Merge branch 'staging' into staging-next

2022-11-05 17:29:02 +01:00 · 2022-11-05 17:29:02 +01:00 · 7a2cb8737c
parent acc7ed91ff d07db27df6
commit 7a2cb8737c
68 changed files with 468 additions and 411 deletions
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@ -1140,6 +1140,13 @@ Here are some more packages that provide a setup hook. Since the list of hooks i
 Many other packages provide hooks, that are not part of `stdenv`. You can find
 these in the [Hooks Reference](#chap-hooks).

+### Compiler and Linker wrapper hooks {#compiler-linker-wrapper-hooks}
+
+If the file `${cc}/nix-support/cc-wrapper-hook` exists, it will be run at the end of the [compiler wrapper](#cc-wrapper).
+If the file `${binutils}/nix-support/post-link-hook` exists, it will be run at the end of the linker wrapper.
+These hooks allow a user to inject code into the wrappers.
+As an example, these hooks can be used to extract `extraBefore`, `params` and `extraAfter` which store all the command line arguments passed to the compiler and linker respectively.
+
 ## Purity in Nixpkgs {#sec-purity-in-nixpkgs}

 *Measures taken to prevent dependencies on packages outside the store, and what you can do to prevent them.*
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -1171,6 +1171,19 @@
          Add udev rules for the Teensy family of microcontrollers.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The Qt QML disk cache is now disabled by default. This fixes a
+          long-standing issue where updating Qt/KDE apps would sometimes
+          cause them to crash or behave strangely without explanation.
+          Those concerned about the small (~10%) performance hit to
+          application startup can re-enable the cache (and expose
+          themselves to gremlins) by setting the envrionment variable
+          <literal>QML_FORCE_DISK_CACHE</literal> to
+          <literal>1</literal> using e.g. the
+          <literal>environment.sessionVariables</literal> NixOS option.
+        </para>
+      </listitem>
      <listitem>
        <para>
          systemd-oomd is enabled by default. Depending on which systemd
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -354,6 +354,14 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).

 - Add udev rules for the Teensy family of microcontrollers.

+- The Qt QML disk cache is now disabled by default. This fixes a 
+  long-standing issue where updating Qt/KDE apps would sometimes cause 
+  them to crash or behave strangely without explanation. Those concerned 
+  about the small (~10%) performance hit to application startup can 
+  re-enable the cache (and expose themselves to gremlins) by setting the 
+  envrionment variable `QML_FORCE_DISK_CACHE` to `1` using e.g. the 
+  `environment.sessionVariables` NixOS option.
+
 - systemd-oomd is enabled by default. Depending on which systemd units have
  `ManagedOOMSwap=kill` or `ManagedOOMMemoryPressure=kill`, systemd-oomd will
  SIGKILL all the processes under the appropriate descendant cgroups when the
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix
@ -16,5 +16,10 @@ in
    calamares-nixos-extensions
    # Needed for calamares QML module packagechooserq
    libsForQt5.full
+    # Get list of locales
+    glibcLocales
  ];
+
+  # Support choosing from any locale
+  i18n.supportedLocales = [ "all" ];
 }
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -269,20 +269,5 @@ in
    # To enable user switching, allow sddm to allocate TTYs/displays dynamically.
    services.xserver.tty = null;
    services.xserver.display = null;
-
-    systemd.tmpfiles.rules = [
-      # Prior to Qt 5.9.2, there is a QML cache invalidation bug which sometimes
-      # strikes new Plasma 5 releases. If the QML cache is not invalidated, SDDM
-      # will segfault without explanation. We really tore our hair out for awhile
-      # before finding the bug:
-      # https://bugreports.qt.io/browse/QTBUG-62302
-      # We work around the problem by deleting the QML cache before startup.
-      # This was supposedly fixed in Qt 5.9.2 however it has been reported with
-      # 5.10 and 5.11 as well. The initial workaround was to delete the directory
-      # in the Xsetup script but that doesn't do anything.
-      # Instead we use tmpfiles.d to ensure it gets wiped.
-      # This causes a small but perceptible delay when SDDM starts.
-      "e ${config.users.users.sddm.home}/.cache - - - 0"
-    ];
  };
 }
--- a/pkgs/applications/audio/flac/default.nix
+++ b/pkgs/applications/audio/flac/default.nix
@ -10,12 +10,12 @@

 stdenv.mkDerivation rec {
  pname = "flac";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchurl {
    url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
    # Official checksum is published at https://github.com/xiph/flac/releases/tag/${version}
-    sha256 = "91303c3e5dfde52c3e94e75976c0ab3ee14ced278ab8f60033a3a12db9209ae6";
+    sha256 = "sha256-4yLVih9I0j2d049DJnKGX2955zpvnMWl9X/KqD61qOQ=";
  };

  nativeBuildInputs = [
@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://xiph.org/flac/";
    description = "Library and tools for encoding and decoding the FLAC lossless audio file format";
+    changelog = "https://xiph.org/flac/changelog.html";
    platforms = platforms.all;
    license = licenses.bsd3;
    maintainers = with maintainers; [ ruuda ];
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -219,6 +219,12 @@ fi
 PATH="$path_backup"
 # Old bash workaround, see above.

+# if a cc-wrapper-hook exists, run it.
+if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
+    compiler=@prog@
+    source @out@/nix-support/cc-wrapper-hook
+fi
+
 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
    exec @prog@ @<(printf "%q\n" \
       ${extraBefore+"${extraBefore[@]}"} \
--- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@ -27,7 +27,7 @@ cargoSetupPostUnpackHook() {
    cat ${tmp_config} >> .cargo/config

    cat >> .cargo/config <<'EOF'
-    @rustTarget@
+    @cargoConfig@
 EOF

    echo "Finished cargoSetupPostUnpackHook"
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@ -68,15 +68,37 @@ in {
        # The `.nativeDrv` stanza works like nativeBuildInputs and ensures cross-compiling has the right version available.
        diff = "${diffutils.nativeDrv or diffutils}/bin/diff";

-        # Target platform
-        rustTarget = ''
-          [target."${rust.toRustTarget stdenv.buildPlatform}"]
+        # We want to specify the correct crt-static flag for both
+        # the build and host platforms. This is important when the wanted
+        # value for crt-static does not match the defaults in the rustc target,
+        # like for pkgsMusl or pkgsCross.musl64; Upstream rustc still assumes
+        # that musl = static[1].
+        #
+        # By default, Cargo doesn't apply RUSTFLAGS when building build.rs
+        # if --target is passed, so the only good way to set crt-static for
+        # build.rs files is to use the unstable -Zhost-config Cargo feature.
+        # This allows us to specify flags that should be passed to rustc
+        # when building for the build platform. We also need to use
+        # -Ztarget-applies-to-host, because using -Zhost-config requires it.
+        #
+        # When doing this, we also have to specify the linker, or cargo
+        # won't pass a -C linker= argument to rustc.  This will make rustc
+        # try to use its default value of "cc", which won't be available
+        # when cross-compiling.
+        #
+        # [1]: https://github.com/rust-lang/compiler-team/issues/422
+        cargoConfig = ''
+          [host]
          "linker" = "${ccForBuild}"
-          ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
-            [target."${shortTarget}"]
-            "linker" = "${ccForHost}"
-          ''}
+          "rustflags" = [ "-C", "target-feature=${if stdenv.buildPlatform.isStatic then "+" else "-"}crt-static" ]
+
+          [target."${shortTarget}"]
+          "linker" = "${ccForHost}"
          "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
+
+          [unstable]
+          host-config = true
+          target-applies-to-host = true
        '';
      };
    } ./cargo-setup-hook.sh) {};
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@ -1,17 +1,17 @@
-{ lib, stdenv, fetchurl, buildPackages }:
+{ lib, stdenv, fetchurl, fetchpatch, buildPackages }:

 stdenv.mkDerivation rec {
  pname = "tzdata";
-  version = "2022e";
+  version = "2022f";

  srcs = [
    (fetchurl {
      url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-jeTCaG3OPRqukDBxnmgUkxwhai1eiR7D0zLm9lFq7M0=";
+      hash = "sha256-mZDXH2ddISVnuTH+iq4cq3An+J/vuKedgIppM6Z68AA=";
    })
    (fetchurl {
      url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-1AKAJTmA6JFo5r5CdahSv5UhUk1HaE3jE1uaXKOHcQs=";
+      hash = "sha256-5FQ+kPhPkfqCgJ6piTAFL9vBOIDIpiPuOk6qQvimTBU=";
    })
  ];

@ -19,6 +19,17 @@ stdenv.mkDerivation rec {

  patches = lib.optionals stdenv.hostPlatform.isWindows [
    ./0001-Add-exe-extension-for-MS-Windows-binaries.patch
+  ] ++ [
+    (fetchpatch {
+      name = "fix-get-random-on-osx-1.patch";
+      url = "https://github.com/eggert/tz/commit/5db8b3ba4816ccb8f4ffeb84f05b99e87d3b1be6.patch";
+      hash = "sha256-FevGjiSahYwEjRUTvRY0Y6/jUO4YHiTlAAPixzEy5hw=";
+    })
+    (fetchpatch {
+      name = "fix-get-random-on-osx-2.patch";
+      url = "https://github.com/eggert/tz/commit/841183210311b1d4ffb4084bfde8fa8bdf3e6757.patch";
+      hash = "sha256-1tUTZBMT7V463P7eygpFS6/k5gTeeXumk5+V4gdKpEI=";
+    })
  ];

  outputs = [ "out" "bin" "man" "dev" ];
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation {
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation {
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
  ] ++ lib.optionals (useLLVM || bareMetal || isMusl || isNewDarwinBootstrap) [
    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation {
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
--- a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation {
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
  ] ++ lib.optionals (useLLVM || bareMetal || isMusl || isAarch64) [
    "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
--- a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation {
    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
    "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
    "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
    "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
    "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@ -75,7 +75,5 @@ rustPlatform.buildRustPackage {
    maintainers = with maintainers; [ retrry ];
    license = [ licenses.mit licenses.asl20 ];
    platforms = platforms.unix;
-    # weird segfault in a build script
-    broken = stdenv.targetPlatform.isMusl && !stdenv.targetPlatform.isStatic;
  };
 }
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -8,7 +8,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, tix ? null, xlibsWrapper ? null, libX11 ? null, x11Support ? false
+, tcl ? null, tk ? null, tix ? null, libX11 ? null, x11Support ? false
 , zlib
 , self
 , configd, coreutils
@ -36,7 +36,6 @@

 assert x11Support -> tcl != null
                  && tk != null
-                  && xlibsWrapper != null
                  && libX11 != null;

 assert lib.assertMsg (enableOptimizations -> (!stdenv.cc.isClang))
@ -234,7 +233,7 @@ let
    ++ optional (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) libffi
    ++ optional stdenv.hostPlatform.isCygwin expat
    ++ [ db gdbm ncurses sqlite readline ]
-    ++ optionals x11Support [ tcl tk xlibsWrapper libX11 ]
+    ++ optionals x11Support [ tcl tk libX11 ]
    ++ optional (stdenv.isDarwin && configd != null) configd;
  nativeBuildInputs =
    [ autoreconfHook ]
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@ -22,6 +22,24 @@
 #     # pythonRemoveDeps = true;
 #     …
 #   }
+#
+# IMPLEMENTATION NOTES:
+#
+# The "Requires-Dist" dependency specification format is described in PEP 508.
+# Examples that the regular expressions in this hook needs to support:
+#
+# Requires-Dist: foo
+#   -> foo
+# Requires-Dist: foo[optional]
+#   -> foo[optional]
+# Requires-Dist: foo[optional]~=1.2.3
+#   -> foo[optional]
+# Requires-Dist: foo[optional, xyz] (~=1.2.3)
+#   -> foo[optional, xyz]
+# Requires-Dist: foo[optional]~=1.2.3 ; os_name = "posix"
+#   -> foo[optional] ; os_name = "posix"
+#
+# Currently unsupported: URL specs (foo @ https://example.com/a.zip).

 _pythonRelaxDeps() {
    local -r metadata_file="$1"
@ -30,11 +48,11 @@ _pythonRelaxDeps() {
        return
    elif [[ "$pythonRelaxDeps" == 1 ]]; then
        sed -i "$metadata_file" -r \
-            -e 's/(Requires-Dist: \S*) \(.*\)/\1/'
+            -e 's/(Requires-Dist: [a-zA-Z0-9_.-]+\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/'
    else
        for dep in $pythonRelaxDeps; do
            sed -i "$metadata_file" -r \
-                -e "s/(Requires-Dist: $dep) \(.*\)/\1/"
+                -e "s/(Requires-Dist: $dep\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/"
        done
    fi
 }
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@ -45,6 +45,11 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
+    # Avoid blanket -Werror to evade build failures on less
+    # tested compilers.
+    substituteInPlace cmake/compiler_settings.cmake \
+      --replace '"-Werror"' ' '
+
    # Missing includes for GCC11
    sed '5i#include <thread>' -i \
      aws-cpp-sdk-cloudfront-integration-tests/CloudfrontOperationTest.cpp \
--- a/pkgs/development/libraries/cppunit/default.nix
+++ b/pkgs/development/libraries/cppunit/default.nix
@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
    sha256 = "19qpqzy66bq76wcyadmi3zahk5v1ll2kig1nvg96zx9padkcdic9";
  };

+  # Avoid blanket -Werror to evade build failures on less
+  # tested compilers.
+  configureFlags = [ "--disable-werror" ];
+
  meta = with lib; {
    homepage = "https://freedesktop.org/wiki/Software/cppunit/";
    description = "C++ unit testing framework";
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "expat";
-  version = "2.4.9";
+  version = "2.5.0";

  src = fetchurl {
    url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bowHKP5cfNP5OmrM5DBGxeRzbHtLaOAy6TUNqg78A1Q=";
+    sha256 = "1gnwihpfz4x18rwd6cbrdggmfqjzwsdfh1gpmc0ph21c4gq2097g";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -7,11 +7,9 @@
 # this is just for tests (not in the closure of any regular package)
 , coreutils, dbus, libxml2, tzdata
 , desktop-file-utils, shared-mime-info
-, darwin, fetchpatch
+, darwin
 }:

-with lib;
-
 assert stdenv.isLinux -> util-linuxMinimal != null;

 # TODO:
@ -40,20 +38,22 @@ let
    done
    ln -sr -t "''${!outputInclude}/include/" "''${!outputInclude}"/lib/*/include/* 2>/dev/null || true
  '';
+
+  buildDocs = stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isStatic;
 in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glib";
-  version = "2.74.0";
+  version = "2.74.1";

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "NlLH8HLXsDGmte3WI/d+vF3NKuaYWYq8yJ/znKda3TA=";
+    sha256 = "CrmBYY0dtHhF5WQXsNfBI/gaNCeyuck/Wkb/W7uWSWQ=";
  };

-  patches = optionals stdenv.isDarwin [
+  patches = lib.optionals stdenv.isDarwin [
    ./darwin-compilation.patch
-  ] ++ optionals stdenv.hostPlatform.isMusl [
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
    ./quark_init_on_demand.patch
    ./gobject_init_on_demand.patch
  ] ++ [
@ -90,29 +90,8 @@ stdenv.mkDerivation (finalAttrs: {
    #    * gio-launch-desktop
    ./split-dev-programs.patch

-    # Fix build on Darwin
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2914
-    (fetchpatch {
-      name = "gio-properly-guard-use-of-utimensat.patch";
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/7f7171e68a420991b537d3e9e63263a0b2871618.patch";
-      sha256 = "kKEqmBqx/RlvFT3eixu+NnM7JXhHb34b9NLRfAt+9h0=";
-    })
-
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2866
-    (fetchpatch {
-      name = "tests-skip-g-file-info-test-if-atime-unsupported.patch";
-      url = "https://gitlab.gnome.org/qyliss/glib/-/commit/339a06d66685107280ca6bdca5da5d96b8222fb5.patch";
-      sha256 = "sha256-/NdFkuiJvyass3jTDEJPeciA2Lwe53IUd3kAnKAvTaw=";
-    })
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
-    ./tests-skip-shared-libs-if-default_library-static.patch
-
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2921
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/f0dd96c28751f15d0703b384bfc7c314af01caa8.patch";
-      sha256 = "sha256-8ucHS6ZnJuP6ajGb4/L8QfhC49FTQG1kAGHVdww/YYE=";
-    })
-
+    # Disable flaky test.
+    # https://gitlab.gnome.org/GNOME/glib/-/issues/820
    ./skip-timer-test.patch
  ];

@ -124,14 +103,14 @@ stdenv.mkDerivation (finalAttrs: {
    libelf
    finalAttrs.setupHook
    pcre2
-  ] ++ optionals (!stdenv.hostPlatform.isWindows) [
+  ] ++ lib.optionals (!stdenv.hostPlatform.isWindows) [
    bash gnum4 # install glib-gettextize and m4 macros for other apps to use
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
    libselinux
    util-linuxMinimal # for libmount
-  ] ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
    AppKit Carbon Cocoa CoreFoundation CoreServices Foundation
-  ]) ++ optionals (stdenv.hostPlatform == stdenv.buildPlatform) [
+  ]) ++ lib.optionals buildDocs [
    # Note: this needs to be both in buildInputs and nativeBuildInputs. The
    # Meson gtkdoc module uses find_program to look it up (-> build dep), but
    # glib's own Meson configuration uses the host pkg-config to find its
@ -147,10 +126,18 @@ stdenv.mkDerivation (finalAttrs: {
  strictDeps = true;

  nativeBuildInputs = [
-    (buildPackages.meson.override {
-      withDarwinFrameworksGtkDocPatch = stdenv.isDarwin;
-    })
-    ninja pkg-config perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 libxml2 libxslt
+    meson
+    ninja
+    pkg-config
+    perl
+    python3
+    gettext
+  ] ++ lib.optionals buildDocs [
+    gtk-doc
+    docbook_xsl
+    docbook_xml_dtd_45
+    libxml2
+    libxslt
  ];

  propagatedBuildInputs = [ zlib libffi gettext libiconv ];
@ -158,10 +145,10 @@ stdenv.mkDerivation (finalAttrs: {
  mesonFlags = [
    # Avoid the need for gobject introspection binaries in PATH in cross-compiling case.
    # Instead we just copy them over from the native output.
-    "-Dgtk_doc=${boolToString (stdenv.hostPlatform == stdenv.buildPlatform)}"
+    "-Dgtk_doc=${lib.boolToString buildDocs}"
    "-Dnls=enabled"
    "-Ddevbindir=${placeholder "dev"}/bin"
-  ] ++ optionals (!stdenv.isDarwin) [
+  ] ++ lib.optionals (!stdenv.isDarwin) [
    "-Dman=true"                # broken on Darwin
  ];

@ -215,7 +202,7 @@ stdenv.mkDerivation (finalAttrs: {
    for i in $dev/bin/*; do
      moveToOutput "share/bash-completion/completions/''${i##*/}" "$dev"
    done
-  '' + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+  '' + lib.optionalString (!buildDocs) ''
    cp -r ${buildPackages.glib.devdoc} $devdoc
  '';

@ -230,7 +217,7 @@ stdenv.mkDerivation (finalAttrs: {

  checkInputs = [ tzdata desktop-file-utils shared-mime-info ];

-  preCheck = optionalString finalAttrs.doCheck or config.doCheckByDefault or false ''
+  preCheck = lib.optionalString finalAttrs.doCheck or config.doCheckByDefault or false ''
    export LD_LIBRARY_PATH="$NIX_BUILD_TOP/glib-${finalAttrs.version}/glib/.libs''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
    export TZDIR="${tzdata}/share/zoneinfo"
    export XDG_CACHE_HOME="$TMP"
--- a/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
+++ b/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
@ -1,141 +0,0 @@
-From b804e4b82cd8e85631112d935543c62ef56783e5 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Tue, 23 Aug 2022 13:13:44 +0000
-Subject: [PATCH] tests: skip shared libs if default_library=static
-
-Otherwise, the build will fail when the toolchain is static-only, even
-with -Ddefault_library=static.  I talked to a Meson developer in their
-IRC channel, who told me that the correct fix was to ensure that
-shared_library is only used if default_library != static.
-
-Part-of: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
-[Backported to 2.72.3]
---
- gio/tests/meson.build  | 43 +++++++++++++++++++++++-------------------
- glib/tests/meson.build |  2 +-
- gmodule/tests/meson.build      | 30 +++++++++++++++--------------
- 3 files changed, 41 insertions(+), 34 deletions(-)
-
-diff --git a/gio/tests/meson.build b/gio/tests/meson.build
-index 3ed23a5f2..7b1aba80d 100644
--- a/gio/tests/meson.build
-+++ b/gio/tests/meson.build
-@@ -203,7 +203,7 @@ if host_machine.system() != 'windows'
-   }
- 
-   # LD_PRELOAD modules don't work so well with AddressSanitizer
-  if have_rtld_next and get_option('b_sanitize') == 'none'
-+  if have_rtld_next and get_option('default_library') != 'static' and get_option('b_sanitize') == 'none'
-     gio_tests += {
-       'gsocketclient-slow' : {
-         'depends' : [
-@@ -607,24 +607,26 @@ if not meson.is_cross_build() or meson.has_exe_wrapper()
- 
-   compiler_type = '--compiler=@0@'.format(cc.get_id())
- 
-  plugin_resources_c = custom_target('plugin-resources.c',
-    input : 'test4.gresource.xml',
-    output : 'plugin-resources.c',
-    command : [glib_compile_resources,
-               compiler_type,
-               '--target=@OUTPUT@',
-               '--sourcedir=' + meson.current_source_dir(),
-               '--internal',
-               '--generate-source',
-               '--c-name', '_g_plugin',
-               '@INPUT@'])
-+  if get_option('default_library') != 'static'
-+    plugin_resources_c = custom_target('plugin-resources.c',
-+      input : 'test4.gresource.xml',
-+      output : 'plugin-resources.c',
-+      command : [glib_compile_resources,
-+                 compiler_type,
-+                 '--target=@OUTPUT@',
-+                 '--sourcedir=' + meson.current_source_dir(),
-+                 '--internal',
-+                 '--generate-source',
-+                 '--c-name', '_g_plugin',
-+                 '@INPUT@'])
- 
-  shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
-    link_args : export_dynamic_ldflags,
-    dependencies : common_gio_tests_deps,
-    install_dir : installed_tests_execdir,
-    install : installed_tests_enabled
-  )
-+    shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
-+      link_args : export_dynamic_ldflags,
-+      dependencies : common_gio_tests_deps,
-+      install_dir : installed_tests_execdir,
-+      install : installed_tests_enabled
-+    )
-+  endif
- 
-   # referenced by test2.gresource.xml
-   big_test_resource = custom_target(
-@@ -917,4 +919,7 @@ if installed_tests_enabled
- endif
- 
- subdir('services')
-subdir('modules')
-+
-+if get_option('default_library') != 'static'
-+  subdir('modules')
-+endif
-diff --git a/glib/tests/meson.build b/glib/tests/meson.build
-index 301158e0f..6203ff45e 100644
--- a/glib/tests/meson.build
-+++ b/glib/tests/meson.build
-@@ -172,7 +172,7 @@ else
-     'include' : {},
-     'unix' : {},
-   }
-  if have_rtld_next
-+  if have_rtld_next and get_option('default_library') != 'static'
-     glib_tests += {
-       'gutils-user-database' : {
-         'depends' : [
-diff --git a/gmodule/tests/meson.build b/gmodule/tests/meson.build
-index c95fa1d00..25144c941 100644
--- a/gmodule/tests/meson.build
-+++ b/gmodule/tests/meson.build
-@@ -72,20 +72,22 @@ if ['darwin', 'ios'].contains(host_machine.system())
-   module_suffix = 'so'
- endif
- 
-foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
-  shared_module(module + '_plugin', 'lib@0@.c'.format(module),
-    dependencies : [libglib_dep, libgmodule_dep],
-    install_dir : installed_tests_execdir,
-    install : installed_tests_enabled,
-    name_suffix : module_suffix
-  )
-  shared_library(module + '_library', 'lib@0@.c'.format(module),
-    dependencies : [libglib_dep, libgmodule_dep],
-    install_dir : installed_tests_execdir,
-    install : installed_tests_enabled,
-    name_suffix : module_suffix
-  )
-endforeach
-+if get_option('default_library') != 'static'
-+  foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
-+    shared_module(module + '_plugin', 'lib@0@.c'.format(module),
-+      dependencies : [libglib_dep, libgmodule_dep],
-+      install_dir : installed_tests_execdir,
-+      install : installed_tests_enabled,
-+      name_suffix : module_suffix
-+    )
-+    shared_library(module + '_library', 'lib@0@.c'.format(module),
-+      dependencies : [libglib_dep, libgmodule_dep],
-+      install_dir : installed_tests_execdir,
-+      install : installed_tests_enabled,
-+      name_suffix : module_suffix
-+    )
-+  endforeach
-+endif
- 
- common_c_args = test_cargs + ['-DGLIB_DISABLE_DEPRECATION_WARNINGS']
- common_deps = [libm, thread_dep, libglib_dep]
-- 
-2.37.1
-
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@ -64,8 +64,9 @@ callPackage ./common.nix { inherit stdenv; } {

  installPhase =
    ''
-      mkdir -p "$out/lib/locale"
+      mkdir -p "$out/lib/locale" "$out/share/i18n"
      cp -v "$TMPDIR/$NIX_STORE/"*"/lib/locale/locale-archive" "$out/lib/locale"
+      cp -v ../glibc-2*/localedata/SUPPORTED "$out/share/i18n/SUPPORTED"
    '';

  setupHook = writeText "locales-setup-hook.sh"
--- a/pkgs/development/libraries/icu/72.nix
+++ b/pkgs/development/libraries/icu/72.nix
@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "72.1";
+  sha256 = "sha256-otLTghcJKn7VZjXjRGf5L5drNw4gGCrTJe3qZoGnHWg=";
+}
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@ -19,14 +19,14 @@
 , systemd # for libudev
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "libcamera";
-  version = "unstable-2022-09-15";
+  version = "0.0.1";

  src = fetchgit {
    url = "https://git.libcamera.org/libcamera/libcamera.git";
-    rev = "74ab3f778c848b20cbf8fe299170756ff6ebab1a";
-    hash = "sha256-w0I4L6xXTBUdqj30LpVW/KZW6bdoUeoW9lnMOW0OLJY=";
+    rev = "v${version}";
+    hash = "sha256-u5FnfXBCjwSp8QBrH8KIkVGV32/9pff41ZWjWXOwuMI=";
  };

  postPatch = ''
@ -77,6 +77,9 @@ stdenv.mkDerivation {
    "-Dv4l2=true"
    "-Dqcam=disabled"
    "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
+    # Avoid blanket -Werror to evade build failures on less
+    # tested compilers.
+    "-Dwerror=false"
    ];

  # Fixes error on a deprecated declaration
@ -85,6 +88,17 @@ stdenv.mkDerivation {
  # Silence fontconfig warnings about missing config
  FONTCONFIG_FILE = makeFontsConf { fontDirectories = []; };

+  # libcamera signs the IPA module libraries at install time, but they are then
+  # modified by stripping and RPATH fixup. Therefore, we need to generate the
+  # signatures again ourselves.
+  #
+  # If this is not done, libcamera will still try to load them, but it will
+  # isolate them in separate processes, which can cause crashes for IPA modules
+  # that are not designed for this (notably ipa_rpi.so).
+  postFixup = ''
+    ../src/ipa/ipa-sign-install.sh src/ipa-priv-key.pem $out/lib/libcamera/ipa_*.so
+  '';
+
  meta = with lib; {
    description = "An open source camera stack and framework for Linux, Android, and ChromeOS";
    homepage = "https://libcamera.org";
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libxcrypt";
-  version = "4.4.28";
+  version = "4.4.30";

  src = fetchurl {
    url = "https://github.com/besser82/libxcrypt/releases/download/v${version}/libxcrypt-${version}.tar.xz";
-    sha256 = "sha256-npNoEfn60R28ozyhm9l8VcUus8oVkB8nreBGzHnmnoc=";
+    sha256 = "sha256-s2Z/C6hdqtavJGukCQ++UxY62TyLaioSV9IqeLt87ro=";
  };

  outputs = [
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  doCheck = !stdenv.hostPlatform.isMusl;
+  doCheck = true;

  passthru.tests = {
    inherit (nixosTests) login shadow;
--- a/pkgs/development/libraries/openssl/1.1/macos-yosemite-compat.patch
+++ b/pkgs/development/libraries/openssl/1.1/macos-yosemite-compat.patch
@ -1,56 +0,0 @@
-From cef404f1e7a598166cbc2fd2e0048f7e2d752ad5 Mon Sep 17 00:00:00 2001
-From: David Carlier <devnexen@gmail.com>
-Date: Tue, 24 Aug 2021 22:40:14 +0100
-Subject: [PATCH] Darwin platform allows to build on releases before
- Yosemite/ios 8.
-
-issue #16407 #16408
---
- crypto/rand/rand_unix.c |  5 +----
- include/crypto/rand.h   | 10 ++++++++++
- 2 files changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c
-index 43f1069d151d..0f4525106af7 100644
--- a/crypto/rand/rand_unix.c
-+++ b/crypto/rand/rand_unix.c
-@@ -34,9 +34,6 @@
- #if defined(__OpenBSD__)
- # include <sys/param.h>
- #endif
-#if defined(__APPLE__)
-# include <CommonCrypto/CommonRandom.h>
-#endif
- 
- #if defined(OPENSSL_SYS_UNIX) || defined(__DJGPP__)
- # include <sys/types.h>
-@@ -381,7 +378,7 @@ static ssize_t syscall_random(void *buf, size_t buflen)
-         if (errno != ENOSYS)
-             return -1;
-     }
-#  elif defined(__APPLE__)
-+#  elif defined(OPENSSL_APPLE_CRYPTO_RANDOM)
-     if (CCRandomGenerateBytes(buf, buflen) == kCCSuccess)
- 	    return (ssize_t)buflen;
- 
-diff --git a/include/crypto/rand.h b/include/crypto/rand.h
-index 5350d3a93119..674f840fd13c 100644
--- a/include/crypto/rand.h
-+++ b/include/crypto/rand.h
-@@ -20,6 +20,16 @@
- 
- # include <openssl/rand.h>
- 
-+# if defined(__APPLE__) && !defined(OPENSSL_NO_APPLE_CRYPTO_RANDOM)
-+#  include <Availability.h>
-+#  if (defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101000) || \
-+     (defined(__IPHONE_OS_VERSION_MIN_REQUIRED) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 80000)
-+#   define OPENSSL_APPLE_CRYPTO_RANDOM 1
-+#   include <CommonCrypto/CommonCryptoError.h>
-+#   include <CommonCrypto/CommonRandom.h>
-+#  endif
-+# endif
-+
- /* forward declaration */
- typedef struct rand_pool_st RAND_POOL;
- 
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -214,17 +214,15 @@ let
 in {


-  openssl_1_1 = common rec {
-    version = "1.1.1q";
-    sha256 = "sha256-15Oc5hQCnN/wtsIPDi5XAxWKSJpyslB7i9Ub+Mj9EMo=";
+  openssl_1_1 = common {
+    version = "1.1.1s";
+    sha256 = "sha256-xawB52Dub/Dath1rK70wFGck0GPrMiGAxvGKb3Tktqo=";
    patches = [
      ./1.1/nix-ssl-cert-file.patch

      (if stdenv.hostPlatform.isDarwin
       then ./use-etc-ssl-certs-darwin.patch
       else ./use-etc-ssl-certs.patch)
-    ] ++ lib.optionals (stdenv.isDarwin && (builtins.substring 5 5 version) < "m") [
-      ./1.1/macos-yosemite-compat.patch
    ];
    withDocs = true;
  };
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@ -2,11 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "pixman";
-  version = "0.38.4";
+  version = "0.42.2";

  src = fetchurl {
-    url = "mirror://xorg/individual/lib/${pname}-${version}.tar.bz2";
-    sha256 = "0l0m48lnmdlmnaxn2021qi5cj366d9fzfjxkqgcj9bs14pxbgaw4";
+    urls = [
+      "mirror://xorg/individual/lib/${pname}-${version}.tar.gz"
+      "https://cairographics.org/releases/${pname}-${version}.tar.gz"
+    ];
+    hash = "sha256-6hSA762i/ZSLx1Nm98NJ4cltMpfQmj/mJibjjiNKYl4=";
  };

  separateDebugInfo = !stdenv.hostPlatform.isStatic;
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@ -81,7 +81,11 @@ let
        sha256 = "0crkw3j1iwdc1pbf5dhar0b4q3h5gs2q1sika8m12y02yk3ns697";
      })
    ];
-    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtdeclarative = [
+      ./qtdeclarative.patch
+      # prevent headaches from stale qmlcache data
+      ./qtdeclarative-default-disable-qmlcache.patch
+    ];
    qtlocation = [ ./qtlocation-gcc-9.patch ];
    qtscript = [ ./qtscript.patch ];
    qtserialport = [ ./qtserialport.patch ];
--- a/pkgs/development/libraries/qt-5/5.12/qtdeclarative-default-disable-qmlcache.patch
+++ b/pkgs/development/libraries/qt-5/5.12/qtdeclarative-default-disable-qmlcache.patch
@ -0,0 +1,40 @@
+diff --git a/src/qml/qml/qqmltypeloader.cpp b/src/qml/qml/qqmltypeloader.cpp
+index 9e5bc0b0..9219def6 100644
+--- a/src/qml/qml/qqmltypeloader.cpp
+++ b/src/qml/qml/qqmltypeloader.cpp
+@@ -2151,7 +2151,7 @@ void QQmlTypeData::unregisterCallback(TypeDataCallback *callback)
+ 
+ bool QQmlTypeData::tryLoadFromDiskCache()
+ {
+-    if (disableDiskCache() && !forceDiskCache())
+    if (!forceDiskCache())
+         return false;
+ 
+     if (isDebugging())
+@@ -2658,7 +2658,7 @@ void QQmlTypeData::compile(const QQmlRefPointer<QQmlTypeNameCache> &typeNameCach
+         return;
+     }
+ 
+-    const bool trySaveToDisk = (!disableDiskCache() || forceDiskCache()) && !m_document->jsModule.debugMode && !typeRecompilation;
+    const bool trySaveToDisk = (forceDiskCache()) && !m_document->jsModule.debugMode && !typeRecompilation;
+     if (trySaveToDisk) {
+         QString errorString;
+         if (m_compiledData->saveToDisk(url(), &errorString)) {
+@@ -3014,7 +3014,7 @@ QQmlRefPointer<QQmlScriptData> QQmlScriptBlob::scriptData() const
+ 
+ void QQmlScriptBlob::dataReceived(const SourceCodeData &data)
+ {
+-    if (!disableDiskCache() || forceDiskCache()) {
+    if (forceDiskCache()) {
+         QQmlRefPointer<QV4::CompiledData::CompilationUnit> unit = QV4::Compiler::Codegen::createUnitForLoading();
+         QString error;
+         if (unit->loadFromDisk(url(), data.sourceTimeStamp(), &error)) {
+@@ -3077,7 +3077,7 @@ void QQmlScriptBlob::dataReceived(const SourceCodeData &data)
+         qmlGenerator.generate(irUnit);
+     }
+ 
+-    if ((!disableDiskCache() || forceDiskCache()) && !isDebugging()) {
+    if ((forceDiskCache()) && !isDebugging()) {
+         QString errorString;
+         if (unit->saveToDisk(url(), &errorString)) {
+             QString error;
--- a/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/pkgs/development/libraries/qt-5/5.14/default.nix
@ -68,7 +68,11 @@ let
      ./qtbase.patch.d/0010-qtbase-assert.patch
      ./qtbase.patch.d/0011-fix-header_module.patch
    ];
-    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtdeclarative = [
+      ./qtdeclarative.patch
+      # prevent headaches from stale qmlcache data
+      ./qtdeclarative-default-disable-qmlcache.patch
+    ];
    qtlocation = [ ./qtlocation-gcc-9.patch ];
    qtscript = [ ./qtscript.patch ];
    qtserialport = [ ./qtserialport.patch ];
--- a/pkgs/development/libraries/qt-5/5.14/qtdeclarative-default-disable-qmlcache.patch
+++ b/pkgs/development/libraries/qt-5/5.14/qtdeclarative-default-disable-qmlcache.patch
@ -0,0 +1,13 @@
+diff --git a/src/qml/qml/qqmltypeloader.cpp b/src/qml/qml/qqmltypeloader.cpp
+index 6c12de92..fc67dc07 100644
+--- a/src/qml/qml/qqmltypeloader.cpp
+++ b/src/qml/qml/qqmltypeloader.cpp
+@@ -705,7 +705,7 @@ bool QQmlTypeLoader::Blob::isDebugging() const
+ 
+ bool QQmlTypeLoader::Blob::diskCacheEnabled() const
+ {
+-    return (!disableDiskCache() || forceDiskCache()) && !isDebugging();
+    return (forceDiskCache()) && !isDebugging();
+ }
+ 
+ bool QQmlTypeLoader::Blob::qmldirDataAvailable(const QQmlRefPointer<QQmlQmldirData> &data, QList<QQmlError> *errors)
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@ -56,7 +56,11 @@ let
      ./qtbase.patch.d/0010-qtbase-assert.patch
      ./qtbase.patch.d/0011-fix-header_module.patch
    ];
-    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtdeclarative = [
+      ./qtdeclarative.patch
+      # prevent headaches from stale qmlcache data
+      ./qtdeclarative-default-disable-qmlcache.patch
+    ];
    qtscript = [ ./qtscript.patch ];
    qtserialport = [ ./qtserialport.patch ];
    qtwebengine = lib.optionals stdenv.isDarwin [
--- a/pkgs/development/libraries/qt-5/5.15/qtdeclarative-default-disable-qmlcache.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-default-disable-qmlcache.patch
@ -0,0 +1,13 @@
+diff --git a/src/qml/qml/qqmltypeloader.cpp b/src/qml/qml/qqmltypeloader.cpp
+index 1d66e75..827567a 100644
+--- a/src/qml/qml/qqmltypeloader.cpp
+++ b/src/qml/qml/qqmltypeloader.cpp
+@@ -727,7 +727,7 @@ bool QQmlTypeLoader::Blob::isDebugging() const
+ 
+ bool QQmlTypeLoader::Blob::diskCacheEnabled() const
+ {
+-    return (!disableDiskCache() && !isDebugging()) || forceDiskCache();
+    return forceDiskCache();
+ }
+ 
+ bool QQmlTypeLoader::Blob::qmldirDataAvailable(const QQmlRefPointer<QQmlQmldirData> &data, QList<QQmlError> *errors)
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
@ -16,6 +16,10 @@ qtModule {
    "-DQT6_INSTALL_PREFIX=${placeholder "out"}"
    "-DQT_INSTALL_PREFIX=${placeholder "out"}"
  ];
+  patches = [
+    # prevent headaches from stale qmlcache data
+    ../patches/qtdeclarative-default-disable-qmlcache.patch
+  ];
  postInstall = ''
    substituteInPlace "$out/lib/cmake/Qt6Qml/Qt6QmlMacros.cmake" \
      --replace ''\'''${QT6_INSTALL_PREFIX}' "$dev"
--- a/pkgs/development/libraries/qt-6/patches/qtdeclarative-default-disable-qmlcache.patch
+++ b/pkgs/development/libraries/qt-6/patches/qtdeclarative-default-disable-qmlcache.patch
@ -0,0 +1,13 @@
+diff --git a/src/qml/jsruntime/qv4engine.cpp b/src/qml/jsruntime/qv4engine.cpp
+index 852cde9e..165f1b57 100644
+--- a/src/qml/jsruntime/qv4engine.cpp
+++ b/src/qml/jsruntime/qv4engine.cpp
+@@ -2093,7 +2093,7 @@ void ExecutionEngine::registerModule(const QString &_name, const QJSValue &modul
+ 
+ bool ExecutionEngine::diskCacheEnabled() const
+ {
+-    return (!disableDiskCache() && !debugger()) || forceDiskCache();
+    return forceDiskCache();
+ }
+ 
+ void ExecutionEngine::callInContext(QV4::Function *function, QObject *self,
--- a/pkgs/development/libraries/taglib/default.nix
+++ b/pkgs/development/libraries/taglib/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "taglib";
-  version = "1.12";
+  version = "1.13";

  src = fetchFromGitHub {
    owner = "taglib";
    repo = "taglib";
    rev = "v${version}";
-    sha256 = "sha256-omErajnYgxbflsbe6pS2KsexZcXisso0WGYnmIud7WA=";
+    sha256 = "sha256-DRALRH+/7c2lBvCpLp8hop3Xxsf76F1q8L7F9qehqQA=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@ -29,13 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "tracker";
-  version = "3.4.0";
+  version = "3.4.1";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "s7OAyVcdfHQjtfQB5KLy143kcUOwNessEoHiQjxZIYs=";
+    sha256 = "6p1BqfucK0KtgPwsgjJ7XHE9WUyWmwnhpJvmP7dPT64=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@ -48,8 +48,20 @@ in buildPythonPackage rec {
    # trashcan support is needed to avoid stack overflows during object deallocation in sage (https://trac.sagemath.org/ticket/27267)
    (fetchpatch {
      name = "trashcan.patch";
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/cython/patches/trashcan.patch?id=4569a839f070a1a38d5dbce2a4d19233d25aeed2";
-      sha256 = "sha256-+pOF1XNTEtNseLpqPzrc1Jfwt5hGx7doUoccIhNneYY=";
+      url = "https://github.com/cython/cython/commit/f781880b6780117660b2026caadf4a6d7905722f.patch";
+      sha256 = "sha256-SnjaJdBZxm3O5gJ5Dxut6+eeVtZv+ygUUNwAwgoiFxg=";
+    })
+    # The above commit introduces custom trashcan macros, as well as
+    # compiler changes to use them in Cython-emitted code. The latter
+    # change is still useful, but the former has been upstreamed as of
+    # Python 3.8, and the patch below makes Cython use the upstream
+    # trashcan macros whenever available. This is needed for Python
+    # 3.11 support, because the API used in Cython's implementation
+    # changed: https://github.com/cython/cython/pull/4475
+    (fetchpatch {
+      name = "disable-trashcan.patch";
+      url = "https://github.com/cython/cython/commit/e337825cdcf5e94d38ba06a0cb0188e99ce0cc92.patch";
+      sha256 = "sha256-q0f63eetKrDpmP5Z4v8EuGxg26heSyp/62OYqhRoSso=";
    })
  ];

--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "build";
-  version = "0.8.0";
+  version = "0.9.0";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "pypa";
    repo = pname;
    rev = version;
-    hash = "sha256-P0DFBYsL2Ce/JwfYss64+CY/IvzYZEiz9wuEslij+oU=";
+    hash = "sha256-iQvfZC/h9SbagExoG8dJ2A8G8gVRdMaRvEy9QcQIN5I=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cattrs/default.nix
+++ b/pkgs/development/python-modules/cattrs/default.nix
@ -2,7 +2,6 @@
 , attrs
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , exceptiongroup
 , hypothesis
 , immutables
@ -21,7 +20,7 @@

 buildPythonPackage rec {
  pname = "cattrs";
-  version = "22.1.0";
+  version = "22.2.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -30,17 +29,9 @@ buildPythonPackage rec {
    owner = "python-attrs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-C8uIsewpgJfB1yYckWTwF5K32+2AAOrxFKB9I18RENg=";
+    hash = "sha256-Qnrq/mIA/t0mur6IAen4vTmMIhILWS6v5nuf+Via2hA=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/python-attrs/cattrs/commit/290d162a589acf10ea63b825b7b283e23ca7698a.diff";
-      excludes = [ "poetry.lock" ];
-      hash = "sha256-n6c3qVg9umGKAxeTALq3QTJgO9DIj3SY0ZHhtsDeW94=";
-    })
-  ];
-
  nativeBuildInputs = [
    poetry-core
  ];
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "exceptiongroup";
-  version = "1.0.0rc9";
+  version = "1.0.0";
  format = "flit";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-kIakoh75sxxyGBx3wECgdLoIie5Wp7KJ/wr7DZdlX5Y=";
+    hash = "sha256-r/ur8T+26YmIw42cVlDnAVaf48HeMjPPthxfM3dGkK0=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@ -1,29 +1,42 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, isPy27, python
-, CoreFoundation, IOKit
+{ lib
+, stdenv
+, buildPythonPackage
+, CoreFoundation
+, fetchPypi
+, IOKit
 , pytestCheckHook
-, mock
-, unittest2
+, python
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "psutil";
-  version = "5.9.2";
+  version = "5.9.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-/rhhoQtsO7AHAQY7N+Svx1T4IX8PCcQigFhr1qxxK1w=";
+    hash = "sha256-fM/N/qT8SwoCyiwx3n/NGGvrnP+CB4AOFKtm95x3OvY=";
  };

-  # We have many test failures on various parts of the package:
-  #  - segfaults on darwin:
-  #    https://github.com/giampaolo/psutil/issues/1715
-  #  - swap (on linux) might cause test failures if it is fully used:
-  #    https://github.com/giampaolo/psutil/issues/1911
-  #  - some mount paths are required in the build sanbox to make the tests succeed:
-  #    https://github.com/giampaolo/psutil/issues/1912
-  doCheck = false;
-  checkInputs = [ pytestCheckHook ]
-  ++ lib.optionals isPy27 [ mock unittest2 ];
+  buildInputs =
+    # workaround for https://github.com/NixOS/nixpkgs/issues/146760
+    lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+      CoreFoundation
+    ] ++ lib.optionals stdenv.isDarwin [
+      IOKit
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # Segfaults on darwin:
+  # https://github.com/giampaolo/psutil/issues/1715
+  doCheck = !stdenv.isDarwin;
+
  # In addition to the issues listed above there are some that occure due to
  # our sandboxing which we can work around by disabling some tests:
  # - cpu_times was flaky on darwin
@ -34,22 +47,19 @@ buildPythonPackage rec {

  # Note: $out must be referenced as test import paths are relative
  disabledTests = [
-    "user"
+    "cpu_freq"
+    "cpu_times"
    "disk_io_counters"
    "sensors_battery"
-    "cpu_times"
-    "cpu_freq"
+    "user"
  ];

-  buildInputs =
-    # workaround for https://github.com/NixOS/nixpkgs/issues/146760
-    lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ CoreFoundation ] ++
-    lib.optionals stdenv.isDarwin [ IOKit ];
-
-  pythonImportsCheck = [ "psutil" ];
+  pythonImportsCheck = [
+    "psutil"
+  ];

  meta = with lib; {
-    description = "Process and system utilization information interface for python";
+    description = "Process and system utilization information interface";
    homepage = "https://github.com/giampaolo/psutil";
    license = licenses.bsd3;
    maintainers = with maintainers; [ jonringer ];
--- a/pkgs/development/python-modules/py-cpuinfo/default.nix
+++ b/pkgs/development/python-modules/py-cpuinfo/default.nix
@ -1,20 +1,24 @@
 { lib
 , stdenv
-, fetchFromGitHub
 , buildPythonPackage
+, fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 , sysctl
 }:

 buildPythonPackage rec {
  pname = "py-cpuinfo";
-  version = "8.0.0";
+  version = "9.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
     owner = "workhorsy";
     repo = pname;
     rev = "v${version}";
-     sha256 = "sha256-Mgzj1HTasUNHeHMVwV6d+TeyVqnBNUwCJ1EC3kfovf8=";
+     hash = "sha256-Q5u0guAqDVhf6bvJTzNvCpWbIzjxxAjE7s0OuXj9T4Q=";
  };

  checkInputs = [
@ -28,7 +32,9 @@ buildPythonPackage rec {
      --replace "_run_and_get_stdout(['sysctl'" "_run_and_get_stdout(['${sysctl}/bin/sysctl'"
  '';

-  pythonImportsCheck = [ "cpuinfo" ];
+  pythonImportsCheck = [
+    "cpuinfo"
+  ];

  meta = with lib; {
    description = "Get CPU info with pure Python";
--- a/pkgs/development/python-modules/pymemcache/default.nix
+++ b/pkgs/development/python-modules/pymemcache/default.nix
@ -1,15 +1,17 @@
 { lib
 , buildPythonPackage
+, faker
 , fetchFromGitHub
 , mock
 , six
 , pytestCheckHook
 , pythonOlder
+, zstd
 }:

 buildPythonPackage rec {
  pname = "pymemcache";
-  version = "3.5.2";
+  version = "4.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +20,7 @@ buildPythonPackage rec {
    owner = "pinterest";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-bsiFWZHGJO/07w6mFXzf0JwftJWClE2mTv86h8zT1K0=";
+    hash = "sha256-WgtHhp7lE6StoOBfSy9+v3ODe/+zUC7lGrc2S4M68+M=";
  };

  propagatedBuildInputs = [
@ -26,8 +28,10 @@ buildPythonPackage rec {
  ];

  checkInputs = [
+    faker
    mock
    pytestCheckHook
+    zstd
  ];

  postPatch = ''
--- a/pkgs/development/python-modules/pytest-datadir/default.nix
+++ b/pkgs/development/python-modules/pytest-datadir/default.nix
@ -1,31 +1,30 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, setuptools-scm, pytest
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "pytest-datadir";
-  version = "1.3.1";
+  version = "1.4.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "gabrielcnr";
-    repo = pname;
-    rev = version;
-    sha256 = "0kwgp6sqnqnmww5r0dkmyfpi0lmw0iwxz3fnwn2fs8w6bvixzznf";
+    repo = "pytest-datadir";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-HyJ0rU1nHqRv8SHFS8m3GZ5409+JZIkoDgIVjy4ol54=";
  };

+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
  nativeBuildInputs = [ setuptools-scm ];
-
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
-  '';
-
-  checkInputs = [ pytest ];
-  checkPhase = "pytest";
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "pytest_datadir" ];

  meta = with lib; {
+    description = "Pytest plugin for manipulating test data directories and files";
    homepage = "https://github.com/gabrielcnr/pytest-datadir";
-    description = "pytest plugin for manipulating test data directories and files";
    license = licenses.mit;
    maintainers = with maintainers; [ kira-bruneau ];
  };
--- a/pkgs/development/python-modules/pytest-subtests/default.nix
+++ b/pkgs/development/python-modules/pytest-subtests/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pytest-subtests";
-  version = "0.8.0";
+  version = "0.9.0";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-Rus3YCLpJpUIFszCNQLeMnetzBOWZS3bMyjOAokFLE0=";
+    sha256 = "sha256-wDF81fal6z6Vfonb5PwzIqmv3botuEFDVe0qLLkahE4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/requests-cache/default.nix
+++ b/pkgs/development/python-modules/requests-cache/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "requests-cache";
-  version = "0.9.6";
+  version = "0.9.7";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "requests-cache";
    repo = "requests-cache";
    rev = "v${version}";
-    hash = "sha256-oFI5Rv/MAiPHiZts0PrNS+YMDFD/RxnMJ6deTxZNkSM=";
+    hash = "sha256-HSYu4jOEMXI/zGuWI7invYVvVeeM5+dDlc+9h8TOGms=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/ruamel-yaml-clib/default.nix
+++ b/pkgs/development/python-modules/ruamel-yaml-clib/default.nix
@ -5,19 +5,19 @@

 buildPythonPackage rec {
  pname = "ruamel-yaml-clib";
-  version = "0.2.6";
+  version = "0.2.7";
  format = "setuptools";

  src = fetchhg {
    url = "http://hg.code.sf.net/p/ruamel-yaml-clib/code";
    rev = version;
-    sha256 = "sha256-mpkh9JhYKRX47jfKprjt1Vpm9DMz8LcWzkotJ+/xoxY=";
+    sha256 = "sha256-QNJyJWfCT8zEvrqI65zPlWIMSRZSoDwIAbFU48TfO4U=";
  };

  # no tests
  doCheck = false;

-  # circular depedency with ruamel-yaml
+  # circular dependency with ruamel-yaml
  # pythonImportsCheck = [ "_ruamel_yaml" ];

  meta = with lib; {
--- a/pkgs/development/ruby-modules/with-packages/Gemfile
+++ b/pkgs/development/ruby-modules/with-packages/Gemfile
@ -77,6 +77,7 @@ gem 'iconv'
 gem 'idn-ruby'
 gem 'jbuilder'
 gem 'jekyll'
+gem 'jekyll-favicon'
 gem 'jmespath'
 gem 'jwt'
 gem 'kramdown-rfc2629'
--- a/pkgs/development/tools/build-managers/cmake/001-search-path.diff
+++ b/pkgs/development/tools/build-managers/cmake/001-search-path.diff
@ -12,7 +12,7 @@ index b9381c3d7d..5e944640b5 100644
   # CMake install location
   "${_CMAKE_INSTALL_DIR}"
   )
-@@ -47,48 +44,48 @@ endif()
+@@ -47,48 +44,49 @@ endif()
 
 # Non "standard" but common install prefixes
 list(APPEND CMAKE_SYSTEM_PREFIX_PATH
@ -22,9 +22,10 @@ index b9381c3d7d..5e944640b5 100644
   )
 
 # List common include file locations not under the common prefixes.
-+if(IS_DIRECTORY $ENV{NIX_CC}
-+  AND EXISTS $ENV{NIX_CC}/nix-support/orig-libc
-+  AND EXISTS $ENV{NIX_CC}/nix-support/orig-libc-dev)
+if(DEFINED ENV{NIX_CC}
+  AND IS_DIRECTORY "$ENV{NIX_CC}"
+  AND EXISTS "$ENV{NIX_CC}/nix-support/orig-libc"
+  AND EXISTS "$ENV{NIX_CC}/nix-support/orig-libc-dev")
 +  file(STRINGS "$ENV{NIX_CC}/nix-support/orig-libc" _nix_cmake_libc)
 +  file(STRINGS "$ENV{NIX_CC}/nix-support/orig-libc-dev" _nix_cmake_libc_dev)
 +else()
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@ -5,7 +5,6 @@
 , pkg-config
 , python3
 , substituteAll
-, withDarwinFrameworksGtkDocPatch ? false
 }:

 python3.pkgs.buildPythonApplication rec {
--- a/pkgs/development/tools/misc/cvise/default.nix
+++ b/pkgs/development/tools/misc/cvise/default.nix
@ -32,6 +32,11 @@ buildPythonApplication rec {
  ];

  postPatch = ''
+    # Avoid blanket -Werror to evade build failures on less
+    # tested compilers.
+    substituteInPlace CMakeLists.txt \
+      --replace " -Werror " " "
+
    # 'cvise --command=...' generates a script with hardcoded shebang.
    substituteInPlace cvise.py \
      --replace "#!/bin/bash" "#!${bash}/bin/bash"
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@ -8,11 +8,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
  pname = "elfutils";
-  version = "0.187";
+  version = "0.188";

  src = fetchurl {
    url = "https://sourceware.org/elfutils/ftp/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-5wsN++YQ+QxNH+DXGvFCpOJcPE7566uNLXK2UVnUVMg=";
+    sha256 = "sha256-+4sOjQgCAFuaMJxgwdjeMt0pUbVvDDo8tW0hzgFZXf8=";
  };

  patches = [
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@ -15,7 +15,12 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake python3 ];

-  cmakeFlags = [ "-DSPIRV-Headers_SOURCE_DIR=${spirv-headers.src}" ];
+  cmakeFlags = [
+    "-DSPIRV-Headers_SOURCE_DIR=${spirv-headers.src}"
+    # Avoid blanket -Werror to evade build failures on less
+    # tested compilers.
+    "-DSPIRV_WERROR=OFF"
+  ];

  # https://github.com/KhronosGroup/SPIRV-Tools/issues/3905
  postPatch = ''
--- a/pkgs/development/tools/xcbuild/wrapper.nix
+++ b/pkgs/development/tools/xcbuild/wrapper.nix
@ -1,6 +1,5 @@
-{ lib, stdenv, makeWrapper, writeText, writeShellScriptBin, runCommand
+{ lib, stdenv, makeWrapper, writeText, writeTextFile, runCommand, callPackage
 , CoreServices, ImageIO, CoreGraphics
-, runtimeShell, callPackage
 , xcodePlatform ? stdenv.targetPlatform.xcodePlatform or "MacOSX"
 , xcodeVer ? stdenv.targetPlatform.xcodeVer or "9.4.1"
 , sdkVer ? stdenv.targetPlatform.darwinSdkVersion or "10.12" }:
@ -37,7 +36,7 @@ let
  '';

  xcode-select = writeText "xcode-select" ''
-#!${runtimeShell}
+#!${stdenv.shell}
 while [ $# -gt 0 ]; do
   case "$1" in
         -h | --help) ;; # noop
@ -51,7 +50,12 @@ while [ $# -gt 0 ]; do
 done
  '';

-  xcrun = writeShellScriptBin "xcrun" ''
+  xcrun = writeTextFile {
+    name = "xcrun";
+    executable = true;
+    destination = "/bin/xcrun";
+    text = ''
+#!${stdenv.shell}
 args=( "$@" )

 # If an SDK was requested, check that it matches.
@ -94,7 +98,11 @@ done
 if ! [[ -z "$@" ]]; then
   exec "$@"
 fi
-  '';
+    '';
+    checkPhase = ''
+      ${stdenv.shellDryRun} "$target"
+    '';
+  };

 in

--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@ -379,6 +379,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
    "O=$(buildRoot)"
    "CC=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
    "HOSTCC=${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc"
+    "HOSTLD=${buildPackages.stdenv.cc.bintools}/bin/${buildPackages.stdenv.cc.targetPrefix}ld"
    "ARCH=${stdenv.hostPlatform.linuxArch}"
  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -122,7 +122,7 @@ assert withHomed -> withCryptsetup;
 let
  wantCurl = withRemote || withImportd;
  wantGcrypt = withResolved || withImportd;
-  version = "251.5";
+  version = "251.7";

  # Bump this variable on every (major) version change. See below (in the meson options list) for why.
  # command:
@ -139,7 +139,7 @@ stdenv.mkDerivation {
    owner = "systemd";
    repo = "systemd-stable";
    rev = "v${version}";
-    sha256 = "sha256-2MEmvFT1D+9v8OazBwjnKc7i/x7i196Eoi8bODk1cM4=";
+    sha256 = "sha256-Sa5diyNFyYtREo1xSCcufAW83ZZGZvueoDVuQ2r8wno=";
  };

  # On major changes, or when otherwise required, you *must* reformat the patches,
@ -243,12 +243,14 @@ stdenv.mkDerivation {
          opt = condition: pkg: if condition then pkg else null;
        in
        [
-          # bpf compilation support
-          { name = "libbpf.so.0"; pkg = opt withLibBPF libbpf; }
+          # bpf compilation support. We use libbpf 1 now.
+          { name = "libbpf.so.1"; pkg = opt withLibBPF libbpf; }
+          { name = "libbpf.so.0"; pkg = null; }

          # We did never provide support for libxkbcommon & qrencode
          { name = "libxkbcommon.so.0"; pkg = null; }
          { name = "libqrencode.so.4"; pkg = null; }
+          { name = "libqrencode.so.3"; pkg = null; }

          # We did not provide libpwquality before so it is safe to disable it for
          # now.
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@ -225,7 +225,7 @@ self: super:

  libXi = super.libXi.overrideAttrs (attrs: {
    outputs = [ "out" "dev" "man" "doc" ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXfixes ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXfixes self.libXext ];
    configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
      "xorg_cv_malloc0_returns_null=no"
    ] ++ lib.optional stdenv.hostPlatform.isStatic "--disable-shared";
--- a/pkgs/tools/misc/calamares-nixos-extensions/default.nix
+++ b/pkgs/tools/misc/calamares-nixos-extensions/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "calamares-nixos-extensions";
-  version = "0.3.10";
+  version = "0.3.11";

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "calamares-nixos-extensions";
    rev = version;
-    sha256 = "YJyK0rsrftrCwYD+aCAkPe/kAqUXsP/4WBAGtNKIGj8=";
+    sha256 = "NAHUU0tQLu8c2dke1V0aM3mHrNgM8ekHSB2Fo9dQUk8=";
  };

  installPhase = ''
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@ -36,6 +36,8 @@ mkDerivation rec {
    # Fix setting the kayboard layout on GNOME wayland
    # By default the module uses the setxkbmap, which will not change the keyboard
    ./waylandkbd.patch
+    # Change default location where calamares searches for locales
+    ./supportedlocale.patch
  ];

  nativeBuildInputs = [ cmake extra-cmake-modules ];
--- a/pkgs/tools/misc/calamares/supportedlocale.patch
+++ b/pkgs/tools/misc/calamares/supportedlocale.patch
@ -0,0 +1,13 @@
+diff --git a/src/modules/locale/Config.cpp b/src/modules/locale/Config.cpp
+index 2357019a7..75b547430 100644
+--- a/src/modules/locale/Config.cpp
+++ b/src/modules/locale/Config.cpp
+@@ -48,7 +48,7 @@ loadLocales( const QString& localeGenPath )
+     // supported locales. We first try that one, and if it doesn't exist, we fall back
+     // to parsing the lines from locale.gen
+     localeGenLines.clear();
+-    QFile supported( "/usr/share/i18n/SUPPORTED" );
+    QFile supported( "/run/current-system/sw/share/i18n/SUPPORTED" );
+     QByteArray ba;
+ 
+     if ( supported.exists() && supported.open( QIODevice::ReadOnly | QIODevice::Text ) )
--- a/pkgs/tools/misc/libcpuid/default.nix
+++ b/pkgs/tools/misc/libcpuid/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libcpuid";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "anrieff";
    repo = "libcpuid";
    rev = "v${version}";
-    sha256 = "sha256-XX+XFd1ehahIUGONAx2iOxetU0s6vONc7m91zEOWz5o=";
+    sha256 = "sha256-KxG06a56XPa34IJGAJbBeHUKkCEba+R7HOSosTCwQKU=";
  };

  nativeBuildInputs = [ autoreconfHook ];
@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "http://libcpuid.sourceforge.net/";
    description = "A small C library for x86 CPU detection and feature extraction";
+    changelog = "https://raw.githubusercontent.com/anrieff/libcpuid/master/ChangeLog";
    license = licenses.bsd2;
    maintainers = with maintainers; [ orivej artuuge ];
    platforms = platforms.x86;
--- a/pkgs/tools/networking/inetutils/default.nix
+++ b/pkgs/tools/networking/inetutils/default.nix
@ -1,14 +1,14 @@
 { stdenv, lib, fetchurl, ncurses, perl, help2man
-, apparmorRulesFromClosure, fetchpatch
+, apparmorRulesFromClosure
 }:

 stdenv.mkDerivation rec {
  pname = "inetutils";
-  version = "2.3";
+  version = "2.4";

  src = fetchurl {
    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-CwG7COKWI8TjuUDyM8lhRR2a+MUGYwGt12pSqV1Rdyw=";
+    sha256 = "sha256-F4nWsbGlff4qere1M+6fXf2cv1tZuxuzwmEu0I0PaLI=";
  };

  outputs = ["out" "apparmor"];
@ -16,11 +16,6 @@ stdenv.mkDerivation rec {
  patches = [
    # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
    ./inetutils-1_9-PATH_PROCNET_DEV.patch
-    (fetchpatch {
-      name = "CVE-2022-39028.patch";
-      url = "https://sources.debian.org/data/main/i/inetutils/2%3A2.3-5/debian/patches/inetutils-telnetd-EC_EL_null_deref.patch";
-      sha256 = "sha256-NYNDbEk3q3EhQdJaR12JBbnjJIRRpOcKLBF/EJJPiGU=";
-    })
  ];

  nativeBuildInputs = [ help2man perl /* for `whois' */ ];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -19489,8 +19489,11 @@ with pkgs;
  icu71 = callPackage ../development/libraries/icu/71.nix ({
    nativeBuildRoot = buildPackages.icu71.override { buildRootOnly = true; };
  });
+  icu72 = callPackage ../development/libraries/icu/72.nix ({
+    nativeBuildRoot = buildPackages.icu72.override { buildRootOnly = true; };
+  });

-  icu = icu71;
+  icu = icu72;

  id3lib = callPackage ../development/libraries/id3lib { };

@ -25706,6 +25709,7 @@ with pkgs;
      enableMinimal = true;
      guiSupport = false;
    };
+    libbpf = libbpf_1;
  };
  systemdMinimal = systemd.override {
    pname = "systemd-minimal";
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@ -1100,10 +1100,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19ynyc7wzl71hn7jw467xr188v0az679l54167slm3jh5mx6rijf";
+      sha256 = "03qiz6kbk260v3613z4wrk8iy1mi06j631fglcskfxyhf18lpy05";
      type = "gem";
    };
-    version = "6.0.7";
+    version = "6.0.8";
  };
  hashie = {
    groups = ["default"];
@ -1325,6 +1325,17 @@
    };
    version = "0.1.4";
  };
+  jekyll-favicon = {
+    dependencies = ["jekyll" "mini_magick" "rexml"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dyksm4i11n0qshd7wh6dvk8d0fc70dd32ir2dxs6igxq0gd6hi1";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
  jekyll-feed = {
    dependencies = ["jekyll"];
    groups = ["default"];
@ -1752,10 +1763,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rsgvdyh828k6bz95b4391ydv6710d4dsdrrfr684glks7599ldf";
+      sha256 = "1jbqw7hkx08i5dj74fwfdc16980hsj3mhrxp4mmjxsdzw1kndrvp";
      type = "gem";
    };
-    version = "3.2.3";
+    version = "3.2.4";
  };
  liquid = {
    groups = ["default"];