Merge branch 'staging' into staging-next

doc/languages-frameworks/beam.section.md

@@ -377,14 +377,7 @@ let
 
   inputs =
     basePackages
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify-tools ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreFoundation
-        CoreServices
-      ]
-    );
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify-tools ];
 
   # define shell startup command
   hooks = ''

doc/languages-frameworks/haskell.section.md

@@ -58,7 +58,7 @@ Each of those compiler versions has a corresponding attribute set `packages` bui
 it. However, the non-standard package sets are not tested regularly and, as a
 result, contain fewer working packages. The corresponding package set for GHC
 9.4.8 is `haskell.packages.ghc948`. In fact `haskellPackages` (at the time of writing) is just an alias
-for `haskell.packages.ghc966`:
+for `haskell.packages.ghc984`:
 
 Every package set also re-exposes the GHC used to build its packages as `haskell.packages.*.ghc`.
 
@@ -297,8 +297,8 @@ Defaults to `false`.
 : Whether to build (HTML) documentation using [haddock][haddock].
 Defaults to `true` if supported.
 
-`testTarget`
-: Name of the test suite to build and run. If unset, all test suites will be executed.
+`testTargets`
+: Names of the test suites to build and run. If unset, all test suites will be executed.
 
 `preCompileBuildDriver`
 : Shell code to run before compiling `Setup.hs`.
@@ -621,6 +621,12 @@ environment. This means you can reuse Nix expressions of packages included in
 nixpkgs, but also use local Nix expressions like this: `hpkgs: [
 (hpkgs.callPackage ./my-project.nix { }) ]`.
 
+`extraDependencies`
+: Extra dependencies, in the form of cabal2nix build attributes. An example use
+case is when you have Haskell scripts that use libraries that don't occur in
+your packages' dependencies. Example: `hpkgs: {libraryHaskellDepends =
+[ hpkgs.releaser ]}`. Defaults to `hpkgs: { }`.
+
 `nativeBuildInputs`
 : Expects a list of derivations to add as build tools to the build environment.
 This is the place to add packages like `cabal-install`, `doctest` or `hlint`.
@@ -773,7 +779,7 @@ that depend on that library, you may want to use:
 
 ```nix
 haskellPackages.haskell-ci.overrideScope (self: super: {
-  Cabal = self.Cabal_3_14_1_0;
+  Cabal = self.Cabal_3_14_1_1;
 })
 ```
 

doc/release-notes/rl-2505.section.md

@@ -15,6 +15,9 @@
 - GCC has been updated from GCC 13 to GCC 14.
   This introduces some backwards‐incompatible changes; see the [upstream porting guide](https://gcc.gnu.org/gcc-14/porting_to.html) for details.
 
+- The default GHC version has been updated from 9.6 to 9.8.
+  `haskellPackages` also uses Stackage LTS 23 (instead of LTS 22) as a baseline.
+
 - LLVM has been updated from LLVM 16 (on Darwin) and LLVM 18 (on other platforms) to LLVM 19.
   This introduces some backwards‐incompatible changes; see the [upstream release notes](https://releases.llvm.org/) for details.
 
@@ -193,6 +196,8 @@
 
 - `mkBinaryCache` now defaults to using `zstd` compression for the binary caches it creates. The previous `xz` compression method can be used by passing `compression = "xz";`.
 
+- `nodejs_latest` was updated from 23.x to 24.x. `nodejs_23` has been removed in favor of `nodejs_24`.
+
 - `nodejs_18` package was removed due to upstream End-of-Life in April 2025.
 
 - `nodePackages."@commitlint/config-conventional"` has been removed, as it is a library, and projects should depend on it instead.
@@ -411,6 +416,10 @@
     - `lib.types.coercedTo`
     - `lib.types.either`
 
+- The `testTarget` argument of `haskellPackages.mkDerivation` has been deprecated in favour of `testTargets`.
+  `testTarget` took a space separated string of targets, whereas the new `testTargets` argument takes a list of targets.
+  For instance, `testTarget = "foo bar baz"` should become `testTargets = [ "foo" "bar" "baz" ]`.
+
 - Plasma 5 and Qt 5 based versions of associated software are deprecated in NixOS 25.05, and will be removed in NixOS 25.11. Users are encouraged to upgrade to Plasma 6.
 
 - `rustPlatform.buildRustPackage` stops handling the deprecated argument `cargoSha256`. Out-of-tree packages that haven't migrated from `cargoSha256` to `cargoHash` now receive errors.

doc/stdenv/stdenv.chapter.md

@@ -1600,6 +1600,10 @@ This flag adds the `-fstack-clash-protection` compiler option, which causes grow
 
 The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services.
 
+#### `nostrictaliasing` {#nostrictaliasing}
+
+This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.
+
 #### `pie` {#pie}
 
 This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for

lib/licenses.nix

@@ -257,6 +257,11 @@ lib.mapAttrs mkLicense (
       fullName = "BSD Protection License";
     };
 
+    bsdSourceCode = {
+      spdxId = "BSD-Source-Code";
+      fullName = "BSD Source Code Attribution";
+    };
+
     bsl11 = {
       spdxId = "BUSL-1.1";
       fullName = "Business Source License 1.1";
@@ -452,6 +457,11 @@ lib.mapAttrs mkLicense (
       fullName = "Common Public License 1.0";
     };
 
+    cronyx = {
+      spdxId = "Cronyx";
+      fullName = "Cronyx License";
+    };
+
     curl = {
       spdxId = "curl";
       fullName = "curl License";
@@ -937,6 +947,11 @@ lib.mapAttrs mkLicense (
       fullName = "MIT No Attribution";
     };
 
+    mitOpenGroup = {
+      spdxId = "MIT-open-group";
+      fullName = "MIT Open Group variant";
+    };
+
     mpl10 = {
       spdxId = "MPL-1.0";
       fullName = "Mozilla Public License 1.0";
@@ -1328,6 +1343,11 @@ lib.mapAttrs mkLicense (
       fullName = "Unicode License Agreement - Data Files and Software (2016)";
     };
 
+    unicodeTOU = {
+      spdxId = "Unicode-TOU";
+      fullName = "Unicode Terms of Use";
+    };
+
     unlicense = {
       spdxId = "Unlicense";
       fullName = "The Unlicense";

maintainers/scripts/haskell/merge-and-open-pr.sh

@@ -1,8 +1,8 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p git gh -I nixpkgs=.
 #
-# Script to merge the currently open haskell-updates PR into master, bump the
-# Stackage version and Hackage versions, and open the next haskell-updates PR.
+# Script to merge the currently open haskell-updates PR , bump the Stackage
+# version and Hackage versions, and open the next haskell-updates PR.
 
 set -eu -o pipefail
 
@@ -79,10 +79,6 @@ fi
 echo "Merging https://github.com/NixOS/nixpkgs/pull/${curr_haskell_updates_pr_num}..."
 gh pr merge --repo NixOS/nixpkgs --merge "$curr_haskell_updates_pr_num"
 
-# Update the list of Haskell package versions in NixOS on Hackage.
-echo "Updating list of Haskell package versions in NixOS on Hackage..."
-./maintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh
-
 # Update stackage, Hackage hashes, and regenerate Haskell package set
 echo "Updating Stackage..."
 ./maintainers/scripts/haskell/update-stackage.sh --do-commit
@@ -100,7 +96,7 @@ git push "$push_remote" haskell-updates
 new_pr_body=$(cat <<EOF
 ### This Merge
 
-This PR is the regular merge of the \`haskell-updates\` branch into \`master\`.
+This PR is the regular merge of the \`haskell-updates\` branch into \`staging\`.
 
 This branch is being continually built and tested by hydra at https://hydra.nixos.org/jobset/nixpkgs/haskell-updates. You may be able to find an up-to-date Hydra build report at [cdepillabout/nix-haskell-updates-status](https://github.com/cdepillabout/nix-haskell-updates-status).
 
@@ -113,7 +109,7 @@ Our workflow is currently described in [\`pkgs/development/haskell-modules/HACKI
 The short version is this:
 * We regularly update the Stackage and Hackage pins on \`haskell-updates\` (normally at the beginning of a merge window).
 * The community fixes builds of Haskell packages on that branch.
-* We aim at at least one merge of \`haskell-updates\` into \`master\` every two weeks.
+* We aim at at least one merge of \`haskell-updates\` into \`staging\` every two weeks.
 * We only do the merge if the [\`mergeable\`](https://hydra.nixos.org/job/nixpkgs/haskell-updates/mergeable) job is succeeding on hydra.
 * If a [\`maintained\`](https://hydra.nixos.org/job/nixpkgs/haskell-updates/maintained) package is still broken at the time of merge, we will only merge if the maintainer has been pinged 7 days in advance. (If you care about a Haskell package, become a maintainer!)
 
@@ -126,4 +122,4 @@ EOF
 )
 
 echo "Opening a PR for the next haskell-updates merge cycle..."
-gh pr create --repo NixOS/nixpkgs --base master --head haskell-updates --title "haskellPackages: update stackage and hackage" --body "$new_pr_body"
+gh pr create --repo NixOS/nixpkgs --base staging --head haskell-updates --title "haskellPackages: update stackage and hackage" --body "$new_pr_body"

maintainers/scripts/haskell/regenerate-hackage-packages.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git nix -I nixpkgs=.
+#! nix-shell -i bash -p coreutils haskellPackages.cabal2nix-unstable git nix nixfmt-rfc-style -I nixpkgs=.
 
 set -euo pipefail
 
@@ -102,6 +102,7 @@ run_hackage2nix
 
 fi
 
+nixfmt pkgs/development/haskell-modules/hackage-packages.nix
 
 if [[ "$DO_COMMIT" -eq 1 ]]; then
 git add pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml

maintainers/scripts/haskell/unbreak.nu

@@ -0,0 +1,31 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i nu -p nushell flock gnused -I nixpkgs=.
+
+# This script tests to build all packages listed in broken.yaml, expecting a build failure.
+# It will remove all packages that build fine from the list.
+
+# Attention: For unknown reasons, the script can't be easily cancelled and needs to be killed manually if it shouldn't run to completion.
+
+use std log
+
+let broken_config = "pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml"
+
+def is-broken [package : string]: nothing -> bool {
+    let res = with-env { NIXPKGS_ALLOW_BROKEN: "1" } {
+        # rather high timeout of half an hour, just to prevent never-ending builds
+        ^nix-build --no-out-link -j 1 --cores 1 --timeout 1800 -A $"haskellPackages.($package)" | complete
+    }
+    if $res.exit_code == 0 {
+      log warning $"($package) is not broken anymore!"
+      return false
+    } else {
+      log info $"($package) is still broken."
+      log debug $"($package) build log:\n($res.stderr)"
+      return true
+    }
+}
+
+def main [] {
+    $broken_config | open | get broken-packages
+      | par-each {|package| if not (is-broken $package) { ^flock -x $broken_config -c $"sed -i -e '/^  - ($package) /d' ($broken_config)" }}
+}

maintainers/scripts/haskell/update-stackage.sh

@@ -8,7 +8,7 @@ set -eu -o pipefail
 # (should be capitalized like the display name)
 SOLVER=LTS
 # Stackage solver verson, if any. Use latest if empty
-VERSION=22
+VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
 readonly SOLVER
 readonly VERSION

maintainers/team-list.nix

@@ -68,6 +68,16 @@ with lib.maintainers;
     ];
   };
 
+  apparmor = {
+    scope = "AppArmor-related modules, userspace tool packages and profiles";
+    shortName = "apparmor";
+    members = [
+      julm
+      thoughtpolice
+      grimmauld
+    ];
+  };
+
   bazel = {
     members = [
       mboes

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -22,6 +22,8 @@
   - the global Mesa version can now be managed without a mass rebuild by setting `hardware.graphics.package`
   - packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively
 
+- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
+
 - The `intel` video driver for X.org (from the xf86-video-intel package) which was previously removed because it was non-functional has been fixed and the driver has been re-introduced.
 
 - The Mattermost module ({option}`services.mattermost`) and packages (`mattermost` and `mmctl`) have been substantially updated:
@@ -261,6 +263,8 @@
   to review the new defaults and description of
   [](#opt-services.nextcloud.poolSettings).
 
+- In `users.users` allocation on systems with multiple users it could happen that collided with others. Now these users get new subuid ranges assigned. When this happens, a warning is issued on the first activation. If the subuids were used (e.g. with rootless container managers like podman), please change the ownership of affected files accordingly.
+
 - The `services.locate` module does no longer support findutil's `locate` due to its inferior performance compared to `mlocate` and `plocate`. The new default is `plocate`.
   As the `service.locate.localuser` option only applied when using findutil's `locate`, it has also been removed.
 
@@ -510,6 +514,8 @@
 
 - `services.avahi.ipv6` now defaults to true.
 
+- A new hardening flag, `nostrictaliasing` was made available, corresponding to the gcc/clang option `-fno-strict-aliasing`.
+
 - In the `services.xserver.displayManager.startx` module, two new options [generateScript](#opt-services.xserver.displayManager.startx.generateScript) and [extraCommands](#opt-services.xserver.displayManager.startx.extraCommands) have been added to to declaratively configure the .xinitrc script.
 
 - All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.

nixos/modules/config/update-users-groups.pl

@@ -54,15 +54,14 @@ sub dry_print {
 # Functions for allocating free GIDs/UIDs. FIXME: respect ID ranges in
 # /etc/login.defs.
 sub allocId {
-    my ($used, $prevUsed, $idMin, $idMax, $up, $getid) = @_;
-    my $id = $up ? $idMin : $idMax;
+    my ($used, $prevUsed, $idMin, $idMax, $delta, $getid) = @_;
+    my $id = $delta > 0 ? $idMin : $idMax;
     while ($id >= $idMin && $id <= $idMax) {
         if (!$used->{$id} && !$prevUsed->{$id} && !defined &$getid($id)) {
             $used->{$id} = 1;
             return $id;
         }
-        $used->{$id} = 1;
-        if ($up) { $id++; } else { $id--; }
+        $id += $delta;
     }
     die "$0: out of free UIDs or GIDs\n";
 }
@@ -77,19 +76,19 @@ sub allocGid {
         $gidsUsed{$prevGid} = 1;
         return $prevGid;
     }
-    return allocId(\%gidsUsed, \%gidsPrevUsed, 400, 999, 0, sub { my ($gid) = @_; getgrgid($gid) });
+    return allocId(\%gidsUsed, \%gidsPrevUsed, 400, 999, -1, sub { my ($gid) = @_; getgrgid($gid) });
 }
 
 sub allocUid {
     my ($name, $isSystemUser) = @_;
-    my ($min, $max, $up) = $isSystemUser ? (400, 999, 0) : (1000, 29999, 1);
+    my ($min, $max, $delta) = $isSystemUser ? (400, 999, -1) : (1000, 29999, 1);
     my $prevUid = $uidMap->{$name};
     if (defined $prevUid && $prevUid >= $min && $prevUid <= $max && !defined $uidsUsed{$prevUid}) {
         dry_print("reviving", "would revive", "user '$name' with UID $prevUid");
         $uidsUsed{$prevUid} = 1;
         return $prevUid;
     }
-    return allocId(\%uidsUsed, \%uidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
+    return allocId(\%uidsUsed, \%uidsPrevUsed, $min, $max, $delta, sub { my ($uid) = @_; getpwuid($uid) });
 }
 
 # Read the declared users/groups
@@ -336,18 +335,14 @@ sub allocSubUid {
     my ($name, @rest) = @_;
 
     # TODO: No upper bounds?
-    my ($min, $max, $up) = (100000, 100000 * 100, 1);
+    my ($min, $max, $delta) = (100000, 100000 + 100 * 65536, 65536);
     my $prevId = $subUidMap->{$name};
     if (defined $prevId && !defined $subUidsUsed{$prevId}) {
         $subUidsUsed{$prevId} = 1;
         return $prevId;
     }
 
-    my $id = allocId(\%subUidsUsed, \%subUidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
-    my $offset = $id - 100000;
-    my $count = $offset * 65536;
-    my $subordinate = 100000 + $count;
-    return $subordinate;
+    return allocId(\%subUidsUsed, \%subUidsPrevUsed, $min, $max, $delta, sub { undef });
 }
 
 my @subGids;
@@ -367,6 +362,14 @@ foreach my $u (values %usersOut) {
 
     if($u->{autoSubUidGidRange}) {
         my $subordinate = allocSubUid($name);
+        if (defined $subUidMap->{$name} && $subUidMap->{$name} != $subordinate) {
+          print STDERR "warning: The subuids for '$name' changed, as they coincided with the subuids of a different user (see /etc/subuid). "
+            . "The range now starts with $subordinate instead of $subUidMap->{$name}. "
+            . "If the subuids were used (e.g. with rootless container managers like podman), please change the ownership of affected files accordingly. "
+            . "Alternatively, to keep the old overlapping ranges, add this to the system configuration: "
+            . "users.users.$name.subUidRanges = [{startUid = $subUidMap->{$name}; count = 65536;}]; "
+            . "users.users.$name.subGidRanges = [{startGid = $subUidMap->{$name}; count = 65536;}];\n";
+        }
         $subUidMap->{$name} = $subordinate;
         my $value = join(":", ($name, $subordinate, 65536));
         push @subUids, $value;

nixos/modules/security/apparmor.nix

@@ -172,7 +172,7 @@ in
               logfiles = /dev/stdin
 
               parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
-              ldd = ${pkgs.glibc.bin}/bin/ldd
+              ldd = ${lib.getExe' pkgs.stdenv.cc.libc "ldd"}
               logger = ${pkgs.util-linux}/bin/logger
 
               # customize how file ownership permissions are presented
@@ -275,8 +275,5 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [
-    julm
-    grimmauld
-  ];
+  meta.maintainers = lib.teams.apparmor.members;
 }

nixos/tests/postgresql/anonymizer.nix

@@ -20,7 +20,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             extensions = ps: [ ps.anonymizer ];
             settings.shared_preload_libraries = [ "anon" ];
           };

nixos/tests/postgresql/pgjwt.nix

@@ -24,7 +24,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             extensions =
               ps: with ps; [
                 pgjwt

nixos/tests/postgresql/postgresql-jit.nix

@@ -51,5 +51,4 @@ let
 in
 genTests {
   inherit makeTestFor;
-  filter = n: _: lib.hasSuffix "_jit" n;
 }

nixos/tests/postgresql/postgresql-tls-client-cert.nix

@@ -51,7 +51,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             enableTCPIP = true;
             ensureUsers = [
               {

nixos/tests/postgresql/postgresql-wal-receiver.nix

@@ -32,7 +32,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             settings = {
               max_replication_slots = 10;
               max_wal_senders = 10;

nixos/tests/postgresql/postgresql.nix

@@ -15,41 +15,33 @@ let
       postgresql-clauses = makeEnsureTestFor package;
     };
 
-  test-sql =
-    enablePLv8Test:
-    pkgs.writeText "postgresql-test" (
-      ''
-        CREATE EXTENSION pgcrypto; -- just to check if lib loading works
-        CREATE TABLE sth (
-          id int
-        );
-        INSERT INTO sth (id) VALUES (1);
-        INSERT INTO sth (id) VALUES (1);
-        INSERT INTO sth (id) VALUES (1);
-        INSERT INTO sth (id) VALUES (1);
-        INSERT INTO sth (id) VALUES (1);
-        CREATE TABLE xmltest ( doc xml );
-        INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
-      ''
-      + lib.optionalString enablePLv8Test ''
-        -- check if hardening gets relaxed
-        CREATE EXTENSION plv8;
-        -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
-        DO $$
-          let xs = [];
-          for (let i = 0, n = 400000; i < n; i++) {
-              xs.push(Math.round(Math.random() * n))
-          }
-          console.log(xs.reduce((acc, x) => acc + x, 0));
-        $$ LANGUAGE plv8;
-      ''
+  test-sql = pkgs.writeText "postgresql-test" (''
+    CREATE EXTENSION pgcrypto; -- just to check if lib loading works
+    CREATE TABLE sth (
+      id int
     );
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    CREATE TABLE xmltest ( doc xml );
+    INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
+
+    -- check if hardening gets relaxed
+    CREATE EXTENSION plv8;
+    -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
+    DO $$
+      let xs = [];
+      for (let i = 0, n = 400000; i < n; i++) {
+          xs.push(Math.round(Math.random() * n))
+      }
+      console.log(xs.reduce((acc, x) => acc + x, 0));
+    $$ LANGUAGE plv8;
+  '');
 
   makeTestForWithBackupAll =
     package: backupAll:
-    let
-      enablePLv8Check = !package.pkgs.plv8.meta.broken;
-    in
     makeTest {
       name = "postgresql${lib.optionalString backupAll "-backup-all"}-${package.name}";
       meta = with lib.maintainers; {
@@ -62,12 +54,9 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
-            # plv8 doesn't support postgresql with JIT, so we only run the test
-            # for the non-jit variant.
             # TODO(@Ma27) split this off into its own VM test and move a few other
             # extension tests to use postgresqlTestExtension.
-            extensions = lib.mkIf enablePLv8Check (ps: with ps; [ plv8 ]);
+            extensions = ps: with ps; [ plv8 ];
           };
 
           services.postgresqlBackup = {
@@ -94,7 +83,7 @@ let
 
           with subtest("Postgresql is available just after unit start"):
               machine.succeed(
-                  "cat ${test-sql enablePLv8Check} | sudo -u postgres psql"
+                  "cat ${test-sql} | sudo -u postgres psql"
               )
 
           with subtest("Postgresql survives restart (bug #1735)"):
@@ -184,7 +173,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             ensureUsers = [
               {
                 name = "all-clauses";

nixos/tests/postgresql/wal2json.nix

@@ -17,7 +17,6 @@ let
         services.postgresql = {
           inherit package;
           enable = true;
-          enableJIT = lib.hasInfix "-jit-" package.name;
           extensions = with package.pkgs; [ wal2json ];
           settings = {
             wal_level = "logical";

pkgs/applications/audio/cd-discid/default.nix

@@ -2,7 +2,6 @@
   fetchurl,
   lib,
   stdenv,
-  IOKit ? null,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,8 +18,6 @@ stdenv.mkDerivation rec {
     "INSTALL=install"
   ];
 
-  buildInputs = [ ] ++ lib.optional stdenv.hostPlatform.isDarwin IOKit;
-
   meta = with lib; {
     homepage = "http://linukz.org/cd-discid.shtml";
     license = licenses.gpl2Plus;

pkgs/applications/audio/chuck/default.nix

@@ -9,13 +9,6 @@
   which,
   DarwinTools,
   xcbuild,
-  AppKit,
-  Carbon,
-  CoreAudio,
-  CoreMIDI,
-  CoreServices,
-  Kernel,
-  MultitouchSupport,
 }:
 
 stdenv.mkDerivation rec {
@@ -38,18 +31,7 @@ stdenv.mkDerivation rec {
       xcbuild
     ];
 
-  buildInputs =
-    [ libsndfile ]
-    ++ lib.optional (!stdenv.hostPlatform.isDarwin) alsa-lib
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Carbon
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Kernel
-      MultitouchSupport
-    ];
+  buildInputs = [ libsndfile ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) alsa-lib;
 
   patches = [ ./darwin-limits.patch ];
 

pkgs/applications/audio/cmus/default.nix

@@ -6,9 +6,6 @@
   ncurses,
   pkg-config,
   libiconv,
-  CoreAudio,
-  AudioUnit,
-  VideoToolbox,
 
   alsaSupport ? stdenv.hostPlatform.isLinux,
   alsa-lib ? null,
@@ -152,9 +149,6 @@ stdenv.mkDerivation rec {
     [ ncurses ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      CoreAudio
-      AudioUnit
-      VideoToolbox
     ]
     ++ lib.flatten (lib.concatMap (a: a.deps) opts);
 

pkgs/applications/audio/csound/default.nix

@@ -9,10 +9,6 @@
   bison,
   boost,
   gettext,
-  Accelerate,
-  AudioUnit,
-  CoreAudio,
-  CoreMIDI,
   portaudio,
   alsa-lib ? null,
   libpulseaudio ? null,
@@ -61,10 +57,6 @@ stdenv.mkDerivation {
       boost
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      AudioUnit
-      CoreAudio
-      CoreMIDI
       portaudio
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux (

pkgs/applications/audio/espeak-ng/default.nix

@@ -17,9 +17,6 @@
   pcaudiolib,
   sonicSupport ? true,
   sonic,
-  CoreAudio,
-  AudioToolbox,
-  AudioUnit,
   alsa-plugins,
   makeWrapper,
 }:
@@ -63,12 +60,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     lib.optional mbrolaSupport mbrola
     ++ lib.optional pcaudiolibSupport pcaudiolib
-    ++ lib.optional sonicSupport sonic
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreAudio
-      AudioToolbox
-      AudioUnit
-    ];
+    ++ lib.optional sonicSupport sonic;
 
   # touch ChangeLog to avoid below error on darwin:
   # Makefile.am: error: required file './ChangeLog.md' not found

pkgs/applications/audio/ft2-clone/default.nix

@@ -7,10 +7,6 @@
   alsa-lib,
   SDL2,
   libiconv,
-  CoreAudio,
-  CoreMIDI,
-  CoreServices,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -30,10 +26,6 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Cocoa
     ];
 
   passthru.tests = {

pkgs/applications/audio/grandorgue/default.nix

@@ -16,7 +16,6 @@
   libicns,
   yaml-cpp,
   makeWrapper,
-  Cocoa,
   includeDemo ? true,
 }:
 
@@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
       alsa-lib
       udev
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ]
     ++ lib.optional jackaudioSupport libjack2;
 
   cmakeFlags =

pkgs/applications/audio/listenbrainz-mpd/default.nix

@@ -7,9 +7,6 @@
   openssl,
   libiconv,
   sqlite,
-  Security,
-  SystemConfiguration,
-  CoreFoundation,
   installShellFiles,
   asciidoctor,
 }:
@@ -41,9 +38,6 @@ rustPlatform.buildRustPackage rec {
       if stdenv.hostPlatform.isDarwin then
         [
           libiconv
-          Security
-          SystemConfiguration
-          CoreFoundation
         ]
       else
         [

pkgs/applications/audio/littlegptracker/default.nix

@@ -5,7 +5,6 @@
   SDL2,
   python3,
   jack2,
-  Foundation,
   alsa-lib,
   pkg-config,
 }:
@@ -31,7 +30,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [ SDL2 ]
     ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform alsa-lib) alsa-lib
-    ++ lib.optional stdenv.hostPlatform.isDarwin Foundation
     ++ lib.optional stdenv.hostPlatform.isLinux jack2;
 
   preBuild = ''

pkgs/applications/audio/master_me/default.nix

@@ -8,7 +8,6 @@
   libXrandr,
   pkg-config,
   python3,
-  Cocoa,
 }:
 stdenv.mkDerivation rec {
   pname = "master_me";
@@ -28,7 +27,6 @@ stdenv.mkDerivation rec {
       libGL
       python3
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libX11
       libXext

pkgs/applications/audio/midivisualizer/default.nix

@@ -12,13 +12,6 @@
   libXcursor,
   gtk3,
   ffmpeg-full,
-  AppKit,
-  Carbon,
-  Cocoa,
-  CoreAudio,
-  CoreMIDI,
-  CoreServices,
-  Kernel,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -49,15 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
       libXinerama
       libXcursor
       gtk3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Carbon
-      Cocoa
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Kernel
     ];
 
   installPhase =

pkgs/applications/audio/minidsp/default.nix

@@ -4,8 +4,6 @@
   rustPlatform,
   stdenv,
   libusb1,
-  AppKit,
-  IOKit,
   pkg-config,
 }:
 rustPlatform.buildRustPackage rec {
@@ -24,12 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "-p minidsp -p minidsp-daemon" ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ libusb1 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      IOKit
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libusb1 ];
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 

pkgs/applications/audio/mmlgui/default.nix

@@ -9,8 +9,6 @@
   libX11,
   libXau,
   libXdmcp,
-  Carbon,
-  Cocoa,
   cppunit,
 }:
 
@@ -61,10 +59,6 @@ stdenv.mkDerivation {
       libX11
       libXau
       libXdmcp
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
     ];
 
   checkInputs = [

pkgs/applications/audio/moc/default.nix

@@ -11,7 +11,6 @@
   popt,
   libtool,
   libiconv,
-  CoreServices,
   # Sound sub-systems
   alsaSupport ? (!stdenv.hostPlatform.isDarwin),
   alsa-lib,
@@ -125,7 +124,6 @@ stdenv.mkDerivation {
     ++ lib.optional samplerateSupport libsamplerate
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      CoreServices
     ];
 
   configureFlags = [

pkgs/applications/audio/mpg123/default.nix

@@ -10,8 +10,6 @@
   withPulse ? stdenv.hostPlatform.isLinux,
   libpulseaudio,
   withCoreAudio ? stdenv.hostPlatform.isDarwin,
-  AudioUnit,
-  AudioToolbox,
   withJack ? stdenv.hostPlatform.isUnix,
   jack,
   withConplay ? !stdenv.hostPlatform.isWindows,
@@ -45,8 +43,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withAlsa [ alsa-lib ]
     ++ lib.optionals withPulse [ libpulseaudio ]
     ++ lib.optionals withCoreAudio [
-      AudioUnit
-      AudioToolbox
     ]
     ++ lib.optionals withJack [ jack ]
   );

pkgs/applications/audio/muso/default.nix

@@ -5,7 +5,6 @@
   rustPlatform,
   pkg-config,
   wrapGAppsHook3,
-  CoreServices,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,7 +22,6 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     wrapGAppsHook3
   ];
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin CoreServices;
 
   preConfigure = ''
     substituteInPlace lib/utils.rs \

pkgs/applications/audio/parrot/default.nix

@@ -9,9 +9,7 @@
   unstableGitUpdater,
   openssl,
   pkg-config,
-  stdenv,
   yt-dlp,
-  Security,
 }:
 rustPlatform.buildRustPackage {
   pname = "parrot";
@@ -36,7 +34,7 @@ rustPlatform.buildRustPackage {
   buildInputs = [
     libopus
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/parrot \

pkgs/applications/audio/schismtracker/default.nix

@@ -9,7 +9,6 @@
   SDL2,
   libX11,
   libXext,
-  Cocoa,
   utf8proc,
   nix-update-script,
 }:
@@ -64,8 +63,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       libXext
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+    ];
 
   enableParallelBuilding = true;
 

pkgs/applications/audio/snapcast/default.nix

@@ -13,8 +13,6 @@
   libvorbis,
   libopus,
   soxr,
-  IOKit,
-  AudioToolbox,
   aixlog,
   popl,
   pulseaudioSupport ? false,
@@ -55,11 +53,7 @@ stdenv.mkDerivation rec {
       openssl
     ]
     ++ lib.optional pulseaudioSupport libpulseaudio
-    ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      AudioToolbox
-    ];
+    ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib;
 
   TARGET = lib.optionalString stdenv.hostPlatform.isDarwin "MACOS";
 

pkgs/applications/audio/xmp/default.nix

@@ -6,8 +6,6 @@
   pkg-config,
   alsa-lib,
   libxmp,
-  AudioUnit,
-  CoreAudio,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,13 +23,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
   ];
-  buildInputs =
-    [ libxmp ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioUnit
-      CoreAudio
-    ];
+  buildInputs = [ libxmp ] ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ];
 
   meta = with lib; {
     description = "Extended module player";

pkgs/applications/blockchains/alfis/default.nix

@@ -7,9 +7,6 @@
   makeWrapper,
   webkitgtk_4_0,
   zenity,
-  Cocoa,
-  Security,
-  WebKit,
   withGui ? true,
 }:
 
@@ -31,13 +28,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     makeWrapper
   ];
-  buildInputs =
-    lib.optional stdenv.hostPlatform.isDarwin Security
-    ++ lib.optional (withGui && stdenv.hostPlatform.isLinux) webkitgtk_4_0
-    ++ lib.optionals (withGui && stdenv.hostPlatform.isDarwin) [
-      Cocoa
-      WebKit
-    ];
+  buildInputs = lib.optional (withGui && stdenv.hostPlatform.isLinux) webkitgtk_4_0;
 
   buildNoDefaultFeatures = true;
   buildFeatures = [ "doh" ] ++ lib.optional withGui "webgui";

pkgs/applications/blockchains/electrs/default.nix

@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   rocksdb_7_10,
-  Security,
 }:
 
 let
@@ -31,8 +29,6 @@ rustPlatform.buildRustPackage rec {
   ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
   ROCKSDB_LIB_DIR = "${rocksdb}/lib";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {

pkgs/applications/blockchains/lighthouse/default.nix

@@ -1,6 +1,5 @@
 {
   cmake,
-  CoreFoundation,
   fetchFromGitHub,
   fetchurl,
   lib,
@@ -11,10 +10,8 @@
   protobuf,
   rustPlatform,
   rust-jemalloc-sys,
-  Security,
   sqlite,
   stdenv,
-  SystemConfiguration,
   testers,
 }:
 
@@ -59,11 +56,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      Security
-      SystemConfiguration
     ];
 
   depositContractSpec = fetchurl {

pkgs/applications/blockchains/monero-cli/default.nix

@@ -16,10 +16,6 @@
   unbound,
   zeromq,
 
-  # darwin
-  CoreData,
-  IOKit,
-
   trezorSupport ? true,
   hidapi,
   libusb1,
@@ -88,10 +84,6 @@ stdenv.mkDerivation rec {
       unbound
       zeromq
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      CoreData
-    ]
     ++ lib.optionals trezorSupport [
       python3
       hidapi

pkgs/applications/blockchains/optimism/geth.nix

@@ -1,10 +1,7 @@
 {
-  stdenv,
   lib,
   buildGoModule,
   fetchFromGitHub,
-  libobjc,
-  IOKit,
 }:
 
 buildGoModule rec {
@@ -36,12 +33,6 @@ buildGoModule rec {
 
   vendorHash = "sha256-pcIydpKWZt3vwShwzGlPKGq+disdxYFOB8gxHou3mVU=";
 
-  # Fix for usb-related segmentation faults on darwin
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libobjc
-    IOKit
-  ];
-
   ldflags = [
     "-s"
     "-w"

pkgs/applications/blockchains/polkadot/default.nix

@@ -10,8 +10,6 @@
   rustPlatform,
   rustc,
   stdenv,
-  Security,
-  SystemConfiguration,
 }:
 
 let
@@ -60,13 +58,9 @@ rustPlatform.buildRustPackage rec {
   ];
 
   # NOTE: jemalloc is used by default on Linux with unprefixed enabled
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ rust-jemalloc-sys-unprefixed ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ rust-jemalloc-sys-unprefixed ];
 
   checkInputs = [
     cacert

pkgs/applications/blockchains/snarkos/default.nix

@@ -3,7 +3,6 @@
   fetchFromGitHub,
   lib,
   rustPlatform,
-  Security,
   curl,
   pkg-config,
   openssl,
@@ -41,7 +40,6 @@ rustPlatform.buildRustPackage rec {
   # ROCKSDB_LIB_DIR="${rocksdb}/lib";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
     curl
   ];
 

pkgs/applications/blockchains/teos/default.nix

@@ -4,8 +4,6 @@
   fetchFromGitHub,
   protobuf,
   rustfmt,
-  stdenv,
-  darwin,
   pkg-config,
   openssl,
 }:
@@ -42,10 +40,6 @@ in
       rustfmt
     ];
 
-    buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
-
     passthru.updateScript = updateScript;
 
     __darwinAllowLocalNetworking = true;
@@ -70,13 +64,9 @@ in
       rustfmt
     ];
 
-    buildInputs =
-      [
-        openssl
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.SystemConfiguration
-      ];
+    buildInputs = [
+      openssl
+    ];
 
     passthru.updateScript = updateScript;
 

pkgs/applications/blockchains/zcash/default.nix

@@ -15,7 +15,6 @@
   makeWrapper,
   rustPlatform,
   pkg-config,
-  Security,
   stdenv,
   testers,
   tl-expected,
@@ -55,19 +54,15 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      boost
-      db62
-      libevent
-      libsodium
-      tl-expected
-      utf8cpp
-      zeromq
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    boost
+    db62
+    libevent
+    libsodium
+    tl-expected
+    utf8cpp
+    zeromq
+  ];
 
   # Use the stdenv default phases (./configure; make) instead of the
   # ones from buildRustPackage.

pkgs/applications/editors/emacs/default.nix

@@ -6,21 +6,6 @@ lib.makeScope pkgs.newScope (
     inherit (self) callPackage;
     inheritedArgs = {
       inherit (pkgs.darwin) sigtool;
-      inherit (pkgs.darwin.apple_sdk.frameworks)
-        Accelerate
-        AppKit
-        Carbon
-        Cocoa
-        GSS
-        ImageCaptureCore
-        ImageIO
-        IOKit
-        OSAKit
-        Quartz
-        QuartzCore
-        WebKit
-        ;
-      inherit (pkgs.darwin.apple_sdk_11_0.frameworks) UniformTypeIdentifiers;
     };
   in
   {

pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix

@@ -810,12 +810,6 @@ let
           osx-dictionary =
             if pkgs.stdenv.hostPlatform.isDarwin then
               super.osx-dictionary.overrideAttrs (old: {
-                buildInputs =
-                  old.buildInputs
-                  ++ (with pkgs.darwin.apple_sdk.frameworks; [
-                    CoreServices
-                    Foundation
-                  ]);
                 postBuild =
                   (old.postBuild or "")
                   + ''

pkgs/applications/editors/emacs/make-emacs.nix

@@ -118,21 +118,6 @@
       "lucid"
   ),
 
-  # macOS dependencies for NS and macPort
-  Accelerate,
-  AppKit,
-  Carbon,
-  Cocoa,
-  GSS,
-  IOKit,
-  ImageCaptureCore,
-  ImageIO,
-  OSAKit,
-  Quartz,
-  QuartzCore,
-  UniformTypeIdentifiers,
-  WebKit,
-
   # test
   callPackage,
 }:
@@ -376,27 +361,6 @@ mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals withNS [
       librsvg
-      AppKit
-      GSS
-      ImageIO
-    ]
-    ++ lib.optionals (variant == "macport") [
-      Accelerate
-      AppKit
-      Carbon
-      Cocoa
-      IOKit
-      OSAKit
-      Quartz
-      QuartzCore
-      WebKit
-      # TODO are these optional?
-      GSS
-      ImageCaptureCore
-      ImageIO
-    ]
-    ++ lib.optionals (variant == "macport" && stdenv.hostPlatform.isAarch64) [
-      UniformTypeIdentifiers
     ];
 
   # Emacs needs to find movemail at run time, see info (emacs) Movemail

pkgs/applications/editors/lapce/default.nix

@@ -13,7 +13,6 @@
   gtk3,
   openssl,
   libGL,
-  libobjc,
   libxkbcommon,
   wrapGAppsHook3,
   wayland,
@@ -77,9 +76,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       fontconfig
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
     ];
 
   postInstall =

pkgs/applications/editors/libresprite/default.nix

@@ -22,9 +22,6 @@
   SDL2,
   SDL2_image,
   lua,
-  AppKit,
-  Cocoa,
-  Foundation,
 
   nixosTests,
 }:
@@ -48,29 +45,23 @@ stdenv.mkDerivation (finalAttrs: {
     gtest
   ];
 
-  buildInputs =
-    [
-      curl
-      freetype
-      giflib
-      libjpeg
-      libpng
-      libwebp
-      libarchive
-      libX11
-      pixman
-      tinyxml-2
-      zlib
-      SDL2
-      SDL2_image
-      lua
-      # no v8 due to missing libplatform and libbase
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
-      Foundation
-    ];
+  buildInputs = [
+    curl
+    freetype
+    giflib
+    libjpeg
+    libpng
+    libwebp
+    libarchive
+    libX11
+    pixman
+    tinyxml-2
+    zlib
+    SDL2
+    SDL2_image
+    lua
+    # no v8 due to missing libplatform and libbase
+  ];
 
   cmakeFlags = [
     "-DWITH_DESKTOP_INTEGRATION=ON"

pkgs/applications/editors/lite-xl/default.nix

@@ -1,6 +1,5 @@
 {
   fetchFromGitHub,
-  Foundation,
   freetype,
   lib,
   lua5_4,
@@ -29,16 +28,12 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      freetype
-      lua5_4
-      pcre2
-      SDL2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-    ];
+  buildInputs = [
+    freetype
+    lua5_4
+    pcre2
+    SDL2
+  ];
 
   mesonFlags = [
     "-Duse_system_lua=true"

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1231";
+  version = "9.1.1336";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-buqA6OM2FcxPefGQIGm8kD8ZWcskw7K/VO3xCRw7SbI=";
+    hash = "sha256-fF1qRPdVzQiYH/R0PSmKR/zFVVuCtT6lPN1x1Th5SgA=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/default.nix

@@ -14,9 +14,6 @@
     url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   },
-  # apple frameworks
-  Carbon,
-  Cocoa,
 }:
 
 let
@@ -41,16 +38,11 @@ stdenv.mkDerivation {
     gettext
     pkg-config
   ];
-  buildInputs =
-    [
-      ncurses
-      bash
-      gawk
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
-    ];
+  buildInputs = [
+    ncurses
+    bash
+    gawk
+  ];
 
   strictDeps = true;
 

pkgs/applications/editors/vim/full.nix

@@ -30,13 +30,6 @@
   makeWrapper,
   wrapGAppsHook3,
 
-  # apple frameworks
-  CoreServices,
-  CoreData,
-  Cocoa,
-  Foundation,
-  libobjc,
-
   features ? "huge", # One of tiny, small, normal, big or huge
   wrapPythonDrv ? false,
   guiSupport ? config.vim.gui or (if stdenv.hostPlatform.isDarwin then "gtk2" else "gtk3"),
@@ -195,13 +188,6 @@ stdenv.mkDerivation {
     ]
     ++ lib.optional (guiSupport == "gtk2") gtk2-x11
     ++ lib.optional (guiSupport == "gtk3") gtk3-x11
-    ++ lib.optionals darwinSupport [
-      CoreServices
-      CoreData
-      Cocoa
-      Foundation
-      libobjc
-    ]
     ++ lib.optional luaSupport lua
     ++ lib.optional pythonSupport python3
     ++ lib.optional tclSupport tcl

pkgs/applications/editors/vim/macvim.nix

@@ -150,7 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
   postConfigure = ''
     substituteInPlace src/auto/config.mk \
       --replace " -L${stdenv.cc.libc}/lib" "" \
-      --replace " -L${darwin.libobjc}/lib" "" \
       --replace " -L${darwin.libunwind}/lib" "" \
       --replace " -L${libiconv}/lib" ""
 

pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix

@@ -10,8 +10,6 @@
   esbuild,
   pkg-config,
   libsecret,
-  stdenv,
-  darwin,
   setDefaultServerPath ? true,
 }:
 
@@ -39,18 +37,13 @@ let
     buildInputs = [
       pkgsBuildBuild.libsecret
     ];
-    nativeBuildInputs =
-      [
-        jq
-        moreutils
-        esbuild
-        # Required by `keytar`, which is a dependency of `vsce`.
-        pkg-config
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.AppKit
-        darwin.apple_sdk.frameworks.Security
-      ];
+    nativeBuildInputs = [
+      jq
+      moreutils
+      esbuild
+      # Required by `keytar`, which is a dependency of `vsce`.
+      pkg-config
+    ];
 
     # Follows https://github.com/rust-lang/rust-analyzer/blob/41949748a6123fd6061eb984a47f4fe780525e63/xtask/src/dist.rs#L39-L65
     installPhase = ''

pkgs/applications/emulators/dosbox-x/default.nix

@@ -3,10 +3,7 @@
   stdenv,
   fetchFromGitHub,
   alsa-lib,
-  AudioUnit,
   autoreconfHook,
-  Carbon,
-  Cocoa,
   ffmpeg,
   fluidsynth,
   freetype,
@@ -86,11 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
       alsa-lib
       libxkbfile
       libXrandr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioUnit
-      Carbon
-      Cocoa
     ];
 
   # Tests for SDL_net.h for modem & IPX support, not automatically picked up due to being in SDL2 subdirectory

pkgs/applications/emulators/dosbox/default.nix

@@ -11,7 +11,6 @@
   graphicsmagick,
   libGL,
   libGLU,
-  OpenGL,
   libpng,
   makeDesktopItem,
 }:
@@ -46,17 +45,10 @@ stdenv.mkDerivation rec {
       SDL_sound
       libpng
     ]
-    ++ (
-      if stdenv.hostPlatform.isDarwin then
-        [
-          OpenGL
-        ]
-      else
-        [
-          libGL
-          libGLU
-        ]
-    );
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      libGL
+      libGLU
+    ];
 
   # Tests for SDL_net.h for modem & IPX support, not automatically picked up due to being in SDL subdirectory
   env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL_net}/include/SDL";

pkgs/applications/emulators/mame/default.nix

@@ -32,12 +32,8 @@
   which,
   writeScript,
   zlib,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
-in
 stdenv.mkDerivation rec {
   pname = "mame";
   version = "0.276";
@@ -105,8 +101,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libpcap
-      CoreAudioKit
-      ForceFeedback
     ];
 
   nativeBuildInputs = [

pkgs/applications/gis/whitebox-tools/default.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   cmake,
   rustPlatform,
   pkg-config,
@@ -9,7 +8,6 @@
   gtk3,
   glib,
   openssl,
-  Security,
   nix-update-script,
 }:
 
@@ -32,7 +30,7 @@ rustPlatform.buildRustPackage rec {
     glib
     gtk3
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
 
   nativeBuildInputs = [
     cmake

pkgs/applications/graphics/ImageMagick/6.x.nix

@@ -45,8 +45,6 @@
   libde265Support ? true,
   libde265,
   fftw,
-  ApplicationServices,
-  Foundation,
   testers,
 }:
 
@@ -124,11 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional djvulibreSupport djvulibre
     ++ lib.optional openexrSupport openexr
     ++ lib.optional librsvgSupport librsvg
-    ++ lib.optional openjpegSupport openjpeg
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Foundation
-    ];
+    ++ lib.optional openjpegSupport openjpeg;
 
   propagatedBuildInputs =
     [ fftw ]

pkgs/applications/graphics/ImageMagick/default.nix

@@ -52,8 +52,6 @@
   potrace,
   coreutils,
   curl,
-  ApplicationServices,
-  Foundation,
   testers,
   nixos-icons,
   perlPackages,
@@ -147,11 +145,7 @@ stdenv.mkDerivation (finalAttrs: {
       librsvg
       pango
     ]
-    ++ lib.optional openjpegSupport openjpeg
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Foundation
-    ];
+    ++ lib.optional openjpegSupport openjpeg;
 
   propagatedBuildInputs =
     [ curl ]

pkgs/applications/graphics/c3d/default.nix

@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   itk,
-  Cocoa,
 }:
 
 stdenv.mkDerivation {
@@ -19,7 +18,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ itk ] ++ lib.optional stdenv.hostPlatform.isDarwin Cocoa;
+  buildInputs = [ itk ];
 
   cmakeFlags = [ "-DCONVERT3D_USE_ITK_REMOTE_MODULES=OFF" ];
 

pkgs/applications/graphics/djview/default.nix

@@ -12,7 +12,6 @@
   qttools,
   xorg,
   libtiff,
-  darwin,
 }:
 
 mkDerivation rec {
@@ -42,7 +41,7 @@ mkDerivation rec {
     qtbase
     xorg.libXt
     libtiff
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.AGL;
+  ];
 
   preConfigure = ''
     NOCONFIGURE=1 ./autogen.sh

pkgs/applications/graphics/emulsion/default.nix

@@ -16,11 +16,6 @@
   libxcb,
   libxkbcommon,
   wayland,
-  AppKit,
-  CoreGraphics,
-  CoreServices,
-  Foundation,
-  OpenGL,
 }:
 let
   rpathLibs =
@@ -59,15 +54,7 @@ rustPlatform.buildRustPackage rec {
     python3
   ];
 
-  buildInputs =
-    rpathLibs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      CoreGraphics
-      CoreServices
-      Foundation
-      OpenGL
-    ];
+  buildInputs = rpathLibs;
 
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/emulsion

pkgs/applications/graphics/epick/default.nix

@@ -9,7 +9,6 @@
   freetype,
   libGL,
   xorg,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -31,19 +30,15 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      expat
-      fontconfig
-      freetype
-      xorg.libX11
-      xorg.libXcursor
-      xorg.libXi
-      xorg.libXrandr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    expat
+    fontconfig
+    freetype
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+  ];
 
   postInstall = ''
     install -Dm444 assets/epick.desktop -t $out/share/applications

pkgs/applications/graphics/f3d/default.nix

@@ -11,8 +11,6 @@
   # See https://github.com/NixOS/nixpkgs/pull/324022. This may change later.
   vtk_9,
   autoPatchelfHook,
-  Cocoa,
-  OpenGL,
   python3Packages,
   opencascade-occt,
   assimp,
@@ -64,10 +62,6 @@ stdenv.mkDerivation rec {
       assimp
       fontconfig
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      OpenGL
-    ]
     ++ lib.optionals withPythonBinding [
       python3Packages.python
       # Using C++ header files, not Python import

pkgs/applications/graphics/foxotron/default.nix

@@ -17,12 +17,6 @@
   libGLU,
   alsa-lib,
   fontconfig,
-  AVFoundation,
-  Carbon,
-  Cocoa,
-  CoreAudio,
-  Kernel,
-  OpenGL,
 }:
 
 stdenv.mkDerivation rec {
@@ -75,14 +69,6 @@ stdenv.mkDerivation rec {
       alsa-lib
       fontconfig
       libGLU
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AVFoundation
-      Carbon
-      Cocoa
-      CoreAudio
-      Kernel
-      OpenGL
     ];
 
   env.NIX_CFLAGS_COMPILE = toString [

pkgs/applications/graphics/gimp/2.0/default.nix

@@ -47,8 +47,6 @@
   libgudev,
   openexr,
   desktopToDarwinBundle,
-  AppKit,
-  Cocoa,
   gtk-mac-integration-gtk2,
   withPython ? false,
   python2,
@@ -144,8 +142,6 @@ stdenv.mkDerivation (finalAttrs: {
       mypaint-brushes1
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
       gtk-mac-integration-gtk2
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [

pkgs/applications/graphics/gimp/default.nix

@@ -66,8 +66,6 @@
   adwaita-icon-theme,
   alsa-lib,
   desktopToDarwinBundle,
-  AppKit,
-  Cocoa,
 }:
 
 let
@@ -202,8 +200,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       llvmPackages.openmp
-      AppKit
-      Cocoa
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libgudev

pkgs/applications/graphics/gnome-obfuscate/default.nix

@@ -17,7 +17,6 @@
   gtk4,
   gdk-pixbuf,
   libadwaita,
-  Foundation,
   nix-update-script,
 }:
 
@@ -60,16 +59,12 @@ stdenv.mkDerivation (finalAttrs: {
     desktop-file-utils
   ];
 
-  buildInputs =
-    [
-      glib
-      gtk4
-      gdk-pixbuf
-      libadwaita
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-    ];
+  buildInputs = [
+    glib
+    gtk4
+    gdk-pixbuf
+    libadwaita
+  ];
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/applications/graphics/menyoki/default.nix

@@ -8,7 +8,6 @@
   withSixel ? false,
   libsixel,
   xorg,
-  AppKit,
   withSki ? true,
 }:
 
@@ -36,8 +35,7 @@ rustPlatform.buildRustPackage rec {
         libX11
         libXrandr
       ]
-    )
-    ++ lib.optional stdenv.hostPlatform.isDarwin AppKit;
+    );
 
   buildNoDefaultFeatures = !withSki;
   buildFeatures = lib.optional withSixel "sixel";

pkgs/applications/graphics/ovito/default.nix

@@ -18,7 +18,6 @@
   qtbase,
   qtsvg,
   qttools,
-  VideoDecodeAcceleration,
   wrapQtAppsHook,
   copyDesktopItems,
   # needed to run natively on wayland
@@ -44,26 +43,22 @@ stdenv.mkDerivation rec {
     copyDesktopItems
   ];
 
-  buildInputs =
-    [
-      boost
-      bzip2
-      ffmpeg
-      fftwSinglePrec
-      hdf5
-      muparser
-      netcdf
-      openssl
-      python3
-      qscintilla
-      qtbase
-      qtsvg
-      qttools
-      qtwayland
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      VideoDecodeAcceleration
-    ];
+  buildInputs = [
+    boost
+    bzip2
+    ffmpeg
+    fftwSinglePrec
+    hdf5
+    muparser
+    netcdf
+    openssl
+    python3
+    qscintilla
+    qtbase
+    qtsvg
+    qttools
+    qtwayland
+  ];
 
   # manually create a desktop file
   desktopItems = [

pkgs/applications/graphics/tesseract/default.nix

@@ -1,17 +1,12 @@
 {
   callPackage,
   lowPrio,
-  Accelerate,
-  CoreGraphics,
-  CoreVideo,
 }:
 
 let
   base3 = callPackage ./tesseract3.nix { };
   base4 = callPackage ./tesseract4.nix { };
-  base5 = callPackage ./tesseract5.nix {
-    inherit Accelerate CoreGraphics CoreVideo;
-  };
+  base5 = callPackage ./tesseract5.nix { };
   languages = callPackage ./languages.nix { };
 in
 {

pkgs/applications/graphics/tesseract/tesseract5.nix

@@ -12,9 +12,6 @@
   libtiff,
   icu,
   pango,
-  Accelerate,
-  CoreGraphics,
-  CoreVideo,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,21 +32,15 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
-  buildInputs =
-    [
-      curl
-      leptonica
-      libarchive
-      libpng
-      libtiff
-      icu
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreGraphics
-      CoreVideo
-    ];
+  buildInputs = [
+    curl
+    leptonica
+    libarchive
+    libpng
+    libtiff
+    icu
+    pango
+  ];
 
   passthru.updateScript = nix-update-script { };
   meta = {

pkgs/applications/graphics/weylus/default.nix

@@ -19,10 +19,6 @@
   autoconf,
   libtool,
   typescript,
-  ApplicationServices,
-  Carbon,
-  Cocoa,
-  VideoToolbox,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -41,12 +37,6 @@ rustPlatform.buildRustPackage rec {
       ffmpeg
       x264
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Carbon
-      Cocoa
-      VideoToolbox
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       dbus
       libva

pkgs/applications/misc/audio/sox/default.nix

@@ -6,7 +6,6 @@
   autoreconfHook,
   autoconf-archive,
   pkg-config,
-  CoreAudio,
   enableAlsa ? true,
   alsa-lib,
   enableLibao ? true,
@@ -84,8 +83,7 @@ stdenv.mkDerivation {
       amrnb
       amrwb
     ]
-    ++ lib.optional enableLibpulseaudio libpulseaudio
-    ++ lib.optional stdenv.hostPlatform.isDarwin CoreAudio;
+    ++ lib.optional enableLibpulseaudio libpulseaudio;
 
   enableParallelBuilding = true;
 

pkgs/applications/misc/binocle/default.nix

@@ -4,13 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   makeWrapper,
-  AppKit,
-  CoreFoundation,
-  CoreGraphics,
-  CoreVideo,
-  Foundation,
-  Metal,
-  QuartzCore,
   xorg,
   vulkan-loader,
 }:
@@ -33,16 +26,6 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    CoreFoundation
-    CoreGraphics
-    CoreVideo
-    Foundation
-    Metal
-    QuartzCore
-  ];
-
   postInstall = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     wrapProgram $out/bin/binocle \
       --suffix LD_LIBRARY_PATH : ${

pkgs/applications/misc/diff-pdf/default.nix

@@ -8,7 +8,6 @@
   cairo,
   poppler,
   wxGTK,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -31,7 +30,7 @@ stdenv.mkDerivation rec {
     cairo
     poppler
     wxGTK
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  ];
 
   preConfigure = "./bootstrap";
 

pkgs/applications/misc/eureka-ideas/default.nix

@@ -5,8 +5,6 @@
   pkg-config,
   libgit2,
   openssl,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,14 +23,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+  ];
 
   useNextest = true;
 

pkgs/applications/misc/far2l/default.nix

@@ -17,12 +17,6 @@
   gnutar,
   p7zip,
   xz,
-  IOKit,
-  Carbon,
-  Cocoa,
-  AudioToolbox,
-  OpenGL,
-  System,
   withTTYX ? true,
   libX11,
   withGUI ? true,
@@ -94,15 +88,7 @@ stdenv.mkDerivation rec {
         debugpy
         pcpp
       ]
-    )
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      Carbon
-      Cocoa
-      AudioToolbox
-      OpenGL
-      System
-    ];
+    );
 
   postPatch = ''
     patchShebangs python/src/prebuild.sh

pkgs/applications/misc/gkrellm/default.nix

@@ -10,7 +10,6 @@
   libSM,
   libICE,
   which,
-  IOKit,
   copyDesktopItems,
   makeDesktopItem,
   wrapGAppsHook3,
@@ -38,7 +37,7 @@ stdenv.mkDerivation rec {
     libX11
     libSM
     libICE
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ];
+  ];
 
   hardeningDisable = [ "format" ];
 

pkgs/applications/misc/inherd-quake/default.nix

@@ -4,9 +4,6 @@
   rustPlatform,
   pkg-config,
   openssl,
-  stdenv,
-  CoreServices,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,14 +22,9 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Knowledge management meta-framework for geeks";

pkgs/applications/misc/inlyne/default.nix

@@ -11,7 +11,6 @@
   wayland,
   libGL,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,20 +35,16 @@ rustPlatform.buildRustPackage rec {
       pkg-config
     ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      fontconfig
-      xorg.libXcursor
-      xorg.libXi
-      xorg.libXrandr
-      xorg.libxcb
-      wayland
-      libxkbcommon
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.AppKit
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    fontconfig
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libxcb
+    wayland
+    libxkbcommon
+    openssl
+  ];
 
   checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     # time out on darwin

pkgs/applications/misc/klipper-estimator/default.nix

@@ -6,8 +6,6 @@
   pkg-config,
   openssl,
   libgit2,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,8 +28,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libgit2
-      Security
-      SystemConfiguration
     ];
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/misc/mdzk/default.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  CoreServices,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,8 +24,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-+x4pOtszvdzI/zR55ezcxlS52GrWQTuBn7vbnqDTVac=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
-
   meta = with lib; {
     description = "Plain text Zettelkasten based on mdBook";
     homepage = "https://github.com/mdzk-rs/mdzk/";

pkgs/applications/misc/opencpn/default.nix

@@ -1,7 +1,6 @@
 {
   stdenv,
   lib,
-  AppKit,
   DarwinTools,
   alsa-utils,
   at-spi2-core,
@@ -86,9 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
       flac
       gitMinimal
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      AppKit
-    ]
     ++ [
       glew
       jasper

pkgs/applications/misc/pastel/default.nix

@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-u+1KDcC2KGqvmOk6k7hOHE16TMvDg92eMOdNMQQszug=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   meta = with lib; {
     description = "Command-line tool to generate, analyze, convert and manipulate colors";
     homepage = "https://github.com/sharkdp/pastel";

pkgs/applications/misc/pomodoro/default.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Foundation,
 }:
 
 rustPlatform.buildRustPackage {
@@ -19,7 +18,6 @@ rustPlatform.buildRustPackage {
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-oXOf9G0BMSbFFAsmRaAZzaquFva1i1gJ4ISqJkqSx4k=";
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
 
   meta = with lib; {
     description = "Simple CLI pomodoro timer using desktop notifications written in Rust";

pkgs/applications/misc/prusa-slicer/default.nix

@@ -11,7 +11,6 @@
   cereal,
   cgal,
   curl,
-  darwin,
   dbus,
   eigen,
   expat,
@@ -142,9 +141,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals withSystemd [
       systemd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.CoreWLAN
     ];
 
   strictDeps = true;

pkgs/applications/misc/pueue/default.nix

@@ -2,8 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  Libsystem,
-  SystemConfiguration,
   installShellFiles,
   libiconv,
   rustPlatform,
@@ -32,8 +30,6 @@ rustPlatform.buildRustPackage rec {
     ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Libsystem
-    SystemConfiguration
     libiconv
   ];
 

pkgs/applications/misc/reddsaver/default.nix

@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   openssl,
   pkg-config,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-xYtdGhuieFudfJz+LxUjP7mV8uItaIvLahCH7vBWTtg=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [ openssl ];
 
   # package does not contain tests as of v0.3.3
   docCheck = false;

pkgs/applications/misc/redshift/default.nix

@@ -19,7 +19,6 @@
   pyxdg,
 
   withQuartz ? stdenv.hostPlatform.isDarwin,
-  ApplicationServices,
   withRandr ? stdenv.hostPlatform.isLinux,
   libxcb,
   withDrm ? stdenv.hostPlatform.isLinux,
@@ -29,9 +28,6 @@
 
   withGeolocation ? true,
   withCoreLocation ? withGeolocation && stdenv.hostPlatform.isDarwin,
-  CoreLocation,
-  Foundation,
-  Cocoa,
   withGeoclue ? withGeolocation && stdenv.hostPlatform.isLinux,
   geoclue,
   withAppIndicator ? stdenv.hostPlatform.isLinux,
@@ -99,12 +95,6 @@ let
         ++ lib.optional withGeoclue geoclue
         ++ lib.optional withDrm libdrm
         ++ lib.optional withVidmode libXxf86vm
-        ++ lib.optional withQuartz ApplicationServices
-        ++ lib.optionals withCoreLocation [
-          CoreLocation
-          Foundation
-          Cocoa
-        ]
         ++ lib.optional withAppIndicator (
           if (pname != "gammastep") then libappindicator else libayatana-appindicator
         );

pkgs/applications/misc/stork/default.nix

@@ -4,8 +4,6 @@
   fetchFromGitHub,
   openssl,
   pkg-config,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,7 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
 
   meta = with lib; {
     description = "Impossibly fast web search, made for static sites";

pkgs/applications/misc/survex/default.nix

@@ -2,8 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  Carbon,
-  Cocoa,
   ffmpeg,
   glib,
   libGLU,
@@ -43,10 +41,6 @@ stdenv.mkDerivation rec {
       gdal
       wxGTK32
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       # TODO: libGLU doesn't build for macOS because of Mesa issues
       # (#233265); is it required for anything?

pkgs/applications/misc/synergy/default.nix

@@ -27,13 +27,6 @@
   xinput,
   avahi-compat,
 
-  # MacOS / darwin
-  ApplicationServices,
-  Carbon,
-  Cocoa,
-  CoreServices,
-  ScreenSaver,
-  UserNotifications,
 }:
 
 stdenv.mkDerivation rec {
@@ -74,14 +67,6 @@ stdenv.mkDerivation rec {
       openssl
       pcre
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Carbon
-      Cocoa
-      CoreServices
-      ScreenSaver
-      UserNotifications
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       util-linux
       libselinux