Merge branch 'staging' into staging-next

2025-03-03 21:17:21 +01:00
parent e0d664e355 ee1459bc6e
commit bd41ca4bbb
169 changed files with 1234 additions and 4877 deletions
@@ -52,7 +52,7 @@
  soundtouch,
  sratom,
  suil,
-  taglib,
+  taglib_1,
  vamp-plugin-sdk,
  wafHook,
  xjadeo,
@@ -166,7 +166,7 @@ stdenv.mkDerivation rec {
      soundtouch
      sratom
      suil
-      taglib
+      taglib_1
      vamp-plugin-sdk
    ]
    ++ lib.optionals videoSupport [
@@ -11,7 +11,7 @@
  qtbase,
  qtx11extras,
  qttools,
-  taglib,
+  taglib_1,
  fftw,
  glew,
  qjson,
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
      qtx11extras
      qttools
      sqlite
-      taglib
+      taglib_1
      alsa-lib
    ]
    # gst_plugins needed for setup-hooks
@@ -19,7 +19,7 @@
  kxmlgui,
  qtbase,
  phonon,
-  taglib,
+  taglib_1,
  # optional backends
  withCD ? true,
  cdparanoia,
@@ -131,7 +131,7 @@ mkDerivation rec {
    qtbase
    phonon
  ];
-  buildInputs = [ taglib ] ++ runtimeDeps;
+  buildInputs = [ taglib_1 ] ++ runtimeDeps;
  # encoder plugins go to ${out}/lib so they're found by kbuildsycoca5
  cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=$out" ];
  sourceRoot = "${src.name}/src";
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1046";
+  version = "9.1.1122";

  outputs = [
    "out"
@@ -11,7 +11,7 @@ rec {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-bH3p78fWUNQRhluUvqQ5uJ+PxNhz7T7wA/4zxUDH130=";
+    hash = "sha256-Eaxia/FLRCnr8MVDvt+ZUFwIQD5Pqq7SsmWZeQdjuXs=";
  };

  enableParallelBuilding = true;
@@ -39,11 +39,11 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.9";
+    version = "6.9.1";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-YpYEKT3yvoFx7IVr9Pi0+qjkMFrxNgfc4PifdBMoNtY=";
+      hash = "sha256-5XdXfumpep+E08NNU8y4uTVCY9arlkR1JQlPPgpWcnA=";
    };

    format = "other";
@@ -6,7 +6,6 @@
  cmake,
  zlib,
  curl,
-  taglib,
  dbus,
  pkg-config,
  qtbase,
@@ -27,7 +26,6 @@ stdenv.mkDerivation (finalAttrs: {
    qtbase
    zlib
    curl
-    taglib
    dbus
  ];

@@ -70,11 +70,11 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString nixosTestRunner "-for-vm-tests"
    + lib.optionalString toolsOnly "-utils"
    + lib.optionalString userOnly "-user";
-  version = "9.2.0";
+  version = "9.2.2";

  src = fetchurl {
    url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+FnwvGXh9TPQQLvoySvP7O5a8skhpmh8ZS+0TQib2JQ=";
+    hash = "sha256-dS6u63cpI6c9U2sjHgW8wJybH1FpCkGtmXPZAOTsn78=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ]
@@ -198,7 +198,7 @@ def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_
    crate_tree = crate_manifest_path.parent

    eprint(f"Copying to {crate_out_dir}")
-    shutil.copytree(crate_tree, crate_out_dir)
+    shutil.copytree(crate_tree, crate_out_dir, ignore_dangling_symlinks=True)
    crate_out_dir.chmod(0o755)

    with open(crate_manifest_path, "r") as f:
@@ -195,7 +195,7 @@ let
        echo Found crate ${pkg.name} at $crateCargoTOML
        tree=$(dirname $crateCargoTOML)

-        cp -prvL "$tree/" $out
+        ${python3Packages.python.interpreter} -c 'import sys, shutil; shutil.copytree(sys.argv[1], sys.argv[2], ignore_dangling_symlinks=True)' "$tree" "$out"
        chmod u+w $out

        if grep -q workspace "$out/Cargo.toml"; then
@@ -1,7 +1,5 @@
 let
-  # This can be made unconditional once jq is available in the bootstrap tools. If corecrypto is  not removed from
-  # the umbrella framework, linking will fail in stage 1 because it can’t find the tbd.
-  disallowedPackages' = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
+  disallowedPackages = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
 in

 {
@@ -10,13 +8,6 @@ in
  stdenv,
 }:

-let
-  disallowedPackages =
-    if jq == null then
-      lib.filter (p: p.package != "corecrypto") disallowedPackages'
-    else
-      disallowedPackages';
-in
 self: super: {
  # Remove headers and stubs for packages that are available in nixpkgs.
  buildPhase =
@@ -390,18 +390,6 @@
  },
  {
    "package": "openldap",
-    "headers": [
-      "lber.h",
-      "lber_types.h",
-      "ldap.h",
-      "ldap_cdefs.h",
-      "ldap_features.h",
-      "ldap_schema.h",
-      "ldap_utf8.h",
-      "ldif.h",
-      "openldap.h",
-      "slapi-plugin.h"
-    ],
    "libraries": [
      "liblber.*",
      "liblber_r.*",
@@ -36,12 +36,8 @@ let
      (callPackage ./common/passthru-private-frameworks.nix { inherit sdkVersion; })
      (callPackage ./common/passthru-source-release-files.nix { inherit sdkVersion; })
      (callPackage ./common/remove-disallowed-packages.nix { })
+      (callPackage ./common/process-stubs.nix { })
    ]
-    # Only process stubs and convert them to tbd-v4 if jq is available. This can be made unconditional once
-    # the bootstrap tools have jq and llvm-readtapi.
-    ++ lib.optional (jq != null && lib.getName llvm != "bootstrap-stage0-llvm") (
-      callPackage ./common/process-stubs.nix { }
-    )
    # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
    ++ lib.optionals (!enableBootstrap) [
      (callPackage ./common/propagate-inputs.nix { })
@@ -1,7 +1,7 @@
 {
  lib,
-  python3,
-  fetchPypi,
+  python3Packages,
+  fetchFromGitHub,
  groff,
  less,
  nix-update-script,
@@ -10,36 +10,38 @@
 }:

 let
-  self = python3.pkgs.buildPythonApplication rec {
+  self = python3Packages.buildPythonApplication rec {
    pname = "awscli";
    # N.B: if you change this, change botocore and boto3 to a matching version too
    # check e.g. https://github.com/aws/aws-cli/blob/1.33.21/setup.py
-    version = "1.36.40";
+    version = "1.37.21";
    pyproject = true;

-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-4qiPiNwW1cDyY3mv1vJUCX5T6LNMghZOWfQWXbbubfo=";
+    src = fetchFromGitHub {
+      owner = "aws";
+      repo = "aws-cli";
+      tag = version;
+      hash = "sha256-gKRWhOhZjGhPVIG6KgCyDqxuyBGbaS8bHD7vnJ4gA+o=";
    };

    pythonRelaxDeps = [
      # botocore must not be relaxed
-      "colorama"
      "docutils"
      "rsa"
    ];

-    build-system = [
-      python3.pkgs.setuptools
+    build-system = with python3Packages; [
+      setuptools
    ];

-    dependencies = with python3.pkgs; [
+    dependencies = with python3Packages; [
      botocore
-      s3transfer
-      colorama
      docutils
-      rsa
+      s3transfer
      pyyaml
+      colorama
+      rsa
+
      groff
      less
    ];
@@ -59,14 +61,14 @@ let
    installCheckPhase = ''
      runHook preInstallCheck

-      $out/bin/aws --version | grep "${python3.pkgs.botocore.version}"
+      $out/bin/aws --version | grep "${python3Packages.botocore.version}"
      $out/bin/aws --version | grep "${version}"

      runHook postInstallCheck
    '';

    passthru = {
-      python = python3; # for aws_shell
+      python = python3Packages.python; # for aws_shell
      updateScript = nix-update-script {
        extraArgs = [ "--version=skip" ];
      };
@@ -10,7 +10,9 @@
 , curl
 , jq
 , common-updater-scripts
+, cctools
 , darwin
+, rcodesign
 }:

 stdenvNoCC.mkDerivation rec {
@@ -43,8 +45,9 @@ stdenvNoCC.mkDerivation rec {
  postPhases = [ "postPatchelf"];
  postPatchelf =
    lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
-      wrapProgram $out/bin/bun \
-        --prefix DYLD_LIBRARY_PATH : ${lib.makeLibraryPath [ darwin.ICU ]}
+      '${lib.getExe' cctools "${cctools.targetPrefix}install_name_tool"}' $out/bin/bun \
+        -change /usr/lib/libicucore.A.dylib '${lib.getLib darwin.ICU}/lib/libicucore.A.dylib'
+      '${lib.getExe rcodesign}' sign --code-signature-flags linker-signed $out/bin/bun
    ''
    # We currently cannot generate completions for x86_64-darwin because bun requires avx support to run, which is:
    # 1. Not currently supported by the version of Rosetta on our aarch64 builders
@@ -19,7 +19,7 @@
  libmusicbrainz5,

  withTaglib ? true,
-  taglib,
+  taglib_1,
  taglib_extras,
  withHttpStream ? true,
  withReplaygain ? true,
@@ -139,7 +139,7 @@ let
      ];
      enable = withTaglib;
      pkgs = [
-        taglib
+        taglib_1
        taglib_extras
      ];
    }
@@ -9,12 +9,12 @@

 stdenv.mkDerivation rec {
  pname = "checkpolicy";
-  version = "3.7";
+  version = "3.8";
  inherit (libsepol) se_url;

  src = fetchurl {
    url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
-    sha256 = "sha256-/T4ZJUd9SZRtERaThmGvRMH4bw1oFGb9nwLqoGACoH8=";
+    sha256 = "sha256-ZforqKJR1tQvAwZGcU5eLegHrhbgIx3isDuUCq2636U=";
  };

  nativeBuildInputs = [
@@ -53,14 +53,14 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "curl";
-  version = "8.12.0";
+  version = "8.12.1";

  src = fetchurl {
    urls = [
      "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
      "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
    ];
-    hash = "sha256-mkYox2S+axqZCVZ8E+jncQQWCd9DshWPysTgXqcJfl0=";
+    hash = "sha256-A0Hx7ZeibIEauuvTfWK4M5VnkrdgfqPxXQAWE8dt4gI=";
  };

  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "double-conversion";
-  version = "3.3.0";
+  version = "3.3.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "double-conversion";
    rev = "v${version}";
-    sha256 = "sha256-DkMoHHoHwV4p40IINEqEPzKsCa0LHrJAFw2Yftw7zHo=";
+    sha256 = "sha256-M80H+azCzQYa4/gBLWv5GNNhEuHsH7LbJ/ajwmACnrM=";
  };

  nativeBuildInputs = [ cmake ];
@@ -8,7 +8,7 @@
  glib,
  libid3tag,
  id3lib,
-  taglib,
+  taglib_1,
  libvorbis,
  libogg,
  opusfile,
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    glib
    libid3tag
    id3lib
-    taglib
+    taglib_1
    libvorbis
    libogg
    opusfile
@@ -12,26 +12,31 @@

 stdenv.mkDerivation rec {
  pname = "gnupg-pkcs11-scd";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchurl {
-    url = "https://github.com/alonbl/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Kb8p53gPkhxtOhH2COKwSDwbtRDFr6hHMJAkndV8Ukk=";
+    url = "https://github.com/alonbl/gnupg-pkcs11-scd/releases/download/gnupg-pkcs11-scd-${version}/gnupg-pkcs11-scd-${version}.tar.bz2";
+    hash = "sha256-lUeH5WLys9kpQhLDLdDYGizTesolDmaFAC0ok7uVkIc=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
  buildInputs = [
+    libassuan
+    libgcrypt
+    libgpg-error
    pkcs11helper
    openssl
  ];

  configureFlags = [
-    "--with-libgpg-error-prefix=${libgpg-error.dev}"
-    "--with-libassuan-prefix=${libassuan.dev}"
    "--with-libgcrypt-prefix=${libgcrypt.dev}"
  ];

  meta = with lib; {
+    changelog = "https://github.com/alonbl/gnupg-pkcs11-scd/blob/gnupg-pkcs11-scd-${version}/ChangeLog";
    description = "Smart-card daemon to enable the use of PKCS#11 tokens with GnuPG";
    mainProgram = "gnupg-pkcs11-scd";
    longDescription = ''
@@ -4,7 +4,7 @@
  fetchurl,
  intltool,
  pkg-config,
-  gtk2,
+  gtk3,
  gpgme,
  libgpg-error,
  libassuan,
@@ -12,25 +12,29 @@

 stdenv.mkDerivation rec {
  pname = "gpa";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchurl {
    url = "mirror://gnupg/gpa/gpa-${version}.tar.bz2";
-    sha256 = "1cbpc45f8qbdkd62p12s3q2rdq6fa5xdzwmcwd3xrj55bzkspnwm";
+    hash = "sha256-Jqj6W/cFQct0Hwxxt8/ikbHqVuq2jusHqpYs71zfM8w=";
  };

  nativeBuildInputs = [
    intltool
    pkg-config
  ];
+
  buildInputs = [
-    gtk2
+    gtk3
    gpgme
    libgpg-error
    libassuan
  ];

+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
  meta = with lib; {
+    changelog = "https://dev.gnupg.org/source/gpa/browse/master/NEWS;gpa-${version}?view=raw";
    description = "Graphical user interface for the GnuPG";
    homepage = "https://www.gnupg.org/related_software/gpa/";
    license = licenses.gpl3Plus;
@@ -15,10 +15,6 @@
 }:

 let
-  # ld64 uses `#embed` to embed `compile_stubs`, which is only implemented in Clang 19.
-  # This can be done unconditionally once the bootstrap tools have been updated.
-  hasEmbed = lib.versionAtLeast (lib.getVersion stdenv.cc) "19";
-
  # Copy the files from their original sources instead of using patches to reduce the size of the patch set in nixpkgs.
  otherSrcs = {
    # The last version of ld64 to have dyldinfo
@@ -55,31 +51,28 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-CVIyL2J9ISZnI4+r+wp4QtOb3+3Tmz2z2Z7/qeRqHS0=";
  };

-  patches =
-    [
-      # These patches are vendored from https://github.com/reckenrode/ld64/tree/ld64-951.9-nixpkgs.
-      # See their comments for more on what they do.
-      ./patches/0001-Always-use-write-instead-of-mmap.patch
-      ./patches/0003-Inline-missing-definitions-instead-of-using-private-.patch
-      ./patches/0004-Removed-unused-Blob-clone-method.patch
-      ./patches/0005-Use-std-atomics-and-std-mutex-for-portability.patch
-      ./patches/0006-Add-Meson-build-system.patch
-      ./patches/0007-Add-CrashReporterClient-header.patch
-      ./patches/0008-Provide-mach-compatibility-headers-based-on-LLVM-s-h.patch
-      ./patches/0009-Support-LTO-in-nixpkgs.patch
-      ./patches/0010-Add-vendored-libtapi-to-the-ld64-build.patch
-      ./patches/0011-Modify-vendored-libtapi-to-build-with-upstream-LLVM.patch
-      ./patches/0012-Move-libcodedirectory-to-its-own-subproject.patch
-      ./patches/0013-Set-the-version-string-in-the-build.patch
-      ./patches/0014-Replace-corecrypto-and-CommonCrypto-with-OpenSSL.patch
-      ./patches/0015-Add-libcd_is_blob_a_linker_signature-implementation.patch
-      ./patches/0016-Add-dyldinfo-to-the-ld64-build.patch
-      ./patches/0017-Fix-dyldinfo-build.patch
-      ./patches/0018-Use-STL-containers-instead-of-LLVM-containers.patch
-    ]
-    ++ lib.optionals (hasEmbed) [
-      ./patches/0002-Add-compile_stubs.h-using-Clang-s-embed-extension-fo.patch
-    ];
+  patches = [
+    # These patches are vendored from https://github.com/reckenrode/ld64/tree/ld64-951.9-nixpkgs.
+    # See their comments for more on what they do.
+    ./patches/0001-Always-use-write-instead-of-mmap.patch
+    ./patches/0002-Add-compile_stubs.h-using-Clang-s-embed-extension-fo.patch
+    ./patches/0003-Inline-missing-definitions-instead-of-using-private-.patch
+    ./patches/0004-Removed-unused-Blob-clone-method.patch
+    ./patches/0005-Use-std-atomics-and-std-mutex-for-portability.patch
+    ./patches/0006-Add-Meson-build-system.patch
+    ./patches/0007-Add-CrashReporterClient-header.patch
+    ./patches/0008-Provide-mach-compatibility-headers-based-on-LLVM-s-h.patch
+    ./patches/0009-Support-LTO-in-nixpkgs.patch
+    ./patches/0010-Add-vendored-libtapi-to-the-ld64-build.patch
+    ./patches/0011-Modify-vendored-libtapi-to-build-with-upstream-LLVM.patch
+    ./patches/0012-Move-libcodedirectory-to-its-own-subproject.patch
+    ./patches/0013-Set-the-version-string-in-the-build.patch
+    ./patches/0014-Replace-corecrypto-and-CommonCrypto-with-OpenSSL.patch
+    ./patches/0015-Add-libcd_is_blob_a_linker_signature-implementation.patch
+    ./patches/0016-Add-dyldinfo-to-the-ld64-build.patch
+    ./patches/0017-Fix-dyldinfo-build.patch
+    ./patches/0018-Use-STL-containers-instead-of-LLVM-containers.patch
+  ];

  prePatch = ''
    # Copy dyldinfo source files
@@ -106,16 +99,6 @@ stdenv.mkDerivation (finalAttrs: {
    done
  '';

-  # Clang 16 doesn’t support C23, but the patchset expects a compiler that supports it. Only `#embed` is used, so stub
-  # out its usage and request an older C standard version. This can be dropped once the bootstrap tools are updated.
-  postPatch = lib.optionalString (!hasEmbed) ''
-    for meson_build in meson.build subprojects/libcodedirectory/meson.build subprojects/libtapi/meson.build; do
-      substituteInPlace $meson_build --replace-fail c23 c2x
-    done
-    echo '#pragma once' > src/ld/compile_stubs.h
-    echo 'static const char compile_stubs[] = "";' >> src/ld/compile_stubs.h
-  '';
-
  xcodeHash = "sha256-qip/1eiGn8PdLThonhPq3oq2veN4E1zOiamDPBfTeNE=";
  xcodeProject = "ld64.xcodeproj";

@@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "libassuan";
-  version = "2.5.7";
+  version = "3.0.2";

  src = fetchurl {
-    url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-AQMIH/wng4ouUEeRU8oQXoc9PWXYqVkygunJTH5q+3Y=";
+    url = "mirror://gnupg/libassuan/libassuan-${version}.tar.bz2";
+    hash = "sha256-0pMc2tJm5jNRD5lw4aLzRgVeNRuxn5t4kSR1uAdMNvY=";
  };

  outputs = [
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
    ignoredVersions = ".*-base";
  };

-  meta = with lib; {
+  meta = {
    description = "IPC library used by GnuPG and related software";
    mainProgram = "libassuan-config";
    longDescription = ''
@@ -60,8 +60,8 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://gnupg.org/software/libassuan/";
    changelog = "https://dev.gnupg.org/source/libassuan/browse/master/NEWS;libassuan-${version}";
-    license = licenses.lgpl2Plus;
-    platforms = platforms.all;
+    license = lib.licenses.lgpl2Plus;
+    platforms = lib.platforms.all;
    maintainers = [ ];
  };
 }
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  buildPackages,
  pcre2,
  pkg-config,
@@ -19,7 +18,7 @@ assert enablePython -> swig != null && python3 != null;
 stdenv.mkDerivation (
  rec {
    pname = "libselinux";
-    version = "3.7";
+    version = "3.8";
    inherit (libsepol) se_url;

    outputs = [
@@ -31,7 +30,7 @@ stdenv.mkDerivation (

    src = fetchurl {
      url = "${se_url}/${version}/libselinux-${version}.tar.gz";
-      hash = "sha256-6gP0LROk+VdXmX26jPCyYyH6xdLxZEGLTMhWqS0rF70=";
+      hash = "sha256-DDdWvKBHyScCgdfE3N7NAAty44oYPJMGYeupaQg5tUE=";
    };

    patches = [
@@ -45,8 +44,8 @@ stdenv.mkDerivation (
      # This is a static email, so we shouldn't have to worry about
      # normalizing the patch.
      (fetchurl {
-        url = "https://lore.kernel.org/selinux/20211113141616.361640-1-hi@alyssa.is/raw";
-        hash = "sha256-dqxiupaJK4o00YERGWGIEIhM7sPelxBFQomAFKXQQpk=";
+        url = "https://lore.kernel.org/selinux/20250211211651.1297357-3-hi@alyssa.is/raw";
+        hash = "sha256-a0wTSItj5vs8GhIkfD1OPSjGmAJlK1orptSE7T3Hx20=";
        postFetch = ''
          mv "$out" $TMPDIR/patch
          ${buildPackages.patchutils_0_3_3}/bin/filterdiff \
@@ -58,13 +57,6 @@ stdenv.mkDerivation (
        url = "https://git.yoctoproject.org/meta-selinux/plain/recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch?id=62b9c816a5000dc01b28e78213bde26b58cbca9d";
        hash = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
      })
-
-      # libselinux: fix swig bindings for 4.3.0
-      (fetchpatch {
-        url = "https://github.com/SELinuxProject/selinux/commit/8e0e718bae53fff30831b92cd784151d475a20da.patch";
-        stripLen = 1;
-        hash = "sha256-8Nd6ketQ7/r5W0sRdheqyGWHJRZ1RfGC4ehTqnHau04=";
-      })
    ];

    nativeBuildInputs =
@@ -7,7 +7,7 @@
  ffmpeg,
  libebur128,
  libresample,
-  taglib,
+  taglib_1,
  zlib,
 }:

@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    ffmpeg
    libebur128
    libresample
-    taglib
+    taglib_1
    zlib
  ];

@@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "lzip";
-  version = "1.24.1";
+  version = "1.25";
  outputs = [
    "out"
    "man"
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://savannah/lzip/${pname}-${version}.tar.gz";
-    hash = "sha256-MMnLagYF9HnElsN262KaSLChaW0WfjweCQxd76SBsWI=";
+    hash = "sha256-CUGKbY+4P1ET9b2FbglwPfXTe64DCMZo0PNG49PwpW8=";
  };

  patches = lib.optionals stdenv.hostPlatform.isMinGW [
@@ -1,30 +0,0 @@
-diff --git a/mesonbuild/compilers/mixins/clang.py b/mesonbuild/compilers/mixins/clang.py
-index d99dc3abf..6b8f75165 100644
--- a/mesonbuild/compilers/mixins/clang.py
-+++ b/mesonbuild/compilers/mixins/clang.py
-@@ -54,11 +54,7 @@ class ClangCompiler(GnuLikeCompiler):
-             {OptionKey('b_colorout'), OptionKey('b_lto_threads'), OptionKey('b_lto_mode'), OptionKey('b_thinlto_cache'),
-              OptionKey('b_thinlto_cache_dir')})
- 
-        # TODO: this really should be part of the linker base_options, but
-        # linkers don't have base_options.
-        if isinstance(self.linker, AppleDynamicLinker):
-            self.base_options.add(OptionKey('b_bitcode'))
-        elif isinstance(self.linker, MSVCDynamicLinker):
-+        if isinstance(self.linker, MSVCDynamicLinker):
-             self.base_options.add(OptionKey('b_vscrt'))
-         # All Clang backends can also do LLVM IR
-         self.can_compile_suffixes.add('ll')
-diff --git a/mesonbuild/linkers/linkers.py b/mesonbuild/linkers/linkers.py
-index 4eec82edd..6db5c6af0 100644
--- a/mesonbuild/linkers/linkers.py
-+++ b/mesonbuild/linkers/linkers.py
-@@ -796,7 +796,7 @@ class AppleDynamicLinker(PosixDynamicLinkerMixin, DynamicLinker):
-         return self._apply_prefix('-headerpad_max_install_names')
- 
-     def bitcode_args(self) -> T.List[str]:
-        return self._apply_prefix('-bitcode_bundle')
-+        raise MesonException('Nixpkgs cctools does not support bitcode bundles')
- 
-     def fatal_warnings(self) -> T.List[str]:
-         return self._apply_prefix('-fatal_warnings')
@@ -4,11 +4,8 @@
  fetchFromGitHub,
  installShellFiles,
  coreutils,
-  darwin,
  libblocksruntime,
  llvmPackages,
-  libxcrypt,
-  openldap,
  ninja,
  pkg-config,
  python3,
@@ -16,16 +13,6 @@
  zlib,
 }:

-let
-  inherit (darwin.apple_sdk.frameworks)
-    AppKit
-    Cocoa
-    Foundation
-    LDAP
-    OpenAL
-    OpenGL
-    ;
-in
 python3.pkgs.buildPythonApplication rec {
  pname = "meson";
  version = "1.7.0";
@@ -75,17 +62,10 @@ python3.pkgs.buildPythonApplication rec {
    # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
    ./005-boost-Do-not-add-system-paths-on-nix.patch

-    # Nixpkgs cctools does not have bitcode support.
-    ./006-disable-bitcode.patch
-
    # This edge case is explicitly part of meson but is wrong for nix
    ./007-freebsd-pkgconfig-path.patch
  ];

-  buildInputs = lib.optionals (python3.pythonOlder "3.9") [
-    libxcrypt
-  ];
-
  nativeBuildInputs = [ installShellFiles ];

  nativeCheckInputs = [
@@ -97,15 +77,6 @@ python3.pkgs.buildPythonApplication rec {
    [
      zlib
    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
-      Foundation
-      LDAP
-      OpenAL
-      OpenGL
-      openldap
-    ]
    ++ lib.optionals (stdenv.cc.isClang && !stdenv.hostPlatform.isDarwin) [
      # https://github.com/mesonbuild/meson/blob/bd3f1b2e0e70ef16dfa4f441686003212440a09b/test%20cases/common/184%20openmp/meson.build
      llvmPackages.openmp
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openh264";
-  version = "2.5.0";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "cisco";
    repo = "openh264";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-K8p94P4XO6bUWCJuT6jR5Kmz3lamNDyclGWgsV6Lf9I=";
+    hash = "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=";
  };

  outputs = [
@@ -26,10 +26,6 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
  ];

-  postPatch = ''
-    substituteInPlace meson.build --replace-fail "'-Werror'," ""
-  '';
-
  nativeBuildInputs = [
    meson
    nasm
@@ -11,12 +11,12 @@

 stdenv.mkDerivation rec {
  pname = "policycoreutils";
-  version = "3.7";
+  version = "3.8";
  inherit (libsepol) se_url;

  src = fetchurl {
    url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
-    hash = "sha256-WP5OSB7ftEVsEUklRC4ROJ3xc5SSWs26PeIRFFzl6pg=";
+    hash = "sha256-LEMLhmKq+zp1clHp2NYuyqvBwkvisqasbofT+giwTiI=";
  };

  postPatch = ''
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "publicsuffix-list";
-  version = "0-unstable-2025-01-16";
+  version = "0-unstable-2025-02-12";

  src = fetchFromGitHub {
    owner = "publicsuffix";
    repo = "list";
-    rev = "4f2d3b20034a6c7a0ad4400716f1e0f752e2c737";
-    hash = "sha256-1U+CS5ER4b/mI9Ox2gJQfEOVeDHBt1C3UbG5sDAs8Mk=";
+    rev = "560007a8aea8267f15cad9abcdbcff7848186bd8";
+    hash = "sha256-/5O0ac0mJZzOgy8h1NE0dTt0jzAEkymBbh5hJmc1+qk=";
  };

  dontBuild = true;
@@ -7,13 +7,13 @@
 }:

 let
-  version = "1.1.392";
+  version = "1.1.394";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "pyright";
    tag = version;
-    hash = "sha256-/Js9w6wxoJLqJxcRkpdwk2i9bR7jw/dtGkUvwxkv/qA=";
+    hash = "sha256-zOJtv9ETolo3XmH+ztNJEmX319rV/CABDIw2crSxqqw=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@@ -44,7 +44,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-xGEX6Dvhhch0PWjO+LDQqTH3IRRfVbQPMXUjbL/KYpE=";
+    npmDepsHash = "sha256-RE1ZwMKgWu686/ejMB0E1CRix8MLv6lNoEkyAkvOC6U=";
    dontNpmBuild = true;
    installPhase = ''
      runHook preInstall
@@ -58,7 +58,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-TK05a3Ys3Q8s/2c2HOjh1EdnL1jFttjdApggeZLQUzw=";
+  npmDepsHash = "sha256-sQeHXfhm6u0at4vhFjGPwMmTdDomU6cJnolOFO6ynXA=";

  postPatch = ''
    chmod +w ../../
@@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "socat";
-  version = "1.8.0.2";
+  version = "1.8.0.3";

  src = fetchurl {
    url = "http://www.dest-unreach.org/socat/download/${pname}-${version}.tar.bz2";
-    hash = "sha256-rcB6nCcjUnz2Vo0vuWVZeUz5wlSkvC7dNvfzeJ6fdiU=";
+    hash = "sha256-AesBc2HZW7OmlB6EC1nkRjo/q/kt9BVO0CsWou1qAJU=";
  };

  postPatch = ''
@@ -6,19 +6,17 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sphinxygen";
-  version = "1.0.4";
+  version = "1.0.10";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "drobilla";
    repo = "sphinxygen";
-    rev = "v${version}";
-    hash = "sha256-TIACg89E/BaMwPgFqj6JUncq7BI5xQ9jUDe4nQ9YiI4=";
+    tag = "v${version}";
+    hash = "sha256-Xii5pDa1eHrHUKERC2gDif/NIkpab/IZYBRvMq9YKtE=";
  };

-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];

  pythonImportsCheck = [ "sphinxygen" ];

@@ -3,33 +3,33 @@
  stdenv,
  fetchFromGitHub,
  cmake,
+  utf8cpp,
  zlib,
  testers,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "taglib";
-  version = "1.13.1";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "taglib";
    repo = "taglib";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-QX0EpHGT36UsgIfRf5iALnwxe0jjLpZvCTbk8vSMFF4=";
+    hash = "sha256-3cJwCo2nUSRYkk8H8dzyg7UswNPhjfhyQ704Fn9yNV8=";
  };

  strictDeps = true;

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ zlib ];
+  buildInputs = [
+    zlib
+    utf8cpp
+  ];

  cmakeFlags = [
    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
-    # Workaround unconditional ${prefix} until upstream is fixed:
-    #   https://github.com/taglib/taglib/issues/1098
-    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
-    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
  ];

  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  zlib,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "taglib";
+  version = "1.13.1";
+
+  src = fetchFromGitHub {
+    owner = "taglib";
+    repo = "taglib";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-QX0EpHGT36UsgIfRf5iALnwxe0jjLpZvCTbk8vSMFF4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ zlib ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    # Workaround unconditional ${prefix} until upstream is fixed:
+    #   https://github.com/taglib/taglib/issues/1098
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
+  ];
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    homepage = "https://taglib.org/";
+    description = "Library for reading and editing audio file metadata";
+    mainProgram = "taglib-config";
+    longDescription = ''
+      TagLib is a library for reading and editing the meta-data of several
+      popular audio formats. Currently it supports both ID3v1 and ID3v2 for MP3
+      files, Ogg Vorbis comments and ID3 tags and Vorbis comments in FLAC, MPC,
+      Speex, WavPack, TrueAudio, WAV, AIFF, MP4 and ASF files.
+    '';
+    license = with lib.licenses; [
+      lgpl21Only
+      mpl11
+    ];
+    maintainers = with lib.maintainers; [ ttuegel ];
+    pkgConfigModules = [
+      "taglib"
+      "taglib_c"
+    ];
+    platforms = lib.platforms.all;
+  };
+})
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchpatch,
  cmake,
  taglib,
  zlib,
@@ -11,9 +12,18 @@ stdenv.mkDerivation rec {
  pname = "taglib-extras";
  version = "1.0.1";
  src = fetchurl {
-    url = "https://ftp.rz.uni-wuerzburg.de/pub/unix/kde/taglib-extras/${version}/src/${pname}-${version}.tar.gz";
+    url = "https://download.kde.org/stable/taglib-extras/${version}/src/taglib-extras-${version}.tar.gz";
    sha256 = "0cln49ws9svvvals5fzxjxlzqm0fzjfymn7yfp4jfcjz655nnm7y";
  };
+
+  patches = [
+    (fetchurl {
+      name = "2001-taglib-extras-Fix-taglib-2.x-compat.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/taglib-2.0.diff?h=taglib-extras&id=5826657b841b138c501e0633d1c9333fe9197b00";
+      hash = "sha256-yhme2KcIS5SPXz+mx/R2OiLV57WHz6WW8LJtYab4h5I=";
+    })
+  ];
+
  buildInputs = [ taglib ];
  nativeBuildInputs = [
    cmake
@@ -81,7 +81,7 @@
  srt,
  stdenv,
  systemd,
-  taglib,
+  taglib_1,
  unzip,
  wayland,
  wayland-protocols,
@@ -194,7 +194,7 @@ stdenv.mkDerivation (finalAttrs: {
      speex
      srt
      systemd
-      taglib
+      taglib_1
      xcbutilkeysyms
      wayland-scanner # only required for configure script
      zlib
@@ -1,20 +1,21 @@
-{ stdenv
-, lib
-, fetchFromGitLab
-, nasm
-, enableShared ? !stdenv.hostPlatform.isStatic
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  nasm,
+  enableShared ? !stdenv.hostPlatform.isStatic,
 }:

 stdenv.mkDerivation rec {
  pname = "x264";
-  version = "0-unstable-2023-10-01";
+  version = "0-unstable-2025-01-03";

  src = fetchFromGitLab {
    domain = "code.videolan.org";
    owner = "videolan";
    repo = pname;
-    rev = "31e19f92f00c7003fa115047ce50978bc98c3a0d";
-    hash = "sha256-7/FaaDFmoVhg82BIhP3RbFq4iKGNnhviOPxl3/8PWCM=";
+    rev = "373697b467f7cd0af88f1e9e32d4f10540df4687";
+    hash = "sha256-WWtS/UfKA4i1yakHErUnyT/3/+Wy2H5F0U0CmxW4ick=";
  };

  patches = [
@@ -29,18 +30,27 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  outputs = [ "out" "lib" "dev" ];
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];

-  preConfigure = lib.optionalString stdenv.hostPlatform.isx86 ''
-    # `AS' is set to the binutils assembler, but we need nasm
-    unset AS
-  '' + lib.optionalString stdenv.hostPlatform.isAarch ''
-    export AS=$CC
-  '';
+  preConfigure =
+    lib.optionalString stdenv.hostPlatform.isx86 ''
+      # `AS' is set to the binutils assembler, but we need nasm
+      unset AS
+    ''
+    + lib.optionalString stdenv.hostPlatform.isAarch ''
+      export AS=$CC
+    '';

-  configureFlags = lib.optional enableShared "--enable-shared"
+  configureFlags =
+    lib.optional enableShared "--enable-shared"
    ++ lib.optional (!stdenv.hostPlatform.isi686) "--enable-pic"
-    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "--cross-prefix=${stdenv.cc.targetPrefix}";
+    ++ lib.optional (
+      stdenv.buildPlatform != stdenv.hostPlatform
+    ) "--cross-prefix=${stdenv.cc.targetPrefix}";

  makeFlags = [
    "BASHCOMPLETIONSDIR=$(out)/share/bash-completion/completions"
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  autoreconfHook,
  pcre,
  pkg-config,
@@ -21,23 +20,15 @@

 stdenv.mkDerivation rec {
  pname = "yara";
-  version = "4.5.0";
+  version = "4.5.2";

  src = fetchFromGitHub {
    owner = "VirusTotal";
    repo = "yara";
    tag = "v${version}";
-    hash = "sha256-AecHsUBtBleUkWuYMQ4Tx/PY8cs9j7JwqncBziJD0hA=";
+    hash = "sha256-ryRbLXnhC7nAxtlhr4bARxmNdtPhpvGKwlOiYPYPXOE=";
  };

-  patches = [
-    (fetchpatch {
-      name = "LFS64.patch";
-      url = "https://github.com/VirusTotal/yara/commit/833a580430abe0fbc9bc17a21fb95bf36dacf367.patch";
-      hash = "sha256-EmwyDsxaNd9zfpAOu6ZB9kzg04qB7LAD7UJB3eAuKd8=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
@@ -12,7 +12,7 @@
  ffmpeg_6,
  libvlc,
  qt6Packages,
-  taglib,
+  taglib_1,
  SDL2,
  gst_all_1,
 }:
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
      qt6Packages.qtmultimedia
      ffmpeg_6
      libvlc
-      taglib
+      taglib_1
      SDL2
    ]
    ++ (with gst_all_1; [
@@ -11,7 +11,7 @@
  deepin-pdfium,
  qt5integration,
  qt5platform-plugins,
-  taglib,
+  taglib_1,
  ffmpeg,
  ffmpegthumbnailer,
  pcre,
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    deepin-pdfium
    qt5integration
    qt5platform-plugins
-    taglib
+    taglib_1
    ffmpeg
    ffmpegthumbnailer
    pcre
@@ -2,6 +2,7 @@
  stdenv,
  lib,
  fetchFromGitLab,
+  fetchpatch,
  gitUpdater,
  nixosTests,
  testers,
@@ -48,6 +49,14 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  patches = [
+    # Fix compat with taglib 2.x
+    # Remove when version > 3.0.4
+    (fetchpatch {
+      name = "0001-lomiri-thumbnailer-Fix-taglib-2.x-compat.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-thumbnailer/-/commit/b7f1055e36cd6e33314bb9f6648f93e977a33267.patch";
+      hash = "sha256-9RHtxqsgdMkgIyswaeL5yS6+o/YvzT+HgRD8KL/RfNM=";
+    })
+
    # Remove when https://gitlab.com/ubports/development/core/lomiri-thumbnailer/-/merge_requests/23 merged & in release
    ./1001-doc-liblomiri-thumbnailer-qt-Honour-CMAKE_INSTALL_DO.patch
    ./1002-Re-enable-documentation.patch
@@ -52,6 +52,14 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://gitlab.com/ubports/development/core/mediascanner2/-/commit/1e65b32e32a0536b9e2f283ba563fa78b6ef6d61.patch";
      hash = "sha256-Xhm5+/E/pP+mn+4enqdsor1oRqfYTzabg1ODVfIhra4=";
    })
+
+    # Fix taglib 2.x compat
+    # Remove when version > 0.117
+    (fetchpatch {
+      name = "0002-mediascanner2-Fix-taglib-2.x-compat.patch";
+      url = "https://gitlab.com/ubports/development/core/mediascanner2/-/commit/0ce744ecb32abb39516d1b9f98d47c3e86690158.patch";
+      hash = "sha256-hz/EB83yNoxhxkEcg7ZMezknpKajhH1BNkYD3wrf/eY=";
+    })
  ];

  postPatch = ''
@@ -188,10 +188,10 @@ in
    old: (addToBuildInputs [ pkgs.ncurses pkgs.stfl ] old) // (addToCscOptions "-L -lncurses" old);
  taglib =
    old:
-    (addToBuildInputs [ pkgs.zlib pkgs.taglib ] old)
+    (addToBuildInputs [ pkgs.zlib pkgs.taglib_1 ] old)
    // (
      # needed for tablib-config to be in PATH
-      addToNativeBuildInputs pkgs.taglib old
+      addToNativeBuildInputs pkgs.taglib_1 old
    );
  uuid-lib = addToBuildInputs pkgs.libuuid;
  webview = addToBuildInputsWithPkgConfig pkgs.webkitgtk_4_0;
@@ -3,13 +3,16 @@
  stdenv,
  enableMultilib,
  targetConfig,
-  withoutTargetLibc,
 }:

 let
  forceLibgccToBuildCrtStuff = import ./libgcc-buildstuff.nix { inherit lib stdenv; };
+  isCross = with stdenv; targetPlatform.config != hostPlatform.config;
 in

+# We don't support multilib and cross at the same time
+assert !(enableMultilib && isCross);
+
 originalAttrs:
 (stdenv.mkDerivation (
  finalAttrs:
@@ -210,64 +213,94 @@ originalAttrs:
    '';

    preInstall =
+      # What follows is a horribly cursed hack.
+      #
+      # GCC will install its libraries to $out/lib, $out/lib32, $out/lib64,
+      # $out/$targetConfig/lib, $out/$targetConfig/lib32 or $out/$targetConfig/lib64,
+      # depending on whether it's built as native or cross, and the exact target spec.
+      #
+      # We can't predict what it's actually going to do, and we also can't just tell it
+      # to always install to lib, but we want everything to end up in lib
+      # for consistency (multilib weirdness aside).
+      #
+      # So, we create a bunch of symlinks before we run GCC's install phase,
+      # redirecting every possible directory it may want to write to to the place
+      # we actually want things to be installed.
+      # We will then nuke the symlinks in postInstall.
+      #
+      # FIXME: there must be a better way to do this.
      ''
-        mkdir -p "$out/''${targetConfig}/lib"
-        mkdir -p "''${!outputLib}/''${targetConfig}/lib"
+        declare -ga compatibilitySymlinks=()
+
+        makeCompatibilitySymlink() {
+          declare -a outputsToLink=("$out")
+
+          if [ -n "$lib" ]; then
+            outputsToLink+=("$lib")
+          fi
+
+          for output in "''${outputsToLink[@]}"; do
+            local linkTarget="$1"
+            local linkName="$output/$2"
+
+            echo "Creating compatibility symlink: $linkTarget -> $linkName"
+
+            mkdir -p "$(dirname "$linkName")"
+            ln -s "$linkTarget" "$linkName"
+            compatibilitySymlinks+=("$linkName")
+          done
+        }
      ''
      +
-        # if cross-compiling, link from $lib/lib to $lib/${targetConfig}.
-        # since native-compiles have $lib/lib as a directory (not a
-        # symlink), this ensures that in every case we can assume that
-        # $lib/lib contains the .so files
-        lib.optionalString (with stdenv; targetPlatform.config != hostPlatform.config) ''
-          ln -Ts "''${!outputLib}/''${targetConfig}/lib" $lib/lib
+        # This will redirect $output/lib{32,64} to $output/lib.
+        # Multilib is special, because it creates $out/lib (for 32-bit)
+        # and $out/lib64 (for 64-bit). No other targets can have both.
+        lib.optionalString (!enableMultilib) ''
+          makeCompatibilitySymlink lib lib32
+          makeCompatibilitySymlink lib lib64
        ''
      +
-        # Make `lib64` symlinks to `lib`.
-        lib.optionalString
-          (!enableMultilib && stdenv.hostPlatform.is64bit && !stdenv.hostPlatform.isMips64n32)
-          ''
-            ln -s lib "$out/''${targetConfig}/lib64"
-            ln -s lib "''${!outputLib}/''${targetConfig}/lib64"
-          ''
-      +
-        # On mips platforms, gcc follows the IRIX naming convention:
-        #
-        #  $PREFIX/lib   = mips32
-        #  $PREFIX/lib32 = mips64n32
-        #  $PREFIX/lib64 = mips64
-        #
-        # Make `lib32` symlinks to `lib`.
-        lib.optionalString (!enableMultilib && stdenv.targetPlatform.isMips64n32) ''
-          ln -s lib "$out/''${targetConfig}/lib32"
-          ln -s lib "''${!outputLib}/''${targetConfig}/lib32"
+        # This will redirect $output/$targetConfig/lib{,32,64} to $output/$targetConfig/lib.
+        lib.optionalString isCross ''
+          makeCompatibilitySymlink lib $targetConfig/lib32
+          makeCompatibilitySymlink lib $targetConfig/lib64
        '';

    postInstall = ''
-      # Move runtime libraries to lib output.
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.so*" "''${!outputLib}"
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.la"  "''${!outputLib}"
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dylib" "''${!outputLib}"
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dll.a" "''${!outputLib}"
-      moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dll" "''${!outputLib}"
+      # Clean up our compatibility symlinks (see above)
+      for link in "''${compatibilitySymlinks[@]}"; do
+        echo "Removing compatibility symlink: $link"
+        rm -f "$link"
+      done
+
+      # Move target runtime libraries to lib output.
+      # For non-cross, they're in $out/lib; for cross, they're in $out/$targetConfig/lib.
+      targetLibDir="''${targetConfig+$targetConfig/}lib"
+
+      moveToOutput "$targetLibDir/lib*.so*" "''${!outputLib}"
+      moveToOutput "$targetLibDir/lib*.la"  "''${!outputLib}"
+      moveToOutput "$targetLibDir/lib*.dylib" "''${!outputLib}"
+      moveToOutput "$targetLibDir/lib*.dll.a" "''${!outputLib}"
+      moveToOutput "$targetLibDir/lib*.dll" "''${!outputLib}"
      moveToOutput "share/gcc-*/python" "''${!outputLib}"

      if [ -z "$enableShared" ]; then
-          moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.a" "''${!outputLib}"
+          moveToOutput "$targetLibDir/lib*.a" "''${!outputLib}"
      fi

-      for i in "''${!outputLib}/''${targetConfig}"/lib/*.{la,py}; do
+      for i in "''${!outputLib}"/$targetLibDir/*.{la,py}; do
          substituteInPlace "$i" --replace "$out" "''${!outputLib}"
      done

+      # Multilib and cross can't exist at the same time, so just use lib64 here
      if [ -n "$enableMultilib" ]; then
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.so*" "''${!outputLib}"
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.la"  "''${!outputLib}"
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dylib" "''${!outputLib}"
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dll.a" "''${!outputLib}"
-          moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dll" "''${!outputLib}"
+          moveToOutput "lib64/lib*.so*" "''${!outputLib}"
+          moveToOutput "lib64/lib*.la"  "''${!outputLib}"
+          moveToOutput "lib64/lib*.dylib" "''${!outputLib}"
+          moveToOutput "lib64/lib*.dll.a" "''${!outputLib}"
+          moveToOutput "lib64/lib*.dll" "''${!outputLib}"

-          for i in "''${!outputLib}/''${targetConfig}"/lib64/*.{la,py}; do
+          for i in "''${!outputLib}"/lib64/*.{la,py}; do
              substituteInPlace "$i" --replace "$out" "''${!outputLib}"
          done
      fi
@@ -313,9 +346,15 @@ originalAttrs:
              ln -sf "$man_prefix"gcc.1 "$i"
          fi
      done
+    ''
+    # if cross-compiling, link from $lib/lib to $lib/${targetConfig}.
+    # since native-compiles have $lib/lib as a directory (not a
+    # symlink), this ensures that in every case we can assume that
+    # $lib/lib contains the .so files
+    + lib.optionalString isCross ''
+      if [ -e "$lib/$targetConfig/lib" ]; then
+        ln -s "$lib/$targetConfig/lib" "$lib/lib"
+      fi
    '';
  }
-  // lib.optionalAttrs ((stdenv.targetPlatform.config != stdenv.hostPlatform.config) && withoutTargetLibc) {
-    dontCheckForBrokenSymlinks = true;
-  }
 ))
@@ -391,13 +391,5 @@ pipe ((callFile ./common/builder.nix {}) ({
  (callPackage ./common/libgcc.nix   { inherit version langC langCC langJit targetPlatform hostPlatform withoutTargetLibc enableShared libcCross; })
 ] ++ optionals atLeast11 [
  (callPackage ./common/checksum.nix { inherit langC langCC; })
-]
-  # This symlink points to itself, and we disallow that now by noBrokenSymlinks (#370750)
-  # TODO: find how exactly this happens and solve it in a better way.
-  ++ optional langJit (pkg: pkg.overrideAttrs (attrs: {
-    postInstall = attrs.postInstall or "" + ''
-      rm "$out/lib/lib"
-    '';
-  }))
-)
+])

@@ -5,7 +5,6 @@
  tzdata,
  replaceVars,
  iana-etc,
-  xcbuild,
  mailcap,
  buildPackages,
  pkgsBuildTarget,
@@ -62,10 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

-  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [
-    xcbuild
-  ];
-
  depsBuildTarget = lib.optional isCross targetCC;

  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
@@ -168,7 +163,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall
    mkdir -p $GOROOT_FINAL
-    cp -a bin pkg src lib misc api doc go.env $GOROOT_FINAL
+    cp -a bin pkg src lib misc api doc go.env VERSION $GOROOT_FINAL
    mkdir -p $out/bin
    ln -s $GOROOT_FINAL/bin/* $out/bin
    runHook postInstall
@@ -5,7 +5,6 @@
  tzdata,
  replaceVars,
  iana-etc,
-  xcbuild,
  mailcap,
  buildPackages,
  pkgsBuildTarget,
@@ -62,10 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

-  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [
-    xcbuild
-  ];
-
  depsBuildTarget = lib.optional isCross targetCC;

  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
@@ -166,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall
    mkdir -p $out/share/go
-    cp -a bin pkg src lib misc api doc go.env $out/share/go
+    cp -a bin pkg src lib misc api doc go.env VERSION $out/share/go
    mkdir -p $out/bin
    ln -s $out/share/go/bin/* $out/bin
    runHook postInstall
@@ -5,7 +5,6 @@
  tzdata,
  replaceVars,
  iana-etc,
-  xcbuild,
  mailcap,
  buildPackages,
  pkgsBuildTarget,
@@ -62,10 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];

-  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [
-    xcbuild
-  ];
-
  depsBuildTarget = lib.optional isCross targetCC;

  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
@@ -166,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall
    mkdir -p $out/share/go
-    cp -a bin pkg src lib misc api doc go.env $out/share/go
+    cp -a bin pkg src lib misc api doc go.env VERSION $out/share/go
    mkdir -p $out/bin
    ln -s $out/share/go/bin/* $out/bin
    runHook postInstall
@@ -427,6 +427,18 @@ let
                  stripLen = 1;
                }
              )
+          ++
+            lib.optional
+              (lib.versionAtLeast metadata.release_version "12" && lib.versionOlder metadata.release_version "19")
+              # Add missing include headers to build against gcc-15:
+              #   https://github.com/llvm/llvm-project/pull/101761
+              (
+                fetchpatch {
+                  url = "https://github.com/llvm/llvm-project/commit/7e44305041d96b064c197216b931ae3917a34ac1.patch";
+                  hash = "sha256-1htuzsaPHbYgravGc1vrR8sqpQ/NSQ8PUZeAU8ucCFk=";
+                  stripLen = 1;
+                }
+              )
          ++
            lib.optional (lib.versionOlder metadata.release_version "16")
              # Fix musl build.
@@ -14,9 +14,6 @@
  lib,
  newScope,
  callPackage,
-  CoreFoundation,
-  Security,
-  SystemConfiguration,
  pkgsBuildTarget,
  pkgsBuildBuild,
  pkgsBuildHost,
@@ -28,6 +25,7 @@
  llvm_19,
  wrapCCWith,
  overrideCC,
+  fetchpatch,
 }@args:
 let
  llvmSharedFor =
@@ -47,8 +45,18 @@ let
 in
 import ./default.nix
  {
-    rustcVersion = "1.84.1";
-    rustcSha256 = "Xi+11JYopUn3Zxssz5hVqzef1EKDGnwq8W4M3MMbs3U=";
+    rustcVersion = "1.85.0";
+    rustcSha256 = "L08xQv+3yEAhOc+geW4kuqrIuf0/lrLe7DuUtARcaoo=";
+
+    rustcPatches = [
+      # Fix for including no_std targets by default, shipping in Rust 1.87
+      # https://github.com/rust-lang/rust/pull/137073
+      (fetchpatch {
+        name = "bootstrap-skip-nostd-docs";
+        url = "https://github.com/rust-lang/rust/commit/97962d7643300b91c102496ba3ab6d9279d2c536.patch";
+        hash = "sha256-DKl9PWqJP3mX4B1pFeRLQ8/sO6mx1JhbmVLTOOMLZI4=";
+      })
+    ];

    llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
    llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -106,26 +114,26 @@ import ./default.nix
    # Note: the version MUST be the same version that we are building. Upstream
    # ensures that each released compiler can compile itself:
    # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.84.1";
+    bootstrapVersion = "1.85.0";

    # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
    bootstrapHashes = {
-      i686-unknown-linux-gnu = "9a2f107b35ca55439a7de0a74a893ff285766e086f96fb1d7049301b196c5da8";
-      x86_64-unknown-linux-gnu = "106c89f23ce1c763fcbea8e2714b2ba869bf7af70804813987a4483896398933";
-      x86_64-unknown-linux-musl = "e52236e269ce8f713691d78895365a376002980c011b4bbdd27e4bee0ec1ee9a";
-      arm-unknown-linux-gnueabihf = "02273a6326639dedf0c627421851f85b88884d3811de2a7390f189575d23b4b4";
-      armv7-unknown-linux-gnueabihf = "434895ed6cf922a3c0fe11a6af7f4e382093cc9edf6c250e49fbfcecd25ada59";
-      aarch64-unknown-linux-gnu = "be89f6ad9b70cc4b25182ae299f94ab047a713a51fddf95284823c8afe4aef85";
-      aarch64-unknown-linux-musl = "8a80398ed1942e8020599b8f1c53ae9775a6c8bed6af252c48a5fb967accd5f1";
-      x86_64-apple-darwin = "c2c80ffef15946abfb08dac6ad54c07f9d95ae56c65fc94c4c10e07b60acb883";
-      aarch64-apple-darwin = "49be10fa1a1de14e36d37cc412b7c44e01896c0a86a2d0d35ee26704a59adba7";
-      powerpc64le-unknown-linux-gnu = "7c56d9b5e2dfbd6a0a18307d96b703d6d70d1cf7bb337ea8865dfdd5e0a38d84";
-      riscv64gc-unknown-linux-gnu = "0e07fe7a0df2220cea37581061ed52576a44dec10866ec8f860f71a98bf41412";
-      s390x-unknown-linux-gnu = "9d6ab731c0cb315349cf5cbbeb88149adbd7165dbeec76f7c723d0b9796c4422";
-      x86_64-unknown-freebsd = "7aa4089315d3ac9eefd7f885283df99b2c4cb930316f0be3bf867d41217b6d05";
+      i686-unknown-linux-gnu = "bbfdbd15ee6a8414baad487c98d448805d2fa7074107e4eded770926ff5f2545";
+      x86_64-unknown-linux-gnu = "be4ba7b777100c851ab268e95f70f405d28d7813ba60a9bdcf4e88c88acf8602";
+      x86_64-unknown-linux-musl = "aec38e0eb03cde68f255959cfb389cccf321c7a020d103ea9174d01ab5acba65";
+      arm-unknown-linux-gnueabihf = "8a716247a8fe15a6c820d64d25d19c7d0b899a2dadd812bc080e92ebff4fdea5";
+      armv7-unknown-linux-gnueabihf = "91d0c9693b218fac740449fa9c3f37e71a680e4be5d27135ac1385f40eb148e0";
+      aarch64-unknown-linux-gnu = "0306c30bee00469fbec4b07bb04ea0308c096454354c3dc96a92b729f1c2acd1";
+      aarch64-unknown-linux-musl = "390de2f3aff938d04275302d6cb47c92f425b141c9cb68cb6cf237f702298627";
+      x86_64-apple-darwin = "69a36d239e38cc08c6366d1d85071847406645346c6f2d2e0dfaf64b58050d3d";
+      aarch64-apple-darwin = "3ff45cefaf9a002069902acf3a6332113b76b530bb31803fe5cfd30f7ef8ba03";
+      powerpc64le-unknown-linux-gnu = "d0761bf0e1786a46dddfe60cc9397b899f680b86e6aebd7ca16b2a70a9dd631b";
+      riscv64gc-unknown-linux-gnu = "5f27e7ed95ccd49fd53e92d6be62042dfdd2861faecad20bf61b0c186ff24df1";
+      s390x-unknown-linux-gnu = "7f6ee970e31e448c31c92175684380a73ec7078b15d7a99eac5d445bef1c4b3a";
+      x86_64-unknown-freebsd = "6ad090d188079450b1d65e4d539833affac54cfeb504e022b1b56d6d98bb4cbe";
    };

-    selectRustPackage = pkgs: pkgs.rust_1_84;
+    selectRustPackage = pkgs: pkgs.rust_1_85;
  }

  (
@@ -135,5 +143,6 @@ import ./default.nix
      "wrapCCWith"
      "overrideCC"
      "pkgsHostTarget"
+      "fetchpatch"
    ]
  )
@@ -53,16 +53,21 @@ rec {
      patchShebangs .
    '';

-    installPhase = ''
-      ./install.sh --prefix=$out \
-        --components=${installComponents}
+    installPhase =
+      ''
+        ./install.sh --prefix=$out \
+          --components=${installComponents}

-      # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
-      # (or similar) here. It causes strange effects where rustc loads
-      # the wrong libraries in a bootstrap-build causing failures that
-      # are very hard to track down. For details, see
-      # https://github.com/rust-lang/rust/issues/34722#issuecomment-232164943
-    '';
+        # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
+        # (or similar) here. It causes strange effects where rustc loads
+        # the wrong libraries in a bootstrap-build causing failures that
+        # are very hard to track down. For details, see
+        # https://github.com/rust-lang/rust/issues/34722#issuecomment-232164943
+      ''
+      + lib.optionalString stdenv.hostPlatform.isDarwin ''
+        install_name_tool -change "/usr/lib/libcurl.4.dylib" \
+        "${lib.getLib curl}/lib/libcurl.4.dylib" "$out/bin/cargo"
+      '';

    # The strip tool in cctools 973.0.1 and up appears to break rlibs in the
    # binaries. The lib.rmeta object inside the ar archive should contain an
@@ -166,7 +171,7 @@ rec {
      ''
      + lib.optionalString stdenv.hostPlatform.isDarwin ''
        install_name_tool -change "/usr/lib/libcurl.4.dylib" \
-          "${curl.out}/lib/libcurl.4.dylib" "$out/bin/cargo"
+          "${lib.getLib curl}/lib/libcurl.4.dylib" "$out/bin/cargo"
      ''
      + ''
        wrapProgram "$out/bin/cargo" \
@@ -1,7 +1,6 @@
 { lib, stdenv, pkgsHostHost
 , file, curl, pkg-config, python3, openssl, cmake, zlib
 , installShellFiles, makeWrapper, rustPlatform, rustc
-, CoreFoundation, Security
 , auditable ? !cargo-auditable.meta.broken
 , cargo-auditable
 , pkgsBuildBuild
@@ -32,8 +31,7 @@ rustPlatform.buildRustPackage.override {
    (lib.getDev pkgsHostHost.curl)
    zlib
  ];
-  buildInputs = [ file curl python3 openssl zlib ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreFoundation Security ];
+  buildInputs = [ file curl python3 openssl zlib ];

  # cargo uses git-rs which is made for a version of libgit2 from recent master that
  # is not compatible with the current version in nixpkgs.
@@ -3,7 +3,6 @@
  lib,
  rustPlatform,
  rustc,
-  Security,
 }:

 rustPlatform.buildRustPackage {
@@ -19,7 +18,7 @@ rustPlatform.buildRustPackage {
  # changes hash of vendor directory otherwise
  dontUpdateAutotoolsGnuConfigScripts = true;

-  buildInputs = [ rustc.llvm ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ rustc.llvm ];

  # fixes: error: the option `Z` is only accepted on the nightly compiler
  RUSTC_BOOTSTRAP = 1;
@@ -13,7 +13,6 @@
 }:
 { stdenv, lib
 , newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
 , pkgsBuildBuild
 , pkgsBuildHost
 , pkgsBuildTarget
@@ -87,13 +86,11 @@ in
        sysroot = if fastCross then self.rustc-unwrapped else null;
      };
      rustfmt = self.callPackage ./rustfmt.nix {
-        inherit Security;
        inherit (self.buildRustPackages) rustc;
      };
      cargo = if (!fastCross) then self.callPackage ./cargo.nix {
        # Use boot package set to break cycle
        rustPlatform = bootRustPlatform;
-        inherit CoreFoundation Security;
      } else self.callPackage ./cargo_cross.nix {};
      cargo-auditable = self.callPackage ./cargo-auditable.nix { };
      cargo-auditable-cargo-wrapper = self.callPackage ./cargo-auditable-cargo-wrapper.nix { };
@@ -102,7 +99,6 @@ in
        # buildPackages.clippy uses the cross compiler and supports
        # linting for the target platform.
        rustPlatform = makeRustPlatform self;
-        inherit Security;
      };
    });
  };
@@ -157,23 +157,23 @@ stdenv.mkDerivation (finalAttrs: {
        concatStringsSep "," (
          [
            stdenv.targetPlatform.rust.rustcTargetSpec
-
-            # Other targets that don't need any extra dependencies to build.
          ]
+          # Other targets that don't need any extra dependencies to build.
          ++ optionals (!fastCross) [
            "wasm32-unknown-unknown"
-
-            # (build!=target): When cross-building a compiler we need to add
-            # the build platform as well so rustc can compile build.rs
-            # scripts.
+            "wasm32v1-none"
+            "bpfel-unknown-none"
+            "bpfeb-unknown-none"
          ]
+          # (build!=target): When cross-building a compiler we need to add
+          # the build platform as well so rustc can compile build.rs
+          # scripts.
          ++ optionals (stdenv.buildPlatform != stdenv.targetPlatform && !fastCross) [
            stdenv.buildPlatform.rust.rustcTargetSpec
-
-            # (host!=target): When building a cross-targeting compiler we
-            # need to add the host platform as well so rustc can compile
-            # build.rs scripts.
          ]
+          # (host!=target): When building a cross-targeting compiler we
+          # need to add the host platform as well so rustc can compile
+          # build.rs scripts.
          ++ optionals (stdenv.hostPlatform != stdenv.targetPlatform && !fastCross) [
            stdenv.hostPlatform.rust.rustcTargetSpec
          ]
@@ -236,19 +236,19 @@ stdenv.mkDerivation (finalAttrs: {
  # library and reuse compiler
  buildPhase =
    if fastCross then
-      "
-    runHook preBuild
+      ''
+        runHook preBuild

-    mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/
-    ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/libstd-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/libstd.so
-    ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/librustc_driver-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc.so
-    ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main
-    touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd.stamp
-    touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc.stamp
-    python ./x.py --keep-stage=0 --stage=1 build library
+        mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/
+        ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/libstd-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/libstd.so
+        ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/librustc_driver-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc.so
+        ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main
+        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd.stamp
+        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc.stamp
+        python ./x.py --keep-stage=0 --stage=1 build library

-    runHook postBuild
-  "
+        runHook postBuild
+      ''
    else
      null;

@@ -5,7 +5,6 @@
  makeWrapper,
  rustPlatform,
  rustc,
-  Security,
  asNightly ? false,
 }:

@@ -26,7 +25,7 @@ rustPlatform.buildRustPackage {

  buildInputs = [
    rustc.llvm
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];

  # rustfmt uses the rustc_driver and std private libraries, and Rust's build process forces them to have
  # an install name of `@rpath/...` [0] [1] instead of the standard on macOS, which is an absolute path
@@ -442,8 +442,8 @@ in
  };

  ruby_3_4 = generic {
-    version = rubyVersion "3" "4" "1" "";
-    hash = "sha256-PTheXSLTaLBkyBehPtjjzD9xp3BdftG654ATwzqnyH8=";
+    version = rubyVersion "3" "4" "2" "";
+    hash = "sha256-QTKKwh8r/dfeazVl708N11QzVNN+lvFXoVUqa9DrNks=";
    cargoHash = "sha256-5Tp8Kth0yO89/LIcU8K01z6DdZRr8MAA0DPKqDEjIt0=";
  };
 }
@@ -119,7 +119,10 @@ in
        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
          ''
            echo SUPPORTED-LOCALES=C.UTF-8/UTF-8 > ../glibc-2*/localedata/SUPPORTED
-            make -j''${NIX_BUILD_CORES:-1} localedata/install-locales
+            # Don't install C.utf-8 into the archive, but into $out/lib/locale: on non-NixOS
+            # systems with an empty /usr/lib/locale/locale-archive, glibc would fall back to
+            # $libdir/locale/C.utf-8 instead of the locale archive of pkgs.glibc. See also #347965.
+            make -j''${NIX_BUILD_CORES:-1} localedata/install-locale-files
          ''
        else
          lib.optionalString stdenv.buildPlatform.isLinux
@@ -60,11 +60,11 @@ in

 stdenv.mkDerivation rec {
  pname = "gnutls";
-  version = "3.8.6";
+  version = "3.8.9";

  src = fetchurl {
    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    hash = "sha256-LhWIquU8sy1Dk38fTsoo/r2cDHqhc0/F3WGn6B4OvN0=";
+    hash = "sha256-aeET2ALRZwxNWsG5kECx8tXHwF2uxQA4E8BJtRhIIO0=";
  };

  outputs = [ "bin" "dev" "out" ]
@@ -76,15 +76,6 @@ stdenv.mkDerivation rec {

  patches = [
    ./nix-ssl-cert-file.patch
-    # Revert https://gitlab.com/gnutls/gnutls/-/merge_requests/1800
-    # dlopen isn't as easy in NixPkgs, as noticed in tests broken by this.
-    # Without getting the libs into RPATH they won't be found.
-    (fetchpatch2 {
-      name = "revert-dlopen-compression.patch";
-      url = "https://gitlab.com/gnutls/gnutls/-/commit/8584908d6b679cd4e7676de437117a793e18347c.diff";
-      revert = true;
-      hash = "sha256-r/+Gmwqy0Yc1LHL/PdPLXlErUBC5JxquLzCBAN3LuRM=";
-    })
  ];

  # Skip some tests:
@@ -122,6 +113,8 @@ stdenv.mkDerivation rec {
      "--disable-doc"
    ] ++ lib.optionals (stdenv.hostPlatform.isLinux && tpmSupport) [
      "--with-trousers-lib=${trousers}/lib/libtspi.so"
+    ] ++ [ # do not dlopen in nixpkgs
+        "--with-zlib=link"
    ];

  enableParallelBuilding = true;
@@ -2,9 +2,9 @@ allow overriding system trust store location via $NIX_SSL_CERT_FILE

 --- a/lib/system/certs.c
 +++ b/lib/system/certs.c
-@@ -404,6 +404,10 @@ gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
- 					unsigned int tl_flags,
- 					unsigned int tl_vflags)
+@@ -381,6 +381,10 @@ int gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
+ 					    unsigned int tl_flags,
+ 					    unsigned int tl_vflags)
 {
 -	return add_system_trust(list, tl_flags | GNUTLS_TL_NO_DUPLICATES,
 -				tl_vflags);
@@ -21,7 +21,7 @@

 stdenv.mkDerivation rec {
  pname = "gpgme";
-  version = "1.24.1";
+  version = "1.24.2";
  pyproject = true;

  outputs = [
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnupg/gpgme/gpgme-${version}.tar.bz2";
-    hash = "sha256-6gXQJY5xBh1hcWWE7DTO9ZMwqRNAVx7cRreDdJc7qF8=";
+    hash = "sha256-4RsaDjYXd+nlX0igPYkJbiq/CMY9hLcBfP4dzgZjlYE=";
  };

  patches = [
@@ -3,6 +3,7 @@
 , buildPackages
 , replaceVars
 , fetchurl
+, fetchpatch
 , pkg-config
 , docutils
 , gettext
@@ -82,6 +83,15 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-7zG9vW8ILEQBY0ogyFCwBQyb8lLvHgeXZO6VoqDEyVo=";
  };

+  patches = [
+    # Fix rendering glitches on vulkan drivers which do not support mipmaps for VK_IMAGE_TILING_LINEAR (Asahi Honeykrisp)
+    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/8058
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/c9a3cdd396c5646382612ed25e93bb5f9664d043.patch";
+      hash = "sha256-K774FFu6eyyjnxBTy7oTDygkh8+7qp5/KssHkyEwRR8=";
+    })
+  ];
+
  depsBuildBuild = [
    pkg-config
  ];
@@ -58,7 +58,8 @@ stdenv.mkDerivation rec {
  # Tries to link test binaries binaries dynamically and fails
  doCheck = !stdenv.hostPlatform.isStatic;

-  enableParallelBuilding = true;
+  # Parallel builds break reproducibility.
+  enableParallelBuilding = false;

  meta = with lib; {
    homepage = "https://jemalloc.net/";
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  libcddb,
  pkg-config,
  ncurses,
@@ -14,29 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "libcdio";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchurl {
-    url = "mirror://gnu/libcdio/libcdio-${version}.tar.bz2";
-    sha256 = "0avi6apv5ydjy6b9c3z9a46rvp5i57qyr09vr7x4nndxkmcfjl45";
+    url = "https://github.com/libcdio/libcdio/releases/download/${version}/${pname}-${version}.tar.bz2";
+    hash = "sha256-b4+99NGJz2Pyp6FUnFFs1yDHsiLHqq28kkom50WkhTk=";
  };

-  patches = [
-    # Fixes test failure of realpath test with glibc-2.36
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/libcdio/raw/d49ccdd9c8b4e9d57c01539f4c8948f28ce82bca/f/realpath-test-fix.patch";
-      sha256 = "sha256-ldAGlcf79uQ8QAt4Au8Iv6jsI6ICZXtXOKZBpyELtN8=";
-    })
-
-    # pull pending upstream patch to fix build on ncurses-6.3:
-    #  https://savannah.gnu.org/patch/index.php?10130
-    (fetchpatch {
-      name = "ncurses-6.3.patch";
-      url = "https://savannah.gnu.org/patch/download.php?file_id=52179";
-      sha256 = "1v15gxhpi4bgcr12pb3d9c3hiwj0drvc832vic7sham34lhjmcbb";
-    })
-  ];
-
  postPatch = ''
    patchShebangs .
  '';
@@ -58,10 +41,6 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  env = lib.optionalAttrs stdenv.cc.isGNU {
-    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
-  };
-
  doCheck = !stdenv.hostPlatform.isDarwin;

  meta = with lib; {
@@ -31,7 +31,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libxml2";
-  version = "2.13.5";
+  version = "2.13.6";

  outputs =
    [
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor finalAttrs.version}/libxml2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-dPwWMhejlkJX0745r5Q+CIYSY8QjH571tJa29tTHsrY=";
+    hash = "sha256-9FNIAwdSSWj3oE7GXmTyqDqCWXO80mCi52kb6CrnDJY=";
  };

  strictDeps = true;
@@ -27,6 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
  outputs = [ "out" "dev" "man" ];
  setOutputFlags = false; # some aren't supported

+  # see other isOpenBSD clause below
+  configurePlatforms = if stdenv.hostPlatform.isOpenBSD then ["build"] else ["build" "host"];
+
  configureFlags = [
    (lib.withFeature (!enableStatic) "shared")
    "--without-debug"
@@ -64,7 +67,12 @@ stdenv.mkDerivation (finalAttrs: {
      #
      # For now we allow this with `--undefined-version`:
      "LDFLAGS=-Wl,--undefined-version"
-  ]);
+  ]) ++ lib.optionals stdenv.hostPlatform.isOpenBSD [
+    # If you don't specify the version number in the host specification, a branch gets taken in configure
+    # which assumes that your openbsd is from the 90s, leading to a truly awful compiler/linker configuration.
+    # No, autoreconfHook doesn't work.
+    "--host=${stdenv.hostPlatform.config}${stdenv.cc.libc.version}"
+  ];

  # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
  CFLAGS = lib.optionalString stdenv.hostPlatform.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
@@ -87,16 +87,16 @@ wrapQtAppsHook() {
        do
            isELF "$file" || isMachO "$file" || continue

-            if [ -f "$file" ]
-            then
-                echo "wrapping $file"
-                wrapQtApp "$file"
-            elif [ -h "$file" ]
+            if [ -h "$file" ]
            then
                target="$(readlink -e "$file")"
                echo "wrapping $file -> $target"
                rm "$file"
                makeQtWrapper "$target" "$file"
+            elif [ -f "$file" ]
+            then
+                echo "wrapping $file"
+                wrapQtApp "$file"
            fi
        done
    done
@@ -81,14 +81,14 @@ if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
            [ -d "$targetDir" ] || continue

            find "$targetDir" ! -type d -executable -print0 | while IFS= read -r -d '' file; do
-                if [ -f "$file" ]; then
-                    echo "wrapping $file"
-                    wrapQtApp "$file"
-                elif [ -h "$file" ]; then
+                if [ -h "$file" ]; then
                    target="$(readlink -e "$file")"
                    echo "wrapping $file -> $target"
                    rm "$file"
                    makeQtWrapper "$target" "$file"
+                elif [ -f "$file" ]; then
+                    echo "wrapping $file"
+                    wrapQtApp "$file"
                fi
            done
        done
@@ -3,6 +3,7 @@
  qtbase,
  qtlanguageserver,
  qtshadertools,
+  qtsvg,
  openssl,
  stdenv,
  lib,
@@ -17,6 +18,7 @@ qtModule {
    qtbase
    qtlanguageserver
    qtshadertools
+    qtsvg
    openssl
  ];
  strictDeps = true;
@@ -68,6 +68,13 @@ stdenv.mkDerivation rec {
    })
  ];

+  # This install error is caused by a very old libtool. We can't autoreconfHook this package,
+  # so this is the best we've got!
+  postInstall = lib.optionalString stdenv.hostPlatform.isOpenBSD ''
+    ln -s $out/lib/libhistory.so* $out/lib/libhistory.so
+    ln -s $out/lib/libreadline.so* $out/lib/libreadline.so
+  '';
+
  meta = with lib; {
    description = "Library for interactive line editing";

@@ -14,7 +14,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wayland-protocols";
-  version = "1.40";
+  version = "1.41";

  doCheck =
    stdenv.hostPlatform == stdenv.buildPlatform
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://gitlab.freedesktop.org/wayland/${finalAttrs.pname}/-/releases/${finalAttrs.version}/downloads/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-shcReTJHwsQnY5FDkt+p/LnjcoyktKoRCtuNkV/ABok=";
+    hash = "sha256-J4a2sbeZZeMT8sKJwSB1ue1wDUGESBDFGv2hDuMpV2s=";
  };

  postPatch = lib.optionalString finalAttrs.doCheck ''
@@ -4,7 +4,7 @@
  fetchFromGitHub,
  dune-configurator,
  pkg-config,
-  taglib,
+  taglib_1,
  zlib,
 }:

@@ -24,7 +24,7 @@ buildDunePackage rec {
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dune-configurator ];
  propagatedBuildInputs = [
-    taglib
+    taglib_1
    zlib
  ];

@@ -13,12 +13,11 @@
  pytest-asyncio,
  pytestCheckHook,
  pythonOlder,
-  requests,
 }:

 buildPythonPackage rec {
  pname = "aioboto3";
-  version = "13.1.1";
+  version = "13.4.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -27,16 +26,18 @@ buildPythonPackage rec {
    owner = "terrycain";
    repo = "aioboto3";
    tag = "v${version}";
-    hash = "sha256-g86RKQxTcfG1CIH3gfgn9Vl9JxUkeC1ztmLk4q/MVn0=";
+    hash = "sha256-o3PynPW6nPvbBrsw+HU2fJheVRpCHCb0EnJdmseorsE=";
  };

+  pythonRelaxDeps = [
+    "aiobotocore"
+  ];
+
  build-system = [
    poetry-core
    poetry-dynamic-versioning
  ];

-  pythonRelaxDeps = [ "aiobotocore" ];
-
  dependencies = [
    aiobotocore
    aiofiles
@@ -47,31 +48,23 @@ buildPythonPackage rec {
    s3cse = [ cryptography ];
  };

-  nativeCheckInputs = [
-    dill
-    moto
-    pytest-asyncio
-    pytestCheckHook
-    requests
-  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
+  nativeCheckInputs =
+    [
+      dill
+      moto
+      pytest-asyncio
+      pytestCheckHook
+    ]
+    ++ moto.optional-dependencies.server
+    ++ lib.flatten (builtins.attrValues optional-dependencies);

  pythonImportsCheck = [ "aioboto3" ];

-  disabledTests = [
-    # Our moto package is not ready to support more tests
-    "encrypt_decrypt_aes_cbc"
-    "test_chalice_async"
-    "test_dynamo"
-    "test_flush_doesnt_reset_item_buffer"
-    "test_kms"
-    "test_s3"
-  ];
-
-  meta = with lib; {
+  meta = {
    description = "Wrapper to use boto3 resources with the aiobotocore async backend";
    homepage = "https://github.com/terrycain/aioboto3";
    changelog = "https://github.com/terrycain/aioboto3/blob/${src.rev}/CHANGELOG.rst";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ mbalatsko ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ mbalatsko ];
  };
 }
@@ -1,27 +1,30 @@
 {
  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
  aiohttp,
  aioitertools,
  botocore,
-  buildPythonPackage,
+  python-dateutil,
+  jmespath,
+  multidict,
+  urllib3,
+  wrapt,
  dill,
-  fetchFromGitHub,
-  flask,
-  flask-cors,
-  awscli,
  moto,
+  pytest-asyncio,
+  time-machine,
+  werkzeug,
+  awscli,
  boto3,
  setuptools,
-  pytest-asyncio,
  pytestCheckHook,
-  pythonAtLeast,
-  pythonOlder,
-  wrapt,
 }:

 buildPythonPackage rec {
  pname = "aiobotocore";
-  version = "2.18.0";
+  version = "2.19.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -30,19 +33,25 @@ buildPythonPackage rec {
    owner = "aio-libs";
    repo = "aiobotocore";
    tag = version;
-    hash = "sha256-4S0CZtk5k+xke2WVwYrNyvP2up32xrOcdKNP72kO6zQ=";
+    hash = "sha256-8wtWIkGja4zb2OoYALH9hTR6i90sIjIjYWTUulfYIYA=";
  };

  # Relax version constraints: aiobotocore works with newer botocore versions
  # the pinning used to match some `extras_require` we're not using.
  pythonRelaxDeps = [ "botocore" ];

-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+  ];

  dependencies = [
    aiohttp
    aioitertools
    botocore
+    python-dateutil
+    jmespath
+    multidict
+    urllib3
    wrapt
  ];

@@ -53,57 +62,40 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    dill
-    flask
-    flask-cors
    moto
    pytest-asyncio
+    time-machine
+    werkzeug
    pytestCheckHook
-  ];
+  ] ++ moto.optional-dependencies.server;

  pythonImportsCheck = [ "aiobotocore" ];

  disabledTestPaths = [
-    # Tests require network access
-    "tests/python3.8/"
+    # Test requires network access
+    "tests/test_version.py"
+    # Test not compatible with latest moto
+    "tests/boto_tests/unit/test_eventstream.py"
+    "tests/python3.8/test_eventstreams.py"
    "tests/test_basic_s3.py"
    "tests/test_batch.py"
    "tests/test_dynamodb.py"
    "tests/test_ec2.py"
-    "tests/test_eventstreams.py"
    "tests/test_lambda.py"
    "tests/test_monitor.py"
-    "tests/test_mturk.py"
    "tests/test_patches.py"
    "tests/test_sns.py"
    "tests/test_sqs.py"
-    "tests/test_version.py"
    "tests/test_waiter.py"
-    # moto compat issues
-    "tests/boto_tests/unit/test_signers.py"
  ];

-  disabledTests =
-    [
-      "test_get_credential"
-      "test_load_sso_credentials_without_cache"
-      "test_load_sso_credentials"
-      "test_required_config_not_set"
-      "test_sso_cred_fetcher_raises_helpful_message_on_unauthorized_exception"
-      "test_sso_credential_fetcher_can_fetch_credentials"
-    ]
-    ++ lib.optionals (pythonAtLeast "3.12.") [
-      # AttributeError: 'called_with' is not a valid assertion. Use a spec for the mock if 'called_with' is meant to be an attribute.
-      "test_max_rate_updated_on_success_response"
-      "test_max_rate_cant_exceed_20_percent_max"
-    ];
-
  __darwinAllowLocalNetworking = true;

-  meta = with lib; {
+  meta = {
    description = "Python client for amazon services";
    homepage = "https://github.com/aio-libs/aiobotocore";
    changelog = "https://github.com/aio-libs/aiobotocore/releases/tag/${src.tag}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ teh ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ teh ];
  };
 }
@@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "aiohappyeyeballs";
-  version = "2.4.4";
+  version = "2.4.6";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "bdraco";
    repo = "aiohappyeyeballs";
    tag = "v${version}";
-    hash = "sha256-zf1EkS+cdCkttce2jCjRf1693AlBYkmAuLX5IysWeUs=";
+    hash = "sha256-qTbneCb8XsZ+/Tg7JfFT/q67g7vzd11riZn5lI44Ei8=";
  };

  outputs = [
@@ -3,7 +3,6 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
-  fetchpatch2,
  replaceVars,
  isPy310,
  isPyPy,
@@ -46,14 +45,14 @@

 buildPythonPackage rec {
  pname = "aiohttp";
-  version = "3.11.12";
+  version = "3.11.13";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aio-libs";
    repo = "aiohttp";
    tag = "v${version}";
-    hash = "sha256-GveluMxw100ZllDF+MT4QkZVD9q7UWHwF7IBK85J/j0=";
+    hash = "sha256-VY7Q8m1mOppI/sUgL0Zy/jisR/Vy3zZQBMhgrBYophs=";
  };

  patches = [
@@ -61,12 +60,6 @@ buildPythonPackage rec {
      llhttpDev = lib.getDev llhttp;
      llhttpLib = lib.getLib llhttp;
    })
-    (fetchpatch2 {
-      # https://github.com/aio-libs/aiohttp/issues/10421
-      # https://github.com/aio-libs/aiohttp/pull/10423
-      url = "https://github.com/aio-libs/aiohttp/commit/51daf7190e7674773c22011a4e443df8b5e66437.patch";
-      hash = "sha256-fADetk2tqg92J2sSgzKVTEhbQRSYl6430dxdVZuFx5I=";
-    })
  ];

  postPatch = ''
@@ -25,12 +25,12 @@ buildPythonPackage rec {
    owner = "boto";
    repo = "boto3";
    tag = version;
-    hash = "sha256-b08tC8EA6iW0O/7rseD9pTkKh/cJ2fe3xJZkEqxS6VI=";
+    hash = "sha256-89GUr0isFEKmBevWgPW5z4uU1zOTQ1kM8RX1mlsvdXw=";
  };

-  build-system = [ setuptools ];
-
-  pythonRelaxDeps = [ "s3transfer" ];
+  build-system = [
+    setuptools
+  ];

  dependencies = [
    botocore
@@ -51,7 +51,7 @@ buildPythonPackage rec {
  ];

  optional-dependencies = {
-    crt = [ botocore.optional-dependencies.crt ];
+    crt = botocore.optional-dependencies.crt;
  };

  meta = {
@@ -2,7 +2,7 @@
  lib,
  awscrt,
  buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,

  # build-system
  setuptools,
@@ -19,17 +19,19 @@

 buildPythonPackage rec {
  pname = "botocore";
-  version = "1.35.99"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.36.21"; # N.B: if you change this, change boto3 and awscli to a matching version
  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-HqtE6WnDnF89mjEEoINsJHFVeaRV8Ss5eaMdfN5Rs8M=";
+  src = fetchFromGitHub {
+    owner = "boto";
+    repo = "botocore";
+    tag = version;
+    hash = "sha256-wk3KCRagEju4ywJfoBR8/4dH3xYgzGgaSHavDYCd5XY=";
  };

-  pythonRelaxDeps = [ "urllib3" ];
-
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+  ];

  dependencies = [
    jmespath
@@ -1,29 +0,0 @@
-diff --git a/src/c/_cffi_backend.c b/src/c/_cffi_backend.c
-index 537271f..9c3bf94 100644
--- a/src/c/_cffi_backend.c
-+++ b/src/c/_cffi_backend.c
-@@ -103,11 +103,11 @@
- # define CFFI_CHECK_FFI_PREP_CIF_VAR 0
- # define CFFI_CHECK_FFI_PREP_CIF_VAR_MAYBE 0
- 
-#elif defined(__APPLE__) && defined(FFI_AVAILABLE_APPLE)
-+#elif defined(__APPLE__)
- 
-# define CFFI_CHECK_FFI_CLOSURE_ALLOC __builtin_available(macos 10.15, ios 13, watchos 6, tvos 13, *)
-+# define CFFI_CHECK_FFI_CLOSURE_ALLOC 1
- # define CFFI_CHECK_FFI_CLOSURE_ALLOC_MAYBE 1
-# define CFFI_CHECK_FFI_PREP_CLOSURE_LOC __builtin_available(macos 10.15, ios 13, watchos 6, tvos 13, *)
-+# define CFFI_CHECK_FFI_PREP_CLOSURE_LOC 1
- # define CFFI_CHECK_FFI_PREP_CLOSURE_LOC_MAYBE 1
-# define CFFI_CHECK_FFI_PREP_CIF_VAR __builtin_available(macos 10.15, ios 13, watchos 6, tvos 13, *)
-+# define CFFI_CHECK_FFI_PREP_CIF_VAR 1
- # define CFFI_CHECK_FFI_PREP_CIF_VAR_MAYBE 1
-@@ -6422,7 +6422,7 @@ static PyObject *b_callback(PyObject *self, PyObject *args)
-     else
- #endif
-     {
-#if defined(__APPLE__) && defined(FFI_AVAILABLE_APPLE) && !FFI_LEGACY_CLOSURE_API
-+#if defined(__APPLE__) && !FFI_LEGACY_CLOSURE_API
-         PyErr_Format(PyExc_SystemError, "ffi_prep_closure_loc() is missing");
-         goto error;
- #else
@@ -44,20 +44,6 @@ else
      hash = "sha256-HDnGAWwyvEjdVFYZUOvWg24WcPKuRhKPZ89J54nFKCQ=";
    };

-    patches = [
-      #
-      # Trusts the libffi library inside of nixpkgs on Apple devices.
-      #
-      # Based on some analysis I did:
-      #
-      #   https://groups.google.com/g/python-cffi/c/xU0Usa8dvhk
-      #
-      # I believe that libffi already contains the code from Apple's fork that is
-      # deemed safe to trust in cffi.
-      #
-      ./darwin-use-libffi-closures.diff
-    ];
-
    nativeBuildInputs = [ pkg-config ];

    build-system = [ setuptools ];
@@ -12,12 +12,13 @@
  magic-wormhole,
  mitmproxy,
  typer,
+  flit-core,
 }:

 buildPythonPackage rec {
  pname = "click";
-  version = "8.1.7";
-  format = "setuptools";
+  version = "8.1.8";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@@ -25,10 +26,11 @@ buildPythonPackage rec {
    owner = "pallets";
    repo = "click";
    tag = version;
-    hash = "sha256-8YqIKRyw5MegnRwAO7YTCZateEFQFTH2PHpE8gTPTow=";
+    hash = "sha256-pAAqf8jZbDfVZUoltwIFpov/1ys6HSYMyw3WV2qcE/M=";
  };

-  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  build-system = [ flit-core ];
+  dependencies = lib.optionals (pythonOlder "3.8") [ importlib-metadata ];

  nativeCheckInputs = [ pytestCheckHook ];

@@ -24,7 +24,7 @@

 buildPythonPackage rec {
  pname = "cryptography";
-  version = "44.0.0"; # Also update the hash in vectors.nix
+  version = "44.0.1"; # Also update the hash in vectors.nix
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -33,13 +33,13 @@ buildPythonPackage rec {
    owner = "pyca";
    repo = "cryptography";
    tag = version;
-    hash = "sha256-A+qYW8GksYk+FQG8ZJHNYrjcouE1CsVH0Lko2ahoYUI=";
+    hash = "sha256-PM7InFrRY0ho8qcBcVqqcXV9eVP8fF0ma/y4C0gx1Ic=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-Ni/i21JgAemDXsJOXLL6IKjrJdBkw5jxBB0IdETBPcs=";
+    hash = "sha256-hjfSjmwd/mylVZKyXsj/pP2KvAGDpfthuT+w219HAiA=";
  };

  postPatch = ''
@@ -15,7 +15,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "cryptography_vectors";
    inherit version;
-    hash = "sha256-EGIodmxFuaX/0aiz4lTwVgyCHaedXNf9EToX43U1gKs=";
+    hash = "sha256-WphmsURl3PrxK837wzkph7tVnzesi4pMm2NZvno9fqA=";
  };

  nativeBuildInputs = [ flit-core ];
@@ -43,16 +43,17 @@ buildPythonPackage rec {
    six
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    libredirect.hook
+    pytestCheckHook
+  ];

-  # libredirect is not available on darwin
  # tests hang on pypy indefinitely
-  doCheck = !stdenv.hostPlatform.isDarwin && !isPyPy;
+  doCheck = !isPyPy;

  preCheck = lib.optionalString doCheck ''
    echo "nameserver 127.0.0.1" > resolv.conf
    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/resolv.conf=$(realpath resolv.conf)
-    export LD_PRELOAD=${libredirect}/lib/libredirect.so

    export EVENTLET_IMPORT_VERSION_ONLY=0
  '';
@@ -67,6 +68,8 @@ buildPythonPackage rec {
    "test_server_connection_timeout_exception"
    # broken with openssl 3.4
    "test_ssl_close"
+    # flaky test
+    "test_send_timeout"
  ];

  pythonImportsCheck = [ "eventlet" ];
@@ -2,7 +2,6 @@
  lib,
  buildPythonPackage,
  isPyPy,
-  pythonOlder,
  fetchFromGitHub,
  setuptools,
  mccabe,
@@ -13,17 +12,14 @@

 buildPythonPackage rec {
  pname = "flake8";
-  version = "7.1.1";
-
-  disabled = pythonOlder "3.8";
-
+  version = "7.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PyCQA";
    repo = "flake8";
-    rev = version;
-    hash = "sha256-6iCZEapftHqd9okJS1wMzIjjmWahrmmZtXd7SUMVcmE=";
+    tag = version;
+    hash = "sha256-VhHWGO8UIf77IzVxz9SCpg6Z/ebRmIJQLlSGsKY9Y0E=";
  };

  build-system = [ setuptools ];
@@ -42,12 +38,12 @@ buildPythonPackage rec {
    "test_tokenization_error_but_not_syntax_error"
  ];

-  meta = with lib; {
-    changelog = "https://github.com/PyCQA/flake8/blob/${src.rev}/docs/source/release-notes/${version}.rst";
+  meta = {
+    changelog = "https://github.com/PyCQA/flake8/blob/${src.tag}/docs/source/release-notes/${version}.rst";
    description = "Modular source code checker: pep8, pyflakes and co";
    homepage = "https://github.com/PyCQA/flake8";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
    mainProgram = "flake8";
  };
 }
@@ -25,14 +25,14 @@

 buildPythonPackage rec {
  pname = "flit";
-  version = "3.10.1";
+  version = "3.11.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "pypa";
    repo = "flit";
    rev = version;
-    hash = "sha256-GOup/iiR0zKM07dFiTFNzBEVBwzNp4ERWp1l4w9hOME=";
+    hash = "sha256-AK5iuR1l/i2Cgj8D4CnyV6mQkSNbFw4sHGQF2OdwNkU=";
  };

  build-system = [ flit-core ];
@@ -1,47 +1,51 @@
 {
  lib,
  stdenv,
-  aiohttp,
  buildPythonPackage,
  fetchFromGitHub,
+
+  # build-system
  hatchling,
  hatch-vcs,
-  numpy,
-  paramiko,
-  pytest-asyncio,
-  pytest-mock,
-  pytest-vcr,
-  pytestCheckHook,
-  pythonOlder,
-  requests,
-  smbprotocol,
-  tqdm,
+
+  # optional-dependencies
  adlfs,
+  pyarrow,
  dask,
  distributed,
+  requests,
  dropbox,
+  aiohttp,
  fusepy,
  gcsfs,
  libarchive-c,
  ocifs,
  panel,
-  pyarrow,
+  paramiko,
  pygit2,
  s3fs,
+  smbprotocol,
+  tqdm,
+
+  # tests
+  numpy,
+  pytest-asyncio,
+  pytest-mock,
+  pytest-vcr,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:

 buildPythonPackage rec {
  pname = "fsspec";
-  version = "2024.12.0";
+  version = "2025.2.0";
  pyproject = true;

-  disabled = pythonOlder "3.8";
-
  src = fetchFromGitHub {
    owner = "fsspec";
    repo = "filesystem_spec";
    tag = version;
-    hash = "sha256-Vc0vBayPg6zZ4+pxJsHChSGg0kjA0Q16+Gk0bO0IEpI=";
+    hash = "sha256-vJYnPbGbEMAe1p0EUBxSRZYtvBdJzjzDOesyTJsFJbU=";
  };

  build-system = [
@@ -58,9 +62,9 @@ buildPythonPackage rec {
      distributed
    ];
    dropbox = [
-      # missing dropboxdrivefs
-      requests
      dropbox
+      # dropboxdrivefs
+      requests
    ];
    entrypoints = [ ];
    full = [
@@ -90,10 +94,7 @@ buildPythonPackage rec {
    gs = [ gcsfs ];
    gui = [ panel ];
    hdfs = [ pyarrow ];
-    http = [
-      aiohttp
-      requests
-    ];
+    http = [ aiohttp ];
    libarchive = [ libarchive-c ];
    oci = [ ocifs ];
    s3 = [ s3fs ];
@@ -110,39 +111,19 @@ buildPythonPackage rec {
    pytest-mock
    pytest-vcr
    pytestCheckHook
+    writableTmpDirAsHomeHook
  ];

-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
  __darwinAllowLocalNetworking = true;

-  disabledTests =
-    [
-      # Test assumes user name is part of $HOME
-      # AssertionError: assert 'nixbld' in '/homeless-shelter/foo/bar'
-      "test_strip_protocol_expanduser"
-      # test accesses this remote ftp server:
-      # https://ftp.fau.de/debian-cd/current/amd64/log/success
-      "test_find"
-      # Tests want to access S3
-      "test_urlpath_inference_errors"
-      "test_mismatch"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-      # works locally on APFS, fails on hydra with AssertionError comparing timestamps
-      # darwin hydra builder uses HFS+ and has only one second timestamp resolution
-      # this two tests however, assume nanosecond resolution
-      "test_modified"
-      "test_touch"
-      # tries to access /home, ignores $HOME
-      "test_directories"
-    ];
-
-  disabledTestPaths = [
-    # JSON decoding issues
-    "fsspec/implementations/tests/test_dbfs.py"
+  disabledTests = lib.optionals (stdenv.hostPlatform.isDarwin) [
+    # works locally on APFS, fails on hydra with AssertionError comparing timestamps
+    # darwin hydra builder uses HFS+ and has only one second timestamp resolution
+    # this two tests however, assume nanosecond resolution
+    "test_modified"
+    "test_touch"
+    # tries to access /home, ignores $HOME
+    "test_directories"
  ];

  pythonImportsCheck = [ "fsspec" ];
@@ -152,6 +133,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/fsspec/filesystem_spec";
    changelog = "https://github.com/fsspec/filesystem_spec/raw/${version}/docs/source/changelog.rst";
    license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ nickcao ];
  };
 }
@@ -4,51 +4,57 @@
  fetchFromGitHub,
  pytestCheckHook,
  pythonOlder,
+  setuptools,
  google-auth,
  google-auth-oauthlib,
  google-cloud-storage,
  requests,
  decorator,
  fsspec,
-  ujson,
+  fusepy,
  aiohttp,
  crcmod,
  pytest-timeout,
-  pytest-vcr,
-  vcrpy,
+  pytest-asyncio,
 }:

 buildPythonPackage rec {
  pname = "gcsfs";
-  version = "2024.2.0";
-  format = "setuptools";
+  version = "2025.2.0";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "fsspec";
-    repo = pname;
+    repo = "gcsfs";
    tag = version;
-    hash = "sha256-6O09lP2cWLzeMTBathb3O/tVGZPEHSqujfUPWZIBUJI=";
+    hash = "sha256-1nPhttEmGI8jreMe5hwOZRALJa5QTNOw2McisV+cR54=";
  };

-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
    aiohttp
-    crcmod
    decorator
    fsspec
    google-auth
    google-auth-oauthlib
    google-cloud-storage
    requests
-    ujson
  ];

+  optional-dependencies = {
+    gcsfuse = [ fusepy ];
+    crc = [ crcmod ];
+  };
+
  nativeCheckInputs = [
-    pytest-vcr
    pytest-timeout
+    pytest-asyncio
    pytestCheckHook
-    vcrpy
  ];

  disabledTests = [
@@ -65,15 +71,13 @@ buildPythonPackage rec {
    "gcsfs/tests/test_inventory_report_listing.py"
  ];

-  pytestFlagsArray = [ "-x" ];
-
  pythonImportsCheck = [ "gcsfs" ];

-  meta = with lib; {
+  meta = {
    description = "Convenient Filesystem interface over GCS";
    homepage = "https://github.com/fsspec/gcsfs";
    changelog = "https://github.com/fsspec/gcsfs/raw/${version}/docs/source/changelog.rst";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ nbren12 ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nbren12 ];
  };
 }
@@ -12,9 +12,7 @@ buildPythonPackage {
  inherit (gpgme) version src;
  pyproject = true;

-  patches = gpgme.patches or [ ] ++ [
-    ./python313-support.patch
-  ];
+  patches = gpgme.patches or [ ];

  postPatch = ''
    substituteInPlace lang/python/setup.py.in \
@@ -43,13 +43,13 @@

 buildPythonPackage rec {
  pname = "ipython";
-  version = "8.31.0";
+  version = "8.32.0";
  pyproject = true;
  disabled = pythonOlder "3.10";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-tqInRga+xhZkBf8F5Uky7W5c/srKH8BfLKzee7B01ws=";
+    hash = "sha256-viyRiVsLnqe6SdM7I+IEDDUrM+tqUZzKfObgx0NEQlE=";
  };

  build-system = [ setuptools ];
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildPythonPackage,
+  bpf-linker,
+  fetchFromGitHub,
+  rustPlatform,
+  mitmproxy,
+}:
+
+buildPythonPackage rec {
+  pname = "mitmproxy-linux";
+  version = "0.11.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mitmproxy";
+    repo = "mitmproxy_rs";
+    tag = "v${version}";
+    hash = "sha256-vC+Vsv7UWjkO+6lm7gAb91Ig04Y7r9gYQoz6R9xpxsA=";
+  };
+
+  postPatch = ''
+    substituteInPlace mitmproxy-linux/build.rs \
+      --replace-fail '"-Z",' "" \
+      --replace-fail '"build-std=core",' ""
+
+    substituteInPlace mitmproxy-linux-ebpf/.cargo/config.toml \
+      --replace-fail 'build-std = ["core"]' ""
+  '';
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-CFsefq1zQLIYjZcfoy3afYfP/0MlBoi9kVx7FVGEKr0=";
+  };
+
+  RUSTFLAGS = "-C target-feature=";
+  RUSTC_BOOTSTRAP = 1;
+
+  buildAndTestSubdir = "mitmproxy-linux";
+
+  nativeBuildInputs = [
+    bpf-linker
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  # repo has no python tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "mitmproxy_linux" ];
+
+  meta = {
+    description = "Rust bits in mitmproxy";
+    homepage = "https://github.com/mitmproxy/mitmproxy_rs/tree/main/mitmproxy-linux";
+    changelog = "https://github.com/mitmproxy/mitmproxy_rs/blob/${src.rev}/CHANGELOG.md#${
+      lib.replaceStrings [ "." ] [ "" ] version
+    }";
+    license = lib.licenses.mit;
+    inherit (mitmproxy.meta) maintainers;
+  };
+}
@@ -2,25 +2,25 @@
  lib,
  buildPythonPackage,
  fetchPypi,
-  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "mitmproxy-macos";
-  version = "0.9.2";
+  version = "0.11.5";
  format = "wheel";

-  disabled = pythonOlder "3.10";
-
  src = fetchPypi {
    pname = "mitmproxy_macos";
    inherit version;
    format = "wheel";
    dist = "py3";
    python = "py3";
-    hash = "sha256-Q19gQF6qnoF0TDmeZIxu90A5/ur7N7sDcoeBi2LaNrg=";
+    hash = "sha256-j3qqZGrMZLpHkKf01Gy5+/18sEEbm3pWfbBASGS/8o0=";
  };

+  # repo has no python tests
+  doCheck = false;
+
  pythonImportsCheck = [ "mitmproxy_macos" ];

  meta = with lib; {
@@ -3,46 +3,44 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
-  rustPlatform,
-  darwin,
-  libiconv,
  mitmproxy,
+  mitmproxy-linux,
  mitmproxy-macos,
+  rustPlatform,
 }:

 buildPythonPackage rec {
  pname = "mitmproxy-rs";
-  version = "0.10.7";
+  version = "0.11.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mitmproxy";
    repo = "mitmproxy_rs";
    rev = "v${version}";
-    hash = "sha256-YRiaslXdpRGJfuZAHQ4zX+6DgH+IPkeyD8RA7TYgmBY=";
-  };
-
-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "boringtun-0.6.0" = "sha256-fx2lY6q1ZdO5STvf7xnbVG64tn0BC4yWPFy4ICPJgEg=";
-      "smoltcp-0.11.0" = "sha256-KC9nTKd2gfZ1ICjrkLK//M2bbqYlfcCK18gBdN0RqWQ=";
-    };
+    hash = "sha256-vC+Vsv7UWjkO+6lm7gAb91Ig04Y7r9gYQoz6R9xpxsA=";
  };

  buildAndTestSubdir = "mitmproxy-rs";

+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-CFsefq1zQLIYjZcfoy3afYfP/0MlBoi9kVx7FVGEKr0=";
+  };
+
  nativeBuildInputs = [
    rustPlatform.cargoSetupHook
    rustPlatform.maturinBuildHook
  ];

-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.AppKit
-    libiconv
-    mitmproxy-macos
-  ];
+  dependencies =
+    lib.optionals stdenv.hostPlatform.isLinux [ mitmproxy-linux ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ mitmproxy-macos ];
+  # not packaged yet
+  # ++ lib.optionals stdenv.hostPlatform.isWindows [ mitmproxy-windows ]
+
+  # repo has no python tests
+  doCheck = false;

  pythonImportsCheck = [ "mitmproxy_rs" ];

@@ -1,13 +1,11 @@
 {
  lib,
-  stdenv,
  fetchFromGitHub,
  buildPythonPackage,
-  pythonOlder,
  # Mitmproxy requirements
  aioquic,
+  argon2-cffi,
  asgiref,
-  blinker,
  brotli,
  certifi,
  cryptography,
@@ -17,11 +15,9 @@
  hyperframe,
  kaitaistruct,
  ldap3,
-  mitmproxy-macos,
  mitmproxy-rs,
  msgpack,
  passlib,
-  protobuf5,
  publicsuffix2,
  pyopenssl,
  pyparsing,
@@ -35,7 +31,6 @@
  zstandard,
  # Additional check requirements
  hypothesis,
-  parver,
  pytest-asyncio,
  pytest-timeout,
  pytest-xdist,
@@ -45,16 +40,14 @@

 buildPythonPackage rec {
  pname = "mitmproxy";
-  version = "11.0.2";
+  version = "11.1.3";
  pyproject = true;

-  disabled = pythonOlder "3.9";
-
  src = fetchFromGitHub {
    owner = "mitmproxy";
    repo = "mitmproxy";
    tag = "v${version}";
-    hash = "sha256-qcsPOISQjHVHh4TrQ/UihZaxB/jWBfq7AVI4U1gQPVs=";
+    hash = "sha256-gTeXxNQWVMQYiGdIyy7SS6JcuYG16KLnjxBBdjhi+lE=";
  };

  pythonRelaxDeps = [
@@ -65,10 +58,12 @@ buildPythonPackage rec {
    "urwid"
  ];

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    aioquic
+    argon2-cffi
    asgiref
-    blinker
    brotli
    certifi
    cryptography
@@ -81,23 +76,20 @@ buildPythonPackage rec {
    mitmproxy-rs
    msgpack
    passlib
-    protobuf5
    publicsuffix2
    pyopenssl
    pyparsing
    pyperclip
    ruamel-yaml
-    setuptools
    sortedcontainers
    tornado
    urwid
    wsproto
    zstandard
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ mitmproxy-macos ];
+  ];

  nativeCheckInputs = [
    hypothesis
-    parver
    pytest-asyncio
    pytest-timeout
    pytest-xdist
@@ -9,15 +9,15 @@
  crc32c,
  cryptography,
  docker,
-  fetchPypi,
+  fetchFromGitHub,
  flask-cors,
  flask,
  freezegun,
  graphql-core,
  jinja2,
  joserfc,
-  jsondiff,
  jsonpath-ng,
+  jsonschema,
  multipart,
  openapi-spec-validator,
  py-partiql-parser,
@@ -37,17 +37,21 @@

 buildPythonPackage rec {
  pname = "moto";
-  version = "5.0.26";
+  version = "5.0.28";
  pyproject = true;

  disabled = pythonOlder "3.8";

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-aCn1imcKCH58W2P4GDxrctZKFETkIMISJQtzJraakYM=";
+  src = fetchFromGitHub {
+    owner = "getmoto";
+    repo = "moto";
+    tag = version;
+    hash = "sha256-++kkPiI3AOTF+VlvPWhjhuiIjiHQPa3M0Nmh3+1PHSE=";
  };

-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+  ];

  dependencies = [
    boto3
@@ -64,56 +68,54 @@ buildPythonPackage rec {
  optional-dependencies = {
    all = [
      antlr4-python3-runtime
-      aws-xray-sdk
-      cfn-lint
-      docker
-      flask
-      flask-cors
-      graphql-core
      joserfc
-      jsondiff
      jsonpath-ng
-      multipart
-      openapi-spec-validator
-      py-partiql-parser
-      pyparsing
+      docker
+      graphql-core
      pyyaml
+      cfn-lint
+      jsonschema
+      openapi-spec-validator
+      pyparsing
+      py-partiql-parser
+      aws-xray-sdk
      setuptools
+      multipart
    ];
    proxy = [
      antlr4-python3-runtime
-      aws-xray-sdk
-      cfn-lint
+      joserfc
+      jsonpath-ng
      docker
      graphql-core
-      joserfc
-      jsondiff
-      jsonpath-ng
-      multipart
-      openapi-spec-validator
-      py-partiql-parser
-      pyparsing
      pyyaml
+      cfn-lint
+      openapi-spec-validator
+      pyparsing
+      py-partiql-parser
+      aws-xray-sdk
      setuptools
+      multipart
    ];
    server = [
      antlr4-python3-runtime
-      aws-xray-sdk
-      cfn-lint
+      joserfc
+      jsonpath-ng
      docker
+      graphql-core
+      pyyaml
+      cfn-lint
+      openapi-spec-validator
+      pyparsing
+      py-partiql-parser
+      aws-xray-sdk
+      setuptools
      flask
      flask-cors
-      graphql-core
-      joserfc
-      jsondiff
-      jsonpath-ng
-      openapi-spec-validator
-      py-partiql-parser
-      pyparsing
-      pyyaml
-      setuptools
    ];
-    cognitoidp = [ joserfc ];
+    acm = [ ];
+    acmpca = [ ];
+    amp = [ ];
    apigateway = [
      pyyaml
      joserfc
@@ -123,19 +125,53 @@ buildPythonPackage rec {
      pyyaml
      openapi-spec-validator
    ];
+    applicationautoscaling = [ ];
+    appsync = [
+      graphql-core
+    ];
+    athena = [ ];
+    autoscaling = [ ];
+    awslambda = [
+      docker
+    ];
+    awslambda_simple = [ ];
+    backup = [ ];
+    batch = [
+      docker
+    ];
+    batch_simple = [ ];
+    budgets = [ ];
+    ce = [ ];
    cloudformation = [
-      aws-xray-sdk
-      cfn-lint
+      joserfc
      docker
      graphql-core
-      joserfc
-      jsondiff
-      openapi-spec-validator
-      py-partiql-parser
-      pyparsing
      pyyaml
+      cfn-lint
+      openapi-spec-validator
+      pyparsing
+      py-partiql-parser
+      aws-xray-sdk
      setuptools
    ];
+    cloudfront = [ ];
+    cloudtrail = [ ];
+    cloudwatch = [ ];
+    codebuild = [ ];
+    codecommit = [ ];
+    codepipeline = [ ];
+    cognitoidentity = [ ];
+    cognitoidp = [
+      joserfc
+    ];
+    comprehend = [ ];
+    config = [ ];
+    databrew = [ ];
+    datapipeline = [ ];
+    datasync = [ ];
+    dax = [ ];
+    dms = [ ];
+    ds = [ ];
    dynamodb = [
      docker
      py-partiql-parser
@@ -144,34 +180,117 @@ buildPythonPackage rec {
      docker
      py-partiql-parser
    ];
-    events = [ jsonpath-ng ];
-    glue = [ pyparsing ];
-    iotdata = [ jsondiff ];
+    ebs = [ ];
+    ec2 = [ ];
+    ec2instanceconnect = [ ];
+    ecr = [ ];
+    ecs = [ ];
+    efs = [ ];
+    eks = [ ];
+    elasticache = [ ];
+    elasticbeanstalk = [ ];
+    elastictranscoder = [ ];
+    elb = [ ];
+    elbv2 = [ ];
+    emr = [ ];
+    emrcontainers = [ ];
+    emrserverless = [ ];
+    es = [ ];
+    events = [
+      jsonpath-ng
+    ];
+    firehose = [ ];
+    forecast = [ ];
+    glacier = [ ];
+    glue = [
+      pyparsing
+    ];
+    greengrass = [ ];
+    guardduty = [ ];
+    iam = [ ];
+    inspector2 = [ ];
+    iot = [ ];
+    iotdata = [ ];
+    ivs = [ ];
+    kinesis = [ ];
+    kinesisvideo = [ ];
+    kinesisvideoarchivedmedia = [ ];
+    kms = [ ];
+    logs = [ ];
+    managedblockchain = [ ];
+    mediaconnect = [ ];
+    medialive = [ ];
+    mediapackage = [ ];
+    mediastore = [ ];
+    mediastoredata = [ ];
+    meteringmarketplace = [ ];
+    mq = [ ];
+    opsworks = [ ];
+    organizations = [ ];
+    panorama = [ ];
+    personalize = [ ];
+    pinpoint = [ ];
+    polly = [ ];
+    quicksight = [
+      jsonschema
+    ];
+    ram = [ ];
+    rds = [ ];
+    redshift = [ ];
+    redshiftdata = [ ];
+    rekognition = [ ];
+    resourcegroups = [ ];
    resourcegroupstaggingapi = [
-      cfn-lint
+      joserfc
      docker
      graphql-core
-      joserfc
-      jsondiff
-      openapi-spec-validator
-      py-partiql-parser
-      pyparsing
      pyyaml
+      cfn-lint
+      openapi-spec-validator
+      pyparsing
+      py-partiql-parser
    ];
+    route53 = [ ];
+    route53resolver = [ ];
    s3 = [
      pyyaml
      py-partiql-parser
    ];
-    sns = [ ];
-    stepfunctions = [
-      antlr4-python3-runtime
-      jsonpath-ng
-    ];
    s3crc32c = [
      pyyaml
      py-partiql-parser
      crc32c
    ];
+    s3control = [ ];
+    sagemaker = [ ];
+    sdb = [ ];
+    scheduler = [ ];
+    secretsmanager = [ ];
+    servicediscovery = [ ];
+    servicequotas = [ ];
+    ses = [ ];
+    signer = [ ];
+    sns = [ ];
+    sqs = [ ];
+    ssm = [
+      pyyaml
+    ];
+    ssoadmin = [ ];
+    stepfunctions = [
+      antlr4-python3-runtime
+      jsonpath-ng
+    ];
+    sts = [ ];
+    support = [ ];
+    swf = [ ];
+    textract = [ ];
+    timestreamwrite = [ ];
+    transcribe = [ ];
+    wafv2 = [ ];
+    xray = [
+      aws-xray-sdk
+      setuptools
+    ];
  };

  __darwinAllowLocalNetworking = true;
@@ -181,7 +300,7 @@ buildPythonPackage rec {
    pytest-order
    pytest-xdist
    pytestCheckHook
-  ] ++ optional-dependencies.all;
+  ] ++ optional-dependencies.server;

  # Some tests depend on AWS credentials environment variables to be set.
  env.AWS_ACCESS_KEY_ID = "ak";
@@ -59,7 +59,7 @@ let
 in
 buildPythonPackage rec {
  pname = "numpy";
-  version = "2.2.2";
+  version = "2.2.3";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -67,7 +67,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    inherit pname version;
    extension = "tar.gz";
-    hash = "sha256-7WkG9hg01odzjSWYiuEXaDcFY2k2zGBb4LsgiyPfTY8=";
+    hash = "sha256-29wV8MgWEZJfOC36l7O9C8LBzhnU/lBILLDdwSujACA=";
  };

  patches = lib.optionals python.hasDistutilsCxxPatch [
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "poetry-core";
-  version = "2.0.1";
+  version = "2.1.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "python-poetry";
    repo = "poetry-core";
    tag = version;
-    hash = "sha256-X3HFvnjbQ8An856QwSsWm5bmzs9KuscPE9LaVebNfgk=";
+    hash = "sha256-DeDfDaP+jPrN6F/lv6shVOG6+4VdD1nL9mz1wJn55Sc=";
  };

  nativeCheckInputs = [
--- a/Show More
+++ b/Show More