staging-next 2024-11-07 - the last one for 24.11 (#354201)

2024-11-14 08:32:49 +01:00
parent 3400d5e942 3a06a0e1b2
commit 7f2d3d2feb
369 changed files with 4120 additions and 5043 deletions
@@ -149,8 +149,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza

 # Python-related code and docs
 /doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries            @natsukium
-/pkgs/development/interpreters/python                   @natsukium
+/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
+/pkgs/development/interpreters/python         @mweinelt @natsukium
 /pkgs/top-level/python-packages.nix                     @natsukium
 /pkgs/top-level/release-python.nix                      @natsukium

@@ -18,6 +18,16 @@ setup hook registering ninja-based build and install phases.

 Controls the flags passed to `meson setup` during configure phase.

+#### `mesonBuildDir` {#meson-build-dir}
+
+Directory where Meson will put intermediate files.
+
+Setting this can be useful for debugging multiple Meson builds while in the same source directory, for example, when building for different platforms.
+Different values for each build will prevent build artefacts from interefering with each other.
+This setting has no tangible effect when running the build in a sandboxed derivation.
+
+The default value is `build`.
+
 #### `mesonWrapMode` {#meson-wrap-mode}

 Which value is passed as
@@ -57,8 +57,8 @@ Available compilers are collected under `haskell.compiler`.
 Each of those compiler versions has a corresponding attribute set `packages` built with
 it. However, the non-standard package sets are not tested regularly and, as a
 result, contain fewer working packages. The corresponding package set for GHC
-9.4.5 is `haskell.packages.ghc945`. In fact `haskellPackages` is just an alias
-for `haskell.packages.ghc964`:
+9.4.5 is `haskell.packages.ghc945`. In fact `haskellPackages` (at the time of writing) is just an alias
+for `haskell.packages.ghc966`:

 Every package set also re-exposes the GHC used to build its packages as `haskell.packages.*.ghc`.

@@ -55,6 +55,7 @@ sets are
 * `pkgs.python311Packages`
 * `pkgs.python312Packages`
 * `pkgs.python313Packages`
+* `pkgs.python314Packages`
 * `pkgs.pypy27Packages`
 * `pkgs.pypy39Packages`
 * `pkgs.pypy310Packages`
@@ -25,12 +25,14 @@ stdenv.mkDerivation {

 The same goes for Qt 5 where libraries and tools are under `libsForQt5`.

-Any Qt package should include `wrapQtAppsHook` in `nativeBuildInputs`, or explicitly set `dontWrapQtApps` to bypass generating the wrappers.
+Any Qt package should include `wrapQtAppsHook` or `wrapQtAppsNoGuiHook` in `nativeBuildInputs`, or explicitly set `dontWrapQtApps` to bypass generating the wrappers.

 ::: {.note}
-Qt 6 graphical applications should also include `qtwayland` in `buildInputs` on Linux (but not on platforms e.g. Darwin, where `qtwayland` is not available), to ensure the Wayland platform plugin is available.

-This may become default in the future, see [NixOS/nixpkgs#269674](https://github.com/NixOS/nixpkgs/pull/269674).
+`wrapQtAppsHook` propagates plugins and QML components from `qtwayland` on platforms that support it, to allow applications to act as native Wayland clients. It should be used for all graphical applications.
+
+`wrapQtAppsNoGuiHook` does not propagate `qtwayland` to reduce closure size for purely command-line applications.
+
 :::

 ## Packages supporting multiple Qt versions {#qt-versions}
@@ -895,6 +895,11 @@ lib.mapAttrs mkLicense ({
    fullName = "MIT License";
  };

+  mit-cmu = {
+    spdxId = "MIT-CMU";
+    fullName = "CMU License";
+  };
+
  mit-feh = {
    spdxId = "MIT-feh";
    fullName = "feh License";
@@ -1,6 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch
 , updateAutotoolsGnuConfigScriptsHook, autoreconfHook
-, IOKit, Carbon
 }:

 stdenv.mkDerivation rec {
@@ -14,8 +13,8 @@ stdenv.mkDerivation rec {

  patches = lib.optionals stdenv.hostPlatform.isDarwin [
    (fetchpatch {
-      url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/osx_interface.patch";
-      sha256 = "0hq3lvfr0h1m3p0r33jij0s1aspiqlpy533rwv19zrfllb39qvr8";
+      url = "https://github.com/macports/macports-ports/raw/c8e15973bc3c1e1ab371bc0ee2de14209e639f17/audio/cdparanoia/files/osx_interface.patch";
+      hash = "sha256-9p4+9dRvqLHkpR0RWLQcNL1m7fb7L6r+c9Q2tt4jh0U=";
      # Our configure patch will subsume it, but we want our configure
      # patch to be used on all platforms so we cannot just start where
      # this leaves off.
@@ -23,13 +22,38 @@ stdenv.mkDerivation rec {
    })
    (fetchurl {
      url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/patch-paranoia_paranoia.c.10.4.diff";
-      sha256 = "17l2qhn8sh4jy6ryy5si6ll6dndcm0r537rlmk4a6a8vkn852vad";
+      hash = "sha256-TW1RkJ0bKaPIrDSfUTKorNlmKDVRF++z8ZJAjSzEgp4=";
+    })
+    # add missing include files needed for function prototypes
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/f210a6061bc53c746730a37922399c6de6d69cb7/audio/cdparanoia/files/fixing-include.patch";
+      hash = "sha256-6a/u4b8/H/4XjyFup23xySgyAI9SMVMom4PLvH8KzhE=";
    })
  ] ++ [
    # Has to come after darwin patches
    ./fix_private_keyword.patch
    # Order does not matter
    ./configure.patch
+    # labs for long
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/f210a6061bc53c746730a37922399c6de6d69cb7/audio/cdparanoia/files/fixing-labs.patch";
+      hash = "sha256-BMMQ5bbPP3eevuwWUVjQCtRBiWbkAHD+O0C0fp+BPaw=";
+    })
+    # use "%s" for passing a buffer to fprintf
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/f210a6061bc53c746730a37922399c6de6d69cb7/audio/cdparanoia/files/fixing-fprintf.patch";
+      hash = "sha256-2dJl16p+f5l3wxVOJhsuLiQ9a4prq7jsRZP8/ygEae4=";
+    })
+    # add support for IDE4-9
+    (fetchpatch {
+      url = "https://salsa.debian.org/optical-media-team/cdparanoia/-/raw/bbf353721834b3784ccc0fd54a36a6b25181f5a4/debian/patches/02-ide-devices.patch";
+      hash = "sha256-S6OzftUIPPq9JHsoAE2K51ltsI1WkVaQrpgCjgm5AG4=";
+    })
+    # check buffer is non-null before dereferencing
+    (fetchpatch {
+      url = "https://salsa.debian.org/optical-media-team/cdparanoia/-/raw/f7bab3024c5576da1fdb7497abbd6abc8959a98c/debian/patches/04-endian.patch";
+      hash = "sha256-krfprwls0L3hsNfoj2j69J5k1RTKEQtzE0fLYG9EJKo=";
+    })
  ] ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch;

  nativeBuildInputs = [
@@ -37,13 +61,6 @@ stdenv.mkDerivation rec {
    autoreconfHook
  ];

-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Carbon
-    IOKit
-  ];
-
-  hardeningDisable = [ "format" ];
-
  # Build system reuses the same object file names for shared and static
  # library. Occasionally fails in the middle:
  #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c
@@ -22,11 +22,11 @@ assert withConplay -> !libOnly;

 stdenv.mkDerivation rec {
  pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.7";
+  version = "1.32.8";

  src = fetchurl {
    url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-PIkZJDcHlRysDjw5u/KGU7yv/EPJj/FoAaJzUNuPDyE=";
+    hash = "sha256-/u4TdMeVQODkBd8LxF/eIK1nARQlw2GidZ4hRolKJ6c=";
  };

  outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
@@ -31,24 +31,10 @@
 , qtnetworkauth
 , qttools
 , nixosTests
-, darwin
+, apple-sdk_11
 }:

-let
-  stdenv' = if stdenv.hostPlatform.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
-  # portaudio propagates Darwin frameworks. Rebuild it using the 11.0 stdenv
-  # from Qt and the 11.0 SDK frameworks.
-  portaudio' = if stdenv.hostPlatform.isDarwin then portaudio.override {
-    stdenv = stdenv';
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      AudioUnit
-      AudioToolbox
-      CoreAudio
-      CoreServices
-      Carbon
-    ;
-  } else portaudio;
-in stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "musescore";
  version = "4.4.3";

@@ -116,7 +102,7 @@ in stdenv'.mkDerivation (finalAttrs: {
    libpulseaudio
    libsndfile
    libvorbis
-    portaudio'
+    portaudio
    portmidi
    flac
    libopusenc
@@ -132,7 +118,7 @@ in stdenv'.mkDerivation (finalAttrs: {
    alsa-lib
    qtwayland
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk_11_0.frameworks.Cocoa
+    apple-sdk_11
  ];

  postInstall = ''
@@ -34,9 +34,10 @@ The file can either be a tar file or an Emacs Lisp file."

 (let ((flag (getenv "turnCompilationWarningToError")))
  (when (and flag
-             (not (string-empty-p flag)))
+             ;; we do not use `string-empty-p' because it requires subr-x in Emacs <= 26
+             (not (string= flag "")))
    (setq byte-compile-error-on-warn t)))

 (let ((flag (getenv "ignoreCompilationError")))
-  (when (string-empty-p flag)
+  (when (string= flag "")
    (setq byte-compile-debug t)))
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0765";
+  version = "9.1.0787";

  outputs = [ "out" "xxd" ];

@@ -8,7 +8,7 @@ rec {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-LtEEMpdWXA6qyjAIjgsZoc4hNXXG2ZXxCsbWKC5aEPI=";
+    hash = "sha256-kV2SaIOUv+ZcDsqBibZZ38gCevVLhejcYtY0TCQVtig=";
  };

  enableParallelBuilding = true;
@@ -139,7 +139,6 @@ stdenv.mkDerivation (finalAttrs: {
  # Xcode project or pass it as a flag to xcodebuild as well.
  postConfigure = ''
    substituteInPlace src/auto/config.mk \
-      --replace "PERL_CFLAGS${"\t"}=" "PERL_CFLAGS${"\t"}= -I${darwin.libutil}/include" \
      --replace " -L${stdenv.cc.libc}/lib" "" \
      --replace " -L${darwin.libobjc}/lib" "" \
      --replace " -L${darwin.libunwind}/lib" "" \
@@ -0,0 +1,28 @@
+# To use this for hacking of your Yi config file, drop into a shell
+# with env attribute.
+{
+  lib,
+  stdenv,
+  makeWrapper,
+  haskellPackages,
+  extraPackages ? (s: [ ]),
+}:
+let
+  yiEnv = haskellPackages.ghcWithPackages (self: [ self.yi ] ++ extraPackages self);
+in
+stdenv.mkDerivation {
+  pname = "yi-custom";
+  dontUnpack = true;
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildCommand = ''
+    mkdir -p $out/bin
+    makeWrapper ${haskellPackages.yi}/bin/yi $out/bin/yi \
+      --set NIX_GHC ${yiEnv}/bin/ghc
+  '';
+
+  # For hacking purposes
+  passthru.env = yiEnv;
+
+  inherit (haskellPackages.yi) meta version;
+}
@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , qtsvg
-, qtwayland
 , qttools
 , exiv2
 , wrapQtAppsHook
@@ -28,7 +27,6 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    qtsvg
-    qtwayland
    exiv2
  ];

@@ -1,4 +1,4 @@
-{ lib, fetchurl, stdenv, zlib, ncurses, libiconv, darwin }:
+{ lib, fetchurl, stdenv, zlib, ncurses, libiconv, apple-sdk_11, darwinMinVersionHook }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "fnc";
@@ -9,18 +9,13 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-npS+sOxF0S/9TuFjtEFlev0HpIOsaP6zmcfopPNUehk=";
  };

-  buildInputs = [ libiconv ncurses zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.libutil
-  ];
+  buildInputs = [ libiconv ncurses zlib apple-sdk_11 (darwinMinVersionHook "11.0") ];

  makeFlags = [ "PREFIX=$(out)" ];

  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
    # Needed with GCC 12
    "-Wno-error=maybe-uninitialized"
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # error: 'strtonum' is only available on macOS 11.0 or newer
-    "-Wno-error=unguarded-availability-new"
  ]);

  preInstall = ''
@@ -245,10 +245,11 @@ stdenv.mkDerivation (finalAttrs: {

   + (if svnSupport then ''
        # wrap git-svn
-        wrapProgram $out/libexec/git-core/git-svn                                                                                \
-                     --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath (perlLibs ++ [svn.out])}" \
-                     --prefix PATH : "${svn.out}/bin" ''
-       else '' # replace git-svn by notification script
+        wrapProgram $out/libexec/git-core/git-svn \
+          --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath (perlLibs ++ [svn.out])}" \
+          --prefix PATH : "${svn.out}/bin"
+      '' else ''
+        # replace git-svn by notification script
        notSupported $out/libexec/git-core/git-svn
     '')

@@ -261,9 +262,11 @@ stdenv.mkDerivation (finalAttrs: {
        notSupported $out/libexec/git-core/git-send-email
      '')

-   + lib.optionalString withManual ''# Install man pages
+   + lib.optionalString withManual ''
+       # Install man pages
       make -j $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html \
-         -C Documentation ''
+         -C Documentation
+     ''

   + (if guiSupport then ''
       # Wrap Tcl/Tk programs
@@ -21,11 +21,11 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.8.1";
+    version = "6.8.2";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-Aw6Kem1ZDk6utAPuJWdWFc2A0jbzq4oLVtzIQYEViwU=";
+      hash = "sha256-qsYYEGdorR7ZdsP+fIZZ/smebwtTN+pupVT66EkMT04=";
    };

    format = "other";
@@ -35,7 +35,7 @@ let
    cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
      inherit src;
      name = "mercurial-${version}";
-      hash = "sha256-i5AVyi9m7qLLubhV8fBhhZ6/RYOjMdwmv9Bek9pT/xo=";
+      hash = "sha256-/HjgGtjKfLLufEqyT7xHYIlC5xnVunYoA+H1xLS1bVw=";
      sourceRoot = "mercurial-${version}/rust";
    } else null;
    cargoRoot = if rustSupport then "rust" else null;
@@ -79,19 +79,3 @@ if [ ! "$havePlatformVersionFlag" ]; then
        extraBefore+=(-@darwinPlatform@_version_min "${@darwinMinVersionVariable@_@suffixSalt@:-@darwinMinVersion@}")
    fi
 fi
-
-mangleVarSingle DEVELOPER_DIR ${role_suffixes[@]+"${role_suffixes[@]}"}
-
-# Allow wrapped bintools to do something useful when no `DEVELOPER_DIR` is set, which can happen when
-# the compiler is run outside of a stdenv or intentionally in an environment with no environment variables set.
-DEVELOPER_DIR=${DEVELOPER_DIR_@suffixSalt@:-@fallback_sdk@}
-
-# Darwin looks for frameworks in the SDK located at `DEVELOPER_DIR`.
-extraBefore+=("-F$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks")
-extraBefore+=("-L$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib")
-
-# While the Swift wrapper should take care of this, anything that needs to link Swift auto-linked frameworks
-# also needs these paths. Note: Test and conditionally add it because the path may not exist in older SDKs.
-if [ -d "$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib/swift" ]; then
-    extraBefore+=("-L$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib/swift")
-fi
@@ -372,24 +372,15 @@ stdenvNoCC.mkDerivation {
      substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
      substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
      substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
+      substituteAll ${../wrapper-common/darwin-sdk-setup.bash} $out/nix-support/darwin-sdk-setup.bash
    ''

    ###
    ### Ensure consistent LC_VERSION_MIN_MACOSX
    ###
-    + optionalString targetPlatform.isDarwin (
-      let
-        inherit (targetPlatform)
-          darwinPlatform darwinSdkVersion
-          darwinMinVersion darwinMinVersionVariable;
-      in ''
-        export darwinPlatform=${darwinPlatform}
-        export darwinMinVersion=${darwinMinVersion}
-        export darwinSdkVersion=${darwinSdkVersion}
-        export darwinMinVersionVariable=${darwinMinVersionVariable}
-        substituteAll ${./add-darwin-ldflags-before.sh} $out/nix-support/add-local-ldflags-before.sh
-      ''
-    )
+    + optionalString targetPlatform.isDarwin ''
+      substituteAll ${./add-darwin-ldflags-before.sh} $out/nix-support/add-local-ldflags-before.sh
+    ''

    ##
    ## Extra custom steps
@@ -403,10 +394,17 @@ stdenvNoCC.mkDerivation {
    # TODO(@sternenseemann): rename env var via stdenv rebuild
    shell = (getBin runtimeShell + runtimeShell.shellPath or "");
    gnugrep_bin = optionalString (!nativeTools) gnugrep;
+    rm = if nativeTools then "rm" else lib.getExe' coreutils "rm";
+    mktemp = if nativeTools then "mktemp" else lib.getExe' coreutils "mktemp";
    wrapperName = "BINTOOLS_WRAPPER";
    inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
    inherit bintools_bin libc_bin libc_dev libc_lib;
    default_hardening_flags_str = builtins.toString defaultHardeningFlags;
+  } // lib.mapAttrs (_: lib.optionalString targetPlatform.isDarwin) {
+    # These will become empty strings when not targeting Darwin.
+    inherit (targetPlatform)
+      darwinPlatform darwinSdkVersion
+      darwinMinVersion darwinMinVersionVariable;
  } // lib.optionalAttrs (apple-sdk != null && stdenvNoCC.targetPlatform.isDarwin) {
    # Wrapped compilers should do something useful even when no SDK is provided at `DEVELOPER_DIR`.
    fallback_sdk = apple-sdk.__spliced.buildTarget or apple-sdk;
@@ -16,6 +16,8 @@ fi

 source @out@/nix-support/utils.bash

+source @out@/nix-support/darwin-sdk-setup.bash
+
 if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
    source @out@/nix-support/add-flags.sh
 fi
@@ -42,9 +44,9 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
    while (( "$n" < "$nParams" )); do
        p=${params[n]}
        p2=${params[n+1]:-} # handle `p` being last one
-        if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
+        if [ "${p:0:3}" = -L/ ] && badPathWithDarwinSdk "${p:2}"; then
            skip "${p:2}"
-        elif [ "$p" = -L ] && badPath "$p2"; then
+        elif [ "$p" = -L ] && badPathWithDarwinSdk "$p2"; then
            n+=1; skip "$p2"
        elif [ "$p" = -rpath ] && badPath "$p2"; then
            n+=1; skip "$p2"
@@ -251,8 +253,8 @@ PATH="$path_backup"
 # Old bash workaround, see above.

 if (( "${NIX_LD_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    responseFile=$(mktemp "${TMPDIR:-/tmp}/ld-params.XXXXXX")
-    trap 'rm -f -- "$responseFile"' EXIT
+    responseFile=$(@mktemp@ "${TMPDIR:-/tmp}/ld-params.XXXXXX")
+    trap '@rm@ -f -- "$responseFile"' EXIT
    printf "%q\n" \
       ${extraBefore+"${extraBefore[@]}"} \
       ${params+"${params[@]}"} \
@@ -78,28 +78,12 @@ if [ -e @out@/nix-support/cc-cflags-before ]; then
    NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@="$(< @out@/nix-support/cc-cflags-before) $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@"
 fi

-# Only add darwin min version flag and set up `DEVELOPER_DIR` if a default darwin min version is set,
+# Only add darwin min version flag if a default darwin min version is set,
 # which is a signal that we're targetting darwin.
 if [ "@darwinMinVersion@" ]; then
    mangleVarSingle @darwinMinVersionVariable@ ${role_suffixes[@]+"${role_suffixes[@]}"}

    NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@="-m@darwinPlatformForCC@-version-min=${@darwinMinVersionVariable@_@suffixSalt@:-@darwinMinVersion@} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@"
-
-    # `DEVELOPER_DIR` is used to dynamically locate libSystem (and the SDK frameworks) based on the SDK at that path.
-    mangleVarSingle DEVELOPER_DIR ${role_suffixes[@]+"${role_suffixes[@]}"}
-
-    # Allow wrapped compilers to do something useful when no `DEVELOPER_DIR` is set, which can happen when
-    # the compiler is run outside of a stdenv or intentionally in an environment with no environment variables set.
-    DEVELOPER_DIR=${DEVELOPER_DIR_@suffixSalt@:-@fallback_sdk@}
-
-    # xcbuild needs `SDKROOT` to be the name of the SDK, which it sets in its own wrapper,
-    # but compilers expect it to point to the absolute path.
-    SDKROOT="$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
-
-    # Set up various library paths since compilers may not support (or may have disabled) finding them in the sysroot.
-    NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@+=" -isysroot $SDKROOT"
-    NIX_CFLAGS_COMPILE_@suffixSalt@+=" -idirafter $SDKROOT/usr/include"
-    NIX_CFLAGS_COMPILE_@suffixSalt@+=" -iframework $SDKROOT/System/Library/Frameworks"
 fi

 # That way forked processes will not extend these environment variables again.
@@ -17,6 +17,8 @@ fi

 source @out@/nix-support/utils.bash

+source @out@/nix-support/darwin-sdk-setup.bash
+

 # Parse command line options and set several variables.
 # For instance, figure out if linker flags should be passed.
@@ -101,7 +103,7 @@ if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
            -[IL] | -isystem) path=$p2 skipNext=true ;;
        esac

-        if [[ -n $path ]] && badPath "$path"; then
+        if [[ -n $path ]] && badPathWithDarwinSdk "$path"; then
            skip "$path"
            $skipNext && n+=1
            continue
@@ -251,8 +253,8 @@ if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
 fi

 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    responseFile=$(mktemp "${TMPDIR:-/tmp}/cc-params.XXXXXX")
-    trap 'rm -f -- "$responseFile"' EXIT
+    responseFile=$(@mktemp@ "${TMPDIR:-/tmp}/cc-params.XXXXXX")
+    trap '@rm@ -f -- "$responseFile"' EXIT
    printf "%q\n" \
       ${extraBefore+"${extraBefore[@]}"} \
       ${params+"${params[@]}"} \
@@ -284,13 +284,6 @@ let
    if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx"
    else targetPlatform.darwinPlatform
  );
-
-  darwinMinVersion = optionalString targetPlatform.isDarwin (
-    targetPlatform.darwinMinVersion
-  );
-
-  darwinMinVersionVariable = optionalString targetPlatform.isDarwin
-    targetPlatform.darwinMinVersionVariable;
 in

 assert includeFortifyHeaders' -> fortify-headers != null;
@@ -707,6 +700,7 @@ stdenvNoCC.mkDerivation {
      substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
      substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
      substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
+      substituteAll ${../wrapper-common/darwin-sdk-setup.bash} $out/nix-support/darwin-sdk-setup.bash
    ''

    + optionalString cc.langAda or false ''
@@ -743,14 +737,19 @@ stdenvNoCC.mkDerivation {
    # TODO(@sternenseemann): rename env var via stdenv rebuild
    shell = getBin runtimeShell + runtimeShell.shellPath or "";
    gnugrep_bin = optionalString (!nativeTools) gnugrep;
+    rm = if nativeTools then "rm" else lib.getExe' coreutils "rm";
+    mktemp = if nativeTools then "mktemp" else lib.getExe' coreutils "mktemp";
    # stdenv.cc.cc should not be null and we have nothing better for now.
    # if the native impure bootstrap is gotten rid of this can become `inherit cc;` again.
    cc = optionalString (!nativeTools) cc;
    wrapperName = "CC_WRAPPER";
    inherit suffixSalt coreutils_bin bintools;
    inherit libc_bin libc_dev libc_lib;
-    inherit darwinPlatformForCC darwinMinVersion darwinMinVersionVariable;
+    inherit darwinPlatformForCC;
    default_hardening_flags_str = builtins.toString defaultHardeningFlags;
+  } // lib.mapAttrs (_: lib.optionalString targetPlatform.isDarwin) {
+    # These will become empty strings when not targeting Darwin.
+    inherit (targetPlatform) darwinMinVersion darwinMinVersionVariable;
  } // lib.optionalAttrs (apple-sdk != null && stdenvNoCC.targetPlatform.isDarwin) {
    # Wrapped compilers should do something useful even when no SDK is provided at `DEVELOPER_DIR`.
    fallback_sdk = apple-sdk.__spliced.buildTarget or apple-sdk;
@@ -0,0 +1,16 @@
+accumulateRoles
+
+# Only set up `DEVELOPER_DIR` if a default darwin min version is set,
+# which is a signal that we're targetting darwin.
+if [[ "@darwinMinVersion@" ]]; then
+    # `DEVELOPER_DIR` is used to dynamically locate libSystem (and the SDK frameworks) based on the SDK at that path.
+    mangleVarSingle DEVELOPER_DIR ${role_suffixes[@]+"${role_suffixes[@]}"}
+
+    # Allow wrapped compilers to do something useful when no `DEVELOPER_DIR` is set, which can happen when
+    # the compiler is run outside of a stdenv or intentionally in an environment with no environment variables set.
+    export DEVELOPER_DIR=${DEVELOPER_DIR_@suffixSalt@:-@fallback_sdk@}
+
+    # xcbuild needs `SDKROOT` to be the name of the SDK, which it sets in its own wrapper,
+    # but compilers expect it to point to the absolute path.
+    export SDKROOT="$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
+fi
@@ -118,6 +118,21 @@ badPath() {
        "${p#"${TEMPDIR:-/tmp}"}" = "$p"
 }

+# Like `badPath`, but handles paths that may be interpreted relative to
+# `$SDKROOT` on Darwin. For example, `-L/usr/lib/swift` is interpreted
+# as `-L$SDKROOT/usr/lib/swift` when `$SDKROOT` is set and
+# `$SDKROOT/usr/lib/swift` exists.
+badPathWithDarwinSdk() {
+    path=$1
+    if [[ "@darwinMinVersion@" ]]; then
+        sdkPath=$SDKROOT/$path
+        if [[ -e $sdkPath ]]; then
+            path=$sdkPath
+        fi
+    fi
+    badPath "$path"
+}
+
 expandResponseParams() {
    declare -ga params=("$@")
    local arg
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, fetchzip, writeText, darwin, conf ? null }:
+{ lib, stdenv, fetchpatch, fetchzip, writeText, conf ? null }:

 let
  rev = "8c32909a159aaa9484c82b71f05b7a73321eb491";
@@ -21,10 +21,6 @@ stdenv.mkDerivation {
  installFlags = [ "install-completion" ];
  CFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";

-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.libutil
-  ];
-
  patches = [
    # https://github.com/martanne/abduco/pull/22
    (fetchpatch {
@@ -7,8 +7,6 @@
 , suitesparse
 , python3
 , libintl
-, libiconv
-, darwin
 }:
 let
  # this is a fork version of fetk (http://www.fetk.org/)
@@ -87,8 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
    python3
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    libintl
-    libiconv
-    darwin.libutil
  ];

  cmakeFlags = [
@@ -54,6 +54,8 @@ self: super: {
      libiconv
      darwin.libresolv
      darwin.libsbuf
+      # Shipped with the SDK only as a library with no headers
+      (lib.getLib darwin.libutil)
      # Required by some SDK headers
      cupsHeaders
    ]
@@ -48,9 +48,13 @@ let
      (callPackage ./common/propagate-inputs.nix { })
      (callPackage ./common/propagate-xcrun.nix { })
    ]
-    ++ [
-      # These have to happen last.
+    # Older SDKs do not include the libraries re-exported from umbrella frameworks in the umbrellas’ stubs, which causes
+    # link failures for those libraries unless their paths have been rewritten to point to the store.
+    ++ lib.optionals (lib.versionOlder sdkVersion "11.0") [
      (callPackage ./common/rewrite-sdk-paths.nix { inherit sdkVersion; })
+    ]
+    # This has to happen last.
+    ++ [
      (callPackage ./common/run-build-phase-hooks.nix { })
    ]
  );
@@ -1,18 +1,29 @@
 {
+  stdenv,
+  python3,
  lib,
-  python3Packages,
 }:

-python3Packages.buildPythonApplication {
+let
+  pythonEnv = python3.withPackages (ps: [ ps.pyelftools ]);
+
+in
+# Note: Not using python3Packages.buildPythonApplication because of dependency propagation.
+stdenv.mkDerivation {
  pname = "auto-patchelf";
  version = "0-unstable-2024-08-14";
-  pyproject = false;
+
+  buildInputs = [ pythonEnv ];

  src = ./source;

-  dependencies = with python3Packages; [
-    pyelftools
-  ];
+  buildPhase = ''
+    runHook preBuild
+
+    substituteInPlace auto-patchelf.py --replace-fail "@defaultBintools@" "$NIX_BINTOOLS"
+
+    runHook postBuild
+  '';

  installPhase = ''
    runHook preInstall
@@ -22,10 +33,6 @@ python3Packages.buildPythonApplication {
    runHook postInstall
  '';

-  makeWrapperArgs = [
-    "--set DEFAULT_BINTOOLS $NIX_BINTOOLS"
-  ];
-
  meta = {
    description = "Automatically patch ELF binaries using patchelf";
    mainProgram = "auto-patchelf";
@@ -21,6 +21,9 @@ from elftools.elf.elffile import ELFFile  # type: ignore
 from elftools.elf.enums import ENUM_E_TYPE, ENUM_EI_OSABI  # type: ignore


+DEFAULT_BINTOOLS = "@defaultBintools@"
+
+
@contextmanager
 def open_elf(path: Path) -> Iterator[ELFFile]:
    with path.open('rb') as stream:
@@ -425,7 +428,7 @@ interpreter_arch: str   = None # type: ignore
 libc_lib: Path          = None # type: ignore

 if __name__ == "__main__":
-    nix_support = Path(os.environ.get('NIX_BINTOOLS', os.environ['DEFAULT_BINTOOLS'])) / 'nix-support'
+    nix_support = Path(os.environ.get('NIX_BINTOOLS', DEFAULT_BINTOOLS)) / 'nix-support'
    interpreter_path = Path((nix_support / 'dynamic-linker').read_text().strip())
    libc_lib = Path((nix_support / 'orig-libc').read_text().strip()) / 'lib'

@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "autoconf-archive";
-  version = "2023.02.20";
+  version = "2024.10.16";

  src = fetchurl {
    url = "mirror://gnu/autoconf-archive/autoconf-archive-${version}.tar.xz";
-    hash = "sha256-cdQEhHmuKPH1eUYZw9ct+cAd9JscYo74X943WW3DGjM=";
+    hash = "sha256-e81dABkW86UO10NvT3AOPSsbrePtgDIZxZLWJQKlc2M=";
  };

  strictDeps = true;
@@ -11,11 +11,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bmake";
-  version = "20240808";
+  version = "20240921";

  src = fetchurl {
    url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-tZGJJRtIPezUSS8fdDh7KlhMA9WqRjfNSLOOxiucCEg=";
+    hash = "sha256-s0ZXnoLSltGk2ineqFlOPuWWEwsgeG3sDziZo+ESdcI=";
  };

  patches = [
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , autoreconfHook
-# doc: https://github.com/ivmai/bdwgc/blob/v8.2.6/doc/README.macros (LARGE_CONFIG)
+# doc: https://github.com/ivmai/bdwgc/blob/v8.2.8/doc/README.macros (LARGE_CONFIG)
 , enableLargeConfig ? false
 , enableMmap ? true
 , enableStatic ? false
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "boehm-gc";
-  version = "8.2.6";
+  version = "8.2.8";

  src = fetchFromGitHub {
    owner = "ivmai";
    repo = "bdwgc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-y6hU5qU4qO9VvQvKNH9dvReCrf3+Ih2HHbF6IS1V3WQ=";
+    hash = "sha256-UQSLK/05uPal6/m+HMz0QwXVII1leonlmtSZsXjJ+/c=";
  };

  outputs = [ "out" "dev" "doc" ];
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
  # not fix the problem the test failure will be a reminder to
  # extend the set of versions requiring the workaround).
  makeFlags = lib.optionals (stdenv.hostPlatform.isPower64 &&
-                  finalAttrs.version == "8.2.6")
+                  finalAttrs.version == "8.2.8")
    [
      # do not use /proc primitives to track dirty bits; see:
      # https://github.com/ivmai/bdwgc/issues/479#issuecomment-1279687537
@@ -54,18 +54,18 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    homepage = "https://github.com/google/brotli";
    description = "Generic-purpose lossless compression algorithm and tool";
-    longDescription =
-      ''  Brotli is a generic-purpose lossless compression algorithm that
-          compresses data using a combination of a modern variant of the LZ77
-          algorithm, Huffman coding and 2nd order context modeling, with a
-          compression ratio comparable to the best currently available
-          general-purpose compression methods. It is similar in speed with
-          deflate but offers more dense compression.
+    longDescription = ''
+      Brotli is a generic-purpose lossless compression algorithm that
+      compresses data using a combination of a modern variant of the LZ77
+      algorithm, Huffman coding and 2nd order context modeling, with a
+      compression ratio comparable to the best currently available
+      general-purpose compression methods. It is similar in speed with
+      deflate but offers more dense compression.

-          The specification of the Brotli Compressed Data Format is defined
-          in the following internet draft:
-          http://www.ietf.org/id/draft-alakuijala-brotli
-      '';
+      The specification of the Brotli Compressed Data Format is defined
+      in the following internet draft:
+      http://www.ietf.org/id/draft-alakuijala-brotli
+    '';
    license = licenses.mit;
    maintainers = with maintainers; [ freezeboy ];
    pkgConfigModules = [
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "bubblewrap";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "bubblewrap";
    rev = "v${version}";
-    hash = "sha256-HYJoX7DnAwHCgxCzTYGJlc4RodbVP6hutK065AmGSl0=";
+    hash = "sha256-8IDMLQPeO576N1lizVudXUmTV6hNOiowjzRpEWBsZ+U=";
  };

  postPatch = ''
@@ -4,8 +4,8 @@ buildRubyGem rec {
  inherit ruby;
  name = "${gemName}-${version}";
  gemName = "bundler";
-  version = "2.5.16";
-  source.sha256 = "sha256-h7oDOPQNWSinmxqwZ4Z6Ns3lgTXQi2MmfvY5eVuVmDo=";
+  version = "2.5.22";
+  source.sha256 = "sha256-dj8w1ZjuWHQu6ikoWHVDXqciIY1N8UneNbzjfALOlo4=";
  dontPatchShebangs = true;

  postFixup = ''
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, darwin }:
+{ lib, stdenv, fetchFromGitHub, makeWrapper }:

 stdenv.mkDerivation rec {
  version = "0.11";
@@ -13,8 +13,6 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ makeWrapper ];

-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.libutil;
-
  installPhase = ''
    make install PREFIX="$out"
  '';
@@ -84,20 +84,20 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Library for creating fast, dynamic graphical user interfaces";

-    longDescription =
-      '' Clutter is free software library for creating fast, compelling,
-         portable, and dynamic graphical user interfaces.  It is a core part
-         of MeeGo, and is supported by the open source community.  Its
-         development is sponsored by Intel.
+    longDescription = ''
+      Clutter is free software library for creating fast, compelling,
+      portable, and dynamic graphical user interfaces.  It is a core part
+      of MeeGo, and is supported by the open source community.  Its
+      development is sponsored by Intel.

-         Clutter uses OpenGL for rendering (and optionally OpenGL|ES for use
-         on mobile and embedded platforms), but wraps an easy to use,
-         efficient, flexible API around GL's complexity.
+      Clutter uses OpenGL for rendering (and optionally OpenGL|ES for use
+      on mobile and embedded platforms), but wraps an easy to use,
+      efficient, flexible API around GL's complexity.

-         Clutter enforces no particular user interface style, but provides a
-         rich, generic foundation for higher-level toolkits tailored to
-         specific needs.
-      '';
+      Clutter enforces no particular user interface style, but provides a
+      rich, generic foundation for higher-level toolkits tailored to
+      specific needs.
+    '';

    license = lib.licenses.lgpl2Plus;
    homepage = "http://www.clutter-project.org/";
@@ -0,0 +1,32 @@
+diff --git a/Modules/FindCURL.cmake b/Modules/FindCURL.cmake
+index 5ce8a9046b..f7361308b7 100644
+--- a/Modules/FindCURL.cmake
+++ b/Modules/FindCURL.cmake
+@@ -239,9 +239,24 @@ if(CURL_FOUND)
+         IMPORTED_LOCATION_DEBUG "${CURL_LIBRARY_DEBUG}")
+     endif()
+ 
+-    if(CURL_USE_STATIC_LIBS AND MSVC)
+-       set_target_properties(CURL::libcurl PROPERTIES
+-           INTERFACE_LINK_LIBRARIES "normaliz.lib;ws2_32.lib;wldap32.lib")
+    if(PC_CURL_FOUND)
+      if(PC_CURL_LINK_LIBRARIES)
+        set_property(TARGET CURL::libcurl PROPERTY
+                     INTERFACE_LINK_LIBRARIES "${PC_CURL_LINK_LIBRARIES}")
+      endif()
+      if(PC_CURL_LDFLAGS_OTHER)
+        set_property(TARGET CURL::libcurl PROPERTY
+                     INTERFACE_LINK_OPTIONS "${PC_CURL_LDFLAGS_OTHER}")
+      endif()
+      if(PC_CURL_CFLAGS_OTHER)
+        set_property(TARGET CURL::libcurl PROPERTY
+                     INTERFACE_COMPILE_OPTIONS "${PC_CURL_CFLAGS_OTHER}")
+      endif()
+    else()
+      if(CURL_USE_STATIC_LIBS AND MSVC)
+         set_target_properties(CURL::libcurl PROPERTIES
+             INTERFACE_LINK_LIBRARIES "normaliz.lib;ws2_32.lib;wldap32.lib")
+      endif()
+     endif()
+ 
+   endif()
@@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString isMinimalBuild "-minimal"
    + lib.optionalString cursesUI "-cursesUI"
    + lib.optionalString qt5UI "-qt5UI";
-  version = "3.30.4";
+  version = "3.30.5";

  src = fetchurl {
    url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-x1nJcnTx56qq/LHw0mH53pvzpdbst+LfYWMkpG/nBLI=";
+    hash = "sha256-n1XhpAUI8vKbfgZfoIwp+CxAL6BALag5//5koldVqG0=";
  };

  patches = [
@@ -76,7 +76,12 @@ stdenv.mkDerivation (finalAttrs: {
    substituteAll {
      src = ./007-darwin-bsd-ps-abspath.diff;
      ps = lib.getExe ps;
-    });
+    })
+  ++ [
+    # Backport of https://gitlab.kitware.com/cmake/cmake/-/merge_requests/9900
+    # Needed to corretly link curl in pkgsStatic.
+    ./008-FindCURL-Add-more-target-properties-from-pkg-config.diff
+  ];

  outputs = [ "out" ] ++ lib.optionals buildDocs [ "man" "info" ];
  separateDebugInfo = true;
@@ -5,8 +5,8 @@
 # against the fragment described by `document` or the whole definition.
 # The script will be strict and enforce concrete values, i.e. partial documents are not supported.
 cueSchemaFile: { document ? null }:
-  writeShellScript "validate-using-cue"
-  ''${cue}/bin/cue \
+  writeShellScript "validate-using-cue" ''
+    ${cue}/bin/cue \
      --all-errors \
      --strict \
      vet \
@@ -49,14 +49,14 @@ assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsS

 stdenv.mkDerivation (finalAttrs: {
  pname = "curl";
-  version = "8.10.1";
+  version = "8.11.0";

  src = fetchurl {
    urls = [
      "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
      "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
    ];
-    hash = "sha256-c6Sw6ZWWoJ+lkkpPt+S5lahf2g0YosAquc8TS+vOBO4=";
+    hash = "sha256-21nPDWccpuf1wsXsF3CEozp54EyX5xzxg6XN6iNQVOs=";
  };

  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
@@ -26,13 +26,13 @@ assert useVulkan -> withExamples;

 stdenv.mkDerivation rec {
  pname = "dav1d";
-  version = "1.4.3";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "videolan";
    repo = pname;
    rev = version;
-    hash = "sha256-uudtA9ZpGIpw1yfCzbywFyH7EWYHuXfE6pBb2eksx1g=";
+    hash = "sha256-eOMQj88vlgoxguV+eK4iWXFjUPiXwqRTJlhehev+yGY=";
  };

  outputs = [ "out" "dev" ];
@@ -15,7 +15,10 @@
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , nixosTests
-, withDocs ? true
+, buildPackages
+, gobject-introspection
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
+, withDocs ? withIntrospection
 }:

 stdenv.mkDerivation rec {
@@ -49,12 +52,14 @@ stdenv.mkDerivation rec {
    glib
    bash-completion
    dbus
+  ] ++ lib.optionals withIntrospection [
    vala
  ];

  mesonFlags = [
    "--sysconfdir=/etc"
-    "-Dgtk_doc=${lib.boolToString withDocs}"
+    (lib.mesonBool "gtk_doc" withDocs)
+    (lib.mesonBool "vapi" withIntrospection)
  ];

  nativeCheckInputs = [
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "dhcpcd";
-  version = "10.0.6";
+  version = "10.1.0";

  src = fetchFromGitHub {
    owner = "NetworkConfiguration";
    repo = "dhcpcd";
    rev = "v${version}";
-    sha256 = "sha256-tNC5XCA8dShaTIff15mQz8v+YK9sZkRNLCX5qnlpxx4=";
+    sha256 = "sha256-Qtg9jOFMR/9oWJDmoNNcEAMxG6G1F187HF4MMBJIoTw=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja }:
 stdenv.mkDerivation rec {
  pname = "directx-headers";
-  version = "1.614.0";
+  version = "1.614.1";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "DirectX-Headers";
    rev = "v${version}";
-    hash = "sha256-0LaN9D3cKVacMJhZCe9oxDPHpd1jdCAV0ImG2rSgnxc=";
+    hash = "sha256-CDmzKdV40EExLpOHPAUnytqG9x1+IGW4AZldfYs5YJk=";
  };

  nativeBuildInputs = [ meson ninja ];
@@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch2
 , fetchzip
 , meson
 , ninja
@@ -22,6 +23,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-KZCzrvdWd6zfQHppjyp4XzqNCfH2UnuRneu+BNIRVAY=";
  };

+  patches = [
+    (fetchpatch2 {
+      # https://github.com/dgibson/dtc/pull/141
+      url = "https://github.com/dgibson/dtc/commit/56a7d0cb3be5f2f7604bc42299e24d13a39c72d8.patch";
+      hash = "sha256-GmAyk/K2OolH/Z8SsgwCcq3/GOlFuSpnVPr7jsy8Cs0=";
+    })
+  ];
+
  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;

  nativeBuildInputs = [
@@ -32,8 +32,6 @@ stdenv.mkDerivation rec {
    openssl
    protobuf
    zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.libutil
  ];

  preBuild = ''
@@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "ethtool";
-  version = "6.9";
+  version = "6.11";

  src = fetchurl {
    url = "mirror://kernel/software/network/ethtool/ethtool-${version}.tar.xz";
-    sha256 = "sha256-pxsDVAEGYcXPF4vGBu1Q/LkYBc8Yl60OsoGDh6X9DNk=";
+    sha256 = "sha256-jZH1xyrj8lt+iNR4EnncsyD3HjAFiRQ3CxxXTJazEgI=";
  };

  nativeBuildInputs = [
@@ -17,7 +17,7 @@
 # files.

 let
-  version = "2.6.3";
+  version = "2.6.4";
  tag = "R_${lib.replaceStrings ["."] ["_"] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = with finalAttrs; "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-J02yVKaXm95arUBHY6cElWlA5GWEPyqb2e168i4sDvw=";
+    hash = "sha256-ppVina4EcFWzfVCg/0d20dRdCkyELPTM7hWEQfVf9+4=";
  };

  strictDeps = true;
@@ -0,0 +1,29 @@
+{
+  ffmpeg_7-headless,
+  lib,
+  fetchFromGitHub,
+}:
+
+(ffmpeg_7-headless.override {
+  version = "7.0.1-unstable-2024-07-10";
+  withCudaLLVM = true;
+  source = fetchFromGitHub {
+    owner = "livepeer";
+    repo = "FFmpeg";
+    rev = "d9751c73e714b01b363483db358b1ea8022c9bea"; # From branch n*-livepeer
+    hash = "sha256-IJVpb/k+obGFD9uOoIVHCd2ZiGL3CA4CV3D+Q9vMbQM=";
+  };
+}).overrideAttrs
+  (old: {
+    pname = "ffmpeg-livepeer";
+
+    meta = {
+      inherit (old.meta)
+        license
+        mainProgram
+        pkgConfigModules
+        platforms
+        ;
+      maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    };
+  })
@@ -35,11 +35,11 @@ stdenv.mkDerivation rec {
    description = "Command-line option parser generator";
    mainProgram = "gengetopt";

-    longDescription =
-      '' GNU Gengetopt program generates a C function that uses getopt_long
-         function to parse the command line options, to validate them and
-         fills a struct
-      '';
+    longDescription = ''
+      GNU Gengetopt program generates a C function that uses getopt_long
+      function to parse the command line options, to validate them and
+      fills a struct
+    '';

    homepage = "https://www.gnu.org/software/gengetopt/";

@@ -32,13 +32,13 @@ let
  ];
 in stdenv.mkDerivation (finalAttrs: {
  pname = "gjs";
-  version = "1.82.0";
+  version = "1.82.1";

  outputs = [ "out" "dev" "installedTests" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FEkCNoaNC/gi96p884/NMz52IHYP3PUOkyQjYR9iZiM=";
+    hash = "sha256-+zmqVjZXbeDloRcfVqGlgl4r0aaZcvsSC6eL0Qm1aTw=";
  };

  patches = [
@@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "imath";
-  version = "3.1.11";
+  version = "3.1.12";

  src = fetchFromGitHub {
    owner = "AcademySoftwareFoundation";
    repo = "imath";
    rev = "v${version}";
-    sha256 = "sha256-Cnl0BTXUzkDvgLSNXJbh5ATczBdbxiwbS4J9L6N8sKI=";
+    sha256 = "sha256-r4FNyNsWdmpZrHOpSvaSUWRYhAU+qnW4lE5uYPKn7Mw=";
  };

  nativeBuildInputs = [ cmake ];
@@ -22,6 +22,7 @@ python.pkgs.buildPythonApplication rec {
  '';

  pythonRelaxDeps = [
+    "pillow"
    "pydantic-settings"
  ];

@@ -13,12 +13,12 @@

 stdenv.mkDerivation rec {
  pname = "iwd";
-  version = "2.22";
+  version = "3.0";

  src = fetchgit {
    url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
    rev = version;
-    hash = "sha256-t2mfBRP/PRlcfeezu3B7myCKXVv9SHeW8HlGK1cO3/I=";
+    hash = "sha256-pkren8mF0xg5yrkaIrMJ5auq+7w8VAldbgVflE2BmlM=";
  };

  outputs = [ "out" "man" "doc" ]
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gitUpdater,
+  testers,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kvazaar";
+  version = "2.3.1";
+
+  src = fetchFromGitHub {
+    owner = "ultravideo";
+    repo = "kvazaar";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-d/OkX18nyHSQXJgNhBtiCLb/Fe8Y/MpddXxLpNMZiXI=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+    "man"
+  ];
+
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Open-source HEVC encoder";
+    homepage = "https://github.com/ultravideo/kvazaar";
+    changelog = "https://github.com/ultravideo/kvazaar/releases/tag/v${finalAttrs.version}";
+    pkgConfigModules = [ "kvazaar" ];
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+  };
+})
@@ -0,0 +1,104 @@
+{
+  cmake,
+  copyPkgconfigItems,
+  fetchFromGitHub,
+  fmt,
+  git,
+  gitUpdater,
+  gtest,
+  lib,
+  makePkgconfigItem,
+  pkg-config,
+  python3,
+  range-v3,
+  rapidjson,
+  stdenv,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lcevcdec";
+  version = "3.2.1";
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "v-novaltd";
+    repo = "LCEVCdec";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-Nf0YntB1A3AH0MTXlfUHhxYbzZqeB0EH9Fe9Xrqdsts=";
+  };
+
+  postPatch = ''
+    substituteInPlace cmake/tools/version_files.py \
+      --replace-fail "args.git_version" '"${finalAttrs.version}"' \
+      --replace-fail "args.git_hash" '"${finalAttrs.src.rev}"' \
+      --replace-fail "args.git_date" '"1970-01-01"'
+  '';
+
+  env = {
+    includedir = "${placeholder "dev"}/include";
+    libdir = "${placeholder "out"}/lib";
+  };
+
+  pkgconfigItems = [
+    (makePkgconfigItem rec {
+      name = "lcevc_dec";
+      inherit (finalAttrs) version;
+      libs = [
+        "-L${variables.libdir}"
+        "-llcevc_dec_api"
+      ];
+      libsPrivate = [
+        "-lpthread"
+        "-llcevc_dec_core"
+      ];
+      cflags = [
+        "-I${variables.includedir}"
+      ];
+      variables = {
+        prefix = "@dev@";
+        includedir = "@includedir@";
+        libdir = "@libdir@";
+      };
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    python3
+    git
+    pkg-config
+    copyPkgconfigItems
+  ];
+
+  buildInputs = [
+    rapidjson
+    fmt
+    range-v3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "VN_SDK_FFMPEG_LIBS_PACKAGE" "")
+    (lib.cmakeBool "VN_SDK_UNIT_TESTS" false)
+    (lib.cmakeBool "VN_SDK_SAMPLE_SOURCE" false)
+  ];
+
+  passthru = {
+    updateScript = gitUpdater { };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    homepage = "https://github.com/v-novaltd/LCEVCdec";
+    description = "MPEG-5 LCEVC Decoder";
+    license = lib.licenses.bsd3Clear;
+    pkgConfigModules = [ "lcevc_dec" ];
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -1,25 +0,0 @@
-From 3e80d438e2a3ec50d666f2b6e32007c275d4a08a Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Thu, 11 Apr 2024 23:13:29 -0400
-Subject: [PATCH 8/8] Disable searching in standard library locations
-
---
- src/ld/Options.cpp | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/ld/Options.cpp b/src/ld/Options.cpp
-index 67a9f53..611b583 100644
--- a/src/ld/Options.cpp
-+++ b/src/ld/Options.cpp
-@@ -4320,7 +4320,7 @@ bool Options::shouldUseBuildVersion(ld::Platform plat, uint32_t minOSvers) const
- 
- void Options::buildSearchPaths(int argc, const char* argv[])
- {
-	bool addStandardLibraryDirectories = true;
-+	bool addStandardLibraryDirectories = false;
- 	ld::Platform platform = ld::Platform::unknown;
- 	std::vector<const char*> libraryPaths;
- 	std::vector<const char*> frameworkPaths;
-- 
-2.45.1
-
@@ -128,8 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
    ./0006-Add-libcd_is_blob_a_linker_signature-implementation.patch
    # Add OpenSSL implementation of CoreCrypto digest functions. Avoids use of private and non-free APIs.
    ./0007-Add-OpenSSL-based-CoreCrypto-digest-functions.patch
-    # ld64 will search `/usr/lib`, `/Library/Frameworks`, etc by default. Disable that.
-    ./0008-Disable-searching-in-standard-library-locations.patch
+    ./remove-unused-and-incomplete-blob-clone.diff
  ];

  postPatch = ''
@@ -0,0 +1,14 @@
+diff --git a/src/ld/code-sign-blobs/blob.h b/src/ld/code-sign-blobs/blob.h
+index 19c63a9..1dfb380 100644
+--- a/src/ld/code-sign-blobs/blob.h
+++ b/src/ld/code-sign-blobs/blob.h
+@@ -180,9 +180,6 @@ public:
+ 		return NULL;
+ 	}
+ 	
+-	BlobType *clone() const
+-	{ assert(validateBlob()); return specific(this->BlobCore::clone());	}
+-
+ 	static BlobType *readBlob(int fd)
+ 	{ return specific(BlobCore::readBlob(fd, _magic, sizeof(BlobType), 0), true); }
+ 
@@ -1,6 +1,8 @@
 {
  lib,
  fetchurl,
+  fetchpatch,
+  autoreconfHook,
  ncurses,
  pcre2,
  stdenv,
@@ -22,6 +24,23 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-KBn1VWTYbVQqu+yv2C/2HoGaPuyWf6o2zT5o8VlqRLg=";
  };

+  patches = [
+    (fetchpatch {
+      # Fix configure parameters --with-secure=no and --without-secure.
+      url = "https://github.com/gwsw/less/commit/8fff6c56bfc833528b31ebdaee871f65fbe342b1.patch";
+      hash = "sha256-XV5XufivNWWLGeIpaP04YQPWcxIUKYYEINdT+eEx+WA=";
+      includes = [
+        "configure.ac"
+      ];
+    })
+  ];
+
+  # Need `autoreconfHook` since we patch `configure.ac`.
+  # TODO: Remove the `configure.ac` patch and `autoreconfHook` next release
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
  buildInputs = [
    ncurses
    pcre2
@@ -31,13 +31,13 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
  pname = "libarchive";
-  version = "3.7.6";
+  version = "3.7.7";

  src = fetchFromGitHub {
    owner = "libarchive";
    repo = "libarchive";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-smj8JV5irW/StUx/Zp62w5cnlKbF6GRIOSh8i4ocJ8s=";
+    hash = "sha256-maV2+Whi4aDG1VLAYpOTxluO9I0zNiZ8fA3w7epGlDg=";
  };

  outputs = [ "out" "lib" "dev" ];
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "libimobiledevice-glue";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "libimobiledevice";
    repo = pname;
    rev = version;
-    hash = "sha256-+poCrn2YHeH8RQCfWDdnlmJB4Nf+unWUVwn7YwILHIs=";
+    hash = "sha256-Fu0zQIryESRaTGzDlAaewX9Yo2nPEeUxmcb3yPJLuSI=";
  };

  preAutoreconf = ''
@@ -32,13 +32,13 @@ assert !(enableJpeg7 && enableJpeg8);  # pick only one or none, not both
 stdenv.mkDerivation (finalAttrs: {

  pname = "libjpeg-turbo";
-  version = "3.0.3";
+  version = "3.0.4";

  src = fetchFromGitHub {
    owner = "libjpeg-turbo";
    repo = "libjpeg-turbo";
    rev = finalAttrs.version;
-    hash = "sha256-w2wJaVf4sjJ9pPPqc9R4TE6Q6Yl0U6+fI5KLpQKwEXI=";
+    hash = "sha256-ZNqhOfZtWcMv10VWIUxn7MSy4KhW/jBrgC1tUFKczqs=";
  };

  patches = [
@@ -85,7 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
    inherit
      dvgrab
      epeg
-      freeimage
      gd
      graphicsmagick
      imagemagick
@@ -26,11 +26,11 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Library for multiprecision complex arithmetic with exact rounding";

-    longDescription =
-      '' GNU MPC is a C library for the arithmetic of complex numbers with
-         arbitrarily high precision and correct rounding of the result.  It is
-         built upon and follows the same principles as GNU MPFR.
-      '';
+    longDescription = ''
+      GNU MPC is a C library for the arithmetic of complex numbers with
+      arbitrarily high precision and correct rounding of the result.  It is
+      built upon and follows the same principles as GNU MPFR.
+    '';

    homepage = "https://www.multiprecision.org/mpc/";
    license = lib.licenses.lgpl2Plus;
@@ -28,6 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
  ];

+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+  ];
+
  meta = {
    description = "Media container library to manipulate Ogg files";
    longDescription = ''
@@ -1,459 +0,0 @@
-From d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a Mon Sep 17 00:00:00 2001
-From: Michael Buckley <michael@buckleyisms.com>
-Date: Thu, 30 Nov 2023 15:08:02 -0800
-Subject: [PATCH] src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack"
-
-Refs:
-https://terrapin-attack.com/
-https://seclists.org/oss-sec/2023/q4/292
-https://osv.dev/list?ecosystem=&q=CVE-2023-48795
-https://github.com/advisories/GHSA-45x7-px36-x8w8
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795
-
-Fixes #1290
-Closes #1291
---
- src/kex.c          | 63 +++++++++++++++++++++++------------
- src/libssh2_priv.h | 18 +++++++---
- src/packet.c       | 83 +++++++++++++++++++++++++++++++++++++++++++---
- src/packet.h       |  2 +-
- src/session.c      |  3 ++
- src/transport.c    | 12 ++++++-
- 6 files changed, 149 insertions(+), 32 deletions(-)
-
-diff --git a/src/kex.c b/src/kex.c
-index 8e7b7f0af3..a7b301e157 100644
--- a/src/kex.c
-+++ b/src/kex.c
-@@ -3032,6 +3032,13 @@ kex_method_extension_negotiation = {
-     0,
- };
- 
-+static const LIBSSH2_KEX_METHOD
-+kex_method_strict_client_extension = {
-+    "kex-strict-c-v00@openssh.com",
-+    NULL,
-+    0,
-+};
-+
- static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
- #if LIBSSH2_ED25519
-     &kex_method_ssh_curve25519_sha256,
-@@ -3050,6 +3057,7 @@ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
-     &kex_method_diffie_helman_group1_sha1,
-     &kex_method_diffie_helman_group_exchange_sha1,
-     &kex_method_extension_negotiation,
-+    &kex_method_strict_client_extension,
-     NULL
- };
- 
-@@ -3302,13 +3310,13 @@ static int kexinit(LIBSSH2_SESSION * session)
-     return 0;
- }
- 
-/* kex_agree_instr
-+/* _libssh2_kex_agree_instr
-  * Kex specific variant of strstr()
-  * Needle must be preceded by BOL or ',', and followed by ',' or EOL
-  */
-static unsigned char *
-kex_agree_instr(unsigned char *haystack, size_t haystack_len,
-                const unsigned char *needle, size_t needle_len)
-+unsigned char *
-+_libssh2_kex_agree_instr(unsigned char *haystack, size_t haystack_len,
-+                         const unsigned char *needle, size_t needle_len)
- {
-     unsigned char *s;
-     unsigned char *end_haystack;
-@@ -3393,7 +3401,7 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
-         while(s && *s) {
-             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
-             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
-            if(kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
-+            if(_libssh2_kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
-                 const LIBSSH2_HOSTKEY_METHOD *method =
-                     (const LIBSSH2_HOSTKEY_METHOD *)
-                     kex_get_method_by_name((char *) s, method_len,
-@@ -3427,9 +3435,9 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
-     }
- 
-     while(hostkeyp && (*hostkeyp) && (*hostkeyp)->name) {
-        s = kex_agree_instr(hostkey, hostkey_len,
-                            (unsigned char *) (*hostkeyp)->name,
-                            strlen((*hostkeyp)->name));
-+        s = _libssh2_kex_agree_instr(hostkey, hostkey_len,
-+                                     (unsigned char *) (*hostkeyp)->name,
-+                                     strlen((*hostkeyp)->name));
-         if(s) {
-             /* So far so good, but does it suit our purposes? (Encrypting vs
-                Signing) */
-@@ -3463,6 +3471,12 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
- {
-     const LIBSSH2_KEX_METHOD **kexp = libssh2_kex_methods;
-     unsigned char *s;
-+    const unsigned char *strict =
-+        (unsigned char *)"kex-strict-s-v00@openssh.com";
-+
-+    if(_libssh2_kex_agree_instr(kex, kex_len, strict, 28)) {
-+        session->kex_strict = 1;
-+    }
- 
-     if(session->kex_prefs) {
-         s = (unsigned char *) session->kex_prefs;
-@@ -3470,7 +3484,7 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
-         while(s && *s) {
-             unsigned char *q, *p = (unsigned char *) strchr((char *) s, ',');
-             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
-            q = kex_agree_instr(kex, kex_len, s, method_len);
-+            q = _libssh2_kex_agree_instr(kex, kex_len, s, method_len);
-             if(q) {
-                 const LIBSSH2_KEX_METHOD *method = (const LIBSSH2_KEX_METHOD *)
-                     kex_get_method_by_name((char *) s, method_len,
-@@ -3504,9 +3518,9 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
-     }
- 
-     while(*kexp && (*kexp)->name) {
-        s = kex_agree_instr(kex, kex_len,
-                            (unsigned char *) (*kexp)->name,
-                            strlen((*kexp)->name));
-+        s = _libssh2_kex_agree_instr(kex, kex_len,
-+                                     (unsigned char *) (*kexp)->name,
-+                                     strlen((*kexp)->name));
-         if(s) {
-             /* We've agreed on a key exchange method,
-              * Can we agree on a hostkey that works with this kex?
-@@ -3550,7 +3564,7 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
-             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
-             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
- 
-            if(kex_agree_instr(crypt, crypt_len, s, method_len)) {
-+            if(_libssh2_kex_agree_instr(crypt, crypt_len, s, method_len)) {
-                 const LIBSSH2_CRYPT_METHOD *method =
-                     (const LIBSSH2_CRYPT_METHOD *)
-                     kex_get_method_by_name((char *) s, method_len,
-@@ -3572,9 +3586,9 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
-     }
- 
-     while(*cryptp && (*cryptp)->name) {
-        s = kex_agree_instr(crypt, crypt_len,
-                            (unsigned char *) (*cryptp)->name,
-                            strlen((*cryptp)->name));
-+        s = _libssh2_kex_agree_instr(crypt, crypt_len,
-+                                     (unsigned char *) (*cryptp)->name,
-+                                     strlen((*cryptp)->name));
-         if(s) {
-             endpoint->crypt = *cryptp;
-             return 0;
-@@ -3614,7 +3628,7 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
-             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
-             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
- 
-            if(kex_agree_instr(mac, mac_len, s, method_len)) {
-+            if(_libssh2_kex_agree_instr(mac, mac_len, s, method_len)) {
-                 const LIBSSH2_MAC_METHOD *method = (const LIBSSH2_MAC_METHOD *)
-                     kex_get_method_by_name((char *) s, method_len,
-                                            (const LIBSSH2_COMMON_METHOD **)
-@@ -3635,8 +3649,9 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
-     }
- 
-     while(*macp && (*macp)->name) {
-        s = kex_agree_instr(mac, mac_len, (unsigned char *) (*macp)->name,
-                            strlen((*macp)->name));
-+        s = _libssh2_kex_agree_instr(mac, mac_len,
-+                                     (unsigned char *) (*macp)->name,
-+                                     strlen((*macp)->name));
-         if(s) {
-             endpoint->mac = *macp;
-             return 0;
-@@ -3667,7 +3682,7 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
-             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
-             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
- 
-            if(kex_agree_instr(comp, comp_len, s, method_len)) {
-+            if(_libssh2_kex_agree_instr(comp, comp_len, s, method_len)) {
-                 const LIBSSH2_COMP_METHOD *method =
-                     (const LIBSSH2_COMP_METHOD *)
-                     kex_get_method_by_name((char *) s, method_len,
-@@ -3689,8 +3704,9 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
-     }
- 
-     while(*compp && (*compp)->name) {
-        s = kex_agree_instr(comp, comp_len, (unsigned char *) (*compp)->name,
-                            strlen((*compp)->name));
-+        s = _libssh2_kex_agree_instr(comp, comp_len,
-+                                     (unsigned char *) (*compp)->name,
-+                                     strlen((*compp)->name));
-         if(s) {
-             endpoint->comp = *compp;
-             return 0;
-@@ -3871,6 +3887,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
-                 session->local.kexinit = key_state->oldlocal;
-                 session->local.kexinit_len = key_state->oldlocal_len;
-                 key_state->state = libssh2_NB_state_idle;
-+                session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
-                 session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
-                 session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
-                 return -1;
-@@ -3896,6 +3913,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
-                 session->local.kexinit = key_state->oldlocal;
-                 session->local.kexinit_len = key_state->oldlocal_len;
-                 key_state->state = libssh2_NB_state_idle;
-+                session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
-                 session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
-                 session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
-                 return -1;
-@@ -3944,6 +3962,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
-         session->remote.kexinit = NULL;
-     }
- 
-+    session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
-     session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
-     session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
- 
-diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h
-index 7660366954..18d9ab2130 100644
--- a/src/libssh2_priv.h
-+++ b/src/libssh2_priv.h
-@@ -736,6 +736,9 @@ struct _LIBSSH2_SESSION
-     /* key signing algorithm preferences -- NULL yields server order */
-     char *sign_algo_prefs;
- 
-+    /* Whether to use the OpenSSH Strict KEX extension */
-+    int kex_strict;
-+
-     /* (remote as source of data -- packet_read ) */
-     libssh2_endpoint_data remote;
- 
-@@ -908,6 +911,7 @@ struct _LIBSSH2_SESSION
-     int fullpacket_macstate;
-     size_t fullpacket_payload_len;
-     int fullpacket_packet_type;
-+    uint32_t fullpacket_required_type;
- 
-     /* State variables used in libssh2_sftp_init() */
-     libssh2_nonblocking_states sftpInit_state;
-@@ -948,10 +952,11 @@ struct _LIBSSH2_SESSION
- };
- 
- /* session.state bits */
-#define LIBSSH2_STATE_EXCHANGING_KEYS   0x00000001
-#define LIBSSH2_STATE_NEWKEYS           0x00000002
-#define LIBSSH2_STATE_AUTHENTICATED     0x00000004
-#define LIBSSH2_STATE_KEX_ACTIVE        0x00000008
-+#define LIBSSH2_STATE_INITIAL_KEX       0x00000001
-+#define LIBSSH2_STATE_EXCHANGING_KEYS   0x00000002
-+#define LIBSSH2_STATE_NEWKEYS           0x00000004
-+#define LIBSSH2_STATE_AUTHENTICATED     0x00000008
-+#define LIBSSH2_STATE_KEX_ACTIVE        0x00000010
- 
- /* session.flag helpers */
- #ifdef MSG_NOSIGNAL
-@@ -1182,6 +1187,11 @@ ssize_t _libssh2_send(libssh2_socket_t socket, const void *buffer,
- int _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
-                           key_exchange_state_t * state);
- 
-+unsigned char *_libssh2_kex_agree_instr(unsigned char *haystack,
-+                                        size_t haystack_len,
-+                                        const unsigned char *needle,
-+                                        size_t needle_len);
-+
- /* Let crypt.c/hostkey.c expose their method structs */
- const LIBSSH2_CRYPT_METHOD **libssh2_crypt_methods(void);
- const LIBSSH2_HOSTKEY_METHOD **libssh2_hostkey_methods(void);
-diff --git a/src/packet.c b/src/packet.c
-index eccb8c56a8..6da14e9fa1 100644
--- a/src/packet.c
-+++ b/src/packet.c
-@@ -624,14 +624,13 @@ packet_authagent_open(LIBSSH2_SESSION * session,
-  * layer when it has received a packet.
-  *
-  * The input pointer 'data' is pointing to allocated data that this function
- * is asked to deal with so on failure OR success, it must be freed fine.
- * The only exception is when the return code is LIBSSH2_ERROR_EAGAIN.
-+ * will be freed unless return the code is LIBSSH2_ERROR_EAGAIN.
-  *
-  * This function will always be called with 'datalen' greater than zero.
-  */
- int
- _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
-                    size_t datalen, int macstate)
-+                    size_t datalen, int macstate, uint32_t seq)
- {
-     int rc = 0;
-     unsigned char *message = NULL;
-@@ -676,6 +675,70 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
-         break;
-     }
- 
-+    if(session->state & LIBSSH2_STATE_INITIAL_KEX) {
-+        if(msg == SSH_MSG_KEXINIT) {
-+            if(!session->kex_strict) {
-+                if(datalen < 17) {
-+                    LIBSSH2_FREE(session, data);
-+                    session->packAdd_state = libssh2_NB_state_idle;
-+                    return _libssh2_error(session,
-+                                          LIBSSH2_ERROR_BUFFER_TOO_SMALL,
-+                                          "Data too short extracting kex");
-+                }
-+                else {
-+                    const unsigned char *strict =
-+                    (unsigned char *)"kex-strict-s-v00@openssh.com";
-+                    struct string_buf buf;
-+                    unsigned char *algs = NULL;
-+                    size_t algs_len = 0;
-+
-+                    buf.data = (unsigned char *)data;
-+                    buf.dataptr = buf.data;
-+                    buf.len = datalen;
-+                    buf.dataptr += 17; /* advance past type and cookie */
-+
-+                    if(_libssh2_get_string(&buf, &algs, &algs_len)) {
-+                        LIBSSH2_FREE(session, data);
-+                        session->packAdd_state = libssh2_NB_state_idle;
-+                        return _libssh2_error(session,
-+                                              LIBSSH2_ERROR_BUFFER_TOO_SMALL,
-+                                              "Algs too short");
-+                    }
-+
-+                    if(algs_len == 0 ||
-+                       _libssh2_kex_agree_instr(algs, algs_len, strict, 28)) {
-+                        session->kex_strict = 1;
-+                    }
-+                }
-+            }
-+
-+            if(session->kex_strict && seq) {
-+                LIBSSH2_FREE(session, data);
-+                session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
-+                session->packAdd_state = libssh2_NB_state_idle;
-+                libssh2_session_disconnect(session, "strict KEX violation: "
-+                                           "KEXINIT was not the first packet");
-+
-+                return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
-+                                      "strict KEX violation: "
-+                                      "KEXINIT was not the first packet");
-+            }
-+        }
-+
-+        if(session->kex_strict && session->fullpacket_required_type &&
-+            session->fullpacket_required_type != msg) {
-+            LIBSSH2_FREE(session, data);
-+            session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
-+            session->packAdd_state = libssh2_NB_state_idle;
-+            libssh2_session_disconnect(session, "strict KEX violation: "
-+                                       "unexpected packet type");
-+
-+            return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
-+                                  "strict KEX violation: "
-+                                  "unexpected packet type");
-+        }
-+    }
-+
-     if(session->packAdd_state == libssh2_NB_state_allocated) {
-         /* A couple exceptions to the packet adding rule: */
-         switch(msg) {
-@@ -1364,6 +1427,15 @@ _libssh2_packet_ask(LIBSSH2_SESSION * session, unsigned char packet_type,
- 
-             return 0;
-         }
-+        else if(session->kex_strict &&
-+                (session->state & LIBSSH2_STATE_INITIAL_KEX)) {
-+            libssh2_session_disconnect(session, "strict KEX violation: "
-+                                       "unexpected packet type");
-+
-+            return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
-+                                  "strict KEX violation: "
-+                                  "unexpected packet type");
-+        }
-         packet = _libssh2_list_next(&packet->node);
-     }
-     return -1;
-@@ -1425,7 +1497,10 @@ _libssh2_packet_require(LIBSSH2_SESSION * session, unsigned char packet_type,
-     }
- 
-     while(session->socket_state == LIBSSH2_SOCKET_CONNECTED) {
-        int ret = _libssh2_transport_read(session);
-+        int ret;
-+        session->fullpacket_required_type = packet_type;
-+        ret = _libssh2_transport_read(session);
-+        session->fullpacket_required_type = 0;
-         if(ret == LIBSSH2_ERROR_EAGAIN)
-             return ret;
-         else if(ret < 0) {
-diff --git a/src/packet.h b/src/packet.h
-index 1d90b8af12..955351e5f6 100644
--- a/src/packet.h
-+++ b/src/packet.h
-@@ -72,6 +72,6 @@ int _libssh2_packet_burn(LIBSSH2_SESSION * session,
- int _libssh2_packet_write(LIBSSH2_SESSION * session, unsigned char *data,
-                           unsigned long data_len);
- int _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
-                        size_t datalen, int macstate);
-+                        size_t datalen, int macstate, uint32_t seq);
- 
- #endif /* LIBSSH2_PACKET_H */
-diff --git a/src/session.c b/src/session.c
-index 35e7929fe7..9d89ade8ec 100644
--- a/src/session.c
-+++ b/src/session.c
-@@ -469,6 +469,8 @@ libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)),
-         session->abstract = abstract;
-         session->api_timeout = 0; /* timeout-free API by default */
-         session->api_block_mode = 1; /* blocking API by default */
-+        session->state = LIBSSH2_STATE_INITIAL_KEX;
-+        session->fullpacket_required_type = 0;
-         session->packet_read_timeout = LIBSSH2_DEFAULT_READ_TIMEOUT;
-         session->flag.quote_paths = 1; /* default behavior is to quote paths
-                                           for the scp subsystem */
-@@ -1223,6 +1225,7 @@ libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, int reason,
-                               const char *desc, const char *lang)
- {
-     int rc;
-+    session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
-     session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
-     BLOCK_ADJUST(rc, session,
-                  session_disconnect(session, reason, desc, lang));
-diff --git a/src/transport.c b/src/transport.c
-index 21be9d2b80..a8bb588a4b 100644
--- a/src/transport.c
-+++ b/src/transport.c
-@@ -186,6 +186,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
-     struct transportpacket *p = &session->packet;
-     int rc;
-     int compressed;
-+    uint32_t seq = session->remote.seqno;
- 
-     if(session->fullpacket_state == libssh2_NB_state_idle) {
-         session->fullpacket_macstate = LIBSSH2_MAC_CONFIRMED;
-@@ -317,7 +318,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
-     if(session->fullpacket_state == libssh2_NB_state_created) {
-         rc = _libssh2_packet_add(session, p->payload,
-                                  session->fullpacket_payload_len,
-                                 session->fullpacket_macstate);
-+                                 session->fullpacket_macstate, seq);
-         if(rc == LIBSSH2_ERROR_EAGAIN)
-             return rc;
-         if(rc) {
-@@ -328,6 +329,11 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
- 
-     session->fullpacket_state = libssh2_NB_state_idle;
- 
-+    if(session->kex_strict &&
-+        session->fullpacket_packet_type == SSH_MSG_NEWKEYS) {
-+        session->remote.seqno = 0;
-+    }
-+
-     return session->fullpacket_packet_type;
- }
- 
-@@ -1093,6 +1099,10 @@ int _libssh2_transport_send(LIBSSH2_SESSION *session,
- 
-     session->local.seqno++;
- 
-+    if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS) {
-+        session->local.seqno = 0;
-+    }
-+
-     ret = LIBSSH2_SEND(session, p->outbuf, total_length,
-                        LIBSSH2_SOCKET_SEND_FLAGS(session));
-     if(ret < 0)
@@ -15,19 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "libssh2";
-  version = "1.11.0";
+  version = "1.11.1";

  src = fetchurl {
    url = "https://www.libssh2.org/download/libssh2-${version}.tar.gz";
-    sha256 = "sha256-NzYWHkHiaTMk3rOMJs/cPv5iCdY0ukJY2xzs/2pa1GE=";
+    hash = "sha256-2ex2y+NNuY7sNTn+LImdJrDIN8s+tGalaw8QnKv2WPc=";
  };

-  patches = [
-    # fetchpatch cannot be used due to infinite recursion
-    # https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a
-    ./CVE-2023-48795.patch
-  ];
-
  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
  # necessary for FreeBSD code path in configure
  postPatch = ''
@@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "liburing";
-  version = "2.7";
+  version = "2.8";

  src = fetchFromGitHub {
    owner = "axboe";
    repo = "liburing";
    rev = "refs/tags/liburing-${version}";
-    hash = "sha256-WhNlO2opPM7v4LOLWpmzPv31++zmn5Hmb6Su9IQBDH8=";
+    hash = "sha256-10zmoMDzO41oNRVXE/6FzDGPVRVJTJTARVUmc1b7f+o=";
  };

  separateDebugInfo = true;
@@ -94,13 +94,13 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;

 stdenv.mkDerivation rec {
  pname = "libvpx";
-  version = "1.14.1";
+  version = "1.15.0";

  src = fetchFromGitHub {
    owner = "webmproject";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Pfg7g4y/dqn2VKDQU1LnTJQSj1Tont9/8Je6ShDb2GQ=";
+    hash = "sha256-ewkx1okhpa05jn4DyN8pkl6UJoz4Ymw4jRe6GN1lWuA=";
  };

  postPatch = ''
@@ -18,7 +18,7 @@

 stdenv.mkDerivation rec {
  pname = "libxmlb";
-  version = "0.3.19";
+  version = "0.3.20";

  outputs = [ "out" "lib" "dev" "devdoc" "installedTests" ];

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    owner = "hughsie";
    repo = "libxmlb";
    rev = version;
-    hash = "sha256-gXLWHkT+h/wvmmi7PyIx16gbeYznVOT7CwuBgF3bjOY=";
+    hash = "sha256-X1sOUaqafppEjlcq2jYFo+BXxNX1d+vLizSQM+x/pvg=";
  };

  patches = [
@@ -32,10 +32,19 @@ stdenv.mkDerivation rec {
  propagatedBuildInputs = [ lv2 ];

  mesonFlags = [
-    "-Ddocs=disabled"
+    (lib.mesonOption "docs" "disabled")
    # Tests require building a shared library.
    (lib.mesonEnable "tests" (!stdenv.hostPlatform.isStatic))
-  ];
+  ] # Add nix and NixOS specific lv2 paths
+    # The default values are from: https://github.com/lv2/lilv/blob/master/src/lilv_config.h
+    ++ lib.optional stdenv.isDarwin  (lib.mesonOption "default_lv2_path"
+      "~/.lv2:~/Library/Audio/Plug-Ins/LV2:"
+      + "/usr/local/lib/lv2:/usr/lib/lv2:"
+      + "/Library/Audio/Plug-Ins/LV2:"
+      + "~/.nix-profile/lib/lv2")
+    ++ lib.optional stdenv.isLinux  (lib.mesonOption "default_lv2_path"
+      "~/.lv2:/usr/local/lib/lv2:/usr/lib/lv2:"
+      + "~/.nix-profile/lib/lv2:/run/current-system/sw/lib/lv2");

  passthru = {
    tests = {
@@ -1,33 +1,52 @@
-{ lib, fetchFromGitHub, buildGoModule
-, pkg-config, ffmpeg, gnutls
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  pkg-config,
+  ffmpeg-livepeer,
+  gnutls,
+  nix-update-script,
 }:

 buildGoModule rec {
  pname = "livepeer";
-  version = "0.5.20";
+  version = "0.8.0";

  proxyVendor = true;
-  vendorHash = "sha256-aRZoAEnRai8i5H08ReW8lEFlbmarYxU0lBRhR/Llw+M=";
+  vendorHash = "sha256-FCTdPVa10/DUYYuZDLtZsrCXCRoDRfuvnkzhmHJNvrk=";

  src = fetchFromGitHub {
    owner = "livepeer";
    repo = "go-livepeer";
-    rev = "v${version}";
-    sha256 = "sha256-cOxIL093Mi+g9Al/SQJ6vdaeBAXUN6ZGsSaVvEIiJpU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UVL5y8z62pHi0mLueIp+iBxtzGf57LpGh+Czwg2pV0Q=";
  };

-  # livepeer_cli has a vendoring problem
-  subPackages = [ "cmd/livepeer" ];
+  nativeBuildInputs = [
+    pkg-config
+  ];

-  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    ffmpeg-livepeer
+    gnutls
+  ];

-  buildInputs = [ ffmpeg gnutls ];
+  __darwinAllowLocalNetworking = true;

-  meta = with lib; {
+  postPatch = ''
+    rm -rf test/e2e # Require docker
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
    description = "Official Go implementation of the Livepeer protocol";
    homepage = "https://livepeer.org";
-    license = licenses.mit;
-    maintainers = with maintainers; [ elitak ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      elitak
+      bot-wxt1221
+    ];
    mainProgram = "livepeer";
  };
 }
@@ -1,12 +1,12 @@
 {lib, stdenv, fetchurl, cyrus_sasl, libevent, nixosTests }:

 stdenv.mkDerivation rec {
-  version = "1.6.29";
+  version = "1.6.31";
  pname = "memcached";

  src = fetchurl {
    url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-JpZD1Ri3uiAzx6H2b9/FYNcnJaKCIZTZDII1QIxEOkk=";
+    sha256 = "sha256-INjTObj7H2x5zuIFWdxv+13+6E255Yn06yFPbSyHPvU=";
  };

  configureFlags = [
@@ -1,87 +0,0 @@
-From a6fb2c165cda4bbf315424c96165ec9cc7052363 Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Wed, 3 Apr 2024 17:35:56 -0400
-Subject: [PATCH] dependencies: find extraframeworks on case-sensitive
- filesystems
-
-Fixes a test failure on case-sensitive filesystems when a CMake
-dependency is turned into an Apple framework.
---
- mesonbuild/dependencies/framework.py              | 9 +++++++--
- test cases/osx/11 case sensitive apfs/meson.build | 5 +++++
- test cases/osx/11 case sensitive apfs/prog.c      | 3 +++
- test cases/osx/11 case sensitive apfs/test.json   | 5 +++++
- 4 files changed, 20 insertions(+), 2 deletions(-)
- create mode 100644 test cases/osx/11 case sensitive apfs/meson.build
- create mode 100644 test cases/osx/11 case sensitive apfs/prog.c
- create mode 100644 test cases/osx/11 case sensitive apfs/test.json
-
-diff --git a/mesonbuild/dependencies/framework.py b/mesonbuild/dependencies/framework.py
-index 3c880c7430af..1fbd628235ba 100644
--- a/mesonbuild/dependencies/framework.py
-+++ b/mesonbuild/dependencies/framework.py
-@@ -47,6 +47,7 @@ def detect(self, name: str, paths: T.List[str]) -> None:
-             framework_path = self._get_framework_path(p, name)
-             if framework_path is None:
-                 continue
-+            framework_name = framework_path.stem
-             # We want to prefer the specified paths (in order) over the system
-             # paths since these are "extra" frameworks.
-             # For example, Python2's framework is in /System/Library/Frameworks and
-@@ -54,11 +55,15 @@ def detect(self, name: str, paths: T.List[str]) -> None:
-             # Python.framework. We need to know for sure that the framework was
-             # found in the path we expect.
-             allow_system = p in self.system_framework_paths
-            args = self.clib_compiler.find_framework(name, self.env, [p], allow_system)
-+            args = self.clib_compiler.find_framework(framework_name, self.env, [p], allow_system)
-             if args is None:
-                 continue
-             self.link_args = args
-             self.framework_path = framework_path.as_posix()
-+            # The search is done case-insensitively, so the found name may differ
-+            # from the one that was requested. Setting the name ensures the correct
-+            # one is used when linking on case-sensitive filesystems.
-+            self.name = framework_name
-             self.compile_args = ['-F' + self.framework_path]
-             # We need to also add -I includes to the framework because all
-             # cross-platform projects such as OpenGL, Python, Qt, GStreamer,
-@@ -74,7 +79,7 @@ def _get_framework_path(self, path: str, name: str) -> T.Optional[Path]:
-         p = Path(path)
-         lname = name.lower()
-         for d in p.glob('*.framework/'):
-            if lname == d.name.rsplit('.', 1)[0].lower():
-+            if lname == d.stem.lower():
-                 return d
-         return None
- 
-diff --git a/test cases/osx/11 case sensitive apfs/meson.build b/test cases/osx/11 case sensitive apfs/meson.build
-new file mode 100644
-index 000000000000..dd566b185f28
--- /dev/null
-+++ b/test cases/osx/11 case sensitive apfs/meson.build	
-@@ -0,0 +1,5 @@
-+project('case-sensitive APFS with extra frameworks test', 'c')
-+
-+dep = dependency('FoUnDaTiOn')
-+
-+exe = executable('prog', 'prog.c', install : true, dependencies: dep)
-diff --git a/test cases/osx/11 case sensitive apfs/prog.c b/test cases/osx/11 case sensitive apfs/prog.c
-new file mode 100644
-index 000000000000..9b6bdc2ec2f0
--- /dev/null
-+++ b/test cases/osx/11 case sensitive apfs/prog.c	
-@@ -0,0 +1,3 @@
-+int main(void) {
-+    return 0;
-+}
-diff --git a/test cases/osx/11 case sensitive apfs/test.json b/test cases/osx/11 case sensitive apfs/test.json
-new file mode 100644
-index 000000000000..a883714eaa27
--- /dev/null
-+++ b/test cases/osx/11 case sensitive apfs/test.json	
-@@ -0,0 +1,5 @@
-+{
-+  "installed": [
-+    {"type": "file", "file": "usr/bin/prog"}
-+  ]
-+}
@@ -1,15 +1,16 @@
-diff -ur a/mesonbuild/modules/pkgconfig.py b/mesonbuild/modules/pkgconfig.py
--- a/mesonbuild/modules/pkgconfig.py	2024-05-17 17:52:30.880877000 -0700
-+++ b/mesonbuild/modules/pkgconfig.py	2024-05-17 17:53:10.901068000 -0700
-@@ -693,10 +693,7 @@
+diff --git a/mesonbuild/modules/pkgconfig.py b/mesonbuild/modules/pkgconfig.py
+index 1bdf82931..db165ea12 100644
+--- a/mesonbuild/modules/pkgconfig.py
+++ b/mesonbuild/modules/pkgconfig.py
+@@ -701,10 +701,7 @@ class PkgConfigModule(NewExtensionModule):
         pcfile = filebase + '.pc'
         pkgroot = pkgroot_name = kwargs['install_dir'] or default_install_dir
         if pkgroot is None:
 -            if mesonlib.is_freebsd():
-                pkgroot = os.path.join(_as_str(state.environment.coredata.get_option(mesonlib.OptionKey('prefix'))), 'libdata', 'pkgconfig')
+-                pkgroot = os.path.join(_as_str(state.environment.coredata.get_option(OptionKey('prefix'))), 'libdata', 'pkgconfig')
 -                pkgroot_name = os.path.join('{prefix}', 'libdata', 'pkgconfig')
 -            elif mesonlib.is_haiku():
 +            if mesonlib.is_haiku():
-                 pkgroot = os.path.join(_as_str(state.environment.coredata.get_option(mesonlib.OptionKey('prefix'))), 'develop', 'lib', 'pkgconfig')
+                 pkgroot = os.path.join(_as_str(state.environment.coredata.get_option(OptionKey('prefix'))), 'develop', 'lib', 'pkgconfig')
                 pkgroot_name = os.path.join('{prefix}', 'develop', 'lib', 'pkgconfig')
             else:
@@ -13,7 +13,6 @@
 , python3
 , substituteAll
 , zlib
-, fetchpatch
 }:

 let
@@ -21,13 +20,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "meson";
-  version = "1.5.2";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "mesonbuild";
    repo = "meson";
    rev = "refs/tags/${version}";
-    hash = "sha256-cesMepnD3fHX2CwnSQ3c5TE9kPSa0FkCVVVZDgXwo8M=";
+    hash = "sha256-st0dbb+GfF0KEyF+Qn/PIE2462ZrrXy8YcnrulHTI8M=";
  };

  patches = [
@@ -74,24 +73,6 @@ python3.pkgs.buildPythonApplication rec {

    # This edge case is explicitly part of meson but is wrong for nix
    ./007-freebsd-pkgconfig-path.patch
-
-    (fetchpatch {
-      name = "tests-skip-framework-recasting-if-CMake-unavailable.patch";
-      url = "https://github.com/mesonbuild/meson/commit/8a8a3a0578fd8d5a8720a7a706f6f3b99e857f9c.patch";
-      hash = "sha256-XkwNQ5eg/fVekhsFg/V2/S2LbIVGz3H0wsSFlUT3ZZE=";
-    })
-
-    # Fix extraframework lookup on case-sensitive APFS.
-    # https://github.com/mesonbuild/meson/pull/13038
-    ./007-case-sensitive-fs.patch
-
-    # Fix meson's detection for zig's linker
-    # https://github.com/mesonbuild/meson/pull/12293
-    (fetchpatch {
-      name = "linker-support-zig-cc.patch";
-      url = "https://github.com/mesonbuild/meson/pull/12293/commits/2baae244c995794d9addfe6ed924dfa72f01be82.patch";
-      hash = "sha256-dDOmSRBKl/gs7I3kmLXIyQk3zsOdlaYov72pPSel4+I=";
-    })
  ];

  buildInputs = lib.optionals (python3.pythonOlder "3.9") [
@@ -129,7 +110,7 @@ python3.pkgs.buildPythonApplication rec {
      patchShebangs 'test cases'
      substituteInPlace \
        'test cases/native/8 external program shebang parsing/script.int.in' \
-        'test cases/common/273 customtarget exe for test/generate.py' \
+        'test cases/common/274 customtarget exe for test/generate.py' \
          --replace /usr/bin/env ${coreutils}/bin/env
    ''
  ]
@@ -3,6 +3,8 @@
 mesonConfigurePhase() {
    runHook preConfigure

+    : ${mesonBuildDir:=build}
+
    local flagsArray=()

    if [ -z "${dontAddPrefix-}" ]; then
@@ -28,8 +30,8 @@ mesonConfigurePhase() {

    echoCmd 'mesonConfigurePhase flags' "${flagsArray[@]}"

-    meson setup build "${flagsArray[@]}"
-    cd build || { echoCmd 'mesonConfigurePhase' "could not cd to build"; exit 1; }
+    meson setup "$mesonBuildDir" "${flagsArray[@]}"
+    cd "$mesonBuildDir" || { echoCmd 'mesonConfigurePhase' "could not cd to $mesonBuildDir"; exit 1; }

    if ! [[ -v enableParallelBuilding ]]; then
        enableParallelBuilding=1
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, ncurses, buildPackages, darwin }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, ncurses, buildPackages }:

 stdenv.mkDerivation {
  pname = "mg";
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
  '';
  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ ncurses ] ++ lib.optional stdenv.isDarwin [ darwin.libutil ];
+  buildInputs = [ ncurses ];

  meta = with lib; {
    description = "Micro GNU/emacs, a portable version of the mg maintained by the OpenBSD team";
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, updateAutotoolsGnuConfigScriptsHook }:
+{ lib, stdenv, fetchurl, autoreconfHook }:

 stdenv.mkDerivation rec {
  pname = "mpdecimal";
@@ -10,10 +10,16 @@ stdenv.mkDerivation rec {
    hash = "sha256-lCRFwyRbInMP1Bpnp8XCMdEcsbmTa5wPdjNPt9C0Row=";
  };

-  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+  nativeBuildInputs = [ autoreconfHook ];

  configureFlags = [ "LD=${stdenv.cc.targetPrefix}cc" ];

+  postPatch = ''
+    # Use absolute library install names on Darwin.
+    substituteInPlace configure.ac \
+      --replace-fail '-install_name @rpath/' "-install_name $out/lib/"
+  '';
+
  postInstall = ''
    mkdir -p $cxx/lib
    mv $out/lib/*c++* $cxx/lib
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ncurses, darwin }:
+{ lib, stdenv, fetchFromGitHub, ncurses }:

 stdenv.mkDerivation rec {
  pname = "mtm";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
    sha256 = "0gibrvah059z37jvn1qs4b6kvd4ivk2mfihmcpgx1vz6yg70zghv";
  };

-  buildInputs = [ ncurses ] ++ lib.optionals stdenv.isDarwin [ darwin.libutil ];
+  buildInputs = [ ncurses ];

  makeFlags = [ "DESTDIR=${placeholder "out"}" "MANDIR=${placeholder "out"}/share/man/man1" ];

@@ -12,12 +12,12 @@
 , pkg-config
 , python3
 , removeReferencesTo
-, xcbuild
+, apple-sdk_11
+, cctools
 , SDL2
 , fontconfig
 , xorg
 , stdenv
-, darwin
 , libglvnd
 , libxkbcommon
 , enableWayland ? stdenv.hostPlatform.isLinux
@@ -62,11 +62,12 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
  SKIA_NINJA_COMMAND = "${ninja}/bin/ninja";

  nativeBuildInputs = [
+    cctools.libtool
    makeWrapper
    pkg-config
    python3 # skia
    removeReferencesTo
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
+  ];

  nativeCheckInputs = [ neovim ];

@@ -74,9 +75,7 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
    SDL2
    fontconfig
    rustPlatform.bindgenHook
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.AppKit
-  ];
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_11 ];

  postFixup = let
    libPath = lib.makeLibraryPath ([
@@ -118,6 +117,6 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
    changelog = "https://github.com/neovide/neovide/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ ck3d ];
-    platforms = platforms.linux ++ [ "aarch64-darwin" ];
+    platforms = platforms.unix;
  };
 }
@@ -6,7 +6,6 @@
  cmake,
  gettext,
  msgpack-c,
-  darwin,
  libuv,
  lua,
  pkg-config,
@@ -145,7 +144,6 @@ stdenv.mkDerivation (
        tree-sitter
        unibilium
      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.libutil ]
      ++ lib.optionals finalAttrs.finalPackage.doCheck [
        glibcLocales
        procps
@@ -185,16 +183,12 @@ stdenv.mkDerivation (
      ];

    # nvim --version output retains compilation flags and references to build tools
-    postPatch =
-      ''
-        substituteInPlace src/nvim/version.c --replace NVIM_VERSION_CFLAGS "";
-      ''
-      + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-        sed -i runtime/CMakeLists.txt \
-          -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-        sed -i src/nvim/po/CMakeLists.txt \
-          -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-      '';
+    postPatch = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      sed -i runtime/CMakeLists.txt \
+        -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+      sed -i src/nvim/po/CMakeLists.txt \
+        -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+    '';
    postInstall = ''
      find "$out" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
    '';
@@ -228,10 +222,7 @@ stdenv.mkDerivation (
      ];

    preConfigure =
-      lib.optionalString stdenv.hostPlatform.isDarwin ''
-        substituteInPlace src/nvim/CMakeLists.txt --replace "    util" ""
      ''
-      + ''
        mkdir -p $out/lib/nvim/parser
      ''
      + lib.concatStrings (
@@ -32,11 +32,11 @@ assert enableJemalloc -> enableApp;

 stdenv.mkDerivation rec {
  pname = "nghttp2";
-  version = "1.63.0";
+  version = "1.64.0";

  src = fetchurl {
    url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-YHsXRVTSKoKLxTLR1zT+D3KbXV7SB/LxLpamLoPynFU=";
+    sha256 = "sha256-OmcN83joUrhaIpXyXk9RzCj1bg/MSWQIuMN2QpBTevU=";
  };

  outputs = [ "out" "dev" "lib" "doc" "man" ];
@@ -43,11 +43,17 @@ python3Packages.buildPythonApplication {
      featureVersionPrefix,
    }:
    let
-      # TODO: Tighten up after update scripts are run.
-      src = fetchFromGitHub (lib.importJSON sourceFile);
+      sourceInfo = lib.importJSON sourceFile;
    in
    {
-      inherit src;
+      src = fetchFromGitHub {
+        inherit (sourceInfo)
+          owner
+          repo
+          rev
+          hash
+          ;
+      };

      updateScript = {
        command = [
@@ -57,10 +63,10 @@ python3Packages.buildPythonApplication {
          sourceFile

          "--owner"
-          src.owner
+          sourceInfo.owner

          "--repo"
-          src.repo
+          sourceInfo.repo

          "--feature-version-prefix"
          featureVersionPrefix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:

 stdenv.mkDerivation rec {
  pname = "numactl";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-ry29RUNa0Hv5gIhy2RTVT94mHhgfdIwb5aqjBycxxj0=";
  };

+  patches = [
+    # Fix for memory corruption in set_nodemask_size
+    (fetchpatch {
+      url = "https://github.com/numactl/numactl/commit/f9deba0c8404529772468d6dd01389f7dbfa5ba9.patch";
+      hash = "sha256-TmWfD99YaSIHA5PSsWHE91GSsdsVgVU+qIow7LOwOGw=";
+    })
+  ];
+
  outputs = [ "out" "dev" "man" ];

  nativeBuildInputs = [ autoreconfHook ];
@@ -15,14 +15,7 @@ let
    passthru.updateScript = ./update.sh;
  };

-  raw-pkg = (haskellPackages.callPackage ./generated-package.nix { }).overrideScope (
-    final: prev: {
-      # Dependency twain requires an older version of http2, and we cannot mix
-      # versions of transitive dependencies.
-      http2 = final.http2_3_0_3;
-      warp = final.warp_3_3_30;
-    }
-  );
+  raw-pkg = haskellPackages.callPackage ./generated-package.nix { };
 in
 lib.pipe raw-pkg [
  (overrideCabal overrides)
@@ -7,8 +7,8 @@
  }
 },
 "https://github.com": {
-  "unicode-org/icu/releases/download/release-71-1/icu4c-71_1-data-bin-l": {
-   "zip": "sha256-pVWIy0BkICsthA5mxhR9SJQHleMNnaEcGl/AaLi5qZM="
+  "unicode-org/icu/releases/download/release-73-1/icu4c-73_1-data-bin-l": {
+   "zip": "sha256-QDgpjuAqDDiRcYXvj/Tr3pyLVSx3f9A+TfbGtLGCXiA="
  }
 },
 "https://repo.maven.apache.org/maven2": {
@@ -1,6 +1,6 @@
 {
+  "hash": "sha256-WV8NHlYlt7buGbirLSorLnS2TnyBD17zUquFfwSL3xE=",
  "owner": "openjdk",
  "repo": "jfx17u",
-  "rev": "17.0.11-ga",
-  "sha256": "sha256-9VfXk2EfMebMyVKPohPRP2QXRFf8XemUtfY0JtBCHyw="
+  "rev": "refs/tags/17.0.11+3"
 }
@@ -2,5 +2,5 @@
  "hash": "sha256-7z0GIbkQwG9mXY9dssaicqaKpMo3FkNEpyAvkswoQQ4=",
  "owner": "openjdk",
  "repo": "jfx21u",
-  "rev": "21.0.3-ga"
+  "rev": "refs/tags/21.0.3+2"
 }
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-a/ev91Rq7D3z9O56ZZQCgvvbfj5GBt5Lonow2NH3s/E=",
+  "hash": "sha256-H3BPLo7yKWBiiI8sd3wkLJDN9h6jbWj5119cs2YHLwU=",
  "owner": "openjdk",
  "repo": "jfx23u",
-  "rev": "23-ga"
+  "rev": "refs/tags/23.0.1+4"
 }
@@ -69,17 +69,8 @@ stdenv.mkDerivation {

  inherit (source) src;

-  patches =
-    if featureVersion == "23" then
-      [
-        # 8338701: Provide media support for libavcodec version 61
-        # <https://github.com/openjdk/jfx23u/pull/18>
-        (fetchpatch2 {
-          url = "https://github.com/openjdk/jfx23u/commit/aba60fda1c82f00e8e685107592305c403a31287.patch?full_index=1";
-          hash = "sha256-+aRhTwi4VQthAq1SH1jxPl0mTosNMKoTY52jm+jiKso=";
-        })
-      ]
-    else if atLeast21 then
+  patches = lib.optionals (!atLeast23) (
+    if atLeast21 then
      [
        ./21/patches/backport-ffmpeg-7-support-jfx21.patch
      ]
@@ -87,7 +78,8 @@ stdenv.mkDerivation {
      [
        ./17/patches/backport-ffmpeg-6-support-jfx11.patch
        ./17/patches/backport-ffmpeg-7-support-jfx11.patch
-      ];
+      ]
+  );

  nativeBuildInputs = [
    gradle_openjfx
@@ -139,11 +131,6 @@ stdenv.mkDerivation {
        -i modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/Heap.cpp \
           modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/IsoSharedPageInlines.h

-    ''
-    + lib.optionalString (!atLeast21) ''
-      substituteInPlace modules/javafx.web/src/main/native/Source/JavaScriptCore/offlineasm/parser.rb \
-        --replace-fail "File.exists?" "File.exist?"
-
    ''
    + ''
      ln -s $config gradle.properties
@@ -60,6 +60,11 @@ stdenv.mkDerivation rec {
    ]))
  ];

+  ${if stdenv.buildPlatform.isDarwin && stdenv.buildPlatform.isx86_64 then "mesonCheckFlags" else null} = [
+    # Tests regularly exceed the default timeout on `x86_64-darwin`.
+    "--timeout-multiplier=0"
+  ];
+
  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  postPatch = ''
@@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation {
  pname = "publicsuffix-list";
-  version = "0-unstable-2024-09-10";
+  version = "0-unstable-2024-10-25";

  src = fetchFromGitHub {
    owner = "publicsuffix";
    repo = "list";
-    rev = "fbcc4c495e8aed1fe0e90156e6b3796556eb6978";
-    hash = "sha256-L6TepLI91IWImX453GO8VNSSle75f0H1IZbFr2qepDA=";
+    rev = "435e07efb28973ea116592dc2291b1f8c27080aa";
+    hash = "sha256-nLuZVgPHNnxOT3GcGz6TEbHkiNgVU5f2uWcgCfr7tZ8=";
  };

  dontBuild = true;
@@ -1,25 +1,32 @@
-{ lib
-, stdenv
-, fetchurl
-, doxygen
-, mandoc
-, meson
-, ninja
-, pkg-config
-, python3
-, sphinx
-, writeScript
+{
+  lib,
+  stdenv,
+  fetchurl,
+  doxygen,
+  mandoc,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  sphinx,
+  sphinxygen,
+  writeScript,
 }:

 stdenv.mkDerivation rec {
  pname = "serd";
-  version = "0.30.16";
+  version = "0.32.2";

-  outputs = [ "out" "dev" "doc" "man" ];
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "man"
+  ];

  src = fetchurl {
    url = "https://download.drobilla.net/${pname}-${version}.tar.xz";
-    hash = "sha256-9Q9IbaUZzdjQOyDJ5CQU5FkTP1okRBHY5jyu+NmskUY=";
+    hash = "sha256-333CyW8rod7P11bkWOBh3tfYFY0lVVTnaTSDrAljxWs=";
  };

  nativeBuildInputs = [
@@ -30,6 +37,7 @@ stdenv.mkDerivation rec {
    pkg-config
    python3
    sphinx
+    sphinxygen
  ];

  postPatch = ''
@@ -51,12 +59,12 @@ stdenv.mkDerivation rec {
    '';
  };

-  meta = with lib; {
+  meta = {
    description = "Lightweight C library for RDF syntax which supports reading and writing Turtle and NTriples";
    homepage = "https://drobilla.net/software/serd";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ samueltardieu ];
    mainProgram = "serdi";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
  };
 }
@@ -66,8 +66,8 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Tools for remote synchronization and `shell archives'";
-    longDescription =
-      '' GNU shar makes so-called shell archives out of many files, preparing
+    longDescription = ''
+         GNU shar makes so-called shell archives out of many files, preparing
         them for transmission by electronic mail services.  A shell archive
         is a collection of files that can be unpacked by /bin/sh.  A wide
         range of features provide extensive flexibility in manufacturing
@@ -12,7 +12,6 @@
 , antlr4
 , capnproto
 , nlohmann_json
-, darwin
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -46,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
    capnproto
    antlr4.runtime.cpp
    nlohmann_json
-  ] ++ lib.optional stdenv.isDarwin [ darwin.libutil ];
+  ];

  cmakeFlags = [
    "-DSURELOG_USE_HOST_CAPNP=On"
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , libtasn1, openssl, fuse, glib, libseccomp, json-glib
@@ -25,6 +26,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-48/BOzGPoKr/BGEXFo3FXWr6ZoPB+ixZIvv78g6L294=";
  };

+  patches = [
+    # Enable 64-bit file API on 32-bit systems:
+    #   https://github.com/stefanberger/swtpm/pull/941
+    (fetchpatch {
+      name = "64-bit-file-api.patch";
+      url = "https://github.com/stefanberger/swtpm/commit/599e2436d4f603ef7c83fad11d76b5546efabefc.patch";
+      hash = "sha256-cS/BByOJeNNevQ1B3Ij1kykJwixVwGoikowx7j9gRmA=";
+    })
+  ];
+
  nativeBuildInputs = [
    pkg-config unixtools.netstat expect socat
    perl # for pod2man
--- a/Show More
+++ b/Show More