Merge #231026: staging-next 2023-05-10

2023-05-13 22:09:45 +02:00 · 2023-05-13 22:09:45 +02:00 · 51c2025d5a
parent bec9166857 021f9a2fe5
commit 51c2025d5a
76 changed files with 525 additions and 178 deletions
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -24,6 +24,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - KDE Plasma has been updated to v5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what is changed.

+- Python implements [PEP 668](https://peps.python.org/pep-0668/), providing better feedback to users that try to run `pip install` system-wide.
+
 - `nixos-rebuild` now supports an extra `--specialisation` option that can be used to change specialisation for `switch` and `test` commands.

 - `libxcrypt`, the library providing the `crypt(3)` password hashing function, is now built without support for algorithms not flagged [`strong`](https://github.com/besser82/libxcrypt/blob/v4.4.33/lib/hashes.conf#L48). This affects the availability of password hashing algorithms used for system login (`login(1)`, `passwd(1)`), but also Apache2 Basic-Auth, Samba, OpenLDAP, Dovecot, and [many other packages](https://github.com/search?q=repo%3ANixOS%2Fnixpkgs%20libxcrypt&type=code).
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -59,6 +59,7 @@ with lib;
      networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
      pango = super.pango.override { x11Support = false; };
      pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; };
+      pipewire = super.pipewire.override { x11Support = false; };
      qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
      qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
      qt5 = super.qt5.overrideScope (const (super': {
--- a/nixos/tests/bpf.nix
+++ b/nixos/tests/bpf.nix
@ -26,8 +26,11 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        "    printf(\"tgid: %d\", ((struct task_struct*) curtask)->tgid); exit() "
        "}'"))
    # module BTF (bpftrace >= 0.17)
-    print(machine.succeed("bpftrace -e 'kfunc:nft_trans_alloc_gfp { "
-        "    printf(\"portid: %d\\n\",args->ctx->portid); "
+    # test is currently disabled on aarch64 as kfunc does not work there yet
+    # https://github.com/iovisor/bpftrace/issues/2496
+    print(machine.succeed("uname -m | grep aarch64 || "
+        "bpftrace -e 'kfunc:nft_trans_alloc_gfp { "
+        "    printf(\"portid: %d\\n\", args->ctx->portid); "
        "} BEGIN { exit() }'"))
  '';
 })
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@ -186,14 +186,12 @@ stdenv.mkDerivation (finalAttrs: {

      # Fix references to the perl, sed, awk and various coreutil binaries used by
      # shell scripts that git calls (e.g. filter-branch)
-      # and completion scripts
      SCRIPT="$(cat <<'EOS'
        BEGIN{
          @a=(
            '${gnugrep}/bin/grep', '${gnused}/bin/sed', '${gawk}/bin/awk',
            '${coreutils}/bin/cut', '${coreutils}/bin/basename', '${coreutils}/bin/dirname',
-            '${coreutils}/bin/wc', '${coreutils}/bin/tr',
-            '${coreutils}/bin/ls'
+            '${coreutils}/bin/wc', '${coreutils}/bin/tr'
            ${lib.optionalString perlSupport ", '${perlPackages.perl}/bin/perl'"}
          );
        }
@ -204,8 +202,7 @@ stdenv.mkDerivation (finalAttrs: {
      EOS
      )"
      perl -0777 -i -pe "$SCRIPT" \
-        $out/libexec/git-core/git-{sh-setup,filter-branch,merge-octopus,mergetool,quiltimport,request-pull,submodule,subtree,web--browse} \
-        $out/share/bash-completion/completions/{git,gitk}
+        $out/libexec/git-core/git-{sh-setup,filter-branch,merge-octopus,mergetool,quiltimport,request-pull,submodule,subtree,web--browse}


      # Also put git-http-backend into $PATH, so that we can use smart
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -33,6 +33,7 @@ cInclude=1
 expandResponseParams "$@"
 linkType=$(checkLinkType "${params[@]}")

+declare -ag positionalArgs=()
 declare -i n=0
 nParams=${#params[@]}
 while (( "$n" < "$nParams" )); do
@ -54,6 +55,17 @@ while (( "$n" < "$nParams" )); do
                c++*) isCxx=1 ;;
            esac
            ;;
+        --) # Everything else is positional args!
+            # See: https://github.com/llvm/llvm-project/commit/ed1d07282cc9d8e4c25d585e03e5c8a1b6f63a74
+
+            # Any positional arg (i.e. any argument after `--`) will be
+            # interpreted as a "non flag" arg:
+            if [[ -v "params[$n]" ]]; then nonFlagArgs=1; fi
+
+            positionalArgs=("${params[@]:$n}")
+            params=("${params[@]:0:$((n - 1))}")
+            break;
+            ;;
        -?*) ;;
        *) nonFlagArgs=1 ;; # Includes a solitary dash (`-`) which signifies standard input; it is not a flag
    esac
@ -207,6 +219,12 @@ if [ "$cc1" = 1 ]; then
  extraBefore=()
 fi

+# Finally, if we got any positional args, append them to `extraAfter`
+# now:
+if [[ "${#positionalArgs[@]}" -gt 0 ]]; then
+    extraAfter+=(-- "${positionalArgs[@]}")
+fi
+
 # Optionally print debug info.
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
    # Old bash workaround, see ld-wrapper for explanation.
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@ -30,7 +30,7 @@ let
  ]));
  extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);

-  srcVersion = "3.86";
+  srcVersion = "3.89.1";
  version = if nssOverride != null then nssOverride.version else srcVersion;
  meta = with lib; {
    homepage = "https://curl.haxx.se/docs/caextract.html";
@ -45,7 +45,7 @@ let

    src = if nssOverride != null then nssOverride.src else fetchurl {
      url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "sha256-PzhfxoZHa7uoEQNfpoIbVCR11VdHsYwgwiHU1mVzuXU=";
+      hash = "sha256-OtrtuecMPF9AYDv2CgHjNhkKbb4Bkp05XxawH+hKAVY=";
    };

    dontBuild = true;
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@ -59,6 +59,7 @@ let majorVersion = "10";
        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
      })
      ../11/fix-struct-redefinition-on-glibc-2.36.patch
+      ../install-info-files-serially.patch
    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
      ++ optional noSysDirs ../no-sys-dirs.patch
      ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@ -63,6 +63,7 @@ let majorVersion = "11";
        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
      })
      ./fix-struct-redefinition-on-glibc-2.36.patch
+      ../install-info-files-serially.patch
    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
      ++ optional noSysDirs ../no-sys-dirs.patch
      ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@ -68,6 +68,7 @@ let majorVersion = "12";
        ../gnat-cflags-11.patch
        ../gcc-12-gfortran-driving.patch
        ../ppc-musl.patch
+        ../install-info-files-serially.patch
      ]
      # We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
      # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@ -74,6 +74,7 @@ let majorVersion = "4";
        ../struct-ucontext-4.8.patch
        ../sigsegv-not-declared.patch
        ../res_state-not-declared.patch
+        ../install-info-files-serially.patch
        # gcc-11 compatibility
        (fetchpatch {
          name = "gcc4-char-reload.patch";
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -63,6 +63,7 @@ let majorVersion = "4";
      [ ../9/fix-struct-redefinition-on-glibc-2.36.patch ../use-source-date-epoch.patch
        ../parallel-bconfig.patch ./parallel-strsignal.patch
        ./libsanitizer.patch
+        ../install-info-files-serially.patch
        (fetchpatch {
          name = "avoid-ustat-glibc-2.28.patch";
          url = "https://gitweb.gentoo.org/proj/gcc-patches.git/plain/4.9.4/gentoo/100_all_avoid-ustat-glibc-2.28.patch?id=55fcb515620a8f7d3bb77eba938aa0fcf0d67c96";
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -72,6 +72,7 @@ let majorVersion = "6";
        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
      })
+      ../install-info-files-serially.patch
    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
      ++ optional noSysDirs ../no-sys-dirs.patch
      ++ optional langAda ../gnat-cflags.patch
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@ -65,6 +65,7 @@ let majorVersion = "7";
        })

        ../9/fix-struct-redefinition-on-glibc-2.36.patch
+        ../install-info-files-serially.patch
      ]
      ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
      ++ optionals targetPlatform.isNetBSD [
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@ -54,6 +54,7 @@ let majorVersion = "8";
        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
      })
      ../9/fix-struct-redefinition-on-glibc-2.36.patch
+      ../install-info-files-serially.patch
    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
      ++ optional targetPlatform.isNetBSD ../libstdc++-netbsd-ctypes.patch
      ++ optional noSysDirs ../no-sys-dirs.patch
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -63,6 +63,7 @@ let majorVersion = "9";
        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
      })
+      ../install-info-files-serially.patch
    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
      ++ optional targetPlatform.isNetBSD ../libstdc++-netbsd-ctypes.patch
      ++ optional noSysDirs ../no-sys-dirs.patch
--- a/pkgs/development/compilers/gcc/install-info-files-serially.patch
+++ b/pkgs/development/compilers/gcc/install-info-files-serially.patch
@ -0,0 +1,15 @@
+diff -Naur gcc-12.2.0/gcc/Makefile.in gcc-12.2.0-new/gcc/Makefile.in
+--- gcc-12.2.0/gcc/Makefile.in	2022-08-19 10:09:52.280658631 +0200
+++ gcc-12.2.0-new/gcc/Makefile.in	2023-05-04 14:35:44.401420184 +0200
+@@ -3781,6 +3781,11 @@
+ 	  fi; \
+ 	fi
+ 
+# We don't care about the order in which the info files are built, but
+# install-info doesn't support multiple parallel invocations writing to
+# the same `dir-file`, so we have to disable parallelism for that reason:
+.NOTPARALLEL: install-info
+
+ # Install the info files.
+ # $(INSTALL_DATA) might be a relative pathname, so we can't cd into srcdir
+ # to do the install.
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.20.3";
+  version = "1.20.4";

  src = fetchurl {
    url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-5Ee0mM3lAhXE92GeUSSw/E4l+10W6kcnHEfyeOeqdjo=";
+    hash = "sha256-nzSs4Sh2S3o6SyOLgFhWzBshhDBN+eVpCCWwcQ9CAtY=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@ -118,6 +118,13 @@ in stdenv.mkDerivation (rec {
      sha256 = "1kckghvsngs51mqm82asy0s9vr19h8aqbw43a0w44mccqw6bzrwf";
      stripLen = 1;
    })
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@ -116,6 +116,13 @@ in stdenv.mkDerivation (rec {
      sha256 = "1kckghvsngs51mqm82asy0s9vr19h8aqbw43a0w44mccqw6bzrwf";
      stripLen = 1;
    })
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@ -100,6 +100,13 @@ in stdenv.mkDerivation (rec {
      sha256 = "sha256:12s8vr6ibri8b48h2z38f3afhwam10arfiqfy4yg37bmc054p5hi";
      stripLen = 1;
    })
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@ -91,6 +91,13 @@ in stdenv.mkDerivation (rec {
      sha256 = "18l6mrvm2vmwm77ckcnbjvh6ybvn72rhrb799d4qzwac4x2ifl7g";
      stripLen = 1;
    })
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@ -87,6 +87,13 @@ in stdenv.mkDerivation (rec {

  patches = [
    ./gnu-install-dirs.patch
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@ -142,6 +142,13 @@ in stdenv.mkDerivation (rec {
    # It's not clear to me why this isn't an issue for LLVM developers running
    # on macOS (nothing about this _seems_ nix specific)..
    ./lit-shell-script-runner-set-dyld-library-path.patch
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optionals enablePolly [
    ./gnu-install-dirs-polly.patch

--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@ -82,6 +82,8 @@ stdenv.mkDerivation (rec {
      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
      stripLen = 1;
    })
+
+    ../../llvm-7-musl.patch
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@ -105,6 +105,8 @@ stdenv.mkDerivation (rec {
      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
      stripLen = 1;
    })
+
+    ../../llvm-7-musl.patch
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@ -108,6 +108,8 @@ in stdenv.mkDerivation (rec {
      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
      stripLen = 1;
    })
+
+    ../../llvm-7-musl.patch
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@ -110,6 +110,13 @@ in stdenv.mkDerivation (rec {
      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
      stripLen = 1;
    })
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@ -108,6 +108,13 @@ in stdenv.mkDerivation (rec {
      sha256 = "0zjfjgavqzi2ypqwqnlvy6flyvdz8hi1anwv0ybwnm2zqixg7za3";
      stripLen = 1;
    })
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optional enablePolly ./gnu-install-dirs-polly.patch;

  postPatch = optionalString stdenv.isDarwin ''
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@ -134,6 +134,13 @@ in stdenv.mkDerivation (rec {
    # It's not clear to me why this isn't an issue for LLVM developers running
    # on macOS (nothing about this _seems_ nix specific)..
    ./lit-shell-script-runner-set-dyld-library-path.patch
+
+    # Fix musl build.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+      relative = "llvm";
+      hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+    })
  ] ++ lib.optionals enablePolly [
    ./gnu-install-dirs-polly.patch

--- a/pkgs/development/compilers/llvm/llvm-7-musl.patch
+++ b/pkgs/development/compilers/llvm/llvm-7-musl.patch
@ -0,0 +1,92 @@
+From 8c747d3157df2830eed9205e7caf1203b345de17 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 4 Feb 2023 13:54:41 -0800
+Subject: [PATCH] cmake: Enable 64bit off_t on 32bit glibc systems
+
+Pass -D_FILE_OFFSET_BITS=64 to compiler flags on 32bit glibc based
+systems. This will make sure that 64bit versions of LFS functions are
+used e.g. seek will behave same as lseek64. Also revert [1] partially
+because this added a cmake test to detect lseek64 but then forgot to
+pass the needed macro to actual compile, this test was incomplete too
+since libc implementations like musl has 64bit off_t by default on 32bit
+systems and does not bundle[2] -D_LARGEFILE64_SOURCE under -D_GNU_SOURCE
+like glibc, which means the compile now fails on musl because the cmake
+check passes but we do not have _LARGEFILE64_SOURCE defined. Using the
+*64 function was transitional anyways so use -D_FILE_OFFSET_BITS=64
+instead
+
+[1] https://github.com/llvm/llvm-project/commit/8db7e5e4eed4c4e697dc3164f2c9351d8c3e942b
+[2] https://git.musl-libc.org/cgit/musl/commit/?id=25e6fee27f4a293728dd15b659170e7b9c7db9bc
+
+Reviewed By: MaskRay
+
+Differential Revision: https://reviews.llvm.org/D139752
+
+(cherry picked from commit 5cd554303ead0f8891eee3cd6d25cb07f5a7bf67)
+---
+ cmake/config-ix.cmake              | 13 ++++++++++---
+ include/llvm/Config/config.h.cmake |  3 ---
+ lib/Support/raw_ostream.cpp        |  2 --
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/cmake/config-ix.cmake b/cmake/config-ix.cmake
+index 18977d9950ff..b558aa83fa62 100644
+--- a/cmake/config-ix.cmake
+++ b/cmake/config-ix.cmake
+@@ -197,9 +197,6 @@ check_symbol_exists(posix_fallocate fcntl.h HAVE_POSIX_FALLOCATE)
+ if( HAVE_SIGNAL_H AND NOT LLVM_USE_SANITIZER MATCHES ".*Address.*" AND NOT APPLE )
+   check_symbol_exists(sigaltstack signal.h HAVE_SIGALTSTACK)
+ endif()
+-set(CMAKE_REQUIRED_DEFINITIONS "-D_LARGEFILE64_SOURCE")
+-check_symbol_exists(lseek64 "sys/types.h;unistd.h" HAVE_LSEEK64)
+-set(CMAKE_REQUIRED_DEFINITIONS "")
+ check_symbol_exists(mallctl malloc_np.h HAVE_MALLCTL)
+ check_symbol_exists(mallinfo malloc.h HAVE_MALLINFO)
+ check_symbol_exists(malloc_zone_statistics malloc/malloc.h
+@@ -237,6 +234,16 @@ if( PURE_WINDOWS )
+   check_function_exists(__main HAVE___MAIN)
+   check_function_exists(__cmpdi2 HAVE___CMPDI2)
+ endif()
+
+check_symbol_exists(__GLIBC__ stdio.h LLVM_USING_GLIBC)
+if( LLVM_USING_GLIBC )
+# enable 64bit off_t on 32bit systems using glibc
+  if (CMAKE_SIZEOF_VOID_P EQUAL 4)
+    add_compile_definitions(_FILE_OFFSET_BITS=64)
+    list(APPEND CMAKE_REQUIRED_DEFINITIONS "-D_FILE_OFFSET_BITS=64")
+  endif()
+endif()
+
+ if( HAVE_DLFCN_H )
+   if( HAVE_LIBDL )
+     list(APPEND CMAKE_REQUIRED_LIBRARIES dl)
+diff --git a/include/llvm/Config/config.h.cmake b/include/llvm/Config/config.h.cmake
+index e934617d7ec7..3c39c373b3c1 100644
+--- a/include/llvm/Config/config.h.cmake
+++ b/include/llvm/Config/config.h.cmake
+@@ -112,9 +112,6 @@
+ /* Define to 1 if you have the <link.h> header file. */
+ #cmakedefine HAVE_LINK_H ${HAVE_LINK_H}
+ 
+-/* Define to 1 if you have the `lseek64' function. */
+-#cmakedefine HAVE_LSEEK64 ${HAVE_LSEEK64}
+-
+ /* Define to 1 if you have the <mach/mach.h> header file. */
+ #cmakedefine HAVE_MACH_MACH_H ${HAVE_MACH_MACH_H}
+ 
+diff --git a/lib/Support/raw_ostream.cpp b/lib/Support/raw_ostream.cpp
+index 038ad00bd608..921ab8409008 100644
+--- a/lib/Support/raw_ostream.cpp
+++ b/lib/Support/raw_ostream.cpp
+@@ -677,8 +677,6 @@ uint64_t raw_fd_ostream::seek(uint64_t off) {
+   flush();
+ #ifdef _WIN32
+   pos = ::_lseeki64(FD, off, SEEK_SET);
+-#elif defined(HAVE_LSEEK64)
+-  pos = ::lseek64(FD, off, SEEK_SET);
+ #else
+   pos = ::lseek(FD, off, SEEK_SET);
+ #endif
+-- 
+2.37.1
+
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -486,6 +486,16 @@ in with passthru; stdenv.mkDerivation {
    # bytecode compilations for the same reason - we don't want bytecode generated.
    mkdir -p $out/share/gdb
    sed '/^#!/d' Tools/gdb/libpython.py > $out/share/gdb/libpython.py
+
+    # Disable system-wide pip installation. See https://peps.python.org/pep-0668/.
+    cat <<'EXTERNALLY_MANAGED' > $out/lib/${libPrefix}/EXTERNALLY-MANAGED
+    [externally-managed]
+    Error=This command has been disabled as it tries to modify the immutable
+     `/nix/store` filesystem.
+
+     To use Python with Nix and nixpkgs, have a look at the online documentation:
+     <https://nixos.org/manual/nixpkgs/stable/#python>.
+    EXTERNALLY_MANAGED
  '';

  preFixup = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -84,8 +84,8 @@ let
          ++ (op fiddleSupport libffi)
          ++ (ops cursesSupport [ ncurses readline ])
          ++ (op zlibSupport zlib)
-          ++ (op (lib.versionOlder ver.majMin "3.0" && opensslSupport) openssl_1_1)
-          ++ (op (atLeast30 && opensslSupport) openssl_1_1)
+          ++ (op (!atLeast31 && opensslSupport) openssl_1_1)
+          ++ (op (atLeast31 && opensslSupport) openssl)
          ++ (op gdbmSupport gdbm)
          ++ (op yamlSupport libyaml)
          # Looks like ruby fails to build on darwin without readline even if curses
--- a/pkgs/development/libraries/acl/LFS64.patch
+++ b/pkgs/development/libraries/acl/LFS64.patch
@ -0,0 +1,38 @@
+From 2b42f64737adf6a2ddd491213580d6e9cdd2f5af Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 10 Nov 2022 18:04:15 -0800
+Subject: chacl: Use portable version of dirent and readdir
+
+Using 64bit versions on 32bit architectures should be enabled with
+--enable-largefile, this makes it portable across musl and glibc
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ tools/chacl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/chacl.c b/tools/chacl.c
+index 525a7ff..8fff875 100644
+--- a/tools/chacl.c
+++ b/tools/chacl.c
+@@ -320,7 +320,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
+ {
+ 	int failed = 0;
+ 	DIR *dir;
+-	struct dirent64 *d;
+	struct dirent *d;
+ 	char *name;
+ 
+ 	if ((dir = opendir(fname)) == NULL) {
+@@ -332,7 +332,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
+ 		return(0);	/* got a file, not an error */
+ 	}
+ 
+-	while ((d = readdir64(dir)) != NULL) {
+	while ((d = readdir(dir)) != NULL) {
+ 		/* skip "." and ".." entries */
+ 		if (strcmp(d->d_name, ".") == 0 || strcmp(d->d_name, "..") == 0)
+ 			continue;
+-- 
+cgit v1.1
+
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-dgxhxokBs3/dXu/ur0wMeia9/disdHoe3/HODiQ8Ea8=";
  };

+  patches = [
+    ./LFS64.patch
+  ];
+
  outputs = [ "bin" "dev" "out" "man" "doc" ];

  nativeBuildInputs = [ gettext ];
@ -24,7 +28,7 @@ stdenv.mkDerivation rec {

  # Upstream use C++-style comments in C code. Remove them.
  # This comment breaks compilation if too strict gcc flags are used.
-  patchPhase = ''
+  postPatch = ''
    echo "Removing C++-style comments from include/acl.h"
    sed -e '/^\/\//d' -i include/acl.h

--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@ -34,11 +34,11 @@

 stdenv.mkDerivation rec {
  pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "7.1.0";
+  version = "7.2.0";

  src = fetchurl {
    url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
-    hash = "sha256-8TWmHNRkye1ryYI3ZMGI8nbDhQqNyQRijeKoeWa3B3s=";
+    hash = "sha256-/FVgyAfq4O/V+VtapMZYAMeo7tZkIAimsefj//94c8w=";
  };

  postPatch = ''
@ -108,6 +108,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "An OpenType text shaping engine";
    homepage = "https://harfbuzz.github.io/";
+    changelog = "https://github.com/harfbuzz/harfbuzz/raw/${version}/NEWS";
    maintainers = [ maintainers.eelco ];
    license = licenses.mit;
    platforms = platforms.unix;
--- a/pkgs/development/libraries/icu/73.nix
+++ b/pkgs/development/libraries/icu/73.nix
@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "73.1";
+  sha256 = "sha256-pFdDHeFktKp+ygDtE00A37+Ip3xphqEK53dPwHa7jEU=";
+}
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "imlib2";
-  version = "1.10.0";
+  version = "1.11.1";

  src = fetchurl {
    url = "mirror://sourceforge/enlightenment/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-cnwak3yIXAgMNyF+R23Ii1o+YNc38b8ECzQ1ILeBy7o=";
+    hash = "sha256-9xK2u53K1G2Lj0rVJhDcu667TMgLX9EvkxJNOjgPpr8=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/libimagequant/Cargo.lock
+++ b/pkgs/development/libraries/libimagequant/Cargo.lock
@ -74,9 +74,9 @@ dependencies = [

 [[package]]
 name = "crossbeam-channel"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf2b3e8478797446514c91ef04bafcb59faba183e621ad488df88983cc14128c"
+checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
 dependencies = [
 "cfg-if",
 "crossbeam-utils",
@ -132,9 +132,9 @@ dependencies = [

 [[package]]
 name = "flate2"
-version = "1.0.25"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8a2db397cb1c8772f31494cb8917e48cd1e64f0fa7efac59fbd741a0a8ce841"
+checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
 dependencies = [
 "crc32fast",
 "miniz_oxide",
@ -160,11 +160,10 @@ dependencies = [

 [[package]]
 name = "imagequant"
-version = "4.1.1"
+version = "4.2.0"
 dependencies = [
 "arrayvec",
 "lodepng",
- "noisy_float",
 "num_cpus",
 "once_cell",
 "rayon",
@ -183,9 +182,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.140"
+version = "0.2.142"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99227334921fae1a979cf0bfdfcc6b3e5ce376ef57e16fb6fb3ea2ed6095f80c"
+checksum = "6a987beff54b60ffa6d51982e1aa1146bc42f19bd26be28b0586f252fccf5317"

 [[package]]
 name = "lodepng"
@ -211,31 +210,13 @@ dependencies = [

 [[package]]
 name = "miniz_oxide"
-version = "0.6.2"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
 dependencies = [
 "adler",
 ]

-[[package]]
-name = "noisy_float"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978fe6e6ebc0bf53de533cd456ca2d9de13de13856eda1518a285d7705a213af"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "num_cpus"
 version = "1.15.0"
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@ -5,13 +5,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "libimagequant";
-  version = "4.1.1";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "ImageOptim";
    repo = pname;
    rev = version;
-    hash = "sha256-sCxscs4D2p7LNDpcrKfAc315/NbxbQXtsyc33zUmccM=";
+    hash = "sha256-51xTCymZKLuw1Xeje6EyKqHdbmqBV1Fdhx+OsO3bZ6Q=";
  };

  cargoLock = {
@ -19,11 +19,9 @@ rustPlatform.buildRustPackage rec {
  };

  postPatch = ''
-    cp ${./Cargo.lock} Cargo.lock
+    ln -s ${./Cargo.lock} Cargo.lock
  '';

-  cargoHash = "sha256-0HOmItooNsGq6iTIb9M5IPXMwYh2nQ03qfjomkg0d00=";
-
  nativeBuildInputs = [ cargo-c ];

  postBuild = ''
--- a/pkgs/development/libraries/libjpeg-turbo/default.nix
+++ b/pkgs/development/libraries/libjpeg-turbo/default.nix
@ -31,13 +31,13 @@ assert !(enableJpeg7 && enableJpeg8);  # pick only one or none, not both
 stdenv.mkDerivation rec {

  pname = "libjpeg-turbo";
-  version = "2.1.4";
+  version = "2.1.5.1";

  src = fetchFromGitHub {
    owner = "libjpeg-turbo";
    repo = "libjpeg-turbo";
    rev = version;
-    sha256 = "sha256-1NRoVIL3zXX1D6iOf2FCrwBEcDW7TYFbdIbCTjY1m8Q=";
+    sha256 = "sha256-96SBBZp+/4WkXLvHKSPItNi5WuzdVccI/ZcbJOFjYYk=";
  };

  # This is needed by freeimage
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "libssh";
-  version = "0.10.4";
+  version = "0.10.5";

  src = fetchurl {
    url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-BzksVKthR2KI0cHwp8VXtQIReXrQDDTDryu8TbxL2X0=";
+    sha256 = "sha256-tg4v9/Nnue7itWNNOmMwPd/t4OahjfyojESodw5+QjQ=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -184,6 +184,8 @@ let
      "-Dsession-managers="
      "-Dvulkan=enabled"
      "-Dx11=${mesonEnableFeature x11Support}"
+      "-Dx11-xfixes=${mesonEnableFeature x11Support}"
+      "-Dlibcanberra=${mesonEnableFeature x11Support}"
      "-Dlibmysofa=${mesonEnableFeature mysofaSupport}"
      "-Dsdl2=disabled" # required only to build examples, causes dependency loop
      "-Drlimits-install=false" # installs to /etc, we won't use this anyway
--- a/pkgs/development/libraries/tomlplusplus/default.nix
+++ b/pkgs/development/libraries/tomlplusplus/default.nix
@ -1,26 +1,11 @@
 { lib
 , stdenv
-, buildPackages
+, meson
 , cmake
 , ninja
 , fetchFromGitHub
-, fetchpatch
 }:

-# Fix regression in precomputing CMAKE_SIZEOF_VOID_P
-# See https://github.com/mesonbuild/meson/pull/11761
-let fixedMeson =
-      buildPackages.meson.overrideAttrs (
-        {patches ? [], ...}: {
-          patches = patches ++ [
-            (fetchpatch {
-              url = "https://github.com/mesonbuild/meson/commit/7c78c2b5a0314078bdabb998ead56925dc8b0fc0.patch";
-              sha256 = "sha256-vSnHhuOIXf/1X+bUkUmGND5b30ES0O8EDArwb4p2/w4=";
-            })
-          ];
-        }
-      ); in
-
 stdenv.mkDerivation rec {
  pname = "tomlplusplus";
  version = "3.3.0";
@ -32,7 +17,7 @@ stdenv.mkDerivation rec {
    hash = "sha256-INX8TOEumz4B5coSxhiV7opc3rYJuQXT2k1BJ3Aje1M=";
  };

-  nativeBuildInputs = [ fixedMeson cmake ninja ];
+  nativeBuildInputs = [ meson cmake ninja ];

  meta = with lib;{
    homepage = "https://github.com/marzer/tomlplusplus";
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@ -25,7 +25,6 @@
 , freezegun
 , gunicorn
 , pytest-mock
-, pytest-xdist
 , pytestCheckHook
 , re-assert
 , trustme
@ -81,12 +80,12 @@ buildPythonPackage rec {
    idna-ssl
  ];

+  # NOTE: pytest-xdist cannot be added because it is flaky. See https://github.com/NixOS/nixpkgs/issues/230597 for more info.
  nativeCheckInputs = [
    async_generator
    freezegun
    gunicorn
    pytest-mock
-    pytest-xdist
    pytestCheckHook
    re-assert
  ] ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) [
--- a/pkgs/development/python-modules/beautifulsoup4/default.nix
+++ b/pkgs/development/python-modules/beautifulsoup4/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , chardet
+, hatchling
 , html5lib
 , lxml
 , pytestCheckHook
@ -12,8 +13,8 @@

 buildPythonPackage rec {
  pname = "beautifulsoup4";
-  version = "4.11.2";
-  format = "setuptools";
+  version = "4.12.2";
+  format = "pyproject";

  outputs = ["out" "doc"];

@ -21,23 +22,31 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vEvdpnF95aKYdDb7jXL0XckN2Fa9/VEqExTOkDSaAQY=";
+    hash = "sha256-SSu8adyjXRLarHHE2xv/8Mh2wA70ov+sziJtRjjrcto=";
  };

  nativeBuildInputs = [
+    hatchling
    sphinxHook
  ];

  propagatedBuildInputs = [
    chardet
-    html5lib
-    lxml
    soupsieve
  ];

+  passthru.optional-dependencies = {
+    html5lib = [
+      html5lib
+    ];
+    lxml = [
+      lxml
+    ];
+  };
+
  nativeCheckInputs = [
    pytestCheckHook
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);

  pythonImportsCheck = [
    "bs4"
@ -45,8 +54,8 @@ buildPythonPackage rec {

  meta = with lib; {
    changelog = "https://git.launchpad.net/beautifulsoup/tree/CHANGELOG?h=${version}";
-    homepage = "http://crummy.com/software/BeautifulSoup/bs4/";
    description = "HTML and XML parser";
+    homepage = "http://crummy.com/software/BeautifulSoup/bs4/";
    license = licenses.mit;
    maintainers = with maintainers; [ domenkozar ];
  };
--- a/pkgs/development/python-modules/cachecontrol/default.nix
+++ b/pkgs/development/python-modules/cachecontrol/default.nix
@ -27,6 +27,13 @@ buildPythonPackage rec {
    hash = "sha256-uUPIQz/n347Q9G7NDOGuB760B/KxOglUxiS/rYjt5Po=";
  };

+  postPatch = ''
+    # https://github.com/ionrock/cachecontrol/issues/297
+    substituteInPlace tests/test_etag.py --replace \
+      "requests.adapters.HTTPResponse.from_httplib" \
+      "urllib3.response.HTTPResponse.from_httplib"
+  '';
+
  propagatedBuildInputs = [
    msgpack
    requests
--- a/pkgs/development/python-modules/deprecated/default.nix
+++ b/pkgs/development/python-modules/deprecated/default.nix
@ -1,20 +1,27 @@
 { lib
-, fetchPypi
+, fetchFromGitHub
 , buildPythonPackage
 , wrapt
 , pytestCheckHook
+, sphinxHook
 }:

 buildPythonPackage rec {
  pname = "deprecated";
  version = "1.2.13";
+  outputs = [ "out" "doc" ];

-  src = fetchPypi {
-    pname = "Deprecated";
-    inherit version;
-    hash = "sha256-Q6xTNdqQwxwkugKK9TapHUHVP55pAd2wIbzFcs5E440=";
+  src = fetchFromGitHub {
+    owner = "tantale";
+    repo = "deprecated";
+    rev = "v${version}";
+    hash = "sha256-rCDUY/TVmJqhrxDah62lEhqpr05JNZSyiFNTlHvSnmw=";
  };

+  nativeBuildInputs = [
+    sphinxHook
+  ];
+
  propagatedBuildInputs = [
    wrapt
  ];
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "3.2.18";
+  version = "3.2.19";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    pname = "Django";
    inherit version;
-    hash = "sha256-CCCN/okutk//BzynQ7O5UjERBPk55/ba6VT+ctzFM7o=";
+    hash = "sha256-AxNluuloFNoZwQcGIYxE3/O2VMxN4gqYvS0pub3kafA=";
  };

  patches = [
--- a/pkgs/development/python-modules/flit/default.nix
+++ b/pkgs/development/python-modules/flit/default.nix
@ -43,6 +43,11 @@ buildPythonPackage rec {
  disabledTests = [
    # needs some ini file.
    "test_invalid_classifier"
+    # calls pip directly. disabled for PEP 668
+    "test_install_data_dir"
+    "test_install_module_pep621"
+    "test_symlink_data_dir"
+    "test_symlink_module_pep621"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "orjson";
-  version = "3.8.9";
+  version = "3.8.11";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,13 +25,13 @@ buildPythonPackage rec {
    owner = "ijl";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-0/yvXXj+z2jBEAGxO4BxMnx1zqUoultYSYfSkKs+hKY=";
+    hash = "sha256-TFoagWUtd/nJceNaptgPp4aTR/tBCmxpiZIVJwOlia4=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-ogkTRRykLF2dTOxilsfwsRH+Au/O0e1kL1e9sFOFLeY=";
+    hash = "sha256-/x+0/I3WFxPwVu2LliTgr42SuJX7VjOLe/SGai5OgAw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pyasn1-modules/default.nix
+++ b/pkgs/development/python-modules/pyasn1-modules/default.nix
@ -1,35 +1,41 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pyasn1
-, pytest
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "pyasn1-modules";
-  version = "0.2.8";
+  version = "0.3.0";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "905f84c712230b2c592c19470d3ca8d552de726050d1d1716282a1f6146be65e";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pyasn1";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-AAS1VuppCIxgswpLSHFAc6q9cyJBLpdDuU9D1KU13vg=";
  };

-  propagatedBuildInputs = [ pyasn1 ];
-
-  nativeCheckInputs = [
-    pytest
+  propagatedBuildInputs = [
+    pyasn1
  ];

-  # running tests through setup.py fails only for python2 for some reason:
-  # AttributeError: 'module' object has no attribute 'suitetests'
-  checkPhase = ''
-    py.test
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pyasn1_modules"
+  ];

  meta = with lib; {
    description = "A collection of ASN.1-based protocols modules";
-    homepage = "https://pypi.python.org/pypi/pyasn1-modules";
+    homepage = "https://github.com/pyasn1/pyasn1-modules";
+    changelog = "https://github.com/pyasn1/pyasn1-modules/releases/tag/v${version}";
    license = licenses.bsd3;
-    platforms = platforms.unix;  # same as pyasn1
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/pyasn1/default.nix
+++ b/pkgs/development/python-modules/pyasn1/default.nix
@ -1,19 +1,29 @@
-{ lib, buildPythonPackage, fetchPypi, }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:

 buildPythonPackage rec {
  pname = "pyasn1";
-  version = "0.4.8";
+  version = "0.5.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "aef77c9fb94a3ac588e87841208bdec464471d9871bd5050a287cc9a475cd0ba";
+    hash = "sha256-l7cpDKaOYqgyVY7Dl28Vy/kRv118cDnYuGHCoOzmn94=";
  };

-  pythonImportsCheck = [ "pyasn1" ];
+  pythonImportsCheck = [
+    "pyasn1"
+  ];

  meta = with lib; {
    description = "Generic ASN.1 library for Python";
-    homepage = "https://github.com/etingof/pyasn1";
+    homepage = "https://pyasn1.readthedocs.io";
+    changelog = "https://github.com/etingof/pyasn1/blob/master/CHANGES.rst";
    license = licenses.bsd2;
    maintainers = with maintainers; [ SuperSandro2000 ];
  };
--- a/pkgs/development/python-modules/python3-saml/default.nix
+++ b/pkgs/development/python-modules/python3-saml/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , freezegun
 , isodate
 , lxml
@ -22,6 +23,14 @@ buildPythonPackage rec {
    hash = "sha256-xPPR2z3h8RpoAROpKpu9ZoDxGq5Stm9wQVt4Stj/6fg=";
  };

+  patches = [
+    (fetchpatch {
+      name = "test-expired.patch";
+      url = "https://github.com/SAML-Toolkits/python3-saml/commit/bd65578e5a21494c89320094c61c1c77250bea33.diff";
+      hash = "sha256-9Trew6R5JDjtc0NRGoklqMVDEI4IEqFOdK3ezyBU6gI=";
+    })
+  ];
+
  propagatedBuildInputs = [
    isodate
    lxml
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@ -2,13 +2,13 @@

 buildPythonPackage rec {
  pname = "pytz";
-  version = "2023.2";
+  version = "2023.3";

  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-on3PYSwF0uveYm99UGVV8Q38gVs+3cz6rfx9mbEcmgc=";
+    hash = "sha256-HYzinbGJGR+1UzjubQOH2Cq1nz0A6sEDQS1k4OvQxYg=";
  };

  nativeCheckInputs = [ unittestCheckHook ];
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "requests";
-  version = "2.28.2";
+  version = "2.29.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-mLGyeC48bEkEk4uEwOuTJyEGnf25E0MTvv98g8LfJL8=";
+    hash = "sha256-8uNKdfR0kBm7Dj7/tmaDYw5P/q91gZ+1G+vvG/Wu8Fk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@ -5,8 +5,11 @@
 , pytest-httpserver
 , pytestCheckHook
 , pythonOlder
+, pyyaml
 , requests
-, toml
+, tomli
+, tomli-w
+, types-pyyaml
 , types-toml
 , typing-extensions
 , urllib3
@ -14,7 +17,7 @@

 buildPythonPackage rec {
  pname = "responses";
-  version = "0.22.0";
+  version = "0.23.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -24,13 +27,14 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "getsentry";
    repo = pname;
-    rev = version;
-    hash = "sha256-VOIpowxPvYmufnj9MM/vMtZQDIOxorAhMCNK0fX/j1U=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-BU90nUZVqowFMn78KfbBEf59X7Q/1itvkGFdOzy4D2c=";
  };

  propagatedBuildInputs = [
+    pyyaml
    requests
-    toml
+    types-pyyaml
    types-toml
    urllib3
  ]  ++ lib.optionals (pythonOlder "3.8") [
@ -42,6 +46,9 @@ buildPythonPackage rec {
    pytest-asyncio
    pytest-httpserver
    pytestCheckHook
+    tomli-w
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    tomli
  ];

  pythonImportsCheck = [
@ -51,6 +58,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module for mocking out the requests Python library";
    homepage = "https://github.com/getsentry/responses";
+    changelog = "https://github.com/getsentry/responses/blob/${version}/CHANGES";
    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@ -7,6 +7,7 @@
 , pygments
 , typing-extensions
 , pytestCheckHook
+, setuptools

 # for passthru.tests
 , enrich
@ -17,7 +18,7 @@

 buildPythonPackage rec {
  pname = "rich";
-  version = "13.3.1";
+  version = "13.3.5";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -26,14 +27,17 @@ buildPythonPackage rec {
    owner = "Textualize";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-1soeb3aD4wB4stILvfOga/YZtyH6jd0XvnxkLmbW4G0=";
+    hash = "sha256-PnyO5u0gxfYKT6xr0k3H0lbLl9wKPl6oxR1mM9A0Hys=";
  };

-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];

  propagatedBuildInputs = [
    markdown-it-py
    pygments
+    setuptools
  ] ++ lib.optionals (pythonOlder "3.9") [
    typing-extensions
  ];
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "textual";
-  version = "0.15.1";
+  version = "0.23.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -31,18 +31,13 @@ buildPythonPackage rec {
    owner = "Textualize";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-UT+ApD/TTb5cxIdgK+n3B2J3z/nEwVXtuyPHpGCv6Tg=";
+    hash = "sha256-XgJ43yyiwzSH22NzidJ7z+Qh6+pOuAdfL7ZxabJkd3U=";
  };

  nativeBuildInputs = [
    poetry-core
  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'importlib-metadata = "^4.11.3"' 'importlib-metadata = "*"'
-  '';
-
  propagatedBuildInputs = [
    rich
    markdown-it-py
@ -77,6 +72,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "TUI framework for Python inspired by modern web development";
    homepage = "https://github.com/Textualize/textual";
+    changelog = "https://github.com/Textualize/textual/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ joelkoen ];
  };
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@ -69,6 +69,13 @@ buildPythonPackage rec {
      url = "https://github.com/mweinelt/twisted/commit/e69e652de671aac0abf5c7e6c662fc5172758c5a.patch";
      hash = "sha256-LmvKUTViZoY/TPBmSlx4S9FbJNZfB5cxzn/YcciDmoI=";
    })
+    # remove half broken pyasn1 integration that blow up with pyasn 0.5.0
+    # https://github.com/twisted/twisted/pull/11843
+    (fetchpatch {
+      url = "https://github.com/twisted/twisted/commit/bdee0eb835a76b2982beaf10c85269ff25ea09fa.patch";
+      excludes = [ "pyproject.toml" "tox.ini" ];
+      hash = "sha256-oGAHmZMpMWfK+2zEDjHD115sW7exCYqfORVOLw+Wa6M=";
+    })
  ] ++ lib.optionals (pythonAtLeast "3.11") [
    (fetchpatch {
      url = "https://github.com/twisted/twisted/pull/11734.diff";
@ -95,6 +102,9 @@ buildPythonPackage rec {
  ];

  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"pyasn1 >= 0.4",' ""
+
    echo 'ListingTests.test_localeIndependent.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
    echo 'ListingTests.test_newFile.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
    echo 'ListingTests.test_newSingleDigitDayOfMonth.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@ -30,6 +30,11 @@ buildPythonPackage rec {
    sha256 = "sha256-s89gs3H//Dc3k6BLZUC4APyDgiWY9LetWAkI+kXQTf8=";
  };

+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "beautifulsoup4>=4.8,<4.12" "beautifulsoup4>=4.8"
+  '';
+
  propagatedBuildInputs = [
    django
    django-modelcluster
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@ -72,6 +72,13 @@ python3.pkgs.buildPythonApplication rec {
        "docs/yaml/objects/dep.yaml"
      ];
    })
+
+    # Fix regression in precomputing CMAKE_SIZEOF_VOID_P
+    # See https://github.com/mesonbuild/meson/pull/11761
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/7c78c2b5a0314078bdabb998ead56925dc8b0fc0.patch";
+      sha256 = "sha256-vSnHhuOIXf/1X+bUkUmGND5b30ES0O8EDArwb4p2/w4=";
+    })
  ];

  setupHook = ./setup-hook.sh;
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@ -1,4 +1,15 @@
-{ lib, stdenv, cmake, fetchFromGitHub, python3, flex, bison, qt5, CoreServices, libiconv }:
+{ lib
+, stdenv
+, cmake
+, fetchFromGitHub
+, python3
+, flex
+, bison
+, qt5
+, CoreServices
+, libiconv
+, withSqlite ? true, sqlite
+}:

 stdenv.mkDerivation rec {
  pname = "doxygen";
@ -19,16 +30,23 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [ libiconv ]
+    ++ lib.optionals withSqlite [ sqlite ]
    ++ lib.optionals (qt5 != null) (with qt5; [ qtbase wrapQtAppsHook ])
    ++ lib.optionals stdenv.isDarwin [ CoreServices ];

-  cmakeFlags =
-    [ "-DICONV_INCLUDE_DIR=${libiconv}/include" ] ++
-    lib.optional (qt5 != null) "-Dbuild_wizard=YES";
+  cmakeFlags = [ "-DICONV_INCLUDE_DIR=${libiconv}/include" ]
+    ++ lib.optional withSqlite "-Duse_sqlite3=ON"
+    ++ lib.optional (qt5 != null) "-Dbuild_wizard=YES";

  env.NIX_CFLAGS_COMPILE =
    lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";

+  # put examples in an output so people/tools can test against them
+  outputs = [ "out" "examples" ];
+  postInstall = ''
+    cp -r ../examples $examples
+  '';
+
  meta = {
    license = lib.licenses.gpl2Plus;
    homepage = "https://www.doxygen.nl/";
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@ -48,6 +48,12 @@ stdenv.mkDerivation rec {

  patches = [
    ./debug-info-from-env.patch
+
+    # Backport musl fix
+    (fetchpatch {
+      url = "https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=2e977d9901393ea1bacbe1896af0929e968bc811";
+      hash = "sha256-/+UYjiOxrszJy1x8xavs63/ptNZ+ISIAQhG+i86VDpA=";
+    })
  ] ++ lib.optionals stdenv.isDarwin [
    ./darwin-target-match.patch
  ];
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "hwdata";
-  version = "0.369";
+  version = "0.370";

  src = fetchFromGitHub {
    owner = "vcrhonek";
    repo = "hwdata";
    rev = "v${version}";
-    sha256 = "sha256-0AyWRir2pT4wBf2/06zVDIUWru8oGaIHoKXVz/3CiSc=";
+    sha256 = "sha256-fqhYPKqtuI+7h/SgdWI4i7jBTgluy/hI8Q6pq4LKtY4=";
  };

  postPatch = ''
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "iproute2";
-  version = "6.2.0";
+  version = "6.3.0";

  src = fetchurl {
    url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-TXJzAgDsWyqrqhovIFU8Z0gpLwZdmhVMfV4iVZ35/WI=";
+    sha256 = "sha256-37KpjbluemU8/8ZpMzWhpGbimjS2rFKL5I814dJ2ZzI=";
  };

  patches = [
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@ -1024,6 +1024,8 @@ let
      CROS_EC_ISHTP = module;

      CROS_KBD_LED_BACKLIGHT = module;
+
+      TCG_TIS_SPI_CR50 = whenAtLeast "5.5" yes;
    } // optionalAttrs (versionAtLeast version "5.4" && stdenv.hostPlatform.system == "x86_64-linux") {
      CHROMEOS_LAPTOP = module;
      CHROMEOS_PSTORE = module;
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@ -15,6 +15,4 @@ buildLinux (args // rec {
    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
    sha256 = "1w56qgf1vgk3dmh4xw6699kjm5pdqvyfzr19ah5yy3xj50a4q2bs";
  };
-  # TODO: possible to remove after any rebuild, e.g. after update.
-  extraConfig = lib.optionalString (buildPackages.stdenv.system == "x86_64-linux") "\n";
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@ -141,7 +141,7 @@ stdenv.mkDerivation ({
  postPatch = ''
    sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'

-    # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
+    # fixup for pre-4.15 kernels using the $(cd $foo && /bin/pwd) pattern
    # FIXME: remove when no longer needed
    substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd

--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "libbpf";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "libbpf";
    repo = "libbpf";
    rev = "v${version}";
-    sha256 = "sha256-/vt6IA1o0gjFtXUWhEKIZ1DUWIN2LOvrhLfFzJBACGY=";
+    sha256 = "sha256-NimK4pdYcai21hZHdP1mBX1MOlNY61iDJ+PDYwpRuVE=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@ -7,11 +7,11 @@ assert usePam -> pam != null;

 stdenv.mkDerivation rec {
  pname = "libcap";
-  version = "2.67";
+  version = "2.68";

  src = fetchurl {
    url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-zpsi/cJxvrba51Q9pfdM8ky4LmhIz9CIpaBp3sXqUZg=";
+    sha256 = "sha256-kL47bUG+X4GuSwPsdgErDSfIKSk2hPbAW2XV+cznJLI=";
  };

  outputs = [ "out" "dev" "lib" "man" "doc" ]
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@ -332,6 +332,13 @@ self: super:
  });

  libpciaccess = super.libpciaccess.overrideAttrs (attrs: {
+    patches = attrs.patches or [] ++ [
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/xorg/lib/libpciaccess/-/commit/833c86ce15cee2a84a37ae71015f236fd32615d9.patch";
+        hash = "sha256-6koQV+Vse7/OWwuWYrWmBUebHBT+5F32Kkn9V9j+m+Q=";
+      })
+    ];
+
    buildInputs = lib.optionals stdenv.hostPlatform.isNetBSD (with netbsd; [ libarch libpci ]);

    meta = attrs.meta // {
--- a/pkgs/test/cc-wrapper/default.nix
+++ b/pkgs/test/cc-wrapper/default.nix
@ -13,6 +13,8 @@ in stdenv.mkDerivation {
  name = "cc-wrapper-test";

  buildCommand = ''
+    set -o pipefail
+
    NIX_DEBUG=1 $CC -v
    NIX_DEBUG=1 $CXX -v

@ -43,6 +45,27 @@ in stdenv.mkDerivation {
      ''}
    ''}

+    ${# See: https://github.com/llvm/llvm-project/commit/ed1d07282cc9d8e4c25d585e03e5c8a1b6f63a74
+      # `gcc` does not support this so we gate the test on `clang`
+      lib.optionalString stdenv.cc.isClang ''
+        printf "checking whether cc-wrapper accepts -- followed by positional (file) args..." >&2
+        mkdir -p positional
+
+        # Make sure `--` is not parsed as a "non flag arg"; we should get an
+        # input file error here and *not* a linker error.
+        { ! $CC --; } |& grep -q "no input files"
+
+        # And that positional file args _must_ be files (this is just testing
+        # that we remembered to put the `--` back in the args to the compiler):
+        { ! $CC -c -- -o foo ${./foo.c}; } \
+          |& grep -q "no such file or directory: '-o'"
+
+        # Now check that we accept single and multiple positional file args:
+        $CC -c -DVALUE=42 -o positional/foo.o -- ${./foo.c}
+        $CC -o positional/main -- positional/foo.o ${./ldflags-main.c}
+        ${emulator} ./positional/main
+    ''}
+
    printf "checking whether compiler uses NIX_CFLAGS_COMPILE... " >&2
    mkdir -p foo/include
    cp ${./foo.c} foo/include/foo.h
--- a/pkgs/tools/archivers/cpio/default.nix
+++ b/pkgs/tools/archivers/cpio/default.nix
@ -1,35 +1,14 @@
-{ lib, stdenv, fetchurl, fetchpatch }:
+{ lib, stdenv, fetchurl }:

 stdenv.mkDerivation rec {
  pname = "cpio";
-  version = "2.13";
+  version = "2.14";

  src = fetchurl {
    url = "mirror://gnu/cpio/cpio-${version}.tar.bz2";
-    sha256 = "0vbgnhkawdllgnkdn6zn1f56fczwk0518krakz2qbwhxmv2vvdga";
+    sha256 = "/NwV1g9yZ6b8fvzWudt7bIlmxPL7u5ZMJNQTNv0/LBI=";
  };

-  patches = let
-    fp = suffix: rev: sha256: fetchpatch {
-      name = "CVE-2021-38185-${suffix}.patch";
-      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=${rev}";
-      inherit sha256;
-    };
-  in [
-    (fp "1" "dd96882877721703e19272fe25034560b794061b"
-        "0vmr0qjwj2ldnzsvccl105ckwgx3ssvn9mp3f27ss0kiyigrzz32")
-    (fp "2" "dfc801c44a93bed7b3951905b188823d6a0432c8"
-        "1qkrhi3lbxk6hflp6w3h4sgssc0wblv8r0qgxqzbjrm36pqwxiwh")
-    (fp "3" "236684f6deb3178043fe72a8e2faca538fa2aae1"
-        "0pidkbxalpj5yz4fr95x8h0rizgjij0xgvjgirfkjk460giawwg6")
-    (fetchpatch {
-      # upstream build fix against -fno-common compilers like >=gcc-10
-      name = "fno-common-fix.patch";
-      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=641d3f489cf6238bb916368d4ba0d9325a235afb";
-      sha256 = "1ffawzxjw72kzpdwffi2y7pvibrmwf4jzrxdq9f4a75q6crl66iq";
-    })
-  ];
-
  separateDebugInfo = true;

  preConfigure = lib.optionalString stdenv.isCygwin ''
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "xz";
-  version = "5.4.2";
+  version = "5.4.3";

  src = fetchurl {
    url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "sha256-qkmQnL2QKMRmajX6SXX5piA+2YFU+7giPuQ++c7ul8M=";
+    sha256 = "sha256-kkOgRZjXpwwfVnoBQ6JVWBrFxksUD9Vf1cvB4AsOb5A=";
  };

  strictDeps = true;
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@ -12,11 +12,11 @@ assert guiSupport -> enableMinimal == false;

 stdenv.mkDerivation rec {
  pname = "gnupg";
-  version = "2.4.1";
+  version = "2.4.0";

  src = fetchurl {
    url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    hash = "sha256-drceWutEO/2RDOnLyCgbYXyDQWh6+2e65FWHeXK1neg=";
+    hash = "sha256-HXkVjdAdmSQx3S4/rLif2slxJ/iXhOosthDGAPsMFIM=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -18116,9 +18116,9 @@ with pkgs;

  dot2tex = with python3.pkgs; toPythonApplication dot2tex;

-  doxygen = callPackage ../development/tools/documentation/doxygen {
+  doxygen = darwin.apple_sdk_11_0.callPackage ../development/tools/documentation/doxygen {
    qt5 = null;
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
+    inherit (darwin.apple_sdk_11_0.frameworks) CoreServices;
  };

  doxygen_gui = lowPrio (doxygen.override { inherit qt5; });
@ -20963,8 +20963,11 @@ with pkgs;
  icu72 = callPackage ../development/libraries/icu/72.nix ({
    nativeBuildRoot = buildPackages.icu72.override { buildRootOnly = true; };
  });
+  icu73 = callPackage ../development/libraries/icu/73.nix ({
+    nativeBuildRoot = buildPackages.icu72.override { buildRootOnly = true; };
+  });

-  icu = icu72;
+  icu = icu73;

  id3lib = callPackage ../development/libraries/id3lib { };