPlatform;
-        inherit CoreFoundation Security;
      } else self.callPackage ./cargo_cross.nix {};
      cargo-auditable = self.callPackage ./cargo-auditable.nix { };
      cargo-auditable-cargo-wrapper = self.callPackage ./cargo-auditable-cargo-wrapper.nix { };
@@ -102,7 +99,6 @@ in
        # buildPackages.clippy uses the cross compiler and supports
        # linting for the target platform.
        rustPlatform = makeRustPlatform self;
-        inherit Security;
      };
    });
  };
@@ -157,23 +157,23 @@ stdenv.mkDerivation (finalAttrs: {
        concatStringsSep "," (
          [
            stdenv.targetPlatform.rust.rustcTargetSpec
-
-            # Other targets that don't need any extra dependencies to build.
          ]
+          # Other targets that don't need any extra dependencies to build.
          ++ optionals (!fastCross) [
            "wasm32-unknown-unknown"
-
-            # (build!=target): When cross-building a compiler we need to add
-            # the build platform as well so rustc can compile build.rs
-            # scripts.
+            "wasm32v1-none"
+            "bpfel-unknown-none"
+            "bpfeb-unknown-none"
          ]
+          # (build!=target): When cross-building a compiler we need to add
+          # the build platform as well so rustc can compile build.rs
+          # scripts.
          ++ optionals (stdenv.buildPlatform != stdenv.targetPlatform && !fastCross) [
            stdenv.buildPlatform.rust.rustcTargetSpec
-
-            # (host!=target): When building a cross-targeting compiler we
-            # need to add the host platform as well so rustc can compile
-            # build.rs scripts.
          ]
+          # (host!=target): When building a cross-targeting compiler we
+          # need to add the host platform as well so rustc can compile
+          # build.rs scripts.
          ++ optionals (stdenv.hostPlatform != stdenv.targetPlatform && !fastCross) [
            stdenv.hostPlatform.rust.rustcTargetSpec
          ]
@@ -236,19 +236,19 @@ stdenv.mkDerivation (finalAttrs: {
  # library and reuse compiler
  buildPhase =
    if fastCross then
-      "
-    runHook preBuild
+      ''
+        runHook preBuild

-    mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/
-    ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/libstd-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/libstd.so
-    ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/librustc_driver-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc.so
-    ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main
-    touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd.stamp
-    touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc.stamp
-    python ./x.py --keep-stage=0 --stage=1 build library
+        mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/
+        ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/libstd-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/libstd.so
+        ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/librustc_driver-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc.so
+        ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main
+        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd.stamp
+        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc.stamp
+        python ./x.py --keep-stage=0 --stage=1 build library

-    runHook postBuild
-  "
+        runHook postBuild
+      ''
    else
      null;

@@ -5,7 +5,6 @@
  makeWrapper,
  rustPlatform,
  rustc,
-  Security,
  asNightly ? false,
 }:

@@ -26,7 +25,7 @@ rustPlatform.buildRustPackage {

  buildInputs = [
    rustc.llvm
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];

  # rustfmt uses the rustc_driver and std private libraries, and Rust's build process forces them to have
  # an install name of `@rpath/...` [0] [1] instead of the standard on macOS, which is an absolute path
@@ -442,8 +442,8 @@ in
  };

  ruby_3_4 = generic {
-    version = rubyVersion "3" "4" "1" "";
-    hash = "sha256-PTheXSLTaLBkyBehPtjjzD9xp3BdftG654ATwzqnyH8=";
+    version = rubyVersion "3" "4" "2" "";
+    hash = "sha256-QTKKwh8r/dfeazVl708N11QzVNN+lvFXoVUqa9DrNks=";
    cargoHash = "sha256-5Tp8Kth0yO89/LIcU8K01z6DdZRr8MAA0DPKqDEjIt0=";
  };
 }
@@ -3,6 +3,7 @@
  stdenv,
  config,
  fetchFromGitHub,
+  fetchpatch,
  nix-update-script,
  pkg-config,
  mesa,
@@ -91,6 +92,11 @@ stdenv.mkDerivation (finalAttrs: {
    # but on NixOS they're spread across different paths.
    # This patch + the setup-hook will ensure that `sdl2-config --cflags` works correctly.
    ./find-headers.patch
+    # https://github.com/libsdl-org/SDL/issues/12224
+    (fetchpatch {
+      url = "https://github.com/libsdl-org/SDL/commit/9e079fe9c7931738ed63d257b1d7fb8a07b66824.diff";
+      hash = "sha256-G8gAivCtw5zuPVI9wvEq2oIo/NxFdnPqyLwrmHG1EJ4=";
+    })
  ];

  postPatch = ''
@@ -119,7 +119,10 @@ in
        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
          ''
            echo SUPPORTED-LOCALES=C.UTF-8/UTF-8 > ../glibc-2*/localedata/SUPPORTED
-            make -j''${NIX_BUILD_CORES:-1} localedata/install-locales
+            # Don't install C.utf-8 into the archive, but into $out/lib/locale: on non-NixOS
+            # systems with an empty /usr/lib/locale/locale-archive, glibc would fall back to
+            # $libdir/locale/C.utf-8 instead of the locale archive of pkgs.glibc. See also #347965.
+            make -j''${NIX_BUILD_CORES:-1} localedata/install-locale-files
          ''
        else
          lib.optionalString stdenv.buildPlatform.isLinux
@@ -60,11 +60,11 @@ in

 stdenv.mkDerivation rec {
  pname = "gnutls";
-  version = "3.8.6";
+  version = "3.8.9";

  src = fetchurl {
    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    hash = "sha256-LhWIquU8sy1Dk38fTsoo/r2cDHqhc0/F3WGn6B4OvN0=";
+    hash = "sha256-aeET2ALRZwxNWsG5kECx8tXHwF2uxQA4E8BJtRhIIO0=";
  };

  outputs = [ "bin" "dev" "out" ]
@@ -76,15 +76,6 @@ stdenv.mkDerivation rec {

  patches = [
    ./nix-ssl-cert-file.patch
-    # Revert https://gitlab.com/gnutls/gnutls/-/merge_requests/1800
-    # dlopen isn't as easy in NixPkgs, as noticed in tests broken by this.
-    # Without getting the libs into RPATH they won't be found.
-    (fetchpatch2 {
-      name = "revert-dlopen-compression.patch";
-      url = "https://gitlab.com/gnutls/gnutls/-/commit/8584908d6b679cd4e7676de437117a793e18347c.diff";
-      revert = true;
-      hash = "sha256-r/+Gmwqy0Yc1LHL/PdPLXlErUBC5JxquLzCBAN3LuRM=";
-    })
  ];

  # Skip some tests:
@@ -122,6 +113,8 @@ stdenv.mkDerivation rec {
      "--disable-doc"
    ] ++ lib.optionals (stdenv.hostPlatform.isLinux && tpmSupport) [
      "--with-trousers-lib=${trousers}/lib/libtspi.so"
+    ] ++ [ # do not dlopen in nixpkgs
+        "--with-zlib=link"
    ];

  enableParallelBuilding = true;
@@ -2,9 +2,9 @@ allow overriding system trust store location via $NIX_SSL_CERT_FILE

 --- a/lib/system/certs.c
 +++ b/lib/system/certs.c
-@@ -404,6 +404,10 @@ gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
- 					unsigned int tl_flags,
- 					unsigned int tl_vflags)
+@@ -381,6 +381,10 @@ int gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
+ 					    unsigned int tl_flags,
+ 					    unsigned int tl_vflags)
 {
 -	return add_system_trust(list, tl_flags | GNUTLS_TL_NO_DUPLICATES,
 -				tl_vflags);
@@ -21,7 +21,7 @@

 stdenv.mkDerivation rec {
  pname = "gpgme";
-  version = "1.24.1";
+  version = "1.24.2";
  pyproject = true;

  outputs = [
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnupg/gpgme/gpgme-${version}.tar.bz2";
-    hash = "sha256-6gXQJY5xBh1hcWWE7DTO9ZMwqRNAVx7cRreDdJc7qF8=";
+    hash = "sha256-4RsaDjYXd+nlX0igPYkJbiq/CMY9hLcBfP4dzgZjlYE=";
  };

  patches = [
@@ -22,6 +22,12 @@ stdenv.mkDerivation rec {
    sha256 = "18n3l9zcldyvn4lwi8izd62307mkhz873039nl6awrv285qzah34";
  };

+  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
+  postConfigure = ''
+    substituteInPlace libtool \
+      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
+  '';
+
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
    mono
@@ -3,6 +3,7 @@
 , buildPackages
 , replaceVars
 , fetchurl
+, fetchpatch
 , pkg-config
 , docutils
 , gettext
@@ -82,6 +83,15 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-7zG9vW8ILEQBY0ogyFCwBQyb8lLvHgeXZO6VoqDEyVo=";
  };

+  patches = [
+    # Fix rendering glitches on vulkan drivers which do not support mipmaps for VK_IMAGE_TILING_LINEAR (Asahi Honeykrisp)
+    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/8058
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/c9a3cdd396c5646382612ed25e93bb5f9664d043.patch";
+      hash = "sha256-K774FFu6eyyjnxBTy7oTDygkh8+7qp5/KssHkyEwRR8=";
+    })
+  ];
+
  depsBuildBuild = [
    pkg-config
  ];
@@ -58,7 +58,8 @@ stdenv.mkDerivation rec {
  # Tries to link test binaries binaries dynamically and fails
  doCheck = !stdenv.hostPlatform.isStatic;

-  enableParallelBuilding = true;
+  # Parallel builds break reproducibility.
+  enableParallelBuilding = false;

  meta = with lib; {
    homepage = "https://jemalloc.net/";
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  libcddb,
  pkg-config,
  ncurses,
@@ -14,28 +13,16 @@

 stdenv.mkDerivation rec {
  pname = "libcdio";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchurl {
-    url = "mirror://gnu/libcdio/libcdio-${version}.tar.bz2";
-    sha256 = "0avi6apv5ydjy6b9c3z9a46rvp5i57qyr09vr7x4nndxkmcfjl45";
+    url = "https://github.com/libcdio/libcdio/releases/download/${version}/${pname}-${version}.tar.bz2";
+    hash = "sha256-b4+99NGJz2Pyp6FUnFFs1yDHsiLHqq28kkom50WkhTk=";
  };

-  patches = [
-    # Fixes test failure of realpath test with glibc-2.36
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/libcdio/raw/d49ccdd9c8b4e9d57c01539f4c8948f28ce82bca/f/realpath-test-fix.patch";
-      sha256 = "sha256-ldAGlcf79uQ8QAt4Au8Iv6jsI6ICZXtXOKZBpyELtN8=";
-    })
-
-    # pull pending upstream patch to fix build on ncurses-6.3:
-    #  https://savannah.gnu.org/patch/index.php?10130
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://savannah.gnu.org/patch/download.php?file_id=52179";
-      sha256 = "1v15gxhpi4bgcr12pb3d9c3hiwj0drvc832vic7sham34lhjmcbb";
-    })
-  ];
+  env = lib.optionalAttrs stdenv.is32bit {
+    NIX_CFLAGS_COMPILE = "-D_LARGEFILE64_SOURCE";
+  };

  postPatch = ''
    patchShebangs .
@@ -58,10 +45,6 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  env = lib.optionalAttrs stdenv.cc.isGNU {
-    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
-  };
-
  doCheck = !stdenv.hostPlatform.isDarwin;

  meta = with lib; {
@@ -31,7 +31,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libxml2";
-  version = "2.13.5";
+  version = "2.13.6";

  outputs =
    [
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor finalAttrs.version}/libxml2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-dPwWMhejlkJX0745r5Q+CIYSY8QjH571tJa29tTHsrY=";
+    hash = "sha256-9FNIAwdSSWj3oE7GXmTyqDqCWXO80mCi52kb6CrnDJY=";
  };

  strictDeps = true;
@@ -0,0 +1,13 @@
+diff --git a/src/gbm/meson.build b/src/gbm/meson.build
+index eaed028d049..1a826c8792d 100644
+--- a/src/gbm/meson.build
+++ b/src/gbm/meson.build
+@@ -43,7 +43,7 @@ if with_tests
+   test('gbm-abi-check', abi_check, suite : ['gbm'])
+ endif
+ 
+-install_headers('main/gbm.h')
+install_headers('main/gbm.h', 'main/gbm_backend_abi.h')
+ 
+ pkg.generate(
+   name : 'gbm',
@@ -20,16 +20,23 @@ stdenv.mkDerivation rec {

  # We don't use the versions from common.nix, because libgbm is a world rebuild,
  # so the updates need to happen separately on staging.
-  version = "24.3.4";
+  version = "25.0.1";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "mesa";
    repo = "mesa";
    rev = "mesa-${version}";
-    hash = "sha256-1RUHbTgcCxdDrWjqB0EG4Ny/nwdjQHHpyPauiW/yogU=";
+    hash = "sha256-9D4d7EEdZysvXDRcmpbyt85Lo64sldNRomp6/HUVORo=";
  };

+  # Install gbm_backend_abi.h header - this is to simplify future iteration
+  # on building Mesa and friends with system libgbm.
+  # See also:
+  # - https://github.com/NixOS/nixpkgs/pull/387292
+  # - https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/33890
+  patches = [ ./gbm-header.patch ];
+
  mesonAutoFeatures = "disabled";

  mesonFlags = [
@@ -27,6 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
  outputs = [ "out" "dev" "man" ];
  setOutputFlags = false; # some aren't supported

+  # see other isOpenBSD clause below
+  configurePlatforms = if stdenv.hostPlatform.isOpenBSD then ["build"] else ["build" "host"];
+
  configureFlags = [
    (lib.withFeature (!enableStatic) "shared")
    "--without-debug"
@@ -64,7 +67,12 @@ stdenv.mkDerivation (finalAttrs: {
      #
      # For now we allow this with `--undefined-version`:
      "LDFLAGS=-Wl,--undefined-version"
-  ]);
+  ]) ++ lib.optionals stdenv.hostPlatform.isOpenBSD [
+    # If you don't specify the version number in the host specification, a branch gets taken in configure
+    # which assumes that your openbsd is from the 90s, leading to a truly awful compiler/linker configuration.
+    # No, autoreconfHook doesn't work.
+    "--host=${stdenv.hostPlatform.config}${stdenv.cc.libc.version}"
+  ];

  # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
  CFLAGS = lib.optionalString stdenv.hostPlatform.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
@@ -34,6 +34,7 @@
  libdrm,
  gst_all_1,
  ffmpeg,
+  fftwFloat,
  bluez,
  sbc,
  libfreeaptx,
@@ -56,6 +57,7 @@
  ffadoSupport ? x11Support && lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform,
  ffado,
  libselinux,
+  libebur128,
 }:

 let
@@ -67,7 +69,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "pipewire";
-  version = "1.2.7";
+  version = "1.4.0";

  outputs = [
    "out"
@@ -83,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "pipewire";
    repo = "pipewire";
    rev = finalAttrs.version;
-    sha256 = "sha256-TV+2nz44a742bUfGnWt7zJAnO15eED5kAwyAgE5CQZ0=";
+    sha256 = "sha256-xhlRwodW79mD6Vj+NLvcWxuK9+W+4M5DeZUaU36OiQE=";
  };

  patches = [
@@ -112,10 +114,12 @@ stdenv.mkDerivation (finalAttrs: {
      dbus
      fdk_aac
      ffmpeg
+      fftwFloat
      glib
      gst_all_1.gst-plugins-base
      gst_all_1.gstreamer
      libcamera
+      libebur128
      libjack2
      libfreeaptx
      liblc3
@@ -87,16 +87,16 @@ wrapQtAppsHook() {
        do
            isELF "$file" || isMachO "$file" || continue

-            if [ -f "$file" ]
-            then
-                echo "wrapping $file"
-                wrapQtApp "$file"
-            elif [ -h "$file" ]
+            if [ -h "$file" ]
            then
                target="$(readlink -e "$file")"
                echo "wrapping $file -> $target"
                rm "$file"
                makeQtWrapper "$target" "$file"
+            elif [ -f "$file" ]
+            then
+                echo "wrapping $file"
+                wrapQtApp "$file"
            fi
        done
    done
@@ -81,14 +81,14 @@ if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
            [ -d "$targetDir" ] || continue

            find "$targetDir" ! -type d -executable -print0 | while IFS= read -r -d '' file; do
-                if [ -f "$file" ]; then
-                    echo "wrapping $file"
-                    wrapQtApp "$file"
-                elif [ -h "$file" ]; then
+                if [ -h "$file" ]; then
                    target="$(readlink -e "$file")"
                    echo "wrapping $file -> $target"
                    rm "$file"
                    makeQtWrapper "$target" "$file"
+                elif [ -f "$file" ]; then
+                    echo "wrapping $file"
+                    wrapQtApp "$file"
                fi
            done
        done
@@ -311,9 +311,9 @@ stdenv.mkDerivation rec {
      fixQtBuiltinPaths "$out" '*.pr?'
    ''
    + lib.optionalString stdenv.hostPlatform.isLinux ''
-
      # FIXME: not sure why this isn't added automatically?
      patchelf --add-rpath "${libmysqlclient}/lib/mariadb" $out/${qtPluginPrefix}/sqldrivers/libqsqlmysql.so
+      patchelf --add-rpath "${vulkan-loader}/lib" --add-needed "libvulkan.so" $out/lib/libQt6Gui.so
    '';

  dontWrapQtApps = true;
@@ -3,6 +3,7 @@
  qtbase,
  qtlanguageserver,
  qtshadertools,
+  qtsvg,
  openssl,
  stdenv,
  lib,
@@ -17,6 +18,7 @@ qtModule {
    qtbase
    qtlanguageserver
    qtshadertools
+    qtsvg
    openssl
  ];
  strictDeps = true;
--- a/Show More
+++ b/Show More