Merge branch 'staging' into staging-next

2023-07-06 17:11:30 +02:00
parent 4b6463704e 58392652f0
commit 91dadd0afb
83 changed files with 2315 additions and 1182 deletions
@@ -26,7 +26,12 @@ with lib;

    fonts.fontconfig.enable = false;

-    nixpkgs.overlays = singleton (const (super: {
+    nixpkgs.overlays = singleton (self: super: let
+      packageOverrides = const (python-prev: {
+        # tk feature requires wayland which fails to compile
+        matplotlib = python-prev.matplotlib.override { enableGtk3 = false; enableTk = false; enableQt = false; };
+      });
+    in {
      beam = super.beam_nox;
      cairo = super.cairo.override { x11Support = false; };
      dbus = super.dbus.override { x11Support = false; };
@@ -62,6 +67,8 @@ with lib;
      pango = super.pango.override { x11Support = false; };
      pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; };
      pipewire = super.pipewire.override { x11Support = false; };
+      python3 = super.python3.override { inherit packageOverrides; };
+      python3Packages = self.python3.pkgs; # required otherwise overlays from above are not forwarded
      qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
      qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
      qt5 = super.qt5.overrideScope (const (super': {
@@ -72,6 +79,6 @@ with lib;
      util-linux = super.util-linux.override { translateManpages = false; };
      vim-full = super.vim-full.override { guiSupport = false; };
      zbar = super.zbar.override { enableVideo = false; withXorg = false; };
-    }));
+    });
  };
 }
@@ -10,12 +10,12 @@

 stdenv.mkDerivation rec {
  pname = "flac";
-  version = "1.4.2";
+  version = "1.4.3";

  src = fetchurl {
    url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
    # Official checksum is published at https://github.com/xiph/flac/releases/tag/${version}
-    sha256 = "sha256-4yLVih9I0j2d049DJnKGX2955zpvnMWl9X/KqD61qOQ=";
+    hash = "sha256-bFjmnNIjSPRBuGEJK4JeWR0Lgi4QbebrDuTQXScgW3A=";
  };

  nativeBuildInputs = [
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1562";
+  version = "9.0.1642";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-+QKh3CxSjwcJ+Rj9RHYHRKSZixkfA1ZCAPDIyV/Npt8=";
+    hash = "sha256-WWj8lZZtnGrv3pxu77otBKixS3ciLcznCyPk/iGryg4=";
  };

  enableParallelBuilding = true;
@@ -3802,7 +3802,7 @@ dependencies = [
 [[package]]
 name = "tauri-plugin-single-instance"
 version = "0.0.0"
-source = "git+https://github.com/tauri-apps/plugins-workspace?branch=v1#c4d2c8c693a8e0da627f4c845486dbe1b1e32c64"
+source = "git+https://github.com/tauri-apps/plugins-workspace?branch=dev#dce0f02bc571128308c30278cde3233f341e6a50"
 dependencies = [
 "log",
 "serde",
@@ -34,11 +34,6 @@ stdenv.mkDerivation rec {

  sourceRoot = "source/src-tauri";

-  postUnpack = ''
-    sed -i -e 's/dev/v1/' source/src-tauri/Cargo.toml
-    cp ${./Cargo.lock} source/src-tauri/Cargo.lock
-  '';
-
  postPatch = ''
    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
      --replace "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
@@ -81,7 +76,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "tauri-plugin-single-instance-0.0.0" = "sha256-9eclolp+Gb8qF/KYIRiOoCJbMJLI8LyWLQu82npI7mQ=";
+      "tauri-plugin-single-instance-0.0.0" = "sha256-M6uGcf4UWAU+494wAK/r2ta1c3IZ07iaURLwJJR9F3U=";
      "tauri-plugin-autostart-0.0.0" = "sha256-9eclolp+Gb8qF/KYIRiOoCJbMJLI8LyWLQu82npI7mQ=";
      "enigo-0.1.2" = "sha256-99VJ0WYD8jV6CYUZ1bpYJBwIE2iwOZ9SjOvyA2On12Q=";
      "selection-0.1.0" = "sha256-85NUACRi7TjyMNKVz93G+W1EXKIVZZge/h/HtDwiW/Q=";
@@ -4,14 +4,14 @@

 stdenv.mkDerivation rec {
  pname = "xterm";
-  version = "382";
+  version = "383";

  src = fetchurl {
    urls = [
      "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
      "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
    ];
-    hash = "sha256-DNC889CqdGqEDqPxNm6imnQmNpTVNbXHd/J+tl1/zu0=";
+    hash = "sha256-oGYTvNpQjCob/21CMIldp0p5h5mi45ojusggide5qZg=";
  };

  strictDeps = true;
@@ -21,11 +21,11 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.4.3";
+    version = "6.4.5";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-p3+2LTJZNKg6ALL8bbEJ9ExnuGdo/EBJA2b1E2QMf2Q=";
+      sha256 = "sha256-sLSwC4smOci+OHOUeW8EJb6zOTFN9+cpN/jd0qQbG4o=";
    };

    format = "other";
@@ -35,7 +35,7 @@ let
    cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
      inherit src;
      name = "mercurial-${version}";
-      sha256 = "sha256-nm9RZZHtmPfeJ7StHZmfxcFqKeJHACQQeA/Evv3wYD8=";
+      sha256 = "sha256-shB2MRGATTg4l6pJ9FVYfBtnrX/eEHRvPhc8GZTA9ns=";
      sourceRoot = "mercurial-${version}/rust";
    } else null;
    cargoRoot = if rustSupport then "rust" else null;
@@ -37,11 +37,11 @@ fi
 for flag in "${!hardeningEnableMap[@]}"; do
  case $flag in
    pie)
-      if [[ ! (" $* " =~ " -shared " \
-            || " $* " =~ " -static " \
-            || " $* " =~ " -r " \
-            || " $* " =~ " -Ur " \
-            || " $* " =~ " -i ") ]]; then
+      if [[ ! (" ${params[*]} " =~ " -shared " \
+            || " ${params[*]} " =~ " -static " \
+            || " ${params[*]} " =~ " -r " \
+            || " ${params[*]} " =~ " -Ur " \
+            || " ${params[*]} " =~ " -i ") ]]; then
        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
        hardeningLDFlags+=('-pie')
      fi
@@ -71,7 +71,7 @@ for flag in "${!hardeningEnableMap[@]}"; do
      # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
      hardeningCFlags=('-fPIE' "${hardeningCFlags[@]}")
-      if [[ ! (" $* " =~ " -shared " || " $* " =~ " -static ") ]]; then
+      if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
        hardeningCFlags=('-pie' "${hardeningCFlags[@]}")
      fi
@@ -111,7 +111,7 @@ export CC${role_post}=@named_cc@
 export CXX${role_post}=@named_cxx@

 # If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
+: ${NIX_HARDENING_ENABLE="fortify fortify3 stackprotector pic strictoverflow format relro bindnow"}
 export NIX_HARDENING_ENABLE

 # No local scope in sourced file
@@ -201,7 +201,7 @@ let

        # Set up configuration for the vendor directory.
        cat > $out/.cargo-config <<EOF
-        [source."${gitParts.url}"]
+        [source."${gitParts.url}${lib.optionalString (gitParts ? type) "?${gitParts.type}=${gitParts.value}"}"]
        git = "${gitParts.url}"
        ${lib.optionalString (gitParts ? type) "${gitParts.type} = \"${gitParts.value}\""}
        replace-with = "vendored-sources"
@@ -18,11 +18,11 @@
  inherit (lib) optional optionals;
 in stdenv.mkDerivation rec {
  pname = "orc";
-  version = "0.4.33";
+  version = "0.4.34";

  src = fetchurl {
    url = "https://gstreamer.freedesktop.org/src/orc/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hE5tfbgIb3k/V2GNPUto0p2ZsWA05xQw3zwhz9PDVCo=";
+    sha256 = "sha256-j0ers/CXFx5E64B63Nq9hg+6Lv/TfY08T71fNByt1B8=";
  };

  postPatch = lib.optionalString stdenv.isAarch32 ''
@@ -58,6 +58,7 @@ in stdenv.mkDerivation rec {
  meta = with lib; {
    description = "The Oil Runtime Compiler";
    homepage = "https://gstreamer.freedesktop.org/projects/orc.html";
+    changelog = "https://cgit.freedesktop.org/gstreamer/orc/plain/RELEASE?h=${version}";
    # The source code implementing the Marsenne Twister algorithm is licensed
    # under the 3-clause BSD license. The rest is 2-clause BSD license.
    license = with licenses; [ bsd3 bsd2 ];
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "rubygems";
-  version = "3.4.14";
+  version = "3.4.15";

  src = fetchurl {
    url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-l5sYQoSKOb5NkO/J05nClKygtuZ9RfgAsmyTzCLQOYM=";
+    hash = "sha256-OCjoZbz3En8ERq41T+bykHeoKkOGvMVVDX21kKYypKw=";
  };

  patches = [
@@ -112,7 +112,29 @@ stdenv.mkDerivation {
    url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
    relative = "include";
    sha256 = "sha256-KlmIbixcds6GyKYt1fx5BxDIrU7msrgDdYo9Va/KJR4=";
-  });
+  })
+  # This fixes another issue regarding ill-formed constant expressions, which is a default error
+  # in clang 16 and will be a hard error in clang 17.
+  ++ lib.optional (lib.versionOlder version "1.80") (fetchpatch {
+    url = "https://github.com/boostorg/log/commit/77f1e20bd69c2e7a9e25e6a9818ae6105f7d070c.patch";
+    relative = "include";
+    hash = "sha256-6qOiGJASm33XzwoxVZfKJd7sTlQ5yd+MMFQzegXm5RI=";
+  })
+  ++ lib.optionals (lib.versionOlder version "1.81") [
+    # libc++ 15 dropped support for `std::unary_function` and `std::binary_function` in C++17+.
+    # C++17 is the default for clang 16, but clang 15 is also affected in that language mode.
+    # This patch is for Boost 1.80, but it also applies to earlier versions.
+    (fetchpatch {
+      url = "https://www.boost.org/patches/1_80_0/0005-config-libcpp15.patch";
+      hash = "sha256-ULFMzKphv70unvPZ3o4vSP/01/xbSM9a2TlIV67eXDQ=";
+    })
+    # This fixes another ill-formed contant expressions issue flagged by clang 16.
+    (fetchpatch {
+      url = "https://github.com/boostorg/numeric_conversion/commit/50a1eae942effb0a9b90724323ef8f2a67e7984a.patch";
+      relative = "include";
+      hash = "sha256-dq4SVgxkPJSC7Fvr59VGnXkM4Lb09kYDaBksCHo9C0s=";
+    })
+  ];

  meta = with lib; {
    homepage = "http://boost.org/";
@@ -10,13 +10,13 @@ assert useVulkan -> withExamples;

 stdenv.mkDerivation rec {
  pname = "dav1d";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "videolan";
    repo = pname;
    rev = version;
-    hash = "sha256-Y9wqa6lIs0eKT+q+95gjzfHIc3pglXzLNaDjsWy1gok=";
+    hash = "sha256-RrEim3HXXjx2RUU7K3wPH3QbhNTRN9ZX/oAcyE9aV8I=";
  };

  outputs = [ "out" "dev" ];
@@ -139,3 +139,67 @@ index f3922e0..e40fcdf 100644
 		} else {
 			DB_ASSERT(env, sharecount > 0);
 			MEMBAR_EXIT();
+diff -ur a/dist/aclocal/clock.m4 b/dist/aclocal/clock.m4
+--- a/dist/aclocal/clock.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/clock.m4	2023-06-05 19:14:02.007080500 -0400
+@@ -21,6 +21,7 @@
+ AC_CACHE_CHECK([for clock_gettime monotonic clock], db_cv_clock_monotonic, [
+ AC_TRY_RUN([
+ #include <sys/time.h>
+int
+ main() {
+ 	struct timespec t;
+ 	return (clock_gettime(CLOCK_MONOTONIC, &t) != 0);
+diff -ur a/dist/aclocal/mutex.m4 b/dist/aclocal/mutex.m4
+--- a/dist/aclocal/mutex.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/mutex.m4	2023-06-05 19:14:47.214158196 -0400
+@@ -4,6 +4,7 @@
+ AC_DEFUN(AM_PTHREADS_SHARED, [
+ AC_TRY_RUN([
+ #include <pthread.h>
+int
+ main() {
+ 	pthread_cond_t cond;
+ 	pthread_mutex_t mutex;
+@@ -46,6 +47,7 @@
+ AC_DEFUN(AM_PTHREADS_PRIVATE, [
+ AC_TRY_RUN([
+ #include <pthread.h>
+int
+ main() {
+ 	pthread_cond_t cond;
+ 	pthread_mutex_t mutex;
+diff -ur a/dist/aclocal/sequence.m4 b/dist/aclocal/sequence.m4
+--- a/dist/aclocal/sequence.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/sequence.m4	2023-06-05 19:14:02.007869956 -0400
+@@ -43,6 +43,9 @@
+ 	# test, which won't test for the appropriate printf format strings.
+ 	if test "$db_cv_build_sequence" = "yes"; then
+ 		AC_TRY_RUN([
+		#include <string.h>
+		#include <stdio.h>
+		int
+ 		main() {
+ 			$db_cv_seq_type l;
+ 			unsigned $db_cv_seq_type u;
+@@ -59,7 +62,9 @@
+				return (1);
+ 			return (0);
+ 		}],, [db_cv_build_sequence="no"],
+-		AC_TRY_LINK(,[
+		AC_TRY_LINK([
+			#include <string.h>
+			#include <stdio.h>],[
+ 			$db_cv_seq_type l;
+ 			unsigned $db_cv_seq_type u;
+ 			char buf@<:@100@:>@;
+diff -ur a/dist/RELEASE b/dist/RELEASE
+--- a/dist/RELEASE	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/RELEASE	2023-07-02 17:32:34.703953049 -0400
+@@ -7,5 +7,5 @@
+ 
+ DB_VERSION_UNIQUE_NAME=`printf "_%d%03d" $DB_VERSION_MAJOR $DB_VERSION_MINOR`
+ 
+-DB_RELEASE_DATE=`date "+%B %e, %Y"`
+DB_RELEASE_DATE="April  9, 2010"
+ DB_VERSION_STRING="Berkeley DB $DB_VERSION: ($DB_RELEASE_DATE)"
@@ -139,3 +139,111 @@ index 106b161..fc4de9d 100644
 		} else {
 			DB_ASSERT(env, sharecount > 0);
 			MEMBAR_EXIT();
+diff -ur a/dist/aclocal/clock.m4 b/dist/aclocal/clock.m4
+--- a/dist/aclocal/clock.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/clock.m4	2023-06-05 19:14:02.007080500 -0400
+@@ -21,6 +21,7 @@
+ AC_CACHE_CHECK([for clock_gettime monotonic clock], db_cv_clock_monotonic, [
+ AC_TRY_RUN([
+ #include <sys/time.h>
+int
+ main() {
+ 	struct timespec t;
+ 	return (clock_gettime(CLOCK_MONOTONIC, &t) != 0);
+diff -ur a/dist/aclocal/mmap.m4 b/dist/aclocal/mmap.m4
+--- a/dist/aclocal/mmap.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/mmap.m4	2023-06-05 19:14:02.007323624 -0400
+@@ -29,6 +29,8 @@
+      * system to system.
+      */
+     #include <stdio.h>
+    #include <stdlib.h>
+    #include <unistd.h>
+     #include <string.h>
+     #include <sys/types.h>
+     #include <sys/stat.h>
+@@ -42,12 +44,13 @@
+     #define MAP_FAILED (-1)
+     #endif
+
+-    int catch_sig(sig)
+    void catch_sig(sig)
+ 	    int sig;
+     {
+ 	    exit(1);
+     }
+
+    int
+     main() {
+ 	    const char *underlying;
+ 	    unsigned gapsize;
+@@ -88,8 +91,8 @@
+ 		    return (4);
+ 	    }
+
+-	    (void) signal(SIGSEGV, catch_sig);
+-	    (void) signal(SIGBUS, catch_sig);
+	    (void) signal(SIGSEGV, &catch_sig);
+	    (void) signal(SIGBUS, &catch_sig);
+
+ 	    for (i = sizeof(buf); i < total_size; i += gapsize)
+ 		    base[i] = 'A';
+diff -ur a/dist/aclocal/mutex.m4 b/dist/aclocal/mutex.m4
+--- a/dist/aclocal/mutex.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/mutex.m4	2023-06-05 19:14:47.214158196 -0400
+@@ -5,6 +5,7 @@
+ AC_TRY_RUN([
+ #include <stdlib.h>
+ #include <pthread.h>
+int
+ main() {
+ 	pthread_cond_t cond;
+ 	pthread_mutex_t mutex;
+@@ -49,6 +50,7 @@
+ AC_TRY_RUN([
+ #include <stdlib.h>
+ #include <pthread.h>
+int
+ main() {
+ 	pthread_cond_t cond;
+ 	pthread_mutex_t mutex;
+@@ -89,6 +91,7 @@
+ AC_TRY_RUN([
+ #include <stdlib.h>
+ #include <pthread.h>
+int
+ main() {
+ 	pthread_cond_t cond;
+ 	pthread_condattr_t condattr;
+@@ -110,6 +113,7 @@
+ AC_TRY_RUN([
+ #include <stdlib.h>
+ #include <pthread.h>
+int
+ main() {
+ 	pthread_rwlock_t rwlock;
+ 	pthread_rwlockattr_t rwlockattr;
+diff -ur a/dist/aclocal/sequence.m4 b/dist/aclocal/sequence.m4
+--- a/dist/aclocal/sequence.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/sequence.m4	2023-06-05 19:14:02.007869956 -0400
+@@ -43,6 +43,9 @@
+ 	# test, which won't test for the appropriate printf format strings.
+ 	if test "$db_cv_build_sequence" = "yes"; then
+ 		AC_TRY_RUN([
+		#include <string.h>
+		#include <stdio.h>
+		int
+ 		main() {
+ 			$db_cv_seq_type l;
+ 			unsigned $db_cv_seq_type u;
+@@ -59,7 +62,9 @@
+				return (1);
+ 			return (0);
+ 		}],, [db_cv_build_sequence="no"],
+-		AC_TRY_LINK(,[
+		AC_TRY_LINK([
+			#include <string.h>
+			#include <stdio.h>],[
+ 			$db_cv_seq_type l;
+ 			unsigned $db_cv_seq_type u;
+ 			char buf@<:@100@:>@;
@@ -0,0 +1,55 @@
+diff -ur a/dist/aclocal/mutex.m4 b/dist/aclocal/mutex.m4
+--- a/dist/aclocal/mutex.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/mutex.m4	2023-06-05 19:14:47.214158196 -0400
+@@ -372,10 +376,11 @@
+ 
+ # _spin_lock_try/_spin_unlock: Apple/Darwin
+ if test "$db_cv_mutex" = no; then
+-AC_TRY_LINK(,[
+-	int x;
+-	_spin_lock_try(&x);
+-	_spin_unlock(&x);
+AC_TRY_LINK([
+#include <os/lock.h>],[
+	os_unfair_lock x = OS_UNFAIR_LOCK_INIT;
+	bool _ = os_unfair_lock_trylock(&x);
+	os_unfair_lock_unlock(&x);
+ ], [db_cv_mutex=Darwin/_spin_lock_try])
+ fi
+ 
+diff -ur a/dbinc/mutex_int.h b/dbinc/mutex_int.h
+--- a/dbinc/mutex_int.h	1969-12-31 19:00:01.000000000 -0500
+++ b/dbinc/mutex_int.h	2023-06-05 19:15:37.510514745 -0400
+@@ -154,14 +154,13 @@
+  * Apple/Darwin library functions.
+  *********************************************************************/
+ #ifdef HAVE_MUTEX_DARWIN_SPIN_LOCK_TRY
+-typedef u_int32_t tsl_t;
+#include <os/lock.h>
+typedef os_unfair_lock tsl_t;
+ 
+ #ifdef LOAD_ACTUAL_MUTEX_CODE
+-extern int _spin_lock_try(tsl_t *);
+-extern void _spin_unlock(tsl_t *);
+-#define	MUTEX_SET(tsl)          _spin_lock_try(tsl)
+-#define	MUTEX_UNSET(tsl)        _spin_unlock(tsl)
+-#define	MUTEX_INIT(tsl)         (MUTEX_UNSET(tsl), 0)
+#define	MUTEX_SET(tsl)          os_unfair_lock_trylock(tsl)
+#define	MUTEX_UNSET(tsl)        os_unfair_lock_unlock(tsl)
+#define	MUTEX_INIT(tsl)         ({ *(tsl) = OS_UNFAIR_LOCK_INIT; tsl; })
+ #endif
+ #endif
+ 
+diff -ur a/dbinc/mutex_int.h b/dbinc/mutex_int.h
+--- a/dbinc_auto/mutex_ext.h	1969-12-31 19:00:01.000000000 -0500
+++ b/dbinc_auto/mutex_ext.h	2023-07-01 22:38:20.749201366 -0400
+@@ -34,6 +34,9 @@
+ #if !defined(HAVE_ATOMIC_SUPPORT) && defined(HAVE_MUTEX_SUPPORT)
+ atomic_value_t __atomic_dec __P((ENV *, db_atomic_t *));
+ #endif
+#if !defined(HAVE_ATOMIC_SUPPORT) && defined(HAVE_MUTEX_SUPPORT)
+int atomic_compare_exchange __P((ENV *, db_atomic_t *, atomic_value_t, atomic_value_t));
+#endif
+ int __db_pthread_mutex_init __P((ENV *, db_mutex_t, u_int32_t));
+ int __db_pthread_mutex_lock __P((ENV *, db_mutex_t));
+ #if defined(HAVE_SHARED_LATCHES)
@@ -0,0 +1,42 @@
+diff -ur a/dist/aclocal/mutex.m4 b/dist/aclocal/mutex.m4
+--- a/dist/aclocal/mutex.m4	1969-12-31 19:00:01.000000000 -0500
+++ b/dist/aclocal/mutex.m4	2023-06-05 19:14:47.214158196 -0400
+@@ -441,10 +445,11 @@
+ 
+ # _spin_lock_try/_spin_unlock: Apple/Darwin
+ if test "$db_cv_mutex" = no; then
+-AC_TRY_LINK(,[
+-	int x;
+-	_spin_lock_try(&x);
+-	_spin_unlock(&x);
+AC_TRY_LINK([
+#include <os/lock.h>],[
+	os_unfair_lock x = OS_UNFAIR_LOCK_INIT;
+	bool _ = os_unfair_lock_trylock(&x);
+	os_unfair_lock_unlock(&x);
+ ], [db_cv_mutex=Darwin/_spin_lock_try])
+ fi
+ 
+diff -ur a/src/dbinc/mutex_int.h b/src/dbinc/mutex_int.h
+--- a/src/dbinc/mutex_int.h	1969-12-31 19:00:01.000000000 -0500
+++ b/src/dbinc/mutex_int.h	2023-06-05 19:15:37.510514745 -0400
+@@ -154,14 +154,13 @@
+  * Apple/Darwin library functions.
+  *********************************************************************/
+ #ifdef HAVE_MUTEX_DARWIN_SPIN_LOCK_TRY
+-typedef u_int32_t tsl_t;
+#include <os/lock.h>
+typedef os_unfair_lock tsl_t;
+ 
+ #ifdef LOAD_ACTUAL_MUTEX_CODE
+-extern int _spin_lock_try(tsl_t *);
+-extern void _spin_unlock(tsl_t *);
+-#define	MUTEX_SET(tsl)          _spin_lock_try(tsl)
+-#define	MUTEX_UNSET(tsl)        _spin_unlock(tsl)
+-#define	MUTEX_INIT(tsl)         (MUTEX_UNSET(tsl), 0)
+#define	MUTEX_SET(tsl)          os_unfair_lock_trylock(tsl)
+#define	MUTEX_UNSET(tsl)        os_unfair_lock_unlock(tsl)
+#define	MUTEX_INIT(tsl)         ({ *(tsl) = OS_UNFAIR_LOCK_INIT; tsl; })
+ #endif
+ #endif
+
@@ -1,9 +1,10 @@
-{ lib, stdenv, fetchurl, ... } @ args:
+{ lib, stdenv, fetchurl, autoreconfHook, ... } @ args:

 import ./generic.nix (args // {
  version = "4.8.30";
  sha256 = "0ampbl2f0hb1nix195kz1syrqqxpmvnvnfvphambj7xjrl3iljg0";
-  extraPatches = [ ./clang-4.8.patch ./CVE-2017-10140-4.8-cwd-db_config.patch ];
+  extraPatches = [ ./clang-4.8.patch ./CVE-2017-10140-4.8-cwd-db_config.patch ]
+    ++ lib.optionals stdenv.isDarwin [ ./darwin-mutexes-4.8.patch ];

  drvArgs.hardeningDisable = [ "format" ];
  drvArgs.doCheck = false;
@@ -1,7 +1,8 @@
-{ lib, stdenv, fetchurl, ... } @ args:
+{ lib, stdenv, fetchurl, autoreconfHook, ... } @ args:

 import ./generic.nix (args // {
  version = "5.3.28";
  sha256 = "0a1n5hbl7027fbz5lm0vp0zzfp1hmxnz14wx3zl9563h83br5ag0";
-  extraPatches = [ ./clang-5.3.patch ./CVE-2017-10140-cwd-db_config.patch ];
+  extraPatches = [ ./clang-5.3.patch ./CVE-2017-10140-cwd-db_config.patch ]
+    ++ lib.optionals stdenv.isDarwin [ ./darwin-mutexes.patch ];
 })
@@ -1,8 +1,9 @@
-{ lib, stdenv, fetchurl, ... } @ args:
+{ lib, stdenv, fetchurl, autoreconfHook, ... } @ args:

 import ./generic.nix (args // {
  version = "6.0.20";
  sha256 = "00r2aaglq625y8r9xd5vw2y070plp88f1mb2gbq3kqsl7128lsl0";
  license = lib.licenses.agpl3;
-  extraPatches = [ ./clang-6.0.patch ./CVE-2017-10140-cwd-db_config.patch ];
+  extraPatches = [ ./clang-6.0.patch ./CVE-2017-10140-cwd-db_config.patch ]
+    ++ lib.optionals stdenv.isDarwin [ ./darwin-mutexes.patch ];
 })
@@ -1,8 +1,9 @@
-{ lib, stdenv, fetchurl, ... } @ args:
+{ lib, stdenv, fetchurl, autoreconfHook, ... } @ args:

 import ./generic.nix (args // {
  version = "6.2.23";
  sha256 = "1isxx4jfmnh913jzhp8hhfngbk6dsg46f4kjpvvc56maj64jqqa7";
  license = lib.licenses.agpl3;
-  extraPatches = [ ./clang-6.0.patch ./CVE-2017-10140-cwd-db_config.patch ];
+  extraPatches = [ ./clang-6.0.patch ./CVE-2017-10140-cwd-db_config.patch ]
+    ++ lib.optionals stdenv.isDarwin [ ./darwin-mutexes.patch ];
 })
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, fetchurl, autoreconfHook
 , cxxSupport ? true
 , compat185 ? true
 , dbmSupport ? false
@@ -10,6 +10,9 @@
 , drvArgs ? {}
 }:

+let
+  shouldReconfigure = stdenv.cc.isClang;
+in
 stdenv.mkDerivation (rec {
  pname = "db";
  inherit version;
@@ -19,10 +22,48 @@ stdenv.mkDerivation (rec {
    sha256 = sha256;
  };

+  # The provided configure script features `main` returning implicit `int`, which causes
+  # configure checks to work incorrectly with clang 16.
+  nativeBuildInputs = lib.optionals stdenv.cc.isClang [ autoreconfHook ];
+
  patches = extraPatches;

  outputs = [ "bin" "out" "dev" ];

+  # Required when regenerated the configure script to make sure the vendored macros are found.
+  autoreconfFlags = lib.optionalString shouldReconfigure [ "-fi" "-Iaclocal" "-Iaclocal_java" ];
+
+  preAutoreconf = lib.optionalString shouldReconfigure ''
+    pushd dist
+    # Upstream’s `dist/s_config` cats everything into `aclocal.m4`, but that doesn’t work with
+    # autoreconfHook, so cat `config.m4` to another file. Otherwise, it won’t be found by `aclocal`.
+    cat aclocal/config.m4 >> aclocal/options.m4
+  '';
+
+  # This isn’t pretty. The version information is kept separate from the configure script.
+  # After the configure script is regenerated, the version information has to be replaced with the
+  # contents of `dist/RELEASE`.
+  postAutoreconf = lib.optionalString shouldReconfigure ''
+    (
+      declare -a vars=(
+        "DB_VERSION_FAMILY"
+        "DB_VERSION_RELEASE"
+        "DB_VERSION_MAJOR"
+        "DB_VERSION_MINOR"
+        "DB_VERSION_PATCH"
+        "DB_VERSION_STRING"
+        "DB_VERSION_FULL_STRING"
+        "DB_VERSION_UNIQUE_NAME"
+        "DB_VERSION"
+      )
+      source RELEASE
+      for var in "''${vars[@]}"; do
+        sed -e "s/__EDIT_''${var}__/''${!var}/g" -i configure
+      done
+    )
+    popd
+  '';
+
  configureFlags =
    [
      (if cxxSupport then "--enable-cxx" else "--disable-cxx")
@@ -44,6 +44,9 @@ stdenv.mkDerivation rec {
    "-DUSE_PCSC=1"
  ];

+  # causes possible redefinition of _FORTIFY_SOURCE?
+  hardeningDisable = [ "fortify3" ];
+
  meta = with lib; {
    description = ''
      Provides library functionality for FIDO 2.0, including communication with a device over USB.
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , nix-update-script

 , autoreconfHook
@@ -25,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "libtiff";
-  version = "4.5.0";
+  version = "4.5.1";

  src = fetchFromGitLab {
    owner = "libtiff";
    repo = "libtiff";
    rev = "v${version}";
-    hash = "sha256-KG6rB940JMjFUTAgtkzg+Zh75gylPY6Q7/4gEbL0Hcs=";
+    hash = "sha256-qQEthy6YhNAQmdDMyoCIvK8f3Tx25MgqhJZW74CB93E=";
  };

  patches = [
@@ -40,32 +39,6 @@ stdenv.mkDerivation rec {
    # libc++abi 11 has an `#include <version>`, this picks up files name
    # `version` in the project's include paths
    ./rename-version.patch
-    (fetchpatch {
-      name = "CVE-2022-48281.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5.diff";
-      sha256 = "sha256-FWUlyJyHXac6fuM5f9PG33kcF5Bm4fyFmYnaDal46iM=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-0800.CVE-2023-0801.CVE-2023-0802.CVE-2023-0803.CVE-2023-0804.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/33aee1275d9d1384791d2206776eb8152d397f00.patch";
-      sha256 = "sha256-wNSa1D9EWObTs331utjIKgo9p9PUWqTM54qG+1Hhm1A=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-0795.CVE-2023-0796.CVE-2023-0797.CVE-2023-0798.CVE-2023-0799.prerequisite-0.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678.patch";
-      sha256 = "sha256-NTs+dCUweKddQDzJLqbdIdvNbaSweGG0cSVt57tntoI=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-0795.CVE-2023-0796.CVE-2023-0797.CVE-2023-0798.CVE-2023-0799.prerequisite-1.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/d63de61b1ec3385f6383ef9a1f453e4b8b11d536.patch";
-      includes = [ "tools/tiffcrop.c" ];
-      sha256 = "sha256-VHg5aAcHKwRkDFDyC1rLjCjj1rMzcq/2SUR/r1fQubQ=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-0795.CVE-2023-0796.CVE-2023-0797.CVE-2023-0798.CVE-2023-0799.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68.patch";
-      sha256 = "sha256-9+oXKVJEeaIuMBdtvhNlUBNpw9uzg31s+zxt4GJo6Lo=";
-    })
  ];

  postPatch = ''
@@ -23,14 +23,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.45.0";
+  version = "1.46.0";
  pname = "libuv";

  src = fetchFromGitHub {
    owner = "libuv";
    repo = "libuv";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-qKw9QFR24Uw7pVA9isPH8Va+9/5DYuqXz6l6jWcXn+4=";
+    sha256 = "sha256-Lrsyh4qd3OkTw1cSPfahzfSGNt6+pRN1X21iiv1SsFo=";
  };

  outputs = [ "out" "dev" ];
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
        "tcp_create_early" "tcp_close" "tcp_bind_error_inval"
        "tcp_bind_error_addrinuse" "tcp_shutdown_after_write"
        "tcp_open" "tcp_write_queue_order" "tcp_try_write" "tcp_writealot"
-        "multiple_listen" "delayed_accept"
+        "multiple_listen" "delayed_accept" "udp_recv_in_a_row"
        "shutdown_close_tcp" "shutdown_eof" "shutdown_twice" "callback_stack"
        "tty_pty" "condvar_5" "hrtime" "udp_multicast_join"
        # Tests that fail when sandboxing is enabled.
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, meson, pkg-config, ninja, wayland-scanner
 , libdrm
-, minimal ? false, libva-minimal
+, minimal ? false
 , libX11, libXext, libXfixes, wayland, libffi, libGL
 , mesa
 # for passthru.tests
@@ -26,11 +26,11 @@ stdenv.mkDerivation rec {

  depsBuildBuild = [ pkg-config ];

-  nativeBuildInputs = [ meson pkg-config ninja wayland-scanner ];
+  nativeBuildInputs = [ meson pkg-config ninja ]
+    ++ lib.optional (!minimal) wayland-scanner;

  buildInputs = [ libdrm ]
-    ++ lib.optionals (!minimal) [ libva-minimal libX11 libXext libXfixes wayland libffi libGL ];
-  # TODO: share libs between minimal and !minimal - perhaps just symlink them
+    ++ lib.optionals (!minimal) [ libX11 libXext libXfixes wayland libffi libGL ];

  mesonFlags = [
    # Add FHS and Debian paths for non-NixOS applications
@@ -1,5 +1,4 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, libtool
-, fetchpatch
 , threadingSupport ? true # multi-threading
 , openglSupport ? false, freeglut, libGL, libGLU # OpenGL (required for vwebp)
 , pngSupport ? true, libpng # PNG image format
@@ -28,24 +27,15 @@

 stdenv.mkDerivation rec {
  pname = "libwebp";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner  = "webmproject";
    repo   = pname;
    rev    = "v${version}";
-    hash   = "sha256-nhXkq+qKpaa75YQB/W/cRozslTIFPdXeqj1y6emQeHk=";
+    hash   = "sha256-Q94avvKjPdwdGt5ADo30cf2V4T7MCTubDHJxTtbG4xQ=";
  };

-  patches = [
-    # https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/#MFSA-TMP-2023-0001
-    (fetchpatch {
-      url = "https://github.com/webmproject/libwebp/commit/a486d800b60d0af4cc0836bf7ed8f21e12974129.patch";
-      name = "fix-msfa-tmp-2023-0001.patch";
-      hash = "sha256-TRKXpNkYVzftBw09mX+WeQRhRoOzBgXFTNZBzSdCKvc=";
-    })
-  ];
-
  configureFlags = [
    (lib.enableFeature threadingSupport "threading")
    (lib.enableFeature openglSupport "gl")
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
    "--enable-hashes=${enableHashes}"
    "--enable-obsolete-api=glibc"
    "--disable-failure-tokens"
-  ] ++ lib.optionals (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.libc == "bionic") [
+    # required for musl, android, march=native
    "--disable-werror"
  ];

@@ -30,6 +30,7 @@
    ] ++ lib.optionals stdenv.hostPlatform.isx86 [
      "iris" # new Intel, could work on non-x86 with PCIe cards, but doesn't build as of 22.3.4
      "crocus" # Intel legacy, x86 only
+      "i915" # Intel extra legacy, x86 only
    ]
  else [ "auto" ]
 , vulkanDrivers ?
@@ -1,76 +0,0 @@
-diff --git nss/cmd/shlibsign/shlibsign.c nss/cmd/shlibsign/shlibsign.c
-index ad8f3b84e..74676d039 100644
--- nss/cmd/shlibsign/shlibsign.c
-+++ nss/cmd/shlibsign/shlibsign.c
-@@ -875,6 +875,8 @@ main(int argc, char **argv)
-         goto cleanup;
-     }
-     lib = PR_LoadLibrary(libname);
-+    if (!lib)
-+        lib = PR_LoadLibrary(NIX_NSS_LIBDIR"libsoftokn3.so");
-     assert(lib != NULL);
-     if (!lib) {
-         PR_fprintf(PR_STDERR, "loading softokn3 failed");
-diff --git nss/lib/pk11wrap/pk11load.c nss/lib/pk11wrap/pk11load.c
-index 119c8c512..720d39ccc 100644
--- nss/lib/pk11wrap/pk11load.c
-+++ nss/lib/pk11wrap/pk11load.c
-@@ -486,6 +486,15 @@ secmod_LoadPKCS11Module(SECMODModule *mod, SECMODModule **oldModule)
- #else
-         library = PR_LoadLibrary(mod->dllName);
- #endif // defined(_WIN32)
-+#ifndef NSS_STATIC_SOFTOKEN
-+        if ((library == NULL) &&
-+            !rindex(mod->dllName, PR_GetDirectorySeparator())) {
-+            library = PORT_LoadLibraryFromOrigin(my_shlib_name,
-+                (PRFuncPtr) &softoken_LoadDSO,
-+                mod->dllName);
-+        }
-+#endif
-+
-         mod->library = (void *)library;
- 
-         if (library == NULL) {
-diff --git nss/lib/util/secload.c nss/lib/util/secload.c
-index 12efd2f75..8b74478f6 100644
--- nss/lib/util/secload.c
-+++ nss/lib/util/secload.c
-@@ -70,9 +70,14 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
- 
-     /* Remove the trailing filename from referencePath and add the new one */
-     c = strrchr(referencePath, PR_GetDirectorySeparator());
-+    if (!c) { /* referencePath doesn't contain a / means that dladdr gave us argv[0]
-+               * and program was called from $PATH. Hack to get libs from NIX_NSS_LIBDIR */
-+        referencePath = NIX_NSS_LIBDIR;
-+        c = (char*) &referencePath[sizeof(NIX_NSS_LIBDIR) - 1]; /* last / */
-+    }
-     if (c) {
-         size_t referencePathSize = 1 + c - referencePath;
-        fullName = (char*)PORT_Alloc(strlen(name) + referencePathSize + 1);
-+        fullName = (char*) PORT_Alloc(strlen(name) + referencePathSize + 5);
-         if (fullName) {
-             memcpy(fullName, referencePath, referencePathSize);
-             strcpy(fullName + referencePathSize, name);
-@@ -82,6 +87,11 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
- #endif
-             libSpec.type = PR_LibSpec_Pathname;
-             libSpec.value.pathname = fullName;
-+            if ((referencePathSize >= 4) &&
-+                (strncmp(fullName + referencePathSize - 4, "bin", 3) == 0)) {
-+                memcpy(fullName + referencePathSize -4, "lib", 3);
-+            }
-+            strcpy(fullName + referencePathSize, name);
-             dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL
- #ifdef PR_LD_ALT_SEARCH_PATH
-                                                        /* allow library's dependencies to be found in the same directory
-@@ -89,6 +99,10 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
-                                                        | PR_LD_ALT_SEARCH_PATH
- #endif
-                                           );
-+            if (! dlh) {
-+                strcpy(fullName + referencePathSize, name);
-+                dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL);
-+            }
-             PORT_Free(fullName);
-         }
-     }
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.4";
-  hash = "sha256-Skcdv6Wzo7fsB4U8b8CijNBmn2mEEp4k9VQeLOFdcdU=";
+  version = "3.90";
+  hash = "sha256-ms1lNMQdjq0Z/Kb8s//+0vnwnEN8PXn+5qTuZoqqk7Y=";
 }
@@ -1,44 +0,0 @@
-https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
-https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
-
-# HG changeset patch
-# User Sergei Trofimovich <slyich@gmail.com>
-# Date 1653552519 0
-# Node ID 21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
-# Parent  ad1046e9eee5f5dc17dac7c9343e2f7f0da44b4e
-Bug 1771273 - cpputil/databuffer.h: add missing <cstdint> include r=nss-reviewers,mt
-
-Without the change build fails on this week's gcc-13 snapshot as:
-
-    ../../cpputil/databuffer.h:20:20: error: 'uint8_t' does not name a type
-       20 |   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
-          |                    ^~~~~~~
-    ../../cpputil/databuffer.h:14:1: note: 'uint8_t' is defined in header '<cstdint>'; did you forget to '#include <cstdint>'?
-       13 | #include <iostream>
-      +++ |+#include <cstdint>
-       14 |
-
-Differential Revision: https://phabricator.services.mozilla.com/D147404
-
-diff --git a/cpputil/databuffer.h b/cpputil/databuffer.h
--- nss/cpputil/databuffer.h
-+++ nss/cpputil/databuffer.h
-@@ -6,16 +6,17 @@
- 
- #ifndef databuffer_h__
- #define databuffer_h__
- 
- #include <algorithm>
- #include <cstring>
- #include <iomanip>
- #include <iostream>
-+#include <cstdint>
- 
- namespace nss_test {
- 
- class DataBuffer {
-  public:
-   DataBuffer() : data_(nullptr), len_(0) {}
-   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
-     Assign(d, l);
-
@@ -42,18 +42,9 @@ stdenv.mkDerivation rec {

  patches = [
    # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
-    (if (lib.versionOlder version "3.84") then
-      ./85_security_load_3.77+.patch
-    else
-      ./85_security_load_3.85+.patch
-    )
+    ./85_security_load_3.85+.patch
    ./fix-cross-compilation.patch
-  ] ++ lib.optionals (lib.versionOlder version "3.89") [
-    # Backport gcc-13 build fix:
-    #  https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
-    #  https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
-    ./gcc-13-esr.patch
-  ] ++ lib.optionals (lib.versionAtLeast version "3.90" && lib.versionOlder version "3.91") [
+  ] ++ lib.optionals (lib.versionOlder version "3.91") [
    # https://bugzilla.mozilla.org/show_bug.cgi?id=1836925
    # https://phabricator.services.mozilla.com/D180068
    ./remove-c25519-support.patch
@@ -48,7 +48,9 @@ stdenv.mkDerivation rec {
    done
  '';

-  cmakeFlags = lib.optional stdenv.hostPlatform.isStatic "-DCMAKE_SKIP_RPATH=ON";
+  cmakeFlags = [
+    "-DCMAKE_CTEST_ARGUMENTS=--timeout;3600"
+  ] ++ lib.optional stdenv.hostPlatform.isStatic "-DCMAKE_SKIP_RPATH=ON";

  nativeBuildInputs = [ cmake ];
  propagatedBuildInputs = [ ilmbase zlib ];
@@ -66,6 +66,7 @@
 , mysofaSupport ? true
 , libmysofa
 , tinycompress
+, ffado
 }:

 let
@@ -73,7 +74,7 @@ let

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.71";
+    version = "0.3.72";

    outputs = [
      "out"
@@ -91,7 +92,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-NPYWl+WeI/z70gNHX1BAKslGFX634D7XrV04vuJgGOo=";
+      sha256 = "sha256-AbATW+uRU4HcYHxvqigqdRwZyLln3yc/hpgWDQ50cPs=";
    };

    patches = [
@@ -126,6 +127,7 @@ let
    buildInputs = [
      alsa-lib
      dbus
+      ffado
      glib
      libjack2
      libusb1
@@ -221,6 +223,7 @@ let

    meta = with lib; {
      description = "Server and user space API to deal with multimedia pipelines";
+      changelog = "https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/${version}";
      homepage = "https://pipewire.org/";
      license = licenses.mit;
      platforms = platforms.linux;
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "s2n-tls";
-  version = "1.3.45";
+  version = "1.3.46";

  src = fetchFromGitHub {
    owner = "aws";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-ZipZXCwat3H0NoUX9T6XB7/qMRvViB2QrYpgj0U41nU=";
+    sha256 = "sha256-X+ZwM53ensCeUoxNa8cBO4KcWxWbb7iKxIRysImvKxw=";
  };

  nativeBuildInputs = [ cmake ];
@@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "srt";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "Haivision";
    repo = "srt";
    rev = "v${version}";
-    sha256 = "sha256-qVvoHtROtJjrUd+YpjN/0I6KmiH7c24+pQ4xYTUGPXk=";
+    sha256 = "sha256-HW5l26k9w4F6IJrtiahU/8/CPY6M/cKn8AgESsntC6A=";
  };

  nativeBuildInputs = [ cmake ];
@@ -1,8 +1,8 @@
-{ stdenv, lib, fetchFromGitHub
+{ stdenv, lib, fetchFromGitHub, fetchurl
 , autoreconfHook, autoconf-archive, pkg-config, doxygen, perl
 , openssl, json_c, curl, libgcrypt
 , cmocka, uthash, ibm-sw-tpm2, iproute2, procps, which
-, shadow
+, shadow, libuuid
 }:
 let
  # Avoid a circular dependency on Linux systems (systemd depends on tpm2-tss,
@@ -15,13 +15,13 @@ in

 stdenv.mkDerivation rec {
  pname = "tpm2-tss";
-  version = "3.2.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "tpm2-software";
    repo = pname;
    rev = version;
-    sha256 = "1jijxnvjcsgz5yw4i9fj7ycdnnz90r3l0zicpwinswrw47ac3yy5";
+    sha256 = "sha256-75yiKVZrR1vcCwKp4tDO4A9JB0KDM0MXPJ1N85kAaRk=";
  };

  outputs = [ "out" "man" "dev" ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {

  # cmocka is checked / used(?) in the configure script
  # when unit and/or integration testing is enabled
-  buildInputs = [ openssl json_c curl libgcrypt uthash ]
+  buildInputs = [ openssl json_c curl libgcrypt uthash libuuid ]
    # cmocka doesn't build with pkgsStatic, and we don't need it anyway
    # when tests are not run
    ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
@@ -53,6 +53,11 @@ stdenv.mkDerivation rec {
    # Do not rely on dynamic loader path
    # TCTI loader relies on dlopen(), this patch prefixes all calls with the output directory
    ./no-dynamic-loader-path.patch
+    (fetchurl {
+      name = "skip-test-fapi-fix-provisioning-with template-if-no-certificate-available.patch";
+      url = "https://github.com/tpm2-software/tpm2-tss/commit/218c0da8d9f675766b1de502a52e23a3aa52648e.patch";
+      sha256 = "sha256-dnl9ZAknCdmvix2TdQvF0fHoYeWp+jfCTg8Uc7h0voA=";
+    })
  ];

  postPatch = ''
@@ -61,8 +66,8 @@ stdenv.mkDerivation rec {
      --replace '@PREFIX@' $out/lib/
    substituteInPlace ./test/unit/tctildr-dl.c \
      --replace '@PREFIX@' $out/lib
-    substituteInPlace ./configure.ac \
-      --replace 'm4_esyscmd_s([git describe --tags --always --dirty])' '${version}'
+    substituteInPlace ./bootstrap \
+      --replace 'git describe --tags --always --dirty' 'echo "${version}"'
  '';

  configureFlags = lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
@@ -1,8 +1,17 @@
 diff --git a/src/tss2-tcti/tctildr-dl.c b/src/tss2-tcti/tctildr-dl.c
-index b364695c..d026de71 100644
+index 622637dc..88fc3d8f 100644
 --- a/src/tss2-tcti/tctildr-dl.c
 +++ b/src/tss2-tcti/tctildr-dl.c
-@@ -116,6 +116,50 @@ handle_from_name(const char *file,
+@@ -92,7 +92,7 @@ handle_from_name(const char *file,
+         LOG_DEBUG("Could not load TCTI file: \"%s\": %s", file, dlerror());
+     }
+ 
+-    len = snprintf(NULL, 0, TCTI_NAME_TEMPLATE_0, file);
+    len = snprintf(NULL, 0, "@PREFIX@" TCTI_NAME_TEMPLATE_0, file);
+     if (len >= PATH_MAX) {
+         LOG_ERROR("TCTI name truncated in transform.");
+         return TSS2_TCTI_RC_BAD_VALUE;
+@@ -129,6 +129,50 @@ handle_from_name(const char *file,
         return TSS2_TCTI_RC_BAD_VALUE;
     }
     *handle = dlopen(file_xfrm, RTLD_NOW);
@@ -12,10 +21,10 @@ index b364695c..d026de71 100644
 +        LOG_DEBUG("Failed to load TCTI for name \"%s\": %s", file, dlerror());
 +    }
 +    size = snprintf(file_xfrm,
-+                    sizeof (file_xfrm),
+                    len + 1,
 +                    "@PREFIX@%s",
 +                    file);
-+    if (size >= sizeof (file_xfrm)) {
+    if (size >= len + 1) {
 +        LOG_ERROR("TCTI name truncated in transform.");
 +        return TSS2_TCTI_RC_BAD_VALUE;
 +    }
@@ -27,10 +36,10 @@ index b364695c..d026de71 100644
 +    }
 +    /* 'name' alone didn't work, try libtss2-tcti-<name>.so.0 */
 +    size = snprintf(file_xfrm,
-+                    sizeof (file_xfrm),
+                    len + 1,
 +                    "@PREFIX@" TCTI_NAME_TEMPLATE_0,
 +                    file);
-+    if (size >= sizeof (file_xfrm)) {
+    if (size >= len + 1) {
 +        LOG_ERROR("TCTI name truncated in transform.");
 +        return TSS2_TCTI_RC_BAD_VALUE;
 +    }
@@ -42,22 +51,22 @@ index b364695c..d026de71 100644
 +    }
 +    /* libtss2-tcti-<name>.so.0 didn't work, try libtss2-tcti-<name>.so */
 +    size = snprintf(file_xfrm,
-+                    sizeof (file_xfrm),
+                    len + 1,
 +                    "@PREFIX@" TCTI_NAME_TEMPLATE,
 +                    file);
-+    if (size >= sizeof (file_xfrm)) {
+    if (size >= len + 1) {
 +        LOG_ERROR("TCTI name truncated in transform.");
 +        return TSS2_TCTI_RC_BAD_VALUE;
 +    }
 +    *handle = dlopen(file_xfrm, RTLD_NOW);
     if (*handle == NULL) {
         LOG_DEBUG("Failed to load TCTI for name \"%s\": %s", file, dlerror());
-         return TSS2_TCTI_RC_NOT_SUPPORTED;
+         SAFE_FREE(file_xfrm);
 diff --git a/test/unit/tctildr-dl.c b/test/unit/tctildr-dl.c
-index 873a4531..c17b939e 100644
+index 4279baee..6685c811 100644
 --- a/test/unit/tctildr-dl.c
 +++ b/test/unit/tctildr-dl.c
-@@ -223,6 +223,18 @@ test_get_info_default_success (void **state)
+@@ -229,6 +229,18 @@ test_get_info_default_success (void **state)
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 
@@ -76,7 +85,7 @@ index 873a4531..c17b939e 100644
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, HANDLE);
-@@ -255,6 +267,18 @@ test_get_info_default_info_fail (void **state)
+@@ -261,6 +273,18 @@ test_get_info_default_info_fail (void **state)
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 
@@ -95,7 +104,7 @@ index 873a4531..c17b939e 100644
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, HANDLE);
-@@ -407,6 +431,15 @@ test_tcti_fail_all (void **state)
+@@ -413,6 +437,15 @@ test_tcti_fail_all (void **state)
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
@@ -111,7 +120,7 @@ index 873a4531..c17b939e 100644
 
     /* Skip over libtss2-tcti-tabrmd.so */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
-@@ -418,6 +451,15 @@ test_tcti_fail_all (void **state)
+@@ -424,6 +457,15 @@ test_tcti_fail_all (void **state)
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
@@ -127,7 +136,7 @@ index 873a4531..c17b939e 100644
 
     /* Skip over libtss2-tcti-device.so, /dev/tpmrm0 */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-device.so.0");
-@@ -429,6 +471,15 @@ test_tcti_fail_all (void **state)
+@@ -435,6 +477,15 @@ test_tcti_fail_all (void **state)
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
@@ -143,7 +152,7 @@ index 873a4531..c17b939e 100644
 
     /* Skip over libtss2-tcti-device.so, /dev/tpm0 */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-device.so.0");
-@@ -440,6 +491,15 @@ test_tcti_fail_all (void **state)
+@@ -446,6 +497,15 @@ test_tcti_fail_all (void **state)
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
@@ -159,7 +168,7 @@ index 873a4531..c17b939e 100644
 
     /* Skip over libtss2-tcti-swtpm.so */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-swtpm.so.0");
-@@ -451,6 +511,15 @@ test_tcti_fail_all (void **state)
+@@ -457,6 +517,15 @@ test_tcti_fail_all (void **state)
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-swtpm.so.0.so");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
@@ -175,7 +184,7 @@ index 873a4531..c17b939e 100644
 
     /* Skip over libtss2-tcti-mssim.so */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-mssim.so.0");
-@@ -462,6 +531,15 @@ test_tcti_fail_all (void **state)
+@@ -468,6 +537,15 @@ test_tcti_fail_all (void **state)
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-mssim.so.0.so");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
@@ -191,7 +200,7 @@ index 873a4531..c17b939e 100644
 
     TSS2_RC r;
     TSS2_TCTI_CONTEXT *tcti;
-@@ -490,6 +568,15 @@ test_info_from_name_handle_fail (void **state)
+@@ -496,6 +574,15 @@ test_info_from_name_handle_fail (void **state)
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
@@ -207,7 +216,7 @@ index 873a4531..c17b939e 100644
 
     TSS2_RC rc = info_from_name ("foo", &info, &data);
     assert_int_equal (rc, TSS2_TCTI_RC_NOT_SUPPORTED);
-@@ -606,6 +693,15 @@ test_tctildr_get_info_from_name (void **state)
+@@ -612,6 +699,15 @@ test_tctildr_get_info_from_name (void **state)
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so");
     expect_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zimg";
-  version = "3.0.4";
+  version = "3.0.5";

  src = fetchFromGitHub {
    owner  = "sekrit-twc";
    repo   = "zimg";
    rev    = "release-${version}";
-    sha256 = "1069x49l7kh1mqcq1h3f0m5j0h832jp5x230bh4c613ymgg5kn00";
+    sha256 = "sha256-DCSqHCnOyIvKtIAfprb8tgtzLn67Ix6BWyeIliu0HO4=";
  };

  outputs = [ "out" "dev" "doc" ];
@@ -9,7 +9,7 @@
 }:

 buildPythonPackage rec {
-  version = "3.6.0";
+  version = "3.7.2";
  pname = "asgiref";
  format = "setuptools";

@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "django";
    repo = "asgiref";
    rev = "refs/tags/${version}";
-    hash = "sha256-Kl4483rfuFKbnD7pBSTND1QAtBsZP6jKsrDlpVCZLDs=";
+    hash = "sha256-VW1PBh6+nLMD7qxmL83ymuxCPYKVY3qGKsB7ZiMqMu8=";
  };

  propagatedBuildInputs = [
@@ -52,14 +52,14 @@ buildPythonPackage rec {

  cargoRoot = "src/rust";

-  nativeBuildInputs = lib.optionals (!isPyPy) [
-    cffi
-    pkg-config
-  ] ++ [
+  nativeBuildInputs = [
    rustPlatform.cargoSetupHook
    setuptools-rust
    cargo
    rustc
+    pkg-config
+  ] ++ lib.optionals (!isPyPy) [
+    cffi
  ];

  buildInputs = [ openssl ]
@@ -27,13 +27,14 @@ buildPythonPackage rec {
    })
  ];

-  # remove vbox tests
  postPatch = ''
-    rm -v testing/test_termination.py
-    rm -v testing/test_channel.py
-    rm -v testing/test_xspec.py
-    rm -v testing/test_gateway.py
-    ${lib.optionalString isPyPy "rm -v testing/test_multi.py"}
+    # remove vbox tests
+    rm testing/test_termination.py
+    rm testing/test_channel.py
+    rm testing/test_xspec.py
+    rm testing/test_gateway.py
+  '' + lib.optionalString isPyPy ''
+    rm testing/test_multi.py
  '';

  nativeBuildInputs = [
@@ -44,8 +45,11 @@ buildPythonPackage rec {
    apipkg
  ];

+  # sometimes crashes with: OSError: [Errno 9] Bad file descriptor
+  doCheck = !isPyPy;
+
  nativeCheckInputs = [
-    py
+    py # no longer required with 1.10.0
    pytestCheckHook
  ];

@@ -62,5 +66,4 @@ buildPythonPackage rec {
    license = licenses.mit;
    maintainers = with maintainers; [ ];
  };
-
 }
@@ -9,6 +9,7 @@
 # build-system
 , pkg-config
 , pybind11
+, setuptools
 , setuptools-scm

 # native libraries
@@ -115,6 +116,7 @@ buildPythonPackage rec {
  nativeBuildInputs = [
    pkg-config
    pybind11
+    setuptools
    setuptools-scm
    numpy
  ];
@@ -41,7 +41,7 @@

 buildPythonPackage rec {
  pname = "SQLAlchemy";
-  version = "2.0.15";
+  version = "2.0.17";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@@ -50,7 +50,7 @@ buildPythonPackage rec {
    owner = "sqlalchemy";
    repo = "sqlalchemy";
    rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-05GhFearTA9At8MgmEfeXfbS3MAZ0Rmx8jER18q7fmI=";
+    hash = "sha256-thwPqyxhojyHZpo7LK6nl69Z1B1Z6+WR1dAdlVrgiaY=";
  };

  nativeBuildInputs =[
@@ -113,6 +113,9 @@ buildPythonPackage rec {
    postgresql_psycopg = [
      psycopg
    ];
+    postgresql_psycopgbinary = [
+      psycopg
+    ];
    pymysql = [
      pymysql
    ];
@@ -1,14 +1,19 @@
-{ lib, pkg-config, fetchPypi, buildPythonPackage
+{ lib
+, pkg-config
+, fetchPypi
+, buildPythonPackage
 , buildPackages
-, zstd, pytest }:
+, zstd
+, pytest
+}:

 buildPythonPackage rec {
  pname = "zstd";
-  version = "1.5.4.0";
+  version = "1.5.5.1";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-oNEd9wqXhSk0G1duaaTwsqI+dGaG4k+bkCYKM85JBC0=";
+    hash = "sha256-HvmAq/Dh4HKwKNLXbvlbR2YyZRyWIlzzC2Gcbu9iVnI=";
  };

  postPatch = ''
@@ -4,8 +4,8 @@ buildRubyGem rec {
  inherit ruby;
  name = "${gemName}-${version}";
  gemName = "bundler";
-  version = "2.4.14";
-  source.sha256 = "sha256-lIJKzVEK30D43O5q0YwJ+FcSyJxGij2uWlxH+mlIfHI=";
+  version = "2.4.15";
+  source.sha256 = "sha256-FM2eQJyQy1UxmHj++zvlqLz8dDOxQRXehSOytfc0rqo=";
  dontPatchShebangs = true;

  postFixup = ''
@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , autoreconfHook
+, bison
 , onigurumaSupport ? true
 , oniguruma
 }:
@@ -38,7 +39,16 @@ stdenv.mkDerivation rec {
  '';

  buildInputs = lib.optionals onigurumaSupport [ oniguruma ];
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook bison ];
+
+  # Darwin requires _REENTRANT be defined to use functions like `lgamma_r`.
+  # Otherwise, configure will detect that they’re in libm, but the build will fail
+  # with clang 16+ due to calls to undeclared functions.
+  # This is fixed upstream and can be removed once jq is updated (to 1.7 or an unstable release).
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin (toString [
+    "-D_REENTRANT=1"
+    "-D_DARWIN_C_SOURCE=1"
+  ]);

  configureFlags = [
    "--bindir=\${bin}/bin"
@@ -7,15 +7,15 @@ let
  rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
  pname = "rust-bindgen-unwrapped";
-  version = "0.66.0";
+  version = "0.66.1";

  src = fetchCrate {
    pname = "bindgen-cli";
    inherit version;
-    sha256 = "sha256-Or5gaYXqfRcxAzBf4nOjmM9CQMvfwb8KbpD8hDJJQ4o=";
+    sha256 = "sha256-xVTVC3dNGIJeFm/v3swekzuJ2RQOe+wSh05vuWYTDRs=";
  };

-  cargoHash = "sha256-rsowGeBSuqHyz90qozeCi5dXsH4EHKhIUQbDaNJKabI=";
+  cargoHash = "sha256-eIvl0RSKErNPip0r6iz7JVHm5YvuY3ke/6aMgkryRcI=";

  buildInputs = [ clang.cc.lib ];

@@ -141,6 +141,7 @@ stdenv.mkDerivation rec {
  dylib_version = lib.versions.majorMinor version;
  preFixup = lib.optionalString stdenv.isDarwin ''
    install_name_tool -change libgs.dylib.$dylib_version $out/lib/libgs.dylib.$dylib_version $out/bin/gs
+    install_name_tool -change libgs.dylib.$dylib_version $out/lib/libgs.dylib.$dylib_version $out/bin/gsx
  '';

  # validate dynamic linkage
@@ -149,6 +150,7 @@ stdenv.mkDerivation rec {
    runHook preInstallCheck

    $out/bin/gs --version
+    $out/bin/gsx --version
    pushd examples
    for f in *.{ps,eps,pdf}; do
      echo "Rendering $f"
@@ -13,6 +13,7 @@ appleDerivation' stdenv {
    NIX_CFLAGS_COMPILE = toString [
      "-ISystemConfiguration.framework/Headers"
      "-I${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders"
+      "-D_DNS_SD_LIBDISPATCH" # Needed for DNSServiceSetDispatchQueue to be available
    ];
  };

@@ -1,7 +1,3 @@
-MacOS SDKs before 10.13 don't support open_memstream. This is already replaced
-by a runtime check in cctools-port, but because we build with SDK 10.12 by
-default, linking still fails for us. Disable it entirely here.
-
 --- a/cctools/include/stuff/diagnostics.h
 +++ b/cctools/include/stuff/diagnostics.h
@@ -60,13 +60,6 @@ void diagnostics_log_msg(enum diagnostic_level level, const char* message);
@@ -16,6 +12,6 @@ default, linking still fails for us. Disable it entirely here.
 -#ifndef HAVE_OPENMEMSTREAM_RUNTIME
 -#  define HAVE_OPENMEMSTREAM_RUNTIME 1
 -#endif
-+#define HAVE_OPENMEMSTREAM_RUNTIME 0
+#define HAVE_OPENMEMSTREAM_RUNTIME 1
 
 #endif /* diagnostics_h */
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, autoreconfHook, memstreamHook
 , installShellFiles
 , libuuid
 , libobjc ? null, maloader ? null
@@ -35,7 +35,8 @@ stdenv.mkDerivation {

  outputs = [ "out" "dev" "man" ];

-  nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ];
+  nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ]
+    ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ memstreamHook ];
  buildInputs = [ libuuid ]
    ++ lib.optionals stdenv.isDarwin [ libobjc ]
    ++ lib.optional enableTapiSupport libtapi;
@@ -51,8 +52,9 @@ stdenv.mkDerivation {
      url = "https://github.com/MercuryTechnologies/cctools-port/commit/025899b7b3593dedb0c681e689e57c0e7bbd9b80.patch";
      hash = "sha256-SWVUzFaJHH2fu9y8RcU3Nx/QKx60hPE5zFx0odYDeQs=";
    })
-  ]
-    ++ lib.optional stdenv.isDarwin ./darwin-no-memstream.patch;
+    # Always use `open_memstream`. This is provided by memstream via hook on x86_64-darwin.
+    ./darwin-memstream.patch
+  ];

  __propagatedImpureHostDeps = [
    # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
@@ -0,0 +1,11 @@
+--- a/CoreFoundation/RunLoop.subproj/CFMessagePort.c	1969-12-31 19:00:01.000000000 -0500
+++ b/CoreFoundation/RunLoop.subproj/CFMessagePort.c	2023-06-09 20:25:28.599209755 -0400
+@@ -28,6 +28,8 @@
+ #endif
+ #endif
+ 
+#include <bootstrap.h>
+
+ extern pid_t getpid(void);
+ 
+ #define __kCFMessagePortMaxNameLengthMax 255
@@ -0,0 +1,25 @@
+diff -u a/CoreFoundation/URL.subproj/CFURLComponents.c b/CoreFoundation/URL.subproj/CFURLComponents.c
+--- a/CoreFoundation/URL.subproj/CFURLComponents.c	1969-12-31 19:00:01.000000000 -0500
+++ b/CoreFoundation/URL.subproj/CFURLComponents.c	2023-06-09 20:36:52.995514573 -0400
+@@ -66,7 +66,8 @@
+     return CFRetain(CFSTR("A really nice CFURLComponents object"));
+ }
+ 
+-CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFURLComponentsRef instance) {
+CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFTypeRef cf) {
+    CFURLComponentsRef instance = (CFURLComponentsRef)cf;
+     __CFGenericValidateType(instance, _CFURLComponentsGetTypeID());
+     
+     if (instance->_urlString) CFRelease(instance->_urlString);
+diff -u a/CoreFoundation/URL.subproj/CFURLComponents.h b/CoreFoundation/URL.subproj/CFURLComponents.h
+--- a/CoreFoundation/URL.subproj/CFURLComponents.h	1969-12-31 19:00:01.000000000 -0500
+++ b/CoreFoundation/URL.subproj/CFURLComponents.h	2023-06-09 20:39:36.967857713 -0400
+@@ -38,7 +38,7 @@
+ 
+ CF_EXPORT CFTypeID _CFURLComponentsGetTypeID(void);
+ 
+-CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFURLComponentsRef);
+CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFTypeRef);
+ 
+ // URLComponents are always mutable.
+ CF_EXPORT _Nullable CFURLComponentsRef _CFURLComponentsCreate(CFAllocatorRef alloc);
@@ -0,0 +1,66 @@
+--- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
+++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:52:49.096019700 -0400
+@@ -129,7 +129,7 @@
+                 Base.subproj/CFByteOrder.h
+                 Base.subproj/CFUUID.h
+                 Base.subproj/CFUtilities.h
+-                Base.subproj/SwiftRuntime/CoreFoundation.h
+                Base.subproj/CoreFoundation.h  # The SwiftRuntime version of this file causes linker errors and is not correct for standalone CF.
+                 Base.subproj/SwiftRuntime/TargetConditionals.h
+                 # Collections
+                 Collections.subproj/CFArray.h
+@@ -245,6 +245,8 @@
+                 # RunLoop
+                 RunLoop.subproj/CFRunLoop.c
+                 RunLoop.subproj/CFSocket.c
+                RunLoop.subproj/CFMachPort.c   # These files are missing from the upstream `CMakeLists.txt` but required to build on Darwin.
+                RunLoop.subproj/CFMessagePort.c
+                 # Stream
+                 Stream.subproj/CFConcreteStreams.c
+                 Stream.subproj/CFSocketStream.c
+@@ -336,6 +338,11 @@
+   target_include_directories(CoreFoundation
+                              PRIVATE
+                                ${CURL_INCLUDE_DIRS})
+elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+  find_package(CURL REQUIRED)
+  target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
+  find_package(LibXml2 REQUIRED)
+  target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
+ else()
+   target_include_directories(CoreFoundation
+                              PRIVATE
+@@ -365,6 +372,10 @@
+                         PRIVATE
+                           ${CURL_LIBRARIES}
+                           ${LIBXML2_LIBRARIES})
+elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+  target_link_libraries(CoreFoundation PRIVATE
+    ${CURL_LIBRARIES}
+    ${LIBXML2_LIBRARIES})
+ else()
+   target_link_libraries(CoreFoundation
+                         PRIVATE
+@@ -398,9 +400,19 @@
+   target_link_libraries(CoreFoundation
+                         PRIVATE
+                           icucore)
+-  set_target_properties(CoreFoundation
+-                        PROPERTIES LINK_FLAGS
+-                          -Xlinker;-alias_list;-Xlinker;Base.subproj/DarwinSymbolAliases;-twolevel_namespace;-sectcreate;__UNICODE;__csbitmaps;CharacterSets/CFCharacterSetBitmaps.bitmap;-sectcreate;__UNICODE;__properties;CharacterSets/CFUniCharPropertyDatabase.data;-sectcreate;__UNICODE;__data;CharacterSets/CFUnicodeData-L.mapping;-segprot;__UNICODE;r;r)
+  target_link_options(CoreFoundation
+                      PUBLIC
+                      "LINKER:-alias_list,../Base.subproj/DarwinSymbolAliases"
+                      "LINKER:-twolevel_namespace"
+                      "LINKER:-sectcreate,__UNICODE,__csbitmaps,../CharacterSets/CFCharacterSetBitmaps.bitmap"
+                      "LINKER:-sectcreate,__UNICODE,__properties,../CharacterSets/CFUniCharPropertyDatabase.data"
+                      "LINKER:-sectcreate,__UNICODE,__data,../CharacterSets/CFUnicodeData-L.mapping"
+                      "LINKER:-segprot,__UNICODE,r,r"
+                      "LINKER:-current_version,1454.90.0"
+                      "LINKER:-compatibility_version,150.0.0"
+                      "LINKER:-init,___CFInitialize")
+  set(CMAKE_SHARED_LIBRARY_PREFIX "")
+  set(CMAKE_SHARED_LIBRARY_SUFFIX "")
+ endif()
+ 
+ install(TARGETS
@@ -0,0 +1,23 @@
+diff -u aa/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
+--- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
+++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:59:19.492601179 -0400
+
+@@ -424,16 +424,11 @@
+   set(CMAKE_SHARED_LIBRARY_SUFFIX "")
+ endif()
+ 
+-install(TARGETS
+-          CoreFoundation
+-        DESTINATION
+-          "${CMAKE_INSTALL_FULL_LIBDIR}")
+ install(DIRECTORY
+           ${CoreFoundation_FRAMEWORK_DIRECTORY}
+         DESTINATION
+-          ${CMAKE_INSTALL_PREFIX}/System/Library/Frameworks
+-        USE_SOURCE_PERMISSIONS
+-        PATTERN PrivateHeaders EXCLUDE)
+          ${CMAKE_INSTALL_PREFIX}/Library/Frameworks
+        USE_SOURCE_PERMISSIONS)
+ 
+ 
+ # TODO(compnerd) formalize this
@@ -0,0 +1,84 @@
+diff -u a/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
+--- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
+++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:59:08.659632504 -0400
+@@ -1,5 +1,5 @@
+ 
+-cmake_minimum_required(VERSION 3.4.3)
+cmake_minimum_required(VERSION 3.14)
+ list(APPEND CMAKE_MODULE_PATH
+      "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules")
+ 
+@@ -45,6 +45,8 @@
+                 ${FRAMEWORK_LIBRARY_TYPE}
+               FRAMEWORK_DIRECTORY
+                 CoreFoundation_FRAMEWORK_DIRECTORY
+              VERSION
+                A
+               MODULE_MAP
+                 Base.subproj/module.modulemap
+               PRIVATE_HEADERS
+diff -u a/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake b/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake
+--- a/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake	1969-12-31 19:00:01.000000000 -0500
+++ b/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake	2023-06-29 18:57:55.792860996 -0400
+@@ -3,7 +3,7 @@
+ 
+ function(add_framework NAME)
+   set(options STATIC SHARED)
+-  set(single_value_args MODULE_MAP FRAMEWORK_DIRECTORY)
+  set(single_value_args MODULE_MAP FRAMEWORK_DIRECTORY VERSION)
+   set(multiple_value_args PRIVATE_HEADERS PUBLIC_HEADERS SOURCES)
+   cmake_parse_arguments(AF "${options}" "${single_value_args}" "${multiple_value_args}" ${ARGN})
+ 
+@@ -14,26 +14,32 @@
+     set(AF_TYPE SHARED)
+   endif()
+ 
+  file(MAKE_DIRECTORY ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/${AF_VERSION})
+  file(CREATE_LINK ${AF_VERSION} ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current SYMBOLIC)
+
+   if(AF_MODULE_MAP)
+     file(COPY
+            ${AF_MODULE_MAP}
+          DESTINATION
+-           ${CMAKE_BINARY_DIR}/${NAME}.framework/Modules
+           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/Modules
+          NO_SOURCE_PERMISSIONS)
+    file(CREATE_LINK Versions/Current/Modules ${CMAKE_BINARY_DIR}/${NAME}.framework/Modules SYMBOLIC)
+   endif()
+   if(AF_PUBLIC_HEADERS)
+     file(COPY
+            ${AF_PUBLIC_HEADERS}
+          DESTINATION
+-           ${CMAKE_BINARY_DIR}/${NAME}.framework/Headers
+           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/Headers
+          NO_SOURCE_PERMISSIONS)
+    file(CREATE_LINK Versions/Current/Headers ${CMAKE_BINARY_DIR}/${NAME}.framework/Headers SYMBOLIC)
+   endif()
+   if(AF_PRIVATE_HEADERS)
+     file(COPY
+            ${AF_PRIVATE_HEADERS}
+          DESTINATION
+-           ${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders
+           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/PrivateHeaders
+          NO_SOURCE_PERMISSIONS)
+    file(CREATE_LINK Versions/Current/PrivateHeaders ${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders SYMBOLIC)
+   endif()
+   add_custom_target(${NAME}_POPULATE_HEADERS
+                     DEPENDS
+@@ -51,13 +57,15 @@
+   set_target_properties(${NAME}
+                         PROPERTIES
+                           LIBRARY_OUTPUT_DIRECTORY
+-                              ${CMAKE_BINARY_DIR}/${NAME}.framework)
+                              ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current)
+   target_compile_options(${NAME}
+                          PRIVATE
+                            -F;${CMAKE_BINARY_DIR}
+                            -I;${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders)
+   add_dependencies(${NAME} ${NAME}_POPULATE_HEADERS)
+ 
+  file(CREATE_LINK Versions/Current/${NAME} ${CMAKE_BINARY_DIR}/${NAME}.framework/${NAME} SYMBOLIC)
+
+   if(AF_FRAMEWORK_DIRECTORY)
+     set(${AF_FRAMEWORK_DIRECTORY} ${CMAKE_BINARY_DIR}/${NAME}.framework PARENT_SCOPE)
+   endif()
@@ -0,0 +1,31 @@
+diff -ur d/CoreFoundation/CMakeLists.txt e/CoreFoundation/CMakeLists.txt
+--- d/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
+++ e/CoreFoundation/CMakeLists.txt	2023-06-29 19:13:15.561253229 -0400
+@@ -343,6 +343,7 @@
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+   find_package(CURL REQUIRED)
+   target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
+  find_package(ICU COMPONENTS uc i18n data REQUIRED)
+   find_package(LibXml2 REQUIRED)
+   target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
+ else()
+@@ -377,6 +378,9 @@
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+   target_link_libraries(CoreFoundation PRIVATE
+     ${CURL_LIBRARIES}
+    ICU::uc
+    ICU::i18n
+    ICU::data
+     ${LIBXML2_LIBRARIES})
+ else()
+   target_link_libraries(CoreFoundation
+@@ -408,9 +412,6 @@
+                         PROPERTIES LINK_FLAGS
+                           -Xlinker;@${CMAKE_SOURCE_DIR}/linux.ld;-Bsymbolic)
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+-  target_link_libraries(CoreFoundation
+-                        PRIVATE
+-                          icucore)
+   target_link_options(CoreFoundation
+                       PUBLIC
+                       "LINKER:-alias_list,../Base.subproj/DarwinSymbolAliases"
@@ -0,0 +1,46 @@
+diff -u a/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
+--- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
+++ b/CoreFoundation/CMakeLists.txt	2023-06-29 19:39:30.074449222 -0400
+@@ -104,7 +104,6 @@
+                 # URL
+                 URL.subproj/CFURL.inc.h
+                 URL.subproj/CFURLPriv.h
+-                URL.subproj/CFURLSessionInterface.h
+               PUBLIC_HEADERS
+                 # FIXME: PrivateHeaders referenced by public headers
+                 Base.subproj/CFKnownLocations.h
+@@ -120,7 +119,6 @@
+                 String.subproj/CFRegularExpression.h
+                 String.subproj/CFRunArray.h
+                 URL.subproj/CFURLPriv.h
+-                URL.subproj/CFURLSessionInterface.h
+ 
+                 # AppServices
+                 AppServices.subproj/CFNotificationCenter.h
+@@ -280,8 +278,7 @@
+                 URL.subproj/CFURL.c
+                 URL.subproj/CFURLAccess.c
+                 URL.subproj/CFURLComponents.c
+-                URL.subproj/CFURLComponents_URIParser.c
+-                URL.subproj/CFURLSessionInterface.c)
+                URL.subproj/CFURLComponents_URIParser.c)
+ if(CMAKE_SYSTEM_NAME STREQUAL Linux OR CMAKE_SYSTEM_NAME STREQUAL Android)
+   target_compile_definitions(CoreFoundation
+                              PRIVATE
+@@ -341,8 +338,6 @@
+                              PRIVATE
+                                ${CURL_INCLUDE_DIRS})
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+-  find_package(CURL REQUIRED)
+-  target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
+   find_package(ICU COMPONENTS uc i18n data REQUIRED)
+   find_package(LibXml2 REQUIRED)
+   target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
+@@ -377,7 +372,6 @@
+                           ${LIBXML2_LIBRARIES})
+ elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+   target_link_libraries(CoreFoundation PRIVATE
+-    ${CURL_LIBRARIES}
+     ICU::uc
+     ICU::i18n
+     ICU::data
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchurl, makeSetupHook, ninja, python3, curl, libxml2, objc4, ICU }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, makeSetupHook, cmake, ninja, pkg-config, launchd, libdispatch, python3, libxml2, objc4, icu }:

 let
  # 10.12 adds a new sysdir.h that our version of CF in the main derivation depends on, but
@@ -21,29 +21,39 @@ stdenv.mkDerivation {
    sha256 = "17kpql0f27xxz4jjw84vpas5f5sn4vdqwv10g151rc3rswbwln1z";
  };

-  nativeBuildInputs = [ ninja python3 ];
-  buildInputs = [ curl libxml2 objc4 ICU ];
+  nativeBuildInputs = [ cmake ninja pkg-config python3 ];
+  buildInputs = [ (lib.getDev launchd) libdispatch libxml2 objc4 icu ];

-  patches = [ ./0001-Add-missing-TARGET_OS_-defines.patch ];
+  patches = [
+    ./0001-Add-missing-TARGET_OS_-defines.patch
+    # CFMessagePort.h uses `bootstrap_check_in` without declaring it, which is defined in the launchd headers.
+    ./0002-Add-missing-launchd-header.patch
+    # CFURLComponents fails to build with clang 16 due to an invalid pointer conversion. This is fixed upstream.
+    ./0003-Fix-incompatible-pointer-conversion.patch
+    # Fix `CMakeLists.txt` to allow it to be used instead of `build.py` to build on Darwin.
+    ./0004-Fix-Darwin-cmake-build.patch
+    # Install CF framework in `$out/Library/Frameworks` instead of `$out/System/Frameworks`.
+    ./0005-Fix-framework-installation-path.patch
+    # Build a framework that matches the contents of the system CoreFoundation. This patch adds
+    # versioning and drops the prefix and suffix, so the dynamic library is named `CoreFoundation`
+    # instead of `libCoreFoundation.dylib`.
+    ./0006-System-CF-framework-compatibility.patch
+    # Link against the nixpkgs ICU instead of using Apple’s vendored version.
+    ./0007-Use-nixpkgs-icu.patch
+    # Don’t link against libcurl. This breaks a cycle between CF and curl, which depends on CF and
+    # uses the SystemConfiguration framework to support NAT64.
+    # This is safe because the symbols provided in CFURLSessionInterface are not provided by the
+    # system CoreFoundation. They are meant to be used by the implementation of `NSURLSession` in
+    # swift-corelibs-foundation, which is not built because it is not fully compatible with the
+    # system Foundation used on Darwin.
+    ./0008-Dont-link-libcurl.patch
+  ];

  postPatch = ''
    cd CoreFoundation

    cp ${sysdir-free-system-directories} Base.subproj/CFSystemDirectories.c

-    # In order, since I can't comment individual lines:
-    # 1. Disable dispatch support for now
-    # 2. For the linker too
-    # 3. Use the legit CoreFoundation.h, not the one telling you not to use it because of Swift
-    substituteInPlace build.py \
-      --replace "cf.CFLAGS += '-DDEPLOYMENT" '#' \
-      --replace "cf.LDFLAGS += '-ldispatch" '#'
-
-    # Fix sandbox impurities.
-    substituteInPlace ../lib/script.py \
-      --replace '/bin/cp' cp
-    patchShebangs --build ../configure
-
    # Includes xpc for some initialization routine that they don't define anyway, so no harm here
    substituteInPlace PlugIn.subproj/CFBundlePriv.h \
      --replace '#if (TARGET_OS_MAC' '#if (0'
@@ -55,55 +65,27 @@ stdenv.mkDerivation {
    # The MIN macro doesn't seem to be defined sensibly for us. Not sure if our stdenv or their bug
    substituteInPlace Base.subproj/CoreFoundation_Prefix.h \
      --replace '#if DEPLOYMENT_TARGET_WINDOWS || DEPLOYMENT_TARGET_LINUX' '#if 1'
-
-    # Somehow our ICU doesn't have this, probably because it's too old (we'll update it soon when we update the rest of the SDK)
-    substituteInPlace Locale.subproj/CFLocale.c \
-      --replace '#if U_ICU_VERSION_MAJOR_NUM' '#if 0 //'
  '';

-  BUILD_DIR = "./Build";
-  CFLAGS = "-DINCLUDE_OBJC -I${libxml2.dev}/include/libxml2"; # They seem to assume we include objc in some places and not in others, make a PR; also not sure why but libxml2 include path isn't getting picked up from buildInputs
+  env.NIX_CFLAGS_COMPILE = toString [
+    # Silence warnings regarding other targets
+    "-Wno-error=undef-prefix"
+    # Avoid redefinitions when including objc headers
+    "-DINCLUDE_OBJC=1"
+  ];

-  # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
-  # and this version is a version from there. No idea how accurate it is.
-  LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
-
-  configurePhase = ''
-    ../configure release --sysroot UNUSED
-  '';
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DCF_ENABLE_LIBDISPATCH=OFF"
+  ];

  enableParallelBuilding = true;

-  buildPhase = ''
-    runHook preBuild
+  postInstall = ''
+    install_name_tool -id '@rpath/CoreFoundation.framework/Versions/A/CoreFoundation' \
+      "$out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"

-    ninja -j $NIX_BUILD_CORES
-
-    runHook postBuild
+    mkdir -p "$out/nix-support"
+    substituteAll ${./pure-corefoundation-hook.sh} "$out/nix-support/setup-hook"
  '';
-
-  # TODO: their build system sorta kinda can do this, but it doesn't seem to work right now
-  # Also, this includes a bunch of private headers in the framework, which is not what we want
-  installPhase = ''
-    base="$out/Library/Frameworks/CoreFoundation.framework"
-    mkdir -p $base/Versions/A/{Headers,PrivateHeaders,Modules}
-
-    cp ./Build/CoreFoundation/libCoreFoundation.dylib $base/Versions/A/CoreFoundation
-
-    # Note that this could easily live in the ldflags above as `-install_name @rpath/...` but
-    # https://github.com/NixOS/nixpkgs/issues/46434 thwarts that, so for now I'm hacking it up
-    # after the fact.
-    install_name_tool -id '@rpath/CoreFoundation.framework/Versions/A/CoreFoundation' $base/Versions/A/CoreFoundation
-
-    cp ./Build/CoreFoundation/usr/include/CoreFoundation/*.h $base/Versions/A/Headers
-    cp ./Build/CoreFoundation/usr/include/CoreFoundation/module.modulemap $base/Versions/A/Modules
-
-    ln -s A $base/Versions/Current
-
-    for i in CoreFoundation Headers Modules; do
-      ln -s Versions/Current/$i $base/$i
-    done
-  '';
-
-    darwinEnvHook = makeSetupHook { name = "darwin-env-hook"; } ./pure-corefoundation-hook.sh;
 }
@@ -22,13 +22,13 @@
 }:

 let
-  apparmor-version = "3.1.5";
+  apparmor-version = "3.1.6";

  apparmor-meta = component: with lib; {
    homepage = "https://apparmor.net/";
    description = "A mandatory access control system - ${component}";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ julm thoughtpolice ];
+    license = with licenses; [ gpl2Only lgpl21Only ];
+    maintainers = with maintainers; [ julm thoughtpolice ajs124 ];
    platforms = platforms.linux;
  };

@@ -36,7 +36,7 @@ let
    owner = "apparmor";
    repo = "apparmor";
    rev = "v${apparmor-version}";
-    hash = "sha256-nqIRs2REbSQNKglEEjAO/YSZc6r2ks128sUNq61gRWE=";
+    hash = "sha256-VPgRmmQv+kgLduc6RTu9gotyjT6OImUXsPeatgG7m9E=";
  };

  aa-teardown = writeShellScript "aa-teardown" ''
@@ -85,7 +85,6 @@ in stdenv.mkDerivation rec {
    "--enable-mesh"
    "--enable-midi"
    "--enable-nfc"
-    "--enable-sap"
    "--enable-sixaxis"
    "--enable-btpclient"
    "--enable-hid2hci"
@@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "iproute2";
-  version = "6.3.0";
+  version = "6.4.0";

  src = fetchurl {
    url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-37KpjbluemU8/8ZpMzWhpGbimjS2rFKL5I814dJ2ZzI=";
+    sha256 = "sha256-TFG43svH5NoVn/sGb1kM+5Pb+a9/+GsWR85Ct8F5onI=";
  };

  patches = [
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {

    # fix build on musl. applied anywhere to prevent patchrot.
    (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/main/iproute2/min.patch?id=4b78dbe29d18151402052c56af43cc12d04b1a69";
-      sha256 = "sha256-0ROZQAN3mUPPgggictr23jyA4JDG7m9vmBUhgRp4ExY=";
+      url = "https://git.alpinelinux.org/aports/plain/main/iproute2/include.patch?id=bd46efb8a8da54948639cebcfa5b37bd608f1069";
+      sha256 = "sha256-NpNnSXQntuzzpjswE42yzo7nqmrQgI5YcHR2kp9NEwA=";
    })
  ];

@@ -111,12 +111,12 @@ let
 in {
  inherit makeLinuxHeaders;

-  linuxHeaders = let version = "6.3"; in
+  linuxHeaders = let version = "6.4"; in
    makeLinuxHeaders {
      inherit version;
      src = fetchurl {
        url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-        hash = "sha256-ujSR9e1r0nCjcMRAQ049aQhfzdUoki+gHnPXZX23Ox4=";
+        hash = "sha256-j6BYjwws7KRMrHeg45ukjJ8AprncaXYcAqXT76yNp/M=";
      };
      patches = [
         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
@@ -515,9 +515,10 @@ stdenv.mkDerivation (finalAttrs: {
    "-Dsysvinit-path="
    "-Dsysvrcnd-path="

-    "-Dsulogin-path=${util-linux}/bin/sulogin"
-    "-Dmount-path=${util-linux}/bin/mount"
-    "-Dumount-path=${util-linux}/bin/umount"
+    "-Dsulogin-path=${util-linux.login}/bin/sulogin"
+    "-Dnologin-path=${util-linux.login}/bin/nologin"
+    "-Dmount-path=${util-linux.mount}/bin/mount"
+    "-Dumount-path=${util-linux.mount}/bin/umount"
    "-Dcreate-log-dirs=false"

    # Use cgroupsv2. This is already the upstream default, but better be explicit.
@@ -568,8 +569,8 @@ stdenv.mkDerivation (finalAttrs: {
            "man/systemd-makefs@.service.xml"
          ];
        }
-        { search = "/sbin/swapon"; replacement = "${lib.getBin util-linux}/sbin/swapon"; where = [ "src/core/swap.c" "src/basic/unit-def.h" ]; }
-        { search = "/sbin/swapoff"; replacement = "${lib.getBin util-linux}/sbin/swapoff"; where = [ "src/core/swap.c" ]; }
+        { search = "/sbin/swapon"; replacement = "${util-linux.swap}/sbin/swapon"; where = [ "src/core/swap.c" "src/basic/unit-def.h" ]; }
+        { search = "/sbin/swapoff"; replacement = "${util-linux.swap}/sbin/swapoff"; where = [ "src/core/swap.c" ]; }
        {
          search = "/bin/echo";
          replacement = "${coreutils}/bin/echo";
@@ -50,7 +50,12 @@ stdenv.mkDerivation rec {
    })
  ];

-  outputs = [ "bin" "dev" "out" "lib" "man" ];
+  # We separate some of the utilities into their own outputs. This
+  # allows putting together smaller systems depending on only part of
+  # the greater util-linux toolset.
+  # Compatibility is maintained by symlinking the binaries from the
+  # smaller outputs in the bin output.
+  outputs = [ "bin" "dev" "out" "lib" "man" "mount" "login" "swap" ];
  separateDebugInfo = true;

  postPatch = ''
@@ -106,6 +111,18 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  postInstall = ''
+    moveToOutput bin/mount "$mount"
+    moveToOutput bin/umount "$mount"
+    ln -svf "$mount/bin/"* $bin/bin/
+
+    moveToOutput sbin/nologin "$login"
+    moveToOutput sbin/sulogin "$login"
+    ln -svf "$login/bin/"* $bin/bin/
+
+    moveToOutput sbin/swapon "$swap"
+    moveToOutput sbin/swapoff "$swap"
+    ln -svf "$swap/bin/"* $bin/bin/
+
    installShellCompletion --bash bash-completion/*
  '';

@@ -814,11 +814,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  imake = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
    pname = "imake";
-    version = "1.0.8";
+    version = "1.0.9";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/util/imake-1.0.8.tar.bz2";
-      sha256 = "00m7l90ws72k1qm101sd2rx92ckd50cszyng5d4dd77jncbf9lmq";
+      url = "mirror://xorg/individual/util/imake-1.0.9.tar.xz";
+      sha256 = "10wgw3l0rsnvc2191awyg5j24n3g552xgc671qr5vnbliwkrvpkj";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -846,11 +846,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libFS = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xtrans }: stdenv.mkDerivation {
    pname = "libFS";
-    version = "1.0.8";
+    version = "1.0.9";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libFS-1.0.8.tar.bz2";
-      sha256 = "03xxyvpfa3rhqcld4p2chkil482jn9cp80hj17jdybcv2hkkgqf8";
+      url = "mirror://xorg/individual/lib/libFS-1.0.9.tar.xz";
+      sha256 = "12i0zh1v5zlba617nam8sjhfqi68qqnl7z5hsz3wqhijid1pjwsr";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -862,11 +862,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libICE = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, xtrans }: stdenv.mkDerivation {
    pname = "libICE";
-    version = "1.0.10";
+    version = "1.1.1";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2";
-      sha256 = "0j638yvmyna2k4mz465jywgdybgdchdqppfx6xfazg7l5khxr1kg";
+      url = "mirror://xorg/individual/lib/libICE-1.1.1.tar.xz";
+      sha256 = "0lg4sddalwmmzsnxv3fgdm2hzqp66j8b3syc0ancfhi9yzx7mrq3";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -878,11 +878,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libSM = callPackage ({ stdenv, pkg-config, fetchurl, libICE, libuuid, xorgproto, xtrans }: stdenv.mkDerivation {
    pname = "libSM";
-    version = "1.2.3";
+    version = "1.2.4";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2";
-      sha256 = "1fwwfq9v3sqmpzpscymswxn76xhxnysa24pfim1mcpxhvjcl89id";
+      url = "mirror://xorg/individual/lib/libSM-1.2.4.tar.xz";
+      sha256 = "113vx53k6pyxf84v5kqb7qhcldx1fi78lym77lcb2xhj9lgfbjzx";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -926,11 +926,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXScrnSaver = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
    pname = "libXScrnSaver";
-    version = "1.2.3";
+    version = "1.2.4";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXScrnSaver-1.2.3.tar.bz2";
-      sha256 = "1y4vx1vabg7j9hamp0vrfrax5b0lmgm3h0lbgbb3hnkv3dd0f5zr";
+      url = "mirror://xorg/individual/lib/libXScrnSaver-1.2.4.tar.xz";
+      sha256 = "1zi0r6mqa1g0hhsp02cdsjcxmsbipiv0v65c1h4pl84fydcjikbm";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -958,11 +958,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXau = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
    pname = "libXau";
-    version = "1.0.9";
+    version = "1.0.11";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2";
-      sha256 = "1v3krc6x0zliaa66qq1bf9j60x5nqfy68v8axaiglxpnvgqcpy6c";
+      url = "mirror://xorg/individual/lib/libXau-1.0.11.tar.xz";
+      sha256 = "1sxv56rql3vsb14za0hgr07mipgvvcw48910srmky32pyn135ypk";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -974,11 +974,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXaw = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXmu, libXpm, libXt }: stdenv.mkDerivation {
    pname = "libXaw";
-    version = "1.0.14";
+    version = "1.0.15";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2";
-      sha256 = "13kg59r3086383g1dyhnwxanhp2frssh9062mrgn34nzlf7gkbkn";
+      url = "mirror://xorg/individual/lib/libXaw-1.0.15.tar.xz";
+      sha256 = "0jkm2ards3nj08y7185k9jvjhhx78r46abrl3g3jrc4zvq7zfddb";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -990,11 +990,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXcomposite = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXfixes }: stdenv.mkDerivation {
    pname = "libXcomposite";
-    version = "0.4.5";
+    version = "0.4.6";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXcomposite-0.4.5.tar.bz2";
-      sha256 = "13sfcglvz87vl58hd9rszwr73z0z4nwga3c12rfh7f5s2ln8l8dk";
+      url = "mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz";
+      sha256 = "11rcvk380l5540gfqy9p8mbzw3l1p5g8l214p870f28smvqbqh7y";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1006,11 +1006,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXcursor = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXfixes, libXrender }: stdenv.mkDerivation {
    pname = "libXcursor";
-    version = "1.2.0";
+    version = "1.2.1";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXcursor-1.2.0.tar.bz2";
-      sha256 = "10l7c9fm0jmpkm9ab9dz8r6m1pr87vvgqjnbx1psz50h4pwfklrs";
+      url = "mirror://xorg/individual/lib/libXcursor-1.2.1.tar.xz";
+      sha256 = "011195an3w4xld3x0dr534kar1xjf52q96hmf0hgvfhh2rrl7ha6";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1022,11 +1022,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXdamage = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXfixes }: stdenv.mkDerivation {
    pname = "libXdamage";
-    version = "1.1.5";
+    version = "1.1.6";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXdamage-1.1.5.tar.bz2";
-      sha256 = "0igaw2akjf712y3rv7lx473jigxmcv9rs9y8sbrvbhya8f30cd5p";
+      url = "mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz";
+      sha256 = "04axzdx75w0wcb4na7lfpa0ai0fddw60dmg7cigs7z32a8gkqwsj";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1038,11 +1038,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXdmcp = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
    pname = "libXdmcp";
-    version = "1.1.3";
+    version = "1.1.4";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXdmcp-1.1.3.tar.bz2";
-      sha256 = "0ab53h0rkq721ihk5hi469x500f3pgbkm1wy01yf24x5m923nli0";
+      url = "mirror://xorg/individual/lib/libXdmcp-1.1.4.tar.xz";
+      sha256 = "005dsry6nfqrv32i7gbqn7mxnb2m3pc8fz9lxj2b9w7q2z1mrkid";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1054,11 +1054,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXext = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto }: stdenv.mkDerivation {
    pname = "libXext";
-    version = "1.3.4";
+    version = "1.3.5";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXext-1.3.4.tar.bz2";
-      sha256 = "0azqxllcsfxc3ilhz6kwc6x7m8wc477p59ir9p0yrsldx766zbar";
+      url = "mirror://xorg/individual/lib/libXext-1.3.5.tar.xz";
+      sha256 = "1jkv7l9qm4vms6af4faax916rirxp6r8rpjrhlxa6zn5jp4c056v";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1070,11 +1070,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXfixes = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
    pname = "libXfixes";
-    version = "6.0.0";
+    version = "6.0.1";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXfixes-6.0.0.tar.bz2";
-      sha256 = "0k2v4i4r24y3kdr5ici1qqhp69djnja919xfqp54c2rylm6s5hd7";
+      url = "mirror://xorg/individual/lib/libXfixes-6.0.1.tar.xz";
+      sha256 = "0n1dq2mi60i0c06i7j6lq64cq335ir2l89yj0amj3529s8ygk5dn";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1102,11 +1102,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXfont2 = callPackage ({ stdenv, pkg-config, fetchurl, libfontenc, xorgproto, freetype, xtrans, zlib }: stdenv.mkDerivation {
    pname = "libXfont2";
-    version = "2.0.5";
+    version = "2.0.6";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXfont2-2.0.5.tar.bz2";
-      sha256 = "0gmm20p3qq23pd2bhc5rsxil60wqvj9xi7l1nh55q8gp3hhnyz5a";
+      url = "mirror://xorg/individual/lib/libXfont2-2.0.6.tar.xz";
+      sha256 = "1x5f4w6f94dq9hfcd11xzzjqbz30yn2hdrnmv1b3zyxhgq0j1jkl";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1118,11 +1118,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXft = callPackage ({ stdenv, pkg-config, fetchurl, fontconfig, freetype, libX11, xorgproto, libXrender }: stdenv.mkDerivation {
    pname = "libXft";
-    version = "2.3.6";
+    version = "2.3.8";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXft-2.3.6.tar.xz";
-      sha256 = "08ihq0in7iy5bwrx71nhnlkj7k1ic34brjcqs2wbnf69kwqyg9k0";
+      url = "mirror://xorg/individual/lib/libXft-2.3.8.tar.xz";
+      sha256 = "0jfxqsqhjl2b2ll6b7x21mj02hxp5znkhjvbxw5a9h6lq95kr32y";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1134,11 +1134,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXi = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXfixes }: stdenv.mkDerivation {
    pname = "libXi";
-    version = "1.8";
+    version = "1.8.1";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXi-1.8.tar.bz2";
-      sha256 = "005sicls6faddkcj449858i9xz1nafy70y26frsk7iv1d9283l9f";
+      url = "mirror://xorg/individual/lib/libXi-1.8.1.tar.xz";
+      sha256 = "19snjrsdib2y2iq8c1zbrp78qy1b6sdmyvif422gg27j2klc1gw9";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1150,11 +1150,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXinerama = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto }: stdenv.mkDerivation {
    pname = "libXinerama";
-    version = "1.1.4";
+    version = "1.1.5";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXinerama-1.1.4.tar.bz2";
-      sha256 = "086p0axqj57nvkaqa6r00dnr9kyrn1m8blgf0zjy25zpxkbxn200";
+      url = "mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz";
+      sha256 = "0p08q8q1wg0sixhizl2l1i935bk6x3ckj3bdd6qqr0n1zkqd352h";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1166,11 +1166,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXmu = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXt }: stdenv.mkDerivation {
    pname = "libXmu";
-    version = "1.1.3";
+    version = "1.1.4";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXmu-1.1.3.tar.bz2";
-      sha256 = "0cdpqnx6258i4l6qhphvkdiyspysg0i5caqjy820kp63wwjk4d4w";
+      url = "mirror://xorg/individual/lib/libXmu-1.1.4.tar.xz";
+      sha256 = "0i42fng5gizablqziib25ipcwm5830jprl955ibq54rykjmy6391";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1182,11 +1182,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXp = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXau, libXext }: stdenv.mkDerivation {
    pname = "libXp";
-    version = "1.0.3";
+    version = "1.0.4";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXp-1.0.3.tar.bz2";
-      sha256 = "0mwc2jwmq03b1m9ihax5c6gw2ln8rc70zz4fsj3kb7440nchqdkz";
+      url = "mirror://xorg/individual/lib/libXp-1.0.4.tar.xz";
+      sha256 = "197iklxwyd4naryc6mzv0g5qi1dy1apxk9w9k3yshd1ax2wf668z";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1198,11 +1198,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXpm = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto, libXt, gettext }: stdenv.mkDerivation {
    pname = "libXpm";
-    version = "3.5.15";
+    version = "3.5.16";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXpm-3.5.15.tar.xz";
-      sha256 = "1hfivygzrzpq81vg9z2l46pd5nrzm326k6z3cfw6syiibin91fv0";
+      url = "mirror://xorg/individual/lib/libXpm-3.5.16.tar.xz";
+      sha256 = "0lczckznwbzsf5pca487g8bzbqjgj3a96z78cz69pgcxlskmvg76";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1212,29 +1212,29 @@ self: with self; {
  }) {};

  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXpresent = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
+  libXpresent = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXfixes, libXrandr }: stdenv.mkDerivation {
    pname = "libXpresent";
-    version = "1.0.0";
+    version = "1.0.1";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2";
-      sha256 = "12kvvar3ihf6sw49h6ywfdiwmb8i1gh8wasg1zhzp6hs2hay06n1";
+      url = "mirror://xorg/individual/lib/libXpresent-1.0.1.tar.xz";
+      sha256 = "06r34v7z3jb0x7l5ghlc1g82gjjp5ilq5p6j11galv86bagdyr5r";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ xorgproto libX11 ];
+    buildInputs = [ xorgproto libX11 libXext libXfixes libXrandr ];
    meta.platforms = lib.platforms.unix;
  }) {};

  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXrandr = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXrender }: stdenv.mkDerivation {
    pname = "libXrandr";
-    version = "1.5.2";
+    version = "1.5.3";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXrandr-1.5.2.tar.bz2";
-      sha256 = "08z0mqywrm7ij8bxlfrx0d2wy6kladdmkva1nw5k6qix82z0xsla";
+      url = "mirror://xorg/individual/lib/libXrandr-1.5.3.tar.xz";
+      sha256 = "0a5l9q37c9m6gfdchlj43a9j3mw2avfwasfn0ivlkqbq980kjxl9";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1246,11 +1246,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXrender = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
    pname = "libXrender";
-    version = "0.9.10";
+    version = "0.9.11";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXrender-0.9.10.tar.bz2";
-      sha256 = "0j89cnb06g8x79wmmnwzykgkkfdhin9j7hjpvsxwlr3fz1wmjvf0";
+      url = "mirror://xorg/individual/lib/libXrender-0.9.11.tar.xz";
+      sha256 = "096whakny5h16nlwz80z0l2nxigpsarl35mm5xqgzlc37ad7alxw";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1262,11 +1262,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXres = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
    pname = "libXres";
-    version = "1.2.1";
+    version = "1.2.2";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXres-1.2.1.tar.bz2";
-      sha256 = "049b7dk6hx47161hg47ryjrm6pwsp27r5pby05b0wqb1pcggprmn";
+      url = "mirror://xorg/individual/lib/libXres-1.2.2.tar.xz";
+      sha256 = "0pvlzahqd8fcyq10wi7ipbxvgrg93hn0vqsymhw7b6sb93rlcx4s";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1278,11 +1278,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXt = callPackage ({ stdenv, pkg-config, fetchurl, libICE, xorgproto, libSM, libX11 }: stdenv.mkDerivation {
    pname = "libXt";
-    version = "1.2.1";
+    version = "1.3.0";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXt-1.2.1.tar.bz2";
-      sha256 = "0q1x7842r8rcn2m0q4q9f69h4qa097fyizs8brzx5ns62s7w1737";
+      url = "mirror://xorg/individual/lib/libXt-1.3.0.tar.xz";
+      sha256 = "14dz66rp66ar2a5q0fbsnlcqkbd34801pzdxj3f0hzc2vcy0p0jj";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1294,11 +1294,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXtst = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXi }: stdenv.mkDerivation {
    pname = "libXtst";
-    version = "1.2.3";
+    version = "1.2.4";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2";
-      sha256 = "012jpyj7xfm653a9jcfqbzxyywdmwb2b5wr1dwylx14f3f54jma6";
+      url = "mirror://xorg/individual/lib/libXtst-1.2.4.tar.xz";
+      sha256 = "1j1kr90b7vmpqniqd0pd786kn5924q799c5m2kpgzd2lj85z7xc4";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1310,11 +1310,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXv = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
    pname = "libXv";
-    version = "1.0.11";
+    version = "1.0.12";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXv-1.0.11.tar.bz2";
-      sha256 = "125hn06bd3d8y97hm2pbf5j55gg4r2hpd3ifad651i4sr7m16v6j";
+      url = "mirror://xorg/individual/lib/libXv-1.0.12.tar.xz";
+      sha256 = "0j1qqrhbhdi3kqz0am5i1lhs31ql9pbc14z41w0a5xw9yq4zmxxa";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1342,11 +1342,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libXxf86dga = callPackage ({ stdenv, pkg-config, fetchurl, libX11, libXext, xorgproto }: stdenv.mkDerivation {
    pname = "libXxf86dga";
-    version = "1.1.5";
+    version = "1.1.6";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXxf86dga-1.1.5.tar.bz2";
-      sha256 = "00vjvcdlc1sga251jkxn6gkxmx9h5n290ffxxpa40qbca1gvr61b";
+      url = "mirror://xorg/individual/lib/libXxf86dga-1.1.6.tar.xz";
+      sha256 = "03wqsxbgyrdbrhw8fk3fxc9nk8jnwz5537ym2yif73w0g5sl4i5y";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1390,11 +1390,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libdmx = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext }: stdenv.mkDerivation {
    pname = "libdmx";
-    version = "1.1.4";
+    version = "1.1.5";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libdmx-1.1.4.tar.bz2";
-      sha256 = "0hvjfhrcym770cr0zpqajdy3cda30aiwbjzv16iafkqkbl090gr5";
+      url = "mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz";
+      sha256 = "0kzprd1ak3m3042m5hra50nsagswciis9p21ckilyaqbidmf591m";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1406,11 +1406,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libfontenc = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, zlib }: stdenv.mkDerivation {
    pname = "libfontenc";
-    version = "1.1.4";
+    version = "1.1.7";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libfontenc-1.1.4.tar.bz2";
-      sha256 = "0y90170dp8wsidr1dzza0grxr1lfh30ji3b5vkjz4j6x1n0wxz1c";
+      url = "mirror://xorg/individual/lib/libfontenc-1.1.7.tar.xz";
+      sha256 = "1hpy7kvppzy36fl8gbnzbv0cvglpdqk9jpdgvcfma1pfza8nkly0";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1422,11 +1422,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libpciaccess = callPackage ({ stdenv, pkg-config, fetchurl, hwdata, zlib }: stdenv.mkDerivation {
    pname = "libpciaccess";
-    version = "0.16";
+    version = "0.17";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2";
-      sha256 = "12glp4w1kgvmqn89lk19cgr6jccd3awxra4dxisp7pagi06rsk11";
+      url = "mirror://xorg/individual/lib/libpciaccess-0.17.tar.xz";
+      sha256 = "0wsvv5d05maqbidvnavka7n0fnql55m4jix5wwlk14blr6ikna3l";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1455,11 +1455,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libxcb = callPackage ({ stdenv, pkg-config, fetchurl, libxslt, libpthreadstubs, libXau, xcbproto, libXdmcp, python3 }: stdenv.mkDerivation {
    pname = "libxcb";
-    version = "1.14";
+    version = "1.15";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libxcb-1.14.tar.xz";
-      sha256 = "0d2chjgyn5lr9sfhacfvqgnj9l9faz11vn322a06jd6lk3dxcpm5";
+      url = "mirror://xorg/individual/lib/libxcb-1.15.tar.xz";
+      sha256 = "0nd035rf83xf531cnjzsf9ykb5w9rdzz6bbyhi683xkwh57p8f6c";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1487,11 +1487,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libxkbfile = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11 }: stdenv.mkDerivation {
    pname = "libxkbfile";
-    version = "1.1.0";
+    version = "1.1.2";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libxkbfile-1.1.0.tar.bz2";
-      sha256 = "1irq9crvscd3yb8sr802dhvvfr35jdy1n2yz094xplmd42mbv3bm";
+      url = "mirror://xorg/individual/lib/libxkbfile-1.1.2.tar.xz";
+      sha256 = "1ca4crhzc5a2gdkc4r0m92wyirsy5mngnz0430bj02s2mi7pi8xq";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1503,11 +1503,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  libxshmfence = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
    pname = "libxshmfence";
-    version = "1.3";
+    version = "1.3.2";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/libxshmfence-1.3.tar.bz2";
-      sha256 = "1ir0j92mnd1nk37mrv9bz5swnccqldicgszvfsh62jd14q6k115q";
+      url = "mirror://xorg/individual/lib/libxshmfence-1.3.2.tar.xz";
+      sha256 = "0vv0c7rjf6nd1afbal4c4ralallarak1v3ss3gcjdca0pibz43c7";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1567,11 +1567,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  makedepend = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto }: stdenv.mkDerivation {
    pname = "makedepend";
-    version = "1.0.6";
+    version = "1.0.8";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2";
-      sha256 = "072h9nzh8s5vqfz35dli4fba36fnr219asjrb7p89n8ph0paan6m";
+      url = "mirror://xorg/individual/util/makedepend-1.0.8.tar.xz";
+      sha256 = "0nxs5ibrghym3msbnh0b8i3yd3xgqandmrkc500jm6qq4n06zcmz";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1695,11 +1695,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  utilmacros = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
    pname = "util-macros";
-    version = "1.19.3";
+    version = "1.20.0";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/util/util-macros-1.19.3.tar.bz2";
-      sha256 = "0w8ryfqylprz37zj9grl4jzdsqq67ibfwq5raj7vm1i7kmp2x08g";
+      url = "mirror://xorg/individual/util/util-macros-1.20.0.tar.xz";
+      sha256 = "1nrh8kmbix5pspva6y7h14fj97xdvxqc6fr3zysfswg9vdib51hb";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1775,11 +1775,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xbitmaps = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
    pname = "xbitmaps";
-    version = "1.1.2";
+    version = "1.1.3";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/data/xbitmaps-1.1.2.tar.bz2";
-      sha256 = "1vh73sc13s7w5r6gnc6irca56s7998bja7wgdivkfn8jccawgw5r";
+      url = "mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz";
+      sha256 = "0yhgrllia3lbqx9b21w31w4sppx1a9ggrk62hrys2ckqi1aasv5d";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1807,11 +1807,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xcbproto = callPackage ({ stdenv, pkg-config, fetchurl, python3 }: stdenv.mkDerivation {
    pname = "xcb-proto";
-    version = "1.14.1";
+    version = "1.15.2";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz";
-      sha256 = "1hzwazgyywd9mz4mjj1yv8ski27qqx7ypmyr27m39hrajyddsjph";
+      url = "mirror://xorg/individual/proto/xcb-proto-1.15.2.tar.xz";
+      sha256 = "1vak6q53abwxnkfn6by7j24m48kd2iy7jnskkqzzx8l0ysqvwwkh";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1839,11 +1839,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xcbutilcursor = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xcbutilimage, xcbutilrenderutil, xorgproto, m4 }: stdenv.mkDerivation {
    pname = "xcb-util-cursor";
-    version = "0.1.3";
+    version = "0.1.4";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/xcb/xcb-util-cursor-0.1.3.tar.bz2";
-      sha256 = "0krr4rcw6r42cncinzvzzdqnmxk3nrgpnadyg2h8k9x10q3hm885";
+      url = "mirror://xorg/individual/xcb/xcb-util-cursor-0.1.4.tar.xz";
+      sha256 = "1yria9h0vqpblkgzqhpygk3rraijd3mmipg0mdhkayxbpj8gxp18";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -2015,11 +2015,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xcursorthemes = callPackage ({ stdenv, pkg-config, fetchurl, libXcursor }: stdenv.mkDerivation {
    pname = "xcursor-themes";
-    version = "1.0.6";
+    version = "1.0.7";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/data/xcursor-themes-1.0.6.tar.bz2";
-      sha256 = "16a96li0s0ggg60v7f6ywxmsrmxdfizcw55ccv7sp4qjfisca7pf";
+      url = "mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz";
+      sha256 = "1j3qfga5llp8g702n7mivvdvfjk7agsgnbglbfh99n13i3sfiflm";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -3133,18 +3133,18 @@ self: with self; {
  }) {};

  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xkeyboardconfig = callPackage ({ stdenv, pkg-config, fetchurl, libX11, xorgproto, python3 }: stdenv.mkDerivation {
+  xkeyboardconfig = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
    pname = "xkeyboard-config";
-    version = "2.33";
+    version = "2.39";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.33.tar.bz2";
-      sha256 = "1g6kn7l0mixw50kgn7d97gwv1990c5rczr2x776q3xywss8dfzv5";
+      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.39.tar.xz";
+      sha256 = "10m6mbjymi7qf30g5yd400kqijdjg7ym9qjzh0bc3c7pxwrzbias";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
-    nativeBuildInputs = [ pkg-config python3 ];
-    buildInputs = [ libX11 xorgproto ];
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ ];
    meta.platforms = lib.platforms.unix;
  }) {};

@@ -3295,11 +3295,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xorgcffiles = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
    pname = "xorg-cf-files";
-    version = "1.0.7";
+    version = "1.0.8";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/util/xorg-cf-files-1.0.7.tar.bz2";
-      sha256 = "0233jyjxjkhlar03vp8l5sm3iq6354izm3crk41h5291pgap39vl";
+      url = "mirror://xorg/individual/util/xorg-cf-files-1.0.8.tar.xz";
+      sha256 = "1f8primgb6qw3zy7plbsj4a1kdhdqb04xpdys520zaygxxfra23l";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -3311,11 +3311,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xorgdocs = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
    pname = "xorg-docs";
-    version = "1.7.1";
+    version = "1.7.2";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2";
-      sha256 = "0jrc4jmb4raqawx0j9jmhgasr0k6sxv0bm2hrxjh9hb26iy6gf14";
+      url = "mirror://xorg/individual/doc/xorg-docs-1.7.2.tar.gz";
+      sha256 = "0xrncq9dkl6h03gfsj89zagi2vkhgvcgy8l6pjjva350d24027hc";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -3327,11 +3327,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xorgproto = callPackage ({ stdenv, pkg-config, fetchurl, libXt, python3 }: stdenv.mkDerivation {
    pname = "xorgproto";
-    version = "2021.5";
+    version = "2023.2";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/proto/xorgproto-2021.5.tar.bz2";
-      sha256 = "05d0kib351qmnlfimaznaw0220fr0ym7fx2gn9h2jqxxilxncbxa";
+      url = "mirror://xorg/individual/proto/xorgproto-2023.2.tar.xz";
+      sha256 = "0b4c27aq25w1fccks49p020avf9jzh75kaq5qwnww51bp1yvq7xn";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -3359,11 +3359,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xorgsgmldoctools = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
    pname = "xorg-sgml-doctools";
-    version = "1.11";
+    version = "1.12";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2";
-      sha256 = "0k5pffyi5bx8dmfn033cyhgd3gf6viqj3x769fqixifwhbgy2777";
+      url = "mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.tar.gz";
+      sha256 = "1nsb8kn6nipc09yv19wdpd94pav6hx7xby0psmmdvnm6wqlh6nlq";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -3519,11 +3519,11 @@ self: with self; {
  # THIS IS A GENERATED FILE.  DO NOT EDIT!
  xtrans = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
    pname = "xtrans";
-    version = "1.4.0";
+    version = "1.5.0";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/lib/xtrans-1.4.0.tar.bz2";
-      sha256 = "0wyp0yc6gi72hwc3kjmvm3vkj9p6s407cb6dxx37jh9wb68l8z1p";
+      url = "mirror://xorg/individual/lib/xtrans-1.5.0.tar.xz";
+      sha256 = "1gdiiw64p279a1x033w7i002myry9v75pwmc1gsdpzbbd41vg90v";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    strictDeps = true;
@@ -1,7 +1,7 @@
 { abiCompat ? null,
  callPackage,
  lib, stdenv, makeWrapper, fetchurl, fetchpatch, fetchFromGitLab, buildPackages,
-  automake, autoconf, libiconv, libtool, intltool,
+  automake, autoconf, libiconv, libtool, intltool, gettext, python3, perl,
  freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
  libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm, netbsd,
  ncompress,
@@ -419,7 +419,11 @@ self: super:
    };
  });

-  xf86inputkeyboard = brokenOnDarwin super.xf86inputkeyboard; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86inputkeyboard.x86_64-darwin
+  xf86inputkeyboard = super.xf86inputkeyboard.overrideAttrs (attrs: {
+    meta = attrs.meta // {
+      platforms = lib.platforms.freebsd ++ lib.platforms.netbsd ++ lib.platforms.openbsd;
+    };
+  });

  xf86inputlibinput = super.xf86inputlibinput.overrideAttrs (attrs: {
    outputs = [ "out" "dev" ];
@@ -538,10 +542,20 @@ self: super:
  });

  xkeyboardconfig = super.xkeyboardconfig.overrideAttrs (attrs: {
-    prePatch = "patchShebangs rules/merge.py";
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [ intltool libxslt ];
-    configureFlags = [ "--with-xkb-rules-symlink=xorg" ];
-
+    prePatch = ''
+      patchShebangs rules/merge.py rules/compat/map-variants.py rules/xml2lst.pl
+    '';
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [
+      meson
+      ninja
+      python3
+      perl
+      libxslt # xsltproc
+      gettext # msgfmt
+    ];
+    mesonFlags = [
+      (lib.mesonBool "xorg-rules-symlinks" true)
+    ];
    # 1: compatibility for X11/xkb location
    # 2: I think pkg-config/ is supposed to be in /lib/
    postInstall = ''
@@ -923,13 +937,6 @@ self: super:
  });

  xorgcffiles = super.xorgcffiles.overrideAttrs (attrs: {
-    patches = [
-      (fetchpatch {
-        name = "add-aarch64-darwin-support.patch";
-        url = "https://gitlab.freedesktop.org/xorg/util/cf/-/commit/8d88c559b177e832b581c8ac0aa383b6cf79e0d0.patch";
-        sha256 = "sha256-wCijdmlUtVgOh9Rp/LJrg1ObYm4OPTke5Xwu0xC0ap4=";
-      })
-    ];
    postInstall = lib.optionalString stdenv.isDarwin ''
      substituteInPlace $out/lib/X11/config/darwin.cf --replace "/usr/bin/" ""
    '';
@@ -1,7 +1,7 @@
 https://invisible-mirror.net/archives/luit/luit-20190106.tgz
 mirror://xorg/individual/xcb/libpthread-stubs-0.4.tar.bz2
 mirror://xorg/individual/xcb/xcb-util-0.4.1.tar.xz
-mirror://xorg/individual/xcb/xcb-util-cursor-0.1.3.tar.bz2
+mirror://xorg/individual/xcb/xcb-util-cursor-0.1.4.tar.xz
 mirror://xorg/individual/xcb/xcb-util-errors-1.0.1.tar.xz
 mirror://xorg/individual/xcb/xcb-util-image-0.4.1.tar.xz
 mirror://xorg/individual/xcb/xcb-util-keysyms-0.4.1.tar.xz
@@ -72,11 +72,11 @@ mirror://xorg/individual/app/xvinfo-1.1.5.tar.xz
 mirror://xorg/individual/app/xwd-1.0.9.tar.xz
 mirror://xorg/individual/app/xwininfo-1.1.6.tar.xz
 mirror://xorg/individual/app/xwud-1.0.6.tar.xz
-mirror://xorg/individual/data/xbitmaps-1.1.2.tar.bz2
-mirror://xorg/individual/data/xcursor-themes-1.0.6.tar.bz2
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.33.tar.bz2
-mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2
-mirror://xorg/individual/doc/xorg-sgml-doctools-1.11.tar.bz2
+mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz
+mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.39.tar.xz
+mirror://xorg/individual/doc/xorg-docs-1.7.2.tar.gz
+mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.tar.gz
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
 mirror://xorg/individual/driver/xf86-input-joystick-1.6.4.tar.xz
 mirror://xorg/individual/driver/xf86-input-keyboard-2.0.0.tar.xz
@@ -167,55 +167,55 @@ mirror://xorg/individual/font/font-util-1.4.0.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 mirror://xorg/individual/lib/libAppleWM-1.4.1.tar.bz2
-mirror://xorg/individual/lib/libdmx-1.1.4.tar.bz2
-mirror://xorg/individual/lib/libfontenc-1.1.4.tar.bz2
-mirror://xorg/individual/lib/libFS-1.0.8.tar.bz2
-mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2
-mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2
-mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
+mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz
+mirror://xorg/individual/lib/libfontenc-1.1.7.tar.xz
+mirror://xorg/individual/lib/libFS-1.0.9.tar.xz
+mirror://xorg/individual/lib/libICE-1.1.1.tar.xz
+mirror://xorg/individual/lib/libpciaccess-0.17.tar.xz
+mirror://xorg/individual/lib/libSM-1.2.4.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libX11-1.8.6.tar.xz
-mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
-mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2
-mirror://xorg/individual/lib/libxcb-1.14.tar.xz
-mirror://xorg/individual/lib/libXcomposite-0.4.5.tar.bz2
-mirror://xorg/individual/lib/libXcursor-1.2.0.tar.bz2
+mirror://xorg/individual/lib/libXau-1.0.11.tar.xz
+mirror://xorg/individual/lib/libXaw-1.0.15.tar.xz
+mirror://xorg/individual/lib/libxcb-1.15.tar.xz
+mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz
+mirror://xorg/individual/lib/libXcursor-1.2.1.tar.xz
 mirror://xorg/individual/lib/libxcvt-0.1.2.tar.xz
-mirror://xorg/individual/lib/libXdamage-1.1.5.tar.bz2
-mirror://xorg/individual/lib/libXdmcp-1.1.3.tar.bz2
-mirror://xorg/individual/lib/libXext-1.3.4.tar.bz2
-mirror://xorg/individual/lib/libXfixes-6.0.0.tar.bz2
+mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz
+mirror://xorg/individual/lib/libXdmcp-1.1.4.tar.xz
+mirror://xorg/individual/lib/libXext-1.3.5.tar.xz
+mirror://xorg/individual/lib/libXfixes-6.0.1.tar.xz
 mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
-mirror://xorg/individual/lib/libXfont2-2.0.5.tar.bz2
-mirror://xorg/individual/lib/libXft-2.3.6.tar.xz
-mirror://xorg/individual/lib/libXi-1.8.tar.bz2
-mirror://xorg/individual/lib/libXinerama-1.1.4.tar.bz2
-mirror://xorg/individual/lib/libxkbfile-1.1.0.tar.bz2
-mirror://xorg/individual/lib/libXmu-1.1.3.tar.bz2
-mirror://xorg/individual/lib/libXp-1.0.3.tar.bz2
-mirror://xorg/individual/lib/libXpm-3.5.15.tar.xz
-mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2
-mirror://xorg/individual/lib/libXrandr-1.5.2.tar.bz2
-mirror://xorg/individual/lib/libXrender-0.9.10.tar.bz2
-mirror://xorg/individual/lib/libXres-1.2.1.tar.bz2
-mirror://xorg/individual/lib/libXScrnSaver-1.2.3.tar.bz2
-mirror://xorg/individual/lib/libxshmfence-1.3.tar.bz2
+mirror://xorg/individual/lib/libXfont2-2.0.6.tar.xz
+mirror://xorg/individual/lib/libXft-2.3.8.tar.xz
+mirror://xorg/individual/lib/libXi-1.8.1.tar.xz
+mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
+mirror://xorg/individual/lib/libxkbfile-1.1.2.tar.xz
+mirror://xorg/individual/lib/libXmu-1.1.4.tar.xz
+mirror://xorg/individual/lib/libXp-1.0.4.tar.xz
+mirror://xorg/individual/lib/libXpm-3.5.16.tar.xz
+mirror://xorg/individual/lib/libXpresent-1.0.1.tar.xz
+mirror://xorg/individual/lib/libXrandr-1.5.3.tar.xz
+mirror://xorg/individual/lib/libXrender-0.9.11.tar.xz
+mirror://xorg/individual/lib/libXres-1.2.2.tar.xz
+mirror://xorg/individual/lib/libXScrnSaver-1.2.4.tar.xz
+mirror://xorg/individual/lib/libxshmfence-1.3.2.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXt-1.2.1.tar.bz2
-mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2
-mirror://xorg/individual/lib/libXv-1.0.11.tar.bz2
+mirror://xorg/individual/lib/libXt-1.3.0.tar.xz
+mirror://xorg/individual/lib/libXtst-1.2.4.tar.xz
+mirror://xorg/individual/lib/libXv-1.0.12.tar.xz
 mirror://xorg/individual/lib/libXvMC-1.0.13.tar.xz
-mirror://xorg/individual/lib/libXxf86dga-1.1.5.tar.bz2
+mirror://xorg/individual/lib/libXxf86dga-1.1.6.tar.xz
 mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.5.tar.xz
-mirror://xorg/individual/lib/xtrans-1.4.0.tar.bz2
-mirror://xorg/individual/proto/xcb-proto-1.14.1.tar.xz
-mirror://xorg/individual/proto/xorgproto-2021.5.tar.bz2
+mirror://xorg/individual/lib/xtrans-1.5.0.tar.xz
+mirror://xorg/individual/proto/xcb-proto-1.15.2.tar.xz
+mirror://xorg/individual/proto/xorgproto-2023.2.tar.xz
 mirror://xorg/individual/util/bdftopcf-1.1.1.tar.xz
 mirror://xorg/individual/util/gccmakedep-1.0.3.tar.bz2
-mirror://xorg/individual/util/imake-1.0.8.tar.bz2
+mirror://xorg/individual/util/imake-1.0.9.tar.xz
 mirror://xorg/individual/util/lndir-1.0.4.tar.xz
-mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2
-mirror://xorg/individual/util/util-macros-1.19.3.tar.bz2
-mirror://xorg/individual/util/xorg-cf-files-1.0.7.tar.bz2
+mirror://xorg/individual/util/makedepend-1.0.8.tar.xz
+mirror://xorg/individual/util/util-macros-1.20.0.tar.xz
+mirror://xorg/individual/util/xorg-cf-files-1.0.8.tar.xz
 mirror://xorg/individual/xserver/xorg-server-21.1.8.tar.xz
@@ -0,0 +1,26 @@
+# Darwin stdenv design goals
+
+There are two more goals worth calling out explicitly:
+
+1. The standard environment should build successfully with sandboxing enabled on Darwin. It is
+   fine if a package requires a `sandboxProfile` to build, but it should not be necessary to
+   disable the sandbox to build the stdenv successfully; and
+2. The output should depend weakly on the bootstrap tools. Historically, Darwin required updating
+   the bootstrap tools prior to updating the version of LLVM used in the standard environment.
+   By not depending on a specific version, the LLVM used on Darwin can be updated simply by
+   bumping the definition of llvmPackages in `all-packages.nix`.
+
+# Updating the stdenv
+
+There are effectively two steps when updating the standard environment:
+
+1. Update the definition of llvmPackages in `all-packages.nix` for Darwin to match the value of
+   llvmPackages.latest in `all-packages.nix`. Timing-wise, this done currently using the spring
+   release of LLVM and once llvmPackages.latest has been updated to match. If the LLVM project
+   has announced a release schedule of patch updates, wait until those are in nixpkgs. Otherwise,
+   the LLVM updates will have to go through staging instead of being merged into master; and
+2. Fix the resulting breakage. Most things break due to additional warnings being turned into
+   errors or additional strictness applied by LLVM. Fixes may come in the form of disabling those
+   new warnings or by fixing the actual source (e.g., with a patch or update upstream). If the
+   fix is trivial (e.g., adding a missing int to an implicit declaration), it is better to fix
+   the problem instead of silencing the warning.
@@ -28,7 +28,7 @@ let
  # the GNU C compiler, and so on.
  stagesLinux = import ./linux args;

-  inherit (import ./darwin args) stagesDarwin;
+  stagesDarwin = import ./darwin args;

  stagesCross = import ./cross args;

@@ -195,16 +195,13 @@ let
  # Musl-based platforms will keep "pie", other platforms will not.
  # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
  # in the nixpkgs manual to inform users about the defaults.
-  defaultHardeningFlags = let
-    # not ready for this by default
-    supportedHardeningFlags' = lib.remove "fortify3" supportedHardeningFlags;
-  in if stdenv.hostPlatform.isMusl &&
+  defaultHardeningFlags = if stdenv.hostPlatform.isMusl &&
      # Except when:
      #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
      #    - static armv7l, where compilation fails.
      !(stdenv.hostPlatform.isAarch && stdenv.hostPlatform.isStatic)
-    then supportedHardeningFlags'
-    else lib.remove "pie" supportedHardeningFlags';
+    then supportedHardeningFlags
+    else lib.remove "pie" supportedHardeningFlags;
  enabledHardeningOptions =
    if builtins.elem "all" hardeningDisable'
    then []
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "graphviz";
-  version = "7.1.0";
+  version = "8.0.5";

  src = fetchFromGitLab {
    owner = "graphviz";
    repo = "graphviz";
    rev = version;
-    hash = "sha256-y91YiBJT45slK266UGfow7MFdrdMXZQm3FYBWs1YuuE=";
+    hash = "sha256-s3AUOLZhehxs2GcDCsq87RVvsDli1NvvQtwI0AyUs4k=";
  };

  nativeBuildInputs = [
@@ -13,11 +13,11 @@ assert guiSupport -> enableMinimal == false;

 stdenv.mkDerivation rec {
  pname = "gnupg";
-  version = "2.4.0";
+  version = "2.4.1";

  src = fetchurl {
    url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    hash = "sha256-HXkVjdAdmSQx3S4/rLif2slxJ/iXhOosthDGAPsMFIM=";
+    hash = "sha256-drceWutEO/2RDOnLyCgbYXyDQWh6+2e65FWHeXK1neg=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -63,12 +63,6 @@ stdenv.mkDerivation rec {
      rm $f
    done
  '' else ''
-    mkdir -p $out/lib/systemd/user
-    for f in doc/examples/systemd-user/*.{service,socket} ; do
-      substitute $f $out/lib/systemd/user/$(basename $f) \
-        --replace /usr/bin $out/bin
-    done
-
    # add gpg2 symlink to make sure git does not break when signing commits
    ln -s $out/bin/gpg $out/bin/gpg2

@@ -20,6 +20,13 @@ stdenv.mkDerivation rec {
  /* If no explicit coreutils is given, use the one from stdenv. */
  buildInputs = [ coreutils ];

+  # Disable stack-related gnulib tests on x86_64-darwin because they have problems running under
+  # Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow fails.
+  postPatch = if (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) then ''
+    sed -i -E 's:test-c-stack2?\.sh::g' gnulib-tests/Makefile.in
+    sed -i -E 's:test-sigsegv-catch-stackoverflow[12]::g' gnulib-tests/Makefile.in
+  '' else null;
+
  configureFlags =
    # "pr" need not be on the PATH as a run-time dep, so we need to tell
    # configure where it is. Covers the cross and native case alike.
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, xmlto, docbook_xml_dtd_412
 , libxslt, docbook_xsl, autoconf, automake, gettext, libiconv, libtool
+, autoreconfHook
 }:

 stdenv.mkDerivation rec {
@@ -21,6 +22,8 @@ stdenv.mkDerivation rec {
      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-text/opensp/files/opensp-1.5.2-c11-using.patch?id=688d9675782dfc162d4e6cff04c668f7516118d0";
      sha256 = "04q14s8qsad0bkjmj067dn831i0r6v7742rafdlnbfm5y249m2q6";
    })
+    # Clang 16 defaults to C++17, which does not allow `register` as a storage class specifier.
+    ./fix-register-storage-class.patch
  ];

  setupHook = ./setup-hook.sh;
@@ -41,7 +44,11 @@ stdenv.mkDerivation rec {
    xmlto
    docbook_xml_dtd_412
    docbook_xsl
-  ] ++ lib.optionals stdenv.isCygwin [ autoconf automake libtool ];
+  ]
+  # Clang 16 fails to build due to inappropriate definitions in the `config.h` generated by the
+  # existing configure scripts. Regenerate them to make sure they detect its features correctly.
+  ++ lib.optional stdenv.cc.isClang autoreconfHook
+  ++ lib.optionals stdenv.isCygwin [ autoconf automake libtool ];

  doCheck = false; # fails

@@ -0,0 +1,11 @@
+--- a/lib/Recognizer.cxx	2005-11-05 04:05:20.000000000 -0500
+++ b/lib/Recognizer.cxx	2023-06-03 11:45:04.497116217 -0400
+@@ -39,7 +39,7 @@
+   }
+   else
+     in->startTokenNoMulticode();
+-  register const Trie *pos = trie_.pointer();
+  const Trie *pos = trie_.pointer();
+   do {
+     pos = pos->next(map_[in->tokenChar(mgr)]);
+   } while (pos->hasNext());
@@ -1,5 +1,5 @@
-{ fetchurl, lib, stdenv, libxml2, libxslt
-, docbook_xml_dtd_45, docbook_xsl, w3m
+{ fetchurl, fetchpatch, lib, stdenv, libxml2, libxslt
+, docbook_xml_dtd_45, docbook_xsl, flex, w3m
 , bash, getopt, makeWrapper }:

 stdenv.mkDerivation rec {
@@ -10,6 +10,20 @@ stdenv.mkDerivation rec {
    sha256 = "0xhj8b2pwp4vhl9y16v3dpxpsakkflfamr191mprzsspg4xdyc0i";
  };

+  # Note: These patches modify `xmlif/xmlif.l`, which requires `flex` to be rerun.
+  patches = [
+    # Fixes implicit `int` on `main`, which is an error with clang 16.
+    (fetchpatch {
+      url = "https://pagure.io/xmlto/c/8e34f087bf410bcc5fe445933d6ad9bae54f24b5.patch";
+      hash = "sha256-z5riDBZBVuFeBcjI++dAl3nTIgOPau4Gag0MJbYt+cc=";
+    })
+    # Fixes implicit `int` on `ifsense`, which is also an error with clang 16.
+    (fetchpatch {
+      url = "https://pagure.io/xmlto/c/1375e2df75530cd198bd16ac3de38e2b0d126276.patch";
+      hash = "sha256-fM6ZdTigrcC9cbXiKu6oa5Hs71mrREockB1wRlw6nDk=";
+    })
+  ];
+
  postPatch = ''
    patchShebangs xmlif/test/run-test

@@ -23,7 +37,7 @@ stdenv.mkDerivation rec {

  # `libxml2' provides `xmllint', needed at build-time and run-time.
  # `libxslt' provides `xsltproc', used by `xmlto' at run-time.
-  nativeBuildInputs = [ makeWrapper getopt ];
+  nativeBuildInputs = [ makeWrapper flex getopt ];
  buildInputs = [ libxml2 libxslt docbook_xml_dtd_45 docbook_xsl ];

  postInstall = ''
@@ -100,7 +100,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
    bintools = self.binutils-unwrapped;
  };

-  cctools = self.cctools-port;
+  cctools = self.cctools-llvm;

  cctools-apple = callPackage ../os-specific/darwin/cctools/apple.nix {
    stdenv = if stdenv.isDarwin then stdenv else pkgs.libcxxStdenv;