Merge #252332: staging-next 2023-08-30

2023-09-06 08:15:16 +02:00 · 2023-09-06 08:15:16 +02:00 · 6485865ec3
parent 8fa0d873d4 750d11f68b
commit 6485865ec3
86 changed files with 604 additions and 301 deletions
--- a/doc/hooks/waf.section.md
+++ b/doc/hooks/waf.section.md
@ -1,16 +1,16 @@
-# wafHook {#wafhook}
+# waf.hook {#wafhook}

 [Waf](https://waf.io) is a Python-based software building system.

-In Nixpkgs, `wafHook` overrides the default configure, build, and install phases.
+In Nixpkgs, `waf.hook` overrides the default configure, build, and install phases.

-## Variables controlling wafHook {#variablesControllingWafHook}
+## Variables controlling waf.hook {#variablesControllingWafHook}

 ### `wafPath` {#wafPath}

 Location of the `waf` tool. It defaults to `./waf`, to honor software projects that include it directly inside their source trees.

-If `wafPath` doesn't exist, then `wafHook` will copy the `waf` provided from Nixpkgs to it.
+If `wafPath` doesn't exist, then `waf.hook` will copy the `waf` provided from Nixpkgs to it.

 ### `wafConfigureFlags` {#wafConfigureFlags}

@ -36,9 +36,9 @@ When set to true, don't use the predefined `wafBuildPhase`.

 When set to true, don't use the predefined `wafInstallPhase`.

-### Variables honored by wafHook {#variablesHonoredByWafHook}
+### Variables honored by waf.hook {#variablesHonoredByWafHook}

-The following variables commonly used by `stdenv.mkDerivation` are also honored by `wafHook`.
+The following variables commonly used by `stdenv.mkDerivation` are also honored by `waf.hook`.

 - `prefixKey`
 - `configureTargets`
--- a/pkgs/applications/audio/ams-lv2/default.nix
+++ b/pkgs/applications/audio/ams-lv2/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cairo, fftw, gtkmm2, lv2, lvtk, pkg-config
-, wafHook, python3 }:
+, waf, python3 }:

 stdenv.mkDerivation  rec {
  pname = "ams-lv2";
@ -12,7 +12,7 @@ stdenv.mkDerivation  rec {
    sha256 = "1lz2mvk4gqsyf92yxd3aaldx0d0qi28h4rnnvsaz4ls0ccqm80nk";
  };

-  nativeBuildInputs = [ pkg-config wafHook python3 ];
+  nativeBuildInputs = [ pkg-config waf.hook python3 ];
  buildInputs = [ cairo fftw gtkmm2 lv2 lvtk ];

  meta = with lib; {
--- a/pkgs/applications/audio/ardour/6.nix
+++ b/pkgs/applications/audio/ardour/6.nix
@ -50,7 +50,7 @@
 , suil
 , taglib
 , vamp-plugin-sdk
-, wafHook
+, waf
 , xjadeo
 , videoSupport ? true
 }:
@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
    perl
    pkg-config
    python3
-    wafHook
+    waf.hook
  ];

  buildInputs = [
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@ -52,7 +52,7 @@
 , suil
 , taglib
 , vamp-plugin-sdk
-, wafHook
+, waf
 , xjadeo
 , videoSupport ? true
 }:
@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
    perl
    pkg-config
    python3
-    wafHook
+    waf.hook
  ];

  buildInputs = [
--- a/pkgs/applications/audio/fomp/default.nix
+++ b/pkgs/applications/audio/fomp/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, lv2, pkg-config, python3, wafHook }:
+{ lib, stdenv, fetchurl, lv2, pkg-config, python3, waf }:

 stdenv.mkDerivation rec {
  pname = "fomp";
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-xnGijydiO3B7BjSlryFuH1j/OPio9hCYbniq2IXp2W8=";
  };

-  nativeBuildInputs = [ pkg-config wafHook ];
+  nativeBuildInputs = [ pkg-config waf.hook ];
  buildInputs = [ lv2 python3 ];

  meta = with lib; {
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@ -30,7 +30,7 @@
 , serd
 , sord
 , sratom
-, wafHook
+, waf
 , wrapGAppsHook
 , zita-convolver
 , zita-resampler
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
    intltool
    pkg-config
    python3
-    wafHook
+    waf.hook
    wrapGAppsHook
  ];

--- a/pkgs/applications/audio/ingen/default.nix
+++ b/pkgs/applications/audio/ingen/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchgit, boost, ganv, glibmm, gtkmm2, libjack2, lilv
 , lv2, pkg-config, python3, raul, serd, sord, sratom
-, wafHook
+, waf
 , suil
 }:

@ -16,7 +16,7 @@ stdenv.mkDerivation  rec {
    deepClone = true;
  };

-  nativeBuildInputs = [ pkg-config wafHook python3 python3.pkgs.wrapPython ];
+  nativeBuildInputs = [ pkg-config waf.hook python3 python3.pkgs.wrapPython ];
  buildInputs = [
    boost ganv glibmm gtkmm2 libjack2 lilv lv2
    python3 raul serd sord sratom suil
--- a/pkgs/applications/audio/jalv/default.nix
+++ b/pkgs/applications/audio/jalv/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, gtk2, libjack2, lilv, lv2, pkg-config, python3
-, serd, sord , sratom, suil, wafHook }:
+, serd, sord , sratom, suil, waf }:

 stdenv.mkDerivation  rec {
  pname = "jalv";
@ -10,7 +10,7 @@ stdenv.mkDerivation  rec {
    sha256 = "sha256-ktFBeBtmQ3MgfDQ868XpuM7UYfryb9zLld8AB7BjnhY=";
  };

-  nativeBuildInputs = [ pkg-config wafHook ];
+  nativeBuildInputs = [ pkg-config waf.hook ];
  buildInputs = [
    gtk2 libjack2 lilv lv2 python3 serd sord sratom suil
  ];
--- a/pkgs/applications/audio/mda-lv2/default.nix
+++ b/pkgs/applications/audio/mda-lv2/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fftwSinglePrec, lv2, pkg-config, wafHook, python3 }:
+{ lib, stdenv, fetchurl, fftwSinglePrec, lv2, pkg-config, waf, python3 }:

 stdenv.mkDerivation rec {
  pname = "mda-lv2";
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-zWYRcCSuBJzzrKg/npBKcCdyJOI6lp9yqcXQEKSYV9s=";
  };

-  nativeBuildInputs = [ pkg-config wafHook python3 ];
+  nativeBuildInputs = [ pkg-config waf.hook python3 ];
  buildInputs = [ fftwSinglePrec lv2 ];

  meta = with lib; {
--- a/pkgs/applications/audio/non/default.nix
+++ b/pkgs/applications/audio/non/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, python3, cairo, libjpeg, ntk, libjack2
-, libsndfile, ladspaH, liblo, libsigcxx, lrdf, wafHook
+, libsndfile, ladspaH, liblo, libsigcxx, lrdf, waf
 }:

 stdenv.mkDerivation {
@ -12,7 +12,7 @@ stdenv.mkDerivation {
    sha256 = "sha256-iMJNMDytNXpEkUhL0RILSd25ixkm8HL/edtOZta0Pf4=";
  };

-  nativeBuildInputs = [ pkg-config wafHook ];
+  nativeBuildInputs = [ pkg-config waf.hook ];
  buildInputs = [ python3 cairo libjpeg ntk libjack2 libsndfile
                  ladspaH liblo libsigcxx lrdf
  ];
--- a/pkgs/applications/audio/patchage/default.nix
+++ b/pkgs/applications/audio/patchage/default.nix
@ -10,7 +10,7 @@
 , libjack2
 , pkg-config
 , python3
-, wafHook
+, waf
 }:

 stdenv.mkDerivation rec {
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    gtkmm2
    libjack2
    python3
-    wafHook
+    waf.hook
  ];

  meta = {
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1642";
+  version = "9.0.1811";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-WWj8lZZtnGrv3pxu77otBKixS3ciLcznCyPk/iGryg4=";
+    hash = "sha256-b/fATWaHcIZIvkmr/UQ4R45ii9N0kWJMb7DerF/JYIA=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/misc/hamster/default.nix
+++ b/pkgs/applications/misc/hamster/default.nix
@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, python3Packages, intltool, glib, itstool, gtk3
-, wrapGAppsHook, gobject-introspection, pango, gdk-pixbuf, atk, wafHook }:
+, wrapGAppsHook, gobject-introspection, pango, gdk-pixbuf, atk, waf }:

 python3Packages.buildPythonApplication rec {
  pname = "hamster";
@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
    wrapGAppsHook
    intltool
    itstool
-    wafHook
+    waf.hook
    glib
    gobject-introspection
  ];
--- a/pkgs/applications/misc/kupfer/default.nix
+++ b/pkgs/applications/misc/kupfer/default.nix
@ -10,7 +10,7 @@
 , desktop-file-utils
 , shared-mime-info
 , wrapGAppsHook
-, wafHook
+, waf
 , bash
 , dbus
 }:
@ -31,7 +31,7 @@ buildPythonApplication rec {
  nativeBuildInputs = [
    wrapGAppsHook intltool
    # For setup hook
-    gobject-introspection wafHook
+    gobject-introspection waf.hook
    itstool            # for help pages
    desktop-file-utils # for update-desktop-database
    shared-mime-info   # for update-mime-info
--- a/pkgs/applications/office/semantik/default.nix
+++ b/pkgs/applications/office/semantik/default.nix
@ -3,7 +3,7 @@
 , mkDerivation
 , fetchFromGitLab
 , fetchpatch
-, wafHook
+, waf
 , pkg-config
 , cmake
 , qtbase
@ -65,7 +65,7 @@ mkDerivation rec {
      --replace /usr/include/KF5/KDELibs4Support "${lib.getDev kdelibs4support}/include/KF5/KDELibs4Support"
  '';

-  nativeBuildInputs = [ (lib.getDev qtsvg) (lib.getLib qtsvg) python3 pkg-config wafHook cmake ];
+  nativeBuildInputs = [ (lib.getDev qtsvg) (lib.getLib qtsvg) python3 pkg-config waf.hook cmake ];

  buildInputs = [
    qtbase
--- a/pkgs/applications/window-managers/eww/default.nix
+++ b/pkgs/applications/window-managers/eww/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "eww";
-  version = "unstable-2023-06-10";
+  version = "unstable-2023-08-18";

  src = fetchFromGitHub {
    owner = "elkowar";
    repo = "eww";
-    rev = "25e50eda46379bccd8a7887c18ee35833e0460e8";
-    hash = "sha256-8e6gHSg6FDp6nU5v89D44Tqb1lR5aQpS0lXOVqzoUS4=";
+    rev = "a9a35c1804d72ef92e04ee71555bd9e5a08fa17e";
+    hash = "sha256-GEysmNDm+olt1WXHzRwb4ZLifkXmeP5+APAN3b81/Og=";
  };

-  cargoHash = "sha256-dC7yVJdR7mO0n+sxWwigM1Q4tbDv5ZuOINHHlUIPdA0=";
+  cargoHash = "sha256-4yeu5AgleZMOLKNynGMd0XuyZxyyZ+RmzNtuJiNPN8g=";

  nativeBuildInputs = [ pkg-config wrapGAppsHook ];

--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -332,7 +332,16 @@ stdenv.mkDerivation {
  setupHooks = [
    ../setup-hooks/role.bash
  ] ++ lib.optional (cc.langC or true) ./setup-hook.sh
-    ++ lib.optional (cc.langFortran or false) ./fortran-hook.sh;
+    ++ lib.optional (cc.langFortran or false) ./fortran-hook.sh
+    ++ lib.optional (targetPlatform.isWindows) (stdenv.mkDerivation {
+      name = "win-dll-hook.sh";
+      dontUnpack = true;
+      installPhase = ''
+        echo addToSearchPath "LINK_DLL_FOLDERS" "${cc_solib}/lib" > $out
+        echo addToSearchPath "LINK_DLL_FOLDERS" "${cc_solib}/lib64" >> $out
+        echo addToSearchPath "LINK_DLL_FOLDERS" "${cc_solib}/lib32" >> $out
+      '';
+    });

  postFixup =
    # Ensure flags files exists, as some other programs cat them. (That these
--- a/pkgs/build-support/setup-hooks/win-dll-link.sh
+++ b/pkgs/build-support/setup-hooks/win-dll-link.sh
@ -1,45 +1,89 @@
-
 fixupOutputHooks+=(_linkDLLs)

-# For every *.{exe,dll} in $output/bin/ we try to find all (potential)
-# transitive dependencies and symlink those DLLs into $output/bin
-# so they are found on invocation.
-# (DLLs are first searched in the directory of the running exe file.)
-# The links are relative, so relocating whole /nix/store won't break them.
-_linkDLLs() {
-(
-    if [ ! -d "$prefix/bin" ]; then exit; fi
-    cd "$prefix/bin"
+addEnvHooks "$targetOffset" linkDLLGetFolders

-    # Compose path list where DLLs should be located:
-    #   prefix $PATH by currently-built outputs
-    local DLLPATH=""
-    local outName
-    for outName in $(getAllOutputNames); do
-        addToSearchPath DLLPATH "${!outName}/bin"
-    done
-    DLLPATH="$DLLPATH:$PATH"
-
-    echo DLLPATH="'$DLLPATH'"
-
-    linkCount=0
-    # Iterate over any DLL that we depend on.
-    local dll
-    for dll in $($OBJDUMP -p *.{exe,dll} | sed -n 's/.*DLL Name: \(.*\)/\1/p' | sort -u); do
-        if [ -e "./$dll" ]; then continue; fi
-        # Locate the DLL - it should be an *executable* file on $DLLPATH.
-        local dllPath="$(PATH="$DLLPATH" type -P "$dll")"
-        if [ -z "$dllPath" ]; then continue; fi
-        # That DLL might have its own (transitive) dependencies,
-        # so add also all DLLs from its directory to be sure.
-        local dllPath2
-        for dllPath2 in "$dllPath" "$(dirname $(readlink "$dllPath" || echo "$dllPath"))"/*.dll; do
-            if [ -e ./"$(basename "$dllPath2")" ]; then continue; fi
-            CYGWIN+=\ winsymlinks:nativestrict ln -sr "$dllPath2" .
-            linkCount=$(($linkCount+1))
-        done
-    done
-    echo "Created $linkCount DLL link(s) in $prefix/bin"
-)
+linkDLLGetFolders() {
+    addToSearchPath "LINK_DLL_FOLDERS" "$1/lib"
+    addToSearchPath "LINK_DLL_FOLDERS" "$1/bin"
 }

+_linkDLLs() {
+    linkDLLsInfolder "$prefix/bin"
+}
+
+# Try to links every known dependency of exe/dll in the folder of the 1str input
+# into said folder, so they are found on invocation.
+# (DLLs are first searched in the directory of the running exe file.)
+# The links are relative, so relocating whole /nix/store won't break them.
+linkDLLsInfolder() {
+    (
+        local folder
+        folder="$1"
+        if [ ! -d "$folder" ]; then
+            echo "Not linking DLLs in the non-existent folder $folder"
+            return
+        fi
+        cd "$folder" || exit
+
+        # Use associative arrays as set
+        local filesToChecks
+        local filesDone
+        declare -A filesToChecks # files that still needs to have their dependancies checked
+        declare -A filesDone     # files that had their dependancies checked and who is copied to the bin folder if found
+
+        markFileAsDone() {
+            if [ ! "${filesDone[$1]+a}" ]; then filesDone[$1]=a; fi
+            if [ "${filesToChecks[$1]+a}" ]; then unset 'filesToChecks[$1]'; fi
+        }
+
+        addFileToLink() {
+            if [ "${filesDone[$1]+a}" ]; then return; fi
+            if [ ! "${filesToChecks[$1]+a}" ]; then filesToChecks[$1]=a; fi
+        }
+
+        # Compose path list where DLLs should be located:
+        #   prefix $PATH by currently-built outputs
+        local DLLPATH=""
+        local outName
+        for outName in $(getAllOutputNames); do
+            addToSearchPath DLLPATH "${!outName}/bin"
+        done
+        DLLPATH="$DLLPATH:$LINK_DLL_FOLDERS"
+
+        echo DLLPATH="'$DLLPATH'"
+
+        for peFile in *.{exe,dll}; do
+            if [ -e "./$peFile" ]; then
+                addFileToLink "$peFile"
+            fi
+        done
+
+        local searchPaths
+        readarray -td: searchPaths < <(printf -- "%s" "$DLLPATH")
+
+        local linkCount=0
+        while [ ${#filesToChecks[*]} -gt 0 ]; do
+            local listOfDlls=("${!filesToChecks[@]}")
+            local file=${listOfDlls[0]}
+            markFileAsDone "$file"
+            if [ ! -e "./$file" ]; then
+                local pathsFound
+                readarray -d '' pathsFound < <(find "${searchPaths[@]}" -name "$file" -type f -print0)
+                if [ ${#pathsFound[@]} -eq 0 ]; then continue; fi
+                local dllPath
+                dllPath="${pathsFound[0]}"
+                CYGWIN+=" winsymlinks:nativestrict" ln -sr "$dllPath" .
+                echo "linking $dllPath"
+                file="$dllPath"
+                linkCount=$((linkCount + 1))
+            fi
+            # local dep_file
+            # Look at the file’s dependancies
+            for dep_file in $($OBJDUMP -p "$file" | sed -n 's/.*DLL Name: \(.*\)/\1/p' | sort -u); do
+                addFileToLink "$dep_file"
+            done
+        done
+
+        echo "Created $linkCount DLL link(s) in $folder"
+    )
+}
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, pkg-config, fetchFromGitHub, python3, vala
-, gtk3, libwnck, libxfce4util, xfce4-panel, wafHook, xfce
+, gtk3, libwnck, libxfce4util, xfce4-panel, waf, xfce
 , gitUpdater
 }:

@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-aKrJzf9rwCyXAJsRIXdBzmJBASuXD5I5kZrp+atx4FA=";
  };

-  nativeBuildInputs = [ pkg-config vala wafHook python3 ];
+  nativeBuildInputs = [ pkg-config vala waf.hook python3 ];
  buildInputs = [ gtk3 libwnck libxfce4util xfce4-panel ];

  postPatch = ''
--- a/pkgs/development/compilers/gcc/common/builder.nix
+++ b/pkgs/development/compilers/gcc/common/builder.nix
@ -219,6 +219,7 @@ originalAttrs: (stdenv.mkDerivation (finalAttrs: originalAttrs // {
    moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.la"  "''${!outputLib}"
    moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dylib" "''${!outputLib}"
    moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dll.a" "''${!outputLib}"
+    moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dll" "''${!outputLib}"
    moveToOutput "share/gcc-*/python" "''${!outputLib}"

    if [ -z "$enableShared" ]; then
@ -233,6 +234,8 @@ originalAttrs: (stdenv.mkDerivation (finalAttrs: originalAttrs // {
        moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.so*" "''${!outputLib}"
        moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.la"  "''${!outputLib}"
        moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dylib" "''${!outputLib}"
+        moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dll.a" "''${!outputLib}"
+        moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dll" "''${!outputLib}"

        for i in "''${!outputLib}/''${targetConfig}"/lib64/*.{la,py}; do
            substituteInPlace "$i" --replace "$out" "''${!outputLib}"
--- a/pkgs/development/compilers/rust/1_72.nix
+++ b/pkgs/development/compilers/rust/1_72.nix
@ -19,8 +19,8 @@
 } @ args:

 import ./default.nix {
-  rustcVersion = "1.71.1";
-  rustcSha256 = "sha256-b6kNUNHVKadfbMNJeE3lfX7AuiQZsJvefTNcJb1ORy4=";
+  rustcVersion = "1.72.0";
+  rustcSha256 = "sha256-6p1hu7UddrbqaBFW9p8OBZa1lyLwRBSwHG4QC0tb46E=";

  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
  llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
@ -34,25 +34,25 @@ import ./default.nix {

  # Note: the version MUST be one version prior to the version we're
  # building
-  bootstrapVersion = "1.70.0";
+  bootstrapVersion = "1.71.1";

  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
  bootstrapHashes = {
-    i686-unknown-linux-gnu = "119dfd4ee3da6c8fc36444dd15a12187e1f9b34ee6792fb75a6a25d09ea7e865";
-    x86_64-unknown-linux-gnu = "8499c0b034dd881cd9a880c44021632422a28dc23d7a81ca0a97b04652245982";
-    x86_64-unknown-linux-musl = "d97c2ac1d9f17e754fa6b7d48c28531d16278547e3fa47050a01da037ddb6de3";
-    arm-unknown-linux-gnueabihf = "ac98b513c31789d0c3201dfe2bbcc81b9437f7e1a15695d09402efec7934c20e";
-    armv7-unknown-linux-gnueabihf = "23e6029c2a7363b307af539f0c81f4bb9f0ade12b588658343c8a8cfa41526ae";
-    aarch64-unknown-linux-gnu = "3aa012fc4d9d5f17ca30af41f87e1c2aacdac46b51adc5213e7614797c6fd24c";
-    aarch64-unknown-linux-musl = "6381de0b55f1741ac322bf1b56701d8aab4e509ff5302043941170f8df34228e";
-    x86_64-apple-darwin = "e5819fdbfc7f1a4d5d82cb4c3b7662250748450b45a585433bfb75648bc45547";
-    aarch64-apple-darwin = "75cbc356a06c9b2daf6b9249febda0f0c46df2a427f7cc8467c7edbd44636e53";
-    powerpc64le-unknown-linux-gnu = "ba8cb5e3078b1bc7c6b27ab53cfa3af14001728db9a047d0bdf29b8f05a4db34";
-    riscv64gc-unknown-linux-gnu = "5964f78e5fb30506101a929162a42be6260b887660b71592c5f38466753440c3";
-    mips64el-unknown-linux-gnuabi64 = "de5fd0b249fbb95b9b67928ba08d7ec49f18f0ae25cbe1b0ede3c02390d7b93a";
+    i686-unknown-linux-gnu = "ea544e213cdf65194d9650df9d521dd2ed63251e2abe89c8123e336dfe580b21";
+    x86_64-unknown-linux-gnu = "34778d1cda674990dfc0537bc600066046ae9cb5d65a07809f7e7da31d4689c4";
+    x86_64-unknown-linux-musl = "67acc1744293e52f4b49231f3c503e8ad187c477e7b567e27925ec792d946a01";
+    arm-unknown-linux-gnueabihf = "4c88b32849132504fce5b93bebf06dd0fa17988340c7fe97afa661e038dfa258";
+    armv7-unknown-linux-gnueabihf = "8f8556dbd8b0350364c7dc8fda57549934bf3c26c65498dda5842087f5c90d60";
+    aarch64-unknown-linux-gnu = "c7cf230c740a62ea1ca6a4304d955c286aea44e3c6fc960b986a8c2eeea4ec3f";
+    aarch64-unknown-linux-musl = "da87f4ca2534886f1006b2e8abb0dda8db231ce82cc67b4857233ad48a21c87c";
+    x86_64-apple-darwin = "916056603da88336aba68bbeab49711cc8fdb9cfb46a49b04850c0c09761f58c";
+    aarch64-apple-darwin = "f4061b65b31ac75b9b5384c1f518e555f3da23f93bcf64dce252461ee65e9351";
+    powerpc64le-unknown-linux-gnu = "bac57066882366e4628d1ed2bbe4ab19c0b373aaf45582c2da9f639f2f6ea537";
+    riscv64gc-unknown-linux-gnu = "fcb67647b764669f3b4e61235fbdc0eca287229adf9aed8c41ce20ffaad4a3ea";
+    mips64el-unknown-linux-gnuabi64 = "6523efea9cd48c0375bd621460d890c65457a5534fafb2d8b69a37ee1e2a39ed";
  };

-  selectRustPackage = pkgs: pkgs.rust_1_71;
+  selectRustPackage = pkgs: pkgs.rust_1_72;

  rustcPatches = [ ];
 }
--- a/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
+++ b/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
@ -1,7 +1,17 @@
-{ lib, runCommand, makeBinaryWrapper, cargo, cargo-auditable }:
+{ lib, runCommand, makeBinaryWrapper, rust-audit-info, cargo, cargo-auditable }:

+if cargo-auditable.meta.broken then
+  cargo
+else
 runCommand "auditable-${cargo.name}" {
  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  passthru.tests = runCommand "rust-audit-info-test" {
+    nativeBuildInputs = [ rust-audit-info ];
+  } ''
+    rust-audit-info ${lib.getBin rust-audit-info}/bin/rust-audit-info > $out
+  '';
+
  meta = cargo-auditable.meta // {
    mainProgram = "cargo";
  };
@ -9,5 +19,6 @@ runCommand "auditable-${cargo.name}" {
  mkdir -p $out/bin
  makeWrapper ${cargo}/bin/cargo $out/bin/cargo \
    --set CARGO_AUDITABLE_IGNORE_UNSUPPORTED 1 \
-    --prefix PATH : ${lib.makeBinPath [ cargo cargo-auditable ]}
+    --prefix PATH : ${lib.makeBinPath [ cargo cargo-auditable ]} \
+    --add-flags auditable
 ''
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@ -15,6 +15,10 @@ rustPlatform.buildRustPackage rec {
  cargoHash = "sha256-SG/SFskr6ywCtJu2WVWTJC9GUKJJB0fUb+hZUaxag0M=";

  cargoBuildFlags = [ "--package" "wasmtime-cli" "--package" "wasmtime-c-api" ];
+  cargoPatches = [
+    # this patch is necessary until cargo-auditable is bumped on the rust platform
+    ./patches/0001-Use-dep-dependency-due-to-cargo-auditable-limitation.patch
+  ];

  outputs = [ "out" "dev" ];

--- a/pkgs/development/interpreters/wasmtime/patches/0001-Use-dep-dependency-due-to-cargo-auditable-limitation.patch
+++ b/pkgs/development/interpreters/wasmtime/patches/0001-Use-dep-dependency-due-to-cargo-auditable-limitation.patch
@ -0,0 +1,26 @@
+From a59bb5f9deeff156bd7bc9d22bc199e0f902b7dc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafael=20Fern=C3=A1ndez=20L=C3=B3pez?=
+ <ereslibre@ereslibre.es>
+Date: Mon, 4 Sep 2023 15:25:15 +0200
+Subject: [PATCH] Use `dep:` dependency due to `cargo-auditable` limitation
+
+`cargo-auditable` fails to process the current `Cargo.toml` as it
+is (cargo/rustc 1.72.0 is able to process this crate without any
+issues).
+---
+ crates/c-api/Cargo.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crates/c-api/Cargo.toml b/crates/c-api/Cargo.toml
+index a464c0dbd..1e793432c 100644
+--- a/crates/c-api/Cargo.toml
+++ b/crates/c-api/Cargo.toml
+@@ -37,4 +37,4 @@ default = ['jitdump', 'wat', 'wasi', 'cache', 'parallel-compilation']
+ jitdump = ["wasmtime/jitdump"]
+ cache = ["wasmtime/cache"]
+ parallel-compilation = ['wasmtime/parallel-compilation']
+-wasi = ['wasi-cap-std-sync', 'wasmtime-wasi', 'cap-std', 'wasi-common']
+wasi = ['wasi-cap-std-sync', 'wasmtime-wasi', 'dep:cap-std', 'wasi-common']
+-- 
+2.40.1
+
--- a/pkgs/development/libraries/aubio/default.nix
+++ b/pkgs/development/libraries/aubio/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, alsa-lib, fftw, libjack2, libsamplerate
-, libsndfile, pkg-config, python3, wafHook
+, libsndfile, pkg-config, python3, waf
 }:

 stdenv.mkDerivation rec {
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "1npks71ljc48w6858l9bq30kaf5nph8z0v61jkfb70xb9np850nl";
  };

-  nativeBuildInputs = [ pkg-config python3 wafHook ];
+  nativeBuildInputs = [ pkg-config python3 waf.hook ];
  buildInputs = [ alsa-lib fftw libjack2 libsamplerate libsndfile ];

  strictDeps = true;
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, lv2, pkg-config, python3, serd, sord, sratom, wafHook
+{ lib, stdenv, fetchurl, lv2, pkg-config, python3, serd, sord, sratom, waf

 # test derivations
 , pipewire
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {

  patches = [ ./lilv-pkgconfig.patch ];

-  nativeBuildInputs = [ pkg-config python3 wafHook ];
+  nativeBuildInputs = [ pkg-config python3 waf.hook ];
  buildInputs = [ serd sord sratom ];
  propagatedBuildInputs = [ lv2 ];
  dontAddWafCrossFlags = true;
--- a/pkgs/development/libraries/audio/lvtk/default.nix
+++ b/pkgs/development/libraries/audio/lvtk/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, boost, gtkmm2, lv2, pkg-config, python3, wafHook }:
+{ lib, stdenv, fetchFromGitHub, boost, gtkmm2, lv2, pkg-config, python3, waf }:

 stdenv.mkDerivation rec {
  pname = "lvtk";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-6IoyhBig3Nvc4Y8F0w8b1up6sn8O2RmoUVaBQ//+Aaw=";
  };

-  nativeBuildInputs = [ pkg-config python3 wafHook ];
+  nativeBuildInputs = [ pkg-config python3 waf.hook ];
  buildInputs = [ boost gtkmm2 lv2 ];

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/audio/ntk/default.nix
+++ b/pkgs/development/libraries/audio/ntk/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cairo, libjpeg, libXft, pkg-config, python3, wafHook }:
+{ lib, stdenv, fetchFromGitHub, cairo, libjpeg, libXft, pkg-config, python3, waf }:

 stdenv.mkDerivation rec {
  pname = "ntk";
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-NyEdg6e+9CI9V+TIgdpPyH1ei+Vq8pUxD3wPzWY5fEU=";
  };

-  nativeBuildInputs = [ pkg-config wafHook ];
+  nativeBuildInputs = [ pkg-config waf.hook ];
  buildInputs = [
    cairo libjpeg libXft python3
  ];
--- a/pkgs/development/libraries/audio/raul/default.nix
+++ b/pkgs/development/libraries/audio/raul/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, boost, gtk2, pkg-config, python3, wafHook }:
+{ lib, stdenv, fetchgit, boost, gtk2, pkg-config, python3, waf }:

 stdenv.mkDerivation rec {
  pname = "raul";
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
    sha256 = "1z37jb6ghc13b8nv8a8hcg669gl8vh4ni9djvfgga9vcz8rmcg8l";
  };

-  nativeBuildInputs = [ pkg-config wafHook python3 ];
+  nativeBuildInputs = [ pkg-config waf.hook python3 ];
  buildInputs = [ boost gtk2 ];

  strictDeps = true;
--- a/pkgs/development/libraries/audio/suil/default.nix
+++ b/pkgs/development/libraries/audio/suil/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, gtk2, lv2, pkg-config, python3, serd, sord, sratom
-, wafHook
+, waf
 , withQt5 ? true, qt5 ? null
 }:

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
    sha256 = "0z4v01pjw4wh65x38w6icn28wdwxz13ayl8hvn4p1g9kmamp1z06";
  };

-  nativeBuildInputs = [ pkg-config wafHook python3 ];
+  nativeBuildInputs = [ pkg-config waf.hook python3 ];
  buildInputs = [ gtk2 lv2 serd sord sratom ]
    ++ lib.optionals withQt5 (with qt5; [ qtbase qttools ]);

--- a/pkgs/development/libraries/exempi/default.nix
+++ b/pkgs/development/libraries/exempi/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "exempi";
-  version = "2.6.3";
+  version = "2.6.4";

  src = fetchurl {
    url = "https://libopenraw.freedesktop.org/download/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-sHSdsYqeeM93FzeVSoOM3NsdVBWIi6wbqcr4y6d8ZWw=";
+    sha256 = "sha256-p1FJyWth45zcsEb9XlbYjP7qtuCPiU4V6//ZlECSv9A=";
  };

  configureFlags = [
--- a/pkgs/development/libraries/fortify-headers/default.nix
+++ b/pkgs/development/libraries/fortify-headers/default.nix
@ -5,14 +5,14 @@

 stdenv.mkDerivation {
  pname = "fortify-headers";
-  version = "1.1alpine1";
+  version = "1.1alpine3";

  # upstream only accessible via git - unusable during bootstrap, hence
  # extract from the alpine package
  src = fetchurl {
-    url = "https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/fortify-headers-1.1-r1.apk";
+    url = "https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/fortify-headers-1.1-r3.apk";
    name = "fortify-headers.tar.gz";  # ensure it's extracted as a .tar.gz
-    hash = "sha256-A67NzUv+dldARY+MTaoVnezTg+Es8ZK/b7XOxA6KzpI=";
+    hash = "sha256-8A8JcKHIBgXpUuIP4zs3Q1yBs5jCGd5F3H2E8UN/S2g=";
  };

  installPhase = ''
--- a/pkgs/development/libraries/ganv/default.nix
+++ b/pkgs/development/libraries/ganv/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, graphviz, gtk2, gtkmm2, pkg-config, python3, wafHook }:
+{ lib, stdenv, fetchgit, graphviz, gtk2, gtkmm2, pkg-config, python3, waf }:

 stdenv.mkDerivation rec {
  pname = "ganv";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "01znnalirbqxpz62fbw2c14c8xn117jc92xv6dhb3hln92k9x37f";
  };

-  nativeBuildInputs = [ pkg-config wafHook python3 gtk2 ];
+  nativeBuildInputs = [ pkg-config waf.hook python3 gtk2 ];
  buildInputs = [ graphviz gtkmm2 ];

  strictDeps = true;
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@ -11,7 +11,7 @@
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , cmocka
-, wafHook
+, waf
 , libxcrypt
 }:

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    pkg-config
    python3
-    wafHook
+    waf.hook
    libxslt
    docbook-xsl-nons
    docbook_xml_dtd_42
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , python3
@ -20,29 +19,16 @@

 stdenv.mkDerivation rec {
  pname = "libgit2";
-  version = "1.7.0";
+  version = "1.7.1";
  # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib

  src = fetchFromGitHub {
    owner = "libgit2";
    repo = "libgit2";
    rev = "v${version}";
-    hash = "sha256-3ZVBGd2T5DQKsDEc5a7pS0yz01+rDCszU9ZK0zxvfyQ=";
+    hash = "sha256-3W0/i6Pu7I7D1zMQhmEqJVsa7PZpKOqU1+udNENSBvM=";
  };

-  patches = [
-    (fetchpatch {
-      name = "darwin-errSSLNetworkTimeout.patch";
-      url = "https://github.com/libgit2/libgit2/commit/3e15292d8863da316a57be23fede04f443460686.patch";
-      hash = "sha256-N314YK7osO9L3hCXb+FcMoDM8iBW9Bt8D5O2Szdz7YA=";
-    })
-    (fetchpatch {
-      name = "missing-git_oidarray.patch";
-      url = "https://github.com/libgit2/libgit2/commit/085a169c1d73e02888708652d7772b3bc1f1b28b.diff";
-      hash = "sha256-l6q1TLuOloyk0Jqvo5Npv4grU/oxlg+RFLa43qENaLI=";
-    })
-  ];
-
  cmakeFlags = [
    "-DUSE_HTTP_PARSER=system"
    "-DUSE_SSH=ON"
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -31,6 +32,24 @@ stdenv.mkDerivation rec {
    hash = "sha256-aaYjvJ2OMTzkUyqWCyHdmsKJ3VGqBmKQzb1DWK/1cPU=";
  };

+  patches = [
+    # Intel Mutual Authentication - FCC lock. Part of 1.30, backported to
+    # openSUSE and Fedora and ChromeOS.
+    # https://src.fedoraproject.org/rpms/libmbim/blob/rawhide/f/libmbim.spec
+    (fetchpatch {
+      url = "https://cgit.freedesktop.org/libmbim/libmbim/patch/?id=910db9cb2b6fde303d3b4720890cf6dc6fc00880";
+      hash = "sha256-412sXdWb8WsSexe1scI/C57dwENgNWoREGO1GxSF4hs=";
+    })
+
+    # Intel Tools. Allows tracing various commands. Part of 1.30, backported to
+    # openSUSE, Fedora and ChromeOS.
+    # https://src.fedoraproject.org/rpms/libmbim/blob/rawhide/f/libmbim.spec
+    (fetchpatch {
+      url = "https://cgit.freedesktop.org/libmbim/libmbim/patch/?id=8a6dec6ed11931601e605c9537da9904b3be5bc0";
+      hash = "sha256-tU4zkUl5aZJE+g/qbnWprUHe/PmZvqVKB9qecSaUBhk=";
+    })
+  ];
+
  mesonFlags = [
    "-Dudevdir=${placeholder "out"}/lib/udev"
    (lib.mesonBool "introspection" withIntrospection)
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@ -1,6 +1,15 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, autogen, pkg-config, python3
 , flac, lame, libmpg123, libogg, libopus, libvorbis
 , alsa-lib, Carbon, AudioToolbox
+
+# for passthru.tests
+, audacity
+, freeswitch
+, gst_all_1
+, libsamplerate
+, moc
+, pipewire
+, pulseaudio
 }:

 stdenv.mkDerivation rec {
@ -33,6 +42,29 @@ stdenv.mkDerivation rec {
  # Needed on Darwin.
  NIX_CFLAGS_LINK = "-logg -lvorbis";

+  doCheck = true;
+  preCheck = ''
+    patchShebangs tests/test_wrapper.sh tests/pedantic-header-test.sh
+
+    substituteInPlace tests/test_wrapper.sh \
+      --replace '/usr/bin/env' "$(type -P env)"
+  '';
+
+  passthru.tests = {
+    inherit
+      audacity
+      freeswitch
+      libsamplerate
+      moc
+      pipewire
+      pulseaudio;
+    inherit (python3.pkgs)
+      soundfile
+      wavefile;
+    inherit (gst_all_1) gst-plugins-bad;
+    lame = (lame.override { sndfileFileIOSupport = true; });
+  };
+
  meta = with lib; {
    description = "A C library for reading and writing files containing sampled sound";
    homepage    = "https://libsndfile.github.io/libsndfile/";
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@ -28,6 +28,9 @@ stdenv.mkDerivation (finalAttrs: {
    "--disable-werror"
  ];

+  # fixes: can't build x86_64-w64-mingw32 shared library unless -no-undefined is specified
+  makeFlags = lib.optionals stdenv.hostPlatform.isWindows [ "LDFLAGS=-no-undefined"] ;
+
  nativeBuildInputs = [
    perl
  ];
--- a/pkgs/development/libraries/ndn-cxx/default.nix
+++ b/pkgs/development/libraries/ndn-cxx/default.nix
@ -5,7 +5,7 @@
 , pkg-config
 , python3
 , python3Packages
-, wafHook
+, waf
 , boost179
 , openssl
 , sqlite
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-nnnxlkYVTSRB6ZcuIUDFol999+amGtqegHXK+06ITK8=";
  };

-  nativeBuildInputs = [ doxygen pkg-config python3 python3Packages.sphinx wafHook ];
+  nativeBuildInputs = [ doxygen pkg-config python3 python3Packages.sphinx waf.hook ];

  buildInputs = [ boost179 openssl sqlite ];

--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -75,7 +75,7 @@ let

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.78";
+    version = "0.3.79";

    outputs = [
      "out"
@ -93,7 +93,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-tiVuab8kugp9ZOKL/m8uZQps/pcrVihwB3rRf6SGuzc=";
+      sha256 = "sha256-pqs991pMqz3IQE+NUk0VNzZS4ExwfoZqBQDWBSGdWcs=";
    };

    patches = [
--- a/pkgs/development/libraries/protobuf/3.24.nix
+++ b/pkgs/development/libraries/protobuf/3.24.nix
@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic-v3-cmake.nix ({
+  version = "3.24.2";
+  sha256 = "sha256-yVLszyVtsz1CCzeOkioL4O3mWTFKKVBUyOhwDbC5UqE=";
+} // args)
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@ -8,7 +8,7 @@
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , fixDarwinDylibNames
-, wafHook
+, waf
 }:

 stdenv.mkDerivation rec {
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    pkg-config
    python3
-    wafHook
+    waf.hook
    docbook-xsl-nons
    docbook_xml_dtd_42
  ] ++ lib.optionals stdenv.isDarwin [
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchurl
 , pkg-config
-, wafHook
+, waf
 , python3
 , readline
 , libxslt
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    python3
    pkg-config
-    wafHook
+    waf.hook
    libxslt
    docbook-xsl-nons
    docbook_xml_dtd_45
--- a/pkgs/development/libraries/tevent/default.nix
+++ b/pkgs/development/libraries/tevent/default.nix
@ -9,7 +9,7 @@
 , docbook-xsl-nons
 , docbook_xml_dtd_42
 , which
-, wafHook
+, waf
 , libxcrypt
 }:

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    libxslt
    docbook-xsl-nons
    docbook_xml_dtd_42
-    wafHook
+    waf.hook
  ];

  buildInputs = [
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@ -28,7 +28,7 @@

 buildPythonPackage rec {
  pname = "anyio";
-  version = "3.7.0";
+  version = "3.7.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -37,7 +37,7 @@ buildPythonPackage rec {
    owner = "agronholm";
    repo = pname;
    rev = version;
-    hash = "sha256-uXPp2ycYl3T/ybZihDchImC/Yi4qgHI37ZeA+I6dg4c=";
+    hash = "sha256-9/pAcVTzw9v57E5l4d8zNyBJM+QNGEuLKrQ0WUBW5xw=";
  };

  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@ -1,10 +1,10 @@
 { lib
 , stdenv
-, callPackage
 , buildPythonPackage
-, fetchPypi
+, callPackage
 , cargo
 , cffi
+, fetchPypi
 , hypothesis
 , iso8601
 , isPyPy
@ -14,8 +14,8 @@
 , pkg-config
 , pretend
 , py
-, pytestCheckHook
 , pytest-subtests
+, pytestCheckHook
 , pythonOlder
 , pytz
 , rustc
@ -29,20 +29,20 @@ let
 in
 buildPythonPackage rec {
  pname = "cryptography";
-  version = "41.0.2"; # Also update the hash in vectors.nix
+  version = "41.0.3"; # Also update the hash in vectors.nix
  format = "pyproject";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fSML+FYWTeFk7LYVzMFMf8beaQbd1bSR86+Q01FMklw=";
+    hash = "sha256-bRknQRE+9eMNidy1uVbvThV48wRwhwG4tz044+FGHzQ=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    sourceRoot = "${pname}-${version}/${cargoRoot}";
    name = "${pname}-${version}";
-    hash = "sha256-hkuoICa/suMXlr4u95JbMlFzi27lJqJRmWnX3nZfzKU=";
+    hash = "sha256-LQu7waympGUs+CZun2yDQd2gUUAgyisKBG5mddrfSo0=";
  };

  postPatch = ''
@ -62,9 +62,14 @@ buildPythonPackage rec {
    cffi
  ];

-  buildInputs = [ openssl ]
-    ++ lib.optionals stdenv.isDarwin [ Security libiconv ]
-    ++ lib.optionals (pythonOlder "3.9") [ libxcrypt ];
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+    libiconv
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    libxcrypt
+  ];

  propagatedBuildInputs = lib.optionals (!isPyPy) [
    cffi
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@ -1,4 +1,9 @@
-{ buildPythonPackage, fetchPypi, lib, cryptography, setuptools }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, cryptography
+, setuptools
+}:

 buildPythonPackage rec {
  pname = "cryptography-vectors";
@ -9,15 +14,19 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "cryptography_vectors";
    inherit version;
-    hash = "sha256-Ao3/lKhSLKgYsRKV/xLfVfNI8zoZPAWX3f6COeU9FYI=";
+    hash = "sha256-gN4EUsSzT1b1UY6B69dba5BfVyiq7VIdQuQfTryKQ/s=";
  };

-  nativeBuildInputs = [ setuptools ];
+  nativeBuildInputs = [
+    setuptools
+  ];

  # No tests included
  doCheck = false;

-  pythonImportsCheck = [ "cryptography_vectors" ];
+  pythonImportsCheck = [
+    "cryptography_vectors"
+  ];

  meta = with lib; {
    description = "Test vectors for the cryptography package";
--- a/pkgs/development/python-modules/dnspython/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "dnspython";
-  version = "2.4.1";
+  version = "2.4.2";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wzlxx5r1vpaLuJfpXCRI4RpkXuhNk7Jlzgt6q+Xf3Kg=";
+    hash = "sha256-jc+ujHRgovhLQHLibxyfQQHKIMBxZJy3w06LapPViYQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/faust-cchardet/default.nix
+++ b/pkgs/development/python-modules/faust-cchardet/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "faust-cchardet";
-  version = "2.1.18";
+  version = "2.1.19";
  format = "pyproject";

  src = fetchFromGitHub {
@ -20,7 +20,7 @@ buildPythonPackage rec {
    repo = "cChardet";
    rev = "refs/tags/v${version}";
    fetchSubmodules = true;
-    hash = "sha256-jTOqxBss/FAb8nMkU62H6O4ysmirD2FTA9mtvxXh43k=";
+    hash = "sha256-yY6YEhXC4S47rxnkKAta4m16IVGn7gkHSt056bYOYJ4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/flask-limiter/default.nix
+++ b/pkgs/development/python-modules/flask-limiter/default.nix
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "alisaifee";
    repo = "flask-limiter";
    rev = "refs/tags/${version}";
-    hash = "sha256-YDVZ/dD+TRJEnJRTRmGEB6EIkK5eQ5MdXh8FideoVDQ=";
+    hash = "sha256-UtmMd180bwFm426YevARq6r7DL182dI7dGAUPFKLWuM=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@ -24,7 +24,7 @@

 buildPythonPackage rec {
  pname = "pikepdf";
-  version = "8.2.1";
+  version = "8.3.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -39,7 +39,7 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-8uPPEoLxoMRq/tkpThatwjPHZIMYQ8lNL6fLcG+nsnw=";
+    hash = "sha256-d76s4iJFwhzWSySXTS53PQQuWfWIboIRecEyjzobsME=";
  };

  patches = [
--- a/pkgs/development/python-modules/pillow-simd/default.nix
+++ b/pkgs/development/python-modules/pillow-simd/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, buildPythonPackage, fetchFromGitHub, isPyPy, isPy3k
 , olefile, freetype, libjpeg, zlib, libtiff, libwebp, libxcrypt, tcl, lcms2
 , libxcb, tk, libX11, openjpeg, libimagequant, pyroma, numpy, defusedxml
-, pytestCheckHook
+, pytestCheckHook, setuptools
 }@args:

 import ../pillow/generic.nix (rec {
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@ -6,7 +6,7 @@
 , fetchpatch
 , isPyPy
 , defusedxml, olefile, freetype, libjpeg, zlib, libtiff, libwebp, libxcrypt, tcl, lcms2, tk, libX11
-, libxcb, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook
+, libxcb, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook, setuptools
 # for passthru.tests
 , imageio, matplotlib, pilkit, pydicom, reportlab
 }@args:
--- a/pkgs/development/python-modules/pillow/generic.nix
+++ b/pkgs/development/python-modules/pillow/generic.nix
@ -39,6 +39,8 @@ buildPythonPackage rec {

  nativeCheckInputs = [ pytestCheckHook pyroma numpy ];

+  nativeBuildInputs = [ setuptools ];
+
  buildInputs = [ freetype libjpeg openjpeg libimagequant zlib libtiff libwebp libxcrypt tcl lcms2 ]
    ++ lib.optionals (lib.versionAtLeast version "7.1.0") [ libxcb ]
    ++ lib.optionals (isPyPy) [ tk libX11 ];
--- a/pkgs/development/python-modules/pip/default.nix
+++ b/pkgs/development/python-modules/pip/default.nix
@ -10,6 +10,9 @@
 , pretend
 , pytest

+# docs
+, sphinx
+
 # coupled downsteam dependencies
 , pip-tools
 }:
@ -36,18 +39,50 @@ buildPythonPackage rec {
    installShellFiles
    setuptools
    wheel
+
+    # docs
+    sphinx
  ];

+  outputs = [
+    "out"
+    "man"
+  ];
+
+  # pip uses a custom sphinx extension and unusual conf.py location, mimic the internal build rather than attempting
+  # to fit sphinxHook see https://github.com/pypa/pip/blob/0778c1c153da7da457b56df55fb77cbba08dfb0c/noxfile.py#L129-L148
+  postBuild = ''
+    cd docs
+
+    # remove references to sphinx extentions only required for html doc generation
+    # sphinx.ext.intersphinx requires network connection or packaged object.inv files for python and pypug
+    # sphinxcontrib.towncrier is not currently packaged
+    for ext in sphinx.ext.intersphinx sphinx_copybutton sphinx_inline_tabs sphinxcontrib.towncrier myst_parser; do
+      substituteInPlace html/conf.py --replace '"'$ext'",' ""
+    done
+
+    PYTHONPATH=$src/src:$PYTHONPATH sphinx-build -v \
+      -d build/doctrees/man \
+      -c html \
+      -d build/doctrees/man \
+      -b man \
+      man \
+      build/man
+    cd ..
+  '';
+
  nativeCheckInputs = [ mock scripttest virtualenv pretend pytest ];

  # Pip wants pytest, but tests are not distributed
  doCheck = false;

  postInstall = ''
+    installManPage docs/build/man/*
+
    installShellCompletion --cmd pip \
-      --bash <($out/bin/pip completion --bash) \
-      --fish <($out/bin/pip completion --fish) \
-      --zsh <($out/bin/pip completion --zsh)
+      --bash <($out/bin/pip completion --bash --no-cache-dir) \
+      --fish <($out/bin/pip completion --fish --no-cache-dir) \
+      --zsh <($out/bin/pip completion --zsh --no-cache-dir)
  '';

  passthru.tests = { inherit pip-tools; };
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "regex";
-  version = "2022.10.31";
+  version = "2023.8.8";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-o6mJIdqaG/hFeu7mpVGUioNgFonl7N1zaJTqm77HfoM=";
+    hash = "sha256-/L3F8rDxzQ9qVs20b+QdLM4eZE47aIMvPu68X7D3cS4=";
  };

  checkPhase = ''
--- a/pkgs/development/python-modules/ruamel-base/default.nix
+++ b/pkgs/development/python-modules/ruamel-base/default.nix
@ -18,6 +18,8 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "ruamel.base" ];

+  pythonNamespaces = [ "ruamel" ];
+
  meta = with lib; {
    description = "Common routines for ruamel packages";
    homepage = "https://sourceforge.net/projects/ruamel-base/";
--- a/pkgs/development/tools/build-managers/waf/default.nix
+++ b/pkgs/development/tools/build-managers/waf/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, callPackage
 , ensureNewerSourcesForZipFilesHook
 , python3
 # optional list of extra waf tools, e.g. `[ "doxygen" "pytest" ]`
@ -59,6 +60,13 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru = {
+    inherit python3 extraTools;
+    hook = callPackage ./hook.nix {
+      waf = finalAttrs.finalPackage;
+    };
+  };
+
  meta = {
    homepage = "https://waf.io";
    description = "The meta build system";
--- a/pkgs/development/tools/rust/cargo-c/default.nix
+++ b/pkgs/development/tools/rust/cargo-c/default.nix
@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-c";
-  version = "0.9.22";
+  version = "0.9.24";

  src = fetchCrate {
    inherit pname;
    # this version may need to be updated along with package version
-    version = "${version}+cargo-0.72";
-    hash = "sha256-B9y8/8qms+t6LnUFes4/MGcEp8P8C2hunCouiTMt0LY=";
+    version = "${version}+cargo-0.73.0";
+    hash = "sha256-eNaK+SRrHz/DXkCcJP040R6bdhyFmjxkwHbXVFlHub8=";
  };

-  cargoHash = "sha256-7amH8qPmi531sDy3aZsZ5J/oSCnbHY47YzsFODDPcBU=";
+  cargoHash = "sha256-Us50BbdNSJAx7JTKkvA4tjbGNueCJsAwGEelc1sP5pc=";

  nativeBuildInputs = [ pkg-config (lib.getDev curl) ];
  buildInputs = [ openssl curl ] ++ lib.optionals stdenv.isDarwin [
--- a/pkgs/development/web/edge-runtime/default.nix
+++ b/pkgs/development/web/edge-runtime/default.nix
@ -11,7 +11,7 @@

 let
  pname = "edge-runtime";
-  version = "1.10.0";
+  version = "1.14.0";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -20,16 +20,16 @@ rustPlatform.buildRustPackage {
    owner = "supabase";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-AWdgqL7Io4v3Z4XNS5JDDGuUeSqsNpF/NpJQ7h5oJZs=";
+    hash = "sha256-63XStzO4Jt6ObWuzcBf2QwCIWsStXvhQ0XaJabELhWg=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-AIwMoqbnCl4DFX0gSGblkV8DgtruwXPw8ngHeBDD6Dw=";
+  cargoHash = "sha256-JwwdvvpqgSbl0Xyb5pQ5hzZRrrCnDSjwV+ikdO2pXCk=";

  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];

  buildInputs = lib.optionals stdenv.isLinux [ openssl ]
-    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security CoreFoundation ]);
+    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security CoreFoundation SystemConfiguration ]);

  # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
  # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
--- a/pkgs/development/web/edge-runtime/librusty_v8.nix
+++ b/pkgs/development/web/edge-runtime/librusty_v8.nix
@ -1,3 +1,4 @@
+# auto-generated file -- DO NOT EDIT!
 { rust, stdenv, fetchurl }:

 let
@ -10,11 +11,11 @@ let
  };
 in
 fetch_librusty_v8 {
-  version = "0.68.0";
+  version = "0.74.3";
  shas = {
-    x86_64-linux = "sha256-yq7YPD2TM6Uw0EvCqIsZ/lbE1RLgIg7a42qDVrr5fX4=";
-    aarch64-linux = "sha256-uZFm3hAeyEUUXqRJFLM3OBVfglH3AecjFKVgeJZu3L0=";
-    x86_64-darwin = "sha256-YkxoggK0I4rT/KNJ30StDPLUc02Mdjwal3JH+s/YTQo=";
-    aarch64-darwin = "sha256-aXE7W3sSzbhvC661BYTTHyHlihmVVtFSv85nSjGOLkU=";
+    x86_64-linux = "sha256-8pa8nqA6rbOSBVnp2Q8/IQqh/rfYQU57hMgwU9+iz4A=";
+    aarch64-linux = "sha256-3kXOV8rlCNbNBdXgOtd3S94qO+JIKyOByA4WGX+XVP0=";
+    x86_64-darwin = "sha256-iBBVKZiSoo08YEQ8J/Rt1/5b7a+2xjtuS6QL/Wod5nQ=";
+    aarch64-darwin = "sha256-Djnuc3l/jQKvBf1aej8LG5Ot2wPT0m5Zo1B24l1UHsM=";
  };
 }
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, openssl, python, zlib, libuv, util-linux, http-parser
+{ lib, stdenv, fetchurl, openssl, python, zlib, libuv, util-linux, http-parser, bash
 , pkg-config, which, buildPackages
 # for `.pkgs` attribute
 , callPackage
@ -14,6 +14,8 @@
 let
  inherit (darwin.apple_sdk.frameworks) CoreServices ApplicationServices;

+  isCross = stdenv.hostPlatform != stdenv.buildPlatform;
+
  majorVersion = lib.versions.major version;
  minorVersion = lib.versions.minor version;

@ -48,12 +50,17 @@ let
      inherit sha256;
    };

+    strictDeps = true;
+
    CC_host = "cc";
    CXX_host = "c++";
-    depsBuildBuild = [ buildPackages.stdenv.cc openssl libuv zlib ];
+    depsBuildBuild = [ buildPackages.stdenv.cc openssl libuv zlib icu ];

+    # NB: technically, we do not need bash in build inputs since all scripts are
+    # wrappers over the corresponding JS scripts. There are some packages though
+    # that use bash wrappers, e.g. polaris-web.
    buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ApplicationServices ]
-      ++ [ zlib libuv openssl http-parser icu ];
+      ++ [ zlib libuv openssl http-parser icu bash ];

    nativeBuildInputs = [ which pkg-config python ]
      ++ lib.optionals stdenv.isDarwin [ xcbuild ];
@ -63,14 +70,11 @@ let
    moveToDev = false;

    configureFlags = let
-      isCross = stdenv.hostPlatform != stdenv.buildPlatform;
      inherit (stdenv.hostPlatform) gcc isAarch32;
    in sharedConfigureFlags ++ lib.optionals (lib.versionOlder version "19") [
      "--without-dtrace"
    ] ++ (lib.optionals isCross [
      "--cross-compiling"
-      "--without-intl"
-      "--without-snapshot"
      "--dest-cpu=${let platform = stdenv.hostPlatform; in
                    if      platform.isAarch32 then "arm"
                    else if platform.isAarch64 then "arm64"
@ -116,32 +120,28 @@ let

    inherit patches;

-    postPatch = ''
-      patchShebangs .
+    doCheck = lib.versionAtLeast version "16"; # some tests fail on v14

-      # fix tests
-      for a in test/parallel/test-child-process-env.js \
-               test/parallel/test-child-process-exec-env.js \
-               test/parallel/test-child-process-default-options.js \
-               test/fixtures/syntax/good_syntax_shebang.js \
-               test/fixtures/syntax/bad_syntax_shebang.js ; do
-        substituteInPlace $a \
-          --replace "/usr/bin/env" "${coreutils}/bin/env"
-      done
-    '' + lib.optionalString stdenv.isDarwin ''
-      sed -i -e "s|tr1/type_traits|type_traits|g" \
-             -e "s|std::tr1|std|" src/util.h
-    '';
+    # Some dependencies required for tools/doc/node_modules (and therefore
+    # test-addons, jstest and others) target are not included in the tarball.
+    # Run test targets that do not require network access.
+    checkTarget = lib.concatStringsSep " " [
+      "build-js-native-api-tests"
+      "build-node-api-tests"
+      "tooltest"
+      "cctest"
+    ];

-    nativeCheckInputs = [ procps ];
-    doCheck = false; # fails 4 out of 1453 tests
+    # Do not create __pycache__ when running tests.
+    checkFlags = [ "PYTHONDONTWRITEBYTECODE=1" ];

    postInstall = ''
-      PATH=$out/bin:$PATH patchShebangs $out
+      HOST_PATH=$out/bin patchShebangs --host $out

-      ${lib.optionalString (enableNpm && stdenv.hostPlatform == stdenv.buildPlatform) ''
-        mkdir -p $out/share/bash-completion/completions/
-        HOME=$TMPDIR $out/bin/npm completion > $out/share/bash-completion/completions/npm
+      ${lib.optionalString (enableNpm) ''
+        mkdir -p $out/share/bash-completion/completions
+        ln -s $out/lib/node_modules/npm/lib/utils/completion.sh \
+          $out/share/bash-completion/completions/npm
        for dir in "$out/lib/node_modules/npm/man/"*; do
          mkdir -p $out/share/man/$(basename "$dir")
          for page in "$dir"/*; do
@ -203,6 +203,14 @@ let
      platforms = platforms.linux ++ platforms.darwin;
      mainProgram = "node";
      knownVulnerabilities = optional (versionOlder version "18") "This NodeJS release has reached its end of life. See https://nodejs.org/en/about/releases/.";
+
+      # Node.js build system does not have separate host and target OS
+      # configurations (architectures are defined as host_arch and target_arch,
+      # but there is no such thing as host_os and target_os).
+      #
+      # We may be missing something here, but it doesn’t look like it is
+      # possible to cross-compile between different operating systems.
+      broken = stdenv.buildPlatform.parsed.kernel.name != stdenv.hostPlatform.parsed.kernel.name;
    };

    passthru.python = python; # to ensure nodeEnv uses the same version
--- a/pkgs/development/web/nodejs/trap-handler-backport.patch
+++ b/pkgs/development/web/nodejs/trap-handler-backport.patch
@ -0,0 +1,76 @@
+Backport V8_TRAP_HANDLER_SUPPORTED conditional compilation for trap
+handler implementation.
+
+See https://github.com/v8/v8/commit/e7bef8d4cc4f38cc3d5a532fbcc445dc62adc08f
+
+E.g. when cross-compiling from aarch64-linux for x86_64-linux target,
+handler-inside-posix.cc is built on aarch64-linux even though it is not
+supported; see src/trap-handler/trap-handler.h in v8 for (host, target)
+combinations where trap handler is supported.
+
+Note that handler-inside-posix.cc fails to build in the case above.
+
+diff --git a/deps/v8/src/trap-handler/handler-inside-posix.cc b/deps/v8/src/trap-handler/handler-inside-posix.cc
+index e4454c378f..17af3d75dc 100644
+--- a/deps/v8/src/trap-handler/handler-inside-posix.cc
+++ b/deps/v8/src/trap-handler/handler-inside-posix.cc
+@@ -47,6 +47,8 @@ namespace v8 {
+ namespace internal {
+ namespace trap_handler {
+ 
+#if V8_TRAP_HANDLER_SUPPORTED
+
+ #if V8_OS_LINUX
+ #define CONTEXT_REG(reg, REG) &uc->uc_mcontext.gregs[REG_##REG]
+ #elif V8_OS_DARWIN
+@@ -181,6 +183,8 @@ void HandleSignal(int signum, siginfo_t* info, void* context) {
+   // TryHandleSignal modifies context to change where we return to.
+ }
+ 
+#endif
+
+ }  // namespace trap_handler
+ }  // namespace internal
+ }  // namespace v8
+diff --git a/deps/v8/src/trap-handler/handler-inside-win.cc b/deps/v8/src/trap-handler/handler-inside-win.cc
+index fcccc78ee5..3d7a2c416a 100644
+--- a/deps/v8/src/trap-handler/handler-inside-win.cc
+++ b/deps/v8/src/trap-handler/handler-inside-win.cc
+@@ -38,6 +38,8 @@ namespace v8 {
+ namespace internal {
+ namespace trap_handler {
+ 
+#if V8_TRAP_HANDLER_SUPPORTED
+
+ // The below struct needed to access the offset in the Thread Environment Block
+ // to see if the thread local storage for the thread has been allocated yet.
+ //
+@@ -129,6 +131,8 @@ LONG HandleWasmTrap(EXCEPTION_POINTERS* exception) {
+   return EXCEPTION_CONTINUE_SEARCH;
+ }
+ 
+#endif
+
+ }  // namespace trap_handler
+ }  // namespace internal
+ }  // namespace v8
+diff --git a/deps/v8/src/trap-handler/handler-outside-simulator.cc b/deps/v8/src/trap-handler/handler-outside-simulator.cc
+index 179eab0659..5e58719e7f 100644
+--- a/deps/v8/src/trap-handler/handler-outside-simulator.cc
+++ b/deps/v8/src/trap-handler/handler-outside-simulator.cc
+@@ -4,6 +4,9 @@
+ 
+ #include "include/v8config.h"
+ #include "src/trap-handler/trap-handler-simulator.h"
+#include "src/trap-handler/trap-handler.h"
+
+#if V8_TRAP_HANDLER_SUPPORTED
+ 
+ #if V8_OS_DARWIN
+ #define SYMBOL(name) "_" #name
+@@ -35,3 +38,5 @@ asm(
+     SYMBOL(v8_probe_memory_continuation) ":         \n"
+     // If the trap handler continues here, it wrote the landing pad in %rax.
+     "  ret                                          \n");
+
+#endif
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@ -1,11 +1,10 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch, openssl, python3, enableNpm ? true }:

 let
  buildNodejs = callPackage ./nodejs.nix {
    inherit openssl;
    python = python3;
  };
-
 in
 buildNodejs {
  inherit enableNpm;
@ -16,5 +15,13 @@ buildNodejs {
    ./bypass-darwin-xcrun-node16.patch
    ./revert-arm64-pointer-auth.patch
    ./node-npm-build-npm-package-logic.patch
+    ./trap-handler-backport.patch
+    # Fixes target toolchain arguments being passed to the host toolchain when
+    # cross-compiling. For example, -m64 is not available on aarch64.
+    (fetchpatch {
+      name = "common-gypi-cross.patch";
+      url = "https://github.com/nodejs/node/pull/48597.patch";
+      hash = "sha256-FmHmwlTxPw5mTW6t4zuy9vr4FxopjU4Kx+F1aqabG1s=";
+    })
  ];
 }
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@ -5,7 +5,6 @@ let
    inherit openssl;
    python = python3;
  };
-
 in
 buildNodejs {
  inherit enableNpm;
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, python3Packages, makeWrapper
 , libsamplerate, libsndfile, readline, eigen, celt
-, wafHook
+, waf
 # Darwin Dependencies
 , aften, AudioUnit, CoreAudio, libobjc, Accelerate

@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {

  outputs = [ "out" "dev" ];

-  nativeBuildInputs = [ pkg-config python makeWrapper wafHook ];
+  nativeBuildInputs = [ pkg-config python makeWrapper waf.hook ];
  buildInputs = [ libsamplerate libsndfile readline eigen celt
    optDbus optPythonDBus optLibffado optAlsaLib optLibopus
  ] ++ lib.optionals stdenv.isDarwin [
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@ -8,6 +8,7 @@
 , fetchurl
 , flex
 , gnutls
+, installShellFiles
 , libuuid
 , meson-tools
 , ncurses
@ -61,6 +62,7 @@ let
      bison
      dtc
      flex
+      installShellFiles
      openssl
      (buildPackages.python3.withPackages (p: [
        p.libfdt
@ -132,6 +134,12 @@ in {
    dontStrip = false;
    extraMeta.platforms = lib.platforms.linux;
    extraMakeFlags = [ "HOST_TOOLS_ALL=y" "CROSS_BUILD_TOOLS=1" "NO_SDL=1" "tools" ];
+
+    outputs = [ "out" "man" ];
+
+    postInstall = ''
+      installManPage doc/*.1
+    '';
    filesToInstall = [
      "tools/dumpimage"
      "tools/fdtgrep"
--- a/pkgs/os-specific/linux/audit/000-fix-static-attribute-malloc.diff
+++ b/pkgs/os-specific/linux/audit/000-fix-static-attribute-malloc.diff
@ -1,12 +0,0 @@
--- a/auparse/auparse.h
-+++ b/auparse/auparse.h
-@@ -32,6 +32,9 @@
- # define __attr_dealloc(dealloc, argno)
- # define __attr_dealloc_free
- #endif
-+#ifndef __attribute_malloc__
-+# define __attribute_malloc__ __attribute__ ((__malloc__))
-+#endif
- 
- #ifdef __cplusplus
- extern "C" {
--- a/pkgs/os-specific/linux/audit/001-ignore-flexible-array.patch
+++ b/pkgs/os-specific/linux/audit/001-ignore-flexible-array.patch
@ -1,35 +0,0 @@
-From beed138222421a2eb4212d83cb889404bd7efc49 Mon Sep 17 00:00:00 2001
-From: Sergei Trofimovich <slyich@gmail.com>
-Date: Wed, 23 Mar 2022 07:27:05 +0000
-Subject: [PATCH] auditswig.i: avoid setter generation for audit_rule_data::buf
-
-As it's a flexible array generated code was never safe to use.
-With kernel's https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed98ea2128b6fd83bce13716edf8f5fe6c47f574
-change it's a build failure now:
-
-    audit> audit_wrap.c:5010:15: error: invalid use of flexible array member
-    audit>  5010 |     arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size));
-    audit>       |               ^
-
-Let's avoid setter generation entirely.
-
-Closes: https://github.com/linux-audit/audit-userspace/issues/252
---
- bindings/swig/src/auditswig.i | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/bindings/swig/src/auditswig.i b/bindings/swig/src/auditswig.i
-index 21aafca31..9a2c5661d 100644
--- a/bindings/swig/src/auditswig.i
-+++ b/bindings/swig/src/auditswig.i
-@@ -39,6 +39,10 @@ signed
- #define __attribute(X) /*nothing*/
- typedef unsigned __u32;
- typedef unsigned uid_t;
-+/* Sidestep SWIG's limitation of handling c99 Flexible arrays by not:
-+ * generating setters against them: https://github.com/swig/swig/issues/1699
-+ */
-+%ignore audit_rule_data::buf;
- %include "/usr/include/linux/audit.h"
- #define __extension__ /*nothing*/
- %include <stdint.i>
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@ -18,20 +18,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "audit";
-  version = "3.1.1";
+  version = "3.1.2";

  src = fetchurl {
    url = "https://people.redhat.com/sgrubb/audit/audit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-RuRrN2I8zgnm7hNOeNZor8NPThyHDIU+8S5BkweM/oc=";
+    hash = "sha256-wLF5LR8KiMbxgocQUJy7mHBZ/GhxLJdmnKkOrhA9KH0=";
  };

-  patches = [
-    ./000-fix-static-attribute-malloc.diff
-    ./001-ignore-flexible-array.patch
-  ];
-
  postPatch = ''
-    sed -i 's,#include <sys/poll.h>,#include <poll.h>\n#include <limits.h>,' audisp/audispd.c
    substituteInPlace bindings/swig/src/auditswig.i \
      --replace "/usr/include/linux/audit.h" \
                "${linuxHeaders}/include/linux/audit.h"
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@ -352,6 +352,9 @@ let
          maintainers.thoughtpolice
        ];
        platforms = platforms.linux;
+        badPlatforms =
+          lib.optionals (lib.versionOlder version "4.15") [ "riscv32-linux" "riscv64-linux" ] ++
+          lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
        timeout = 14400; # 4 hours
      } // extraMeta;
    };
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.21";
-  hash = "sha256-HiYZIdYhmYrcN5YMYV3nhMYUXH9zeoC3gfMQj77Gen4=";
+  version = "2.03.22";
+  hash = "sha256-TFppI70aznzgRHRgioSTfOBTupGxrOnwsAFyaOcy3Hw=";
 }
--- a/pkgs/os-specific/linux/pflask/default.nix
+++ b/pkgs/os-specific/linux/pflask/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, python3, wafHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, python3, waf }:

 stdenv.mkDerivation rec {
  pname = "pflask";
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    })
  ];

-  nativeBuildInputs = [ python3 wafHook ];
+  nativeBuildInputs = [ python3 waf.hook ];

  postInstall = ''
    mkdir -p $out/bin
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -95,6 +95,7 @@
 , withDocumentation ? true
 , withEfi ? stdenv.hostPlatform.isEfi
 , withFido2 ? true
+, withFirstboot ? false # conflicts with the NixOS /etc management
 , withHomed ? !stdenv.hostPlatform.isMusl
 , withHostnamed ? true
 , withHwdb ? true
@ -121,6 +122,7 @@
 , withRemote ? !stdenv.hostPlatform.isMusl
 , withResolved ? true
 , withShellCompletions ? true
+, withSysusers ? false # conflicts with the NixOS user management
 , withTimedated ? true
 , withTimesyncd ? true
 , withTpm2Tss ? true
@ -494,6 +496,8 @@ stdenv.mkDerivation (finalAttrs: {
    "-Dlibcurl=${lib.boolToString wantCurl}"
    "-Dlibidn=false"
    "-Dlibidn2=${lib.boolToString withLibidn2}"
+    "-Dfirstboot=${lib.boolToString withFirstboot}"
+    "-Dsysusers=${lib.boolToString withSysusers}"
    "-Dquotacheck=false"
    "-Dldconfig=false"
    "-Dsmack=true"
--- a/pkgs/os-specific/windows/default.nix
+++ b/pkgs/os-specific/windows/default.nix
@ -6,6 +6,8 @@ lib.makeScope newScope (self: with self; {

  cygwinSetup = callPackage ./cygwin-setup { };

+  dlfcn = callPackage ./dlfcn { };
+
  w32api = callPackage ./w32api { };

  mingwrt = callPackage ./mingwrt { };
--- a/pkgs/os-specific/windows/dlfcn/default.nix
+++ b/pkgs/os-specific/windows/dlfcn/default.nix
@ -0,0 +1,23 @@
+{ stdenv, lib, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "dlfcn";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "dlfcn-win32";
+    repo = "dlfcn-win32";
+    rev = "v${version}";
+    sha256 = "sha256-ljVTMBiGp8TPufrQcK4zQtcVH1To4zcfBAbUOb+v910=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    homepage = "https://github.com/dlfcn-win32/dlfcn-win32";
+    description = "Set of functions that allows runtime dynamic library loading";
+    license = licenses.mit;
+    platforms = platforms.windows;
+    maintainers = with maintainers; [ marius851000 ];
+  };
+}
--- a/pkgs/servers/nfd/default.nix
+++ b/pkgs/servers/nfd/default.nix
@ -8,7 +8,7 @@
 , pkg-config
 , sphinx
 , systemd
-, wafHook
+, waf
 , websocketpp
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , withWebSocket ? true
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ pkg-config sphinx wafHook ];
+  nativeBuildInputs = [ pkg-config sphinx waf.hook ];
  buildInputs = [ libpcap ndn-cxx openssl websocketpp ] ++ lib.optional withSystemd systemd;

  wafConfigureFlags = [
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@ -1,7 +1,7 @@
 { lib, stdenv
 , buildPackages
 , fetchurl
-, wafHook
+, waf
 , pkg-config
 , bison
 , flex
@ -70,7 +70,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    python3Packages.python
-    wafHook
+    waf.hook
    pkg-config
    bison
    flex
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@ -8,7 +8,7 @@
  mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
  mcpp, libepoxy, openssl, pkg-config, llvm, libxslt, libxcrypt,
  ApplicationServices, Carbon, Cocoa, Xplugin,
-  xorg
+  xorg, windows
 }:

 let
@ -80,6 +80,8 @@ self: super:
  mkfontdir = xorg.mkfontscale;

  libxcb = super.libxcb.overrideAttrs (attrs: {
+    # $dev/include/xcb/xcb.h includes pthread.h
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64_pthreads;
    configureFlags = [ "--enable-xkb" "--enable-xinput" ]
      ++ lib.optional stdenv.hostPlatform.isStatic "--disable-shared";
    outputs = [ "out" "dev" "man" "doc" ];
@ -110,6 +112,7 @@ self: super:
        "xcb-xvmc"
        "xcb"
      ];
+      platforms = lib.platforms.unix ++ lib.platforms.windows;
    };
  });

@ -387,6 +390,11 @@ self: super:
    };
  });

+  libpthreadstubs = super.libpthreadstubs.overrideAttrs (attrs: {
+    # only contains a pkgconfig file on linux and windows
+    meta = attrs.meta // { platforms = lib.platforms.unix ++ lib.platforms.windows; };
+  });
+
  setxkbmap = super.setxkbmap.overrideAttrs (attrs: {
    postInstall =
      ''
@ -671,6 +679,14 @@ self: super:
    nativeBuildInputs = attrs.nativeBuildInputs ++ [ meson ninja ];
    # adds support for printproto needed for libXp
    mesonFlags = [ "-Dlegacy=true" ];
+
+    patches = [
+      (fetchpatch {
+        url = "https://aur.archlinux.org/cgit/aur.git/plain/meson.patch?h=mingw-w64-xorgproto&id=7b817efc3144a50e6766817c4ca7242f8ce49307";
+        sha256 = "sha256-Izzz9In53W7CC++k1bLr78iSrmxpFm1cH8qcSpptoUQ=";
+      })
+    ];
+    meta = attrs.meta // { platforms = lib.platforms.unix ++ lib.platforms.windows; };
  });

  xorgserver = with xorg; super.xorgserver.overrideAttrs (attrs_passed:
--- a/pkgs/tools/graphics/blockhash/default.nix
+++ b/pkgs/tools/graphics/blockhash/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python3, pkg-config, imagemagick, wafHook }:
+{ lib, stdenv, fetchFromGitHub, python3, pkg-config, imagemagick, waf }:

 stdenv.mkDerivation rec {
  pname = "blockhash";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    sha256 = "0x3lvhnkb4c3pyq6p81qnnqimz35wpippiac506dgjx3b1848v35";
  };

-  nativeBuildInputs = [ python3 pkg-config wafHook ];
+  nativeBuildInputs = [ python3 pkg-config waf.hook ];
  buildInputs = [ imagemagick ];

  strictDeps = true;
--- a/pkgs/tools/misc/turbo/default.nix
+++ b/pkgs/tools/misc/turbo/default.nix
@ -24,12 +24,12 @@
 , CoreFoundation
 }:
 let
-  version = "1.10.7";
+  version = "1.10.13";
  src = fetchFromGitHub {
    owner = "vercel";
    repo = "turbo";
    rev = "v${version}";
-    sha256 = "sha256-AkrwaaXUiFPZqOO1mX/1XBOZRFRtCdgI7glzdv8ZOfU=";
+    sha256 = "sha256-7bEHE/bHRVOXMP7+oo+4k8yn6d+LkXBi8JcDeR0ajww";
  };

  ffi = rustPlatform.buildRustPackage {
@ -37,7 +37,7 @@ let
    inherit src version;
    cargoBuildFlags = [ "--package" "turborepo-ffi" ];

-    cargoHash = "sha256-j+r1irE0OGMfr9TAYhTOsFjBNzxjmF5/e7EebtshuG8=";
+    cargoHash = "sha256-CIKuW8qKJiqgDBPfuCIBcWUP41BHwAa1m9vmcQ9ZmAY=";

    RUSTC_BOOTSTRAP = 1;
    nativeBuildInputs = [
@ -138,7 +138,7 @@ rustPlatform.buildRustPackage {
  ];
  RELEASE_TURBO_CLI = "true";

-  cargoHash = "sha256-GCo1PRB4JkHSXz7nBiKhJsC1xhMTlA136gGpUblPpVk=";
+  cargoHash = "sha256-rKdonANA6WvXPMpK8sC95hsX9Yb5zedeBezY4LWzsZE=";

  RUSTC_BOOTSTRAP = 1;
  nativeBuildInputs = [
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@ -17,6 +17,11 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-rrn+ZTAsFs7UTP4xQL3Cy8G6RG7vwT0wMKnXHHIkB90=";

+  checkFlags = [
+    # https://github.com/containers/aardvark-dns/issues/379
+    "--skip=test::test::tests::test_backend_network_scoped_custom_dns_server"
+  ];
+
  passthru.tests = { inherit (nixosTests) podman; };

  meta = with lib; {
--- a/pkgs/tools/networking/ndn-tools/default.nix
+++ b/pkgs/tools/networking/ndn-tools/default.nix
@ -7,7 +7,7 @@
 , openssl
 , pkg-config
 , sphinx
-, wafHook
+, waf
 }:

 stdenv.mkDerivation rec {
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    EOF
  '';

-  nativeBuildInputs = [ pkg-config sphinx wafHook ];
+  nativeBuildInputs = [ pkg-config sphinx waf.hook ];
  buildInputs = [ libpcap ndn-cxx openssl ];

  wafConfigureFlags = [
--- a/pkgs/tools/networking/saldl/default.nix
+++ b/pkgs/tools/networking/saldl/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchFromGitHub
 , pkg-config
-, wafHook
+, waf
 , python3
 , asciidoc
 , docbook_xml_dtd_45
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    pkg-config
-    wafHook
+    waf.hook
    python3
    asciidoc
    docbook_xml_dtd_45
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1862,7 +1862,7 @@ mapAliases ({
  inherit (libsForQt5.mauiPackages) vvave; # added 2022-05-17

  ### W ###
-
+  wafHook = waf.hook; # Added 2023-08-23
  wavesurfer = throw "wavesurfer has been removed: depended on snack which has been removed"; # Added 2022-04-21
  waybar-hyprland = throw "waybar-hyprland has been removed: hyprland support is now built into waybar by default."; # Added 2023-08-21
  way-cooler = throw "way-cooler is abandoned by its author: https://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html"; # Added 2020-01-13
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -14832,7 +14832,6 @@ with pkgs;
  volumeicon = callPackage ../tools/audio/volumeicon { };

  waf = callPackage ../development/tools/build-managers/waf { };
-  wafHook = callPackage ../development/tools/build-managers/waf/hook.nix { };

  waf-tester = callPackage ../tools/security/waf-tester { };

@ -17117,11 +17116,11 @@ with pkgs;
    inherit (darwin) apple_sdk;
  };

-  rust_1_71 = callPackage ../development/compilers/rust/1_71.nix {
+  rust_1_72 = callPackage ../development/compilers/rust/1_72.nix {
    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
    llvm_16 = llvmPackages_16.libllvm;
  };
-  rust = rust_1_71;
+  rust = rust_1_72;

  mrustc = callPackage ../development/compilers/mrustc { };
  mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@ -17129,8 +17128,8 @@ with pkgs;
    openssl = openssl_1_1;
  };

-  rustPackages_1_71 = rust_1_71.packages.stable;
-  rustPackages = rustPackages_1_71;
+  rustPackages_1_72 = rust_1_72.packages.stable;
+  rustPackages = rustPackages_1_72;

  inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;

@ -24708,8 +24707,9 @@ with pkgs;

  prospector = callPackage ../development/tools/prospector { };

-  protobuf = protobuf3_23;
+  protobuf = protobuf3_24;

+  protobuf3_24 = callPackage ../development/libraries/protobuf/3.24.nix { };
  protobuf3_23 = callPackage ../development/libraries/protobuf/3.23.nix { };
  protobuf3_21 = callPackage ../development/libraries/protobuf/3.21.nix {
    abseil-cpp = abseil-cpp_202103;