Merge branch 'staging' into staging-next

doc/languages-frameworks/go.section.md

@@ -20,7 +20,7 @@ In the following is an example expression using `buildGoModule`, the following a
 
   To obtain the actual hash, set `vendorHash = lib.fakeSha256;` and run the build ([more details here](#sec-source-hashes)).
 - `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform-dependent `vendorHash` checksums.
-- `modPostBuild`: Shell commands to run after the build of the go-modules executes `go mod vendor`, and before calculating fixed output derivation's `vendorHash` (or `vendorSha256`). Note that if you change this attribute, you need to update `vendorHash` (or `vendorSha256`) attribute.
+- `modPostBuild`: Shell commands to run after the build of the goModules executes `go mod vendor`, and before calculating fixed output derivation's `vendorHash` (or `vendorSha256`). Note that if you change this attribute, you need to update `vendorHash` (or `vendorSha256`) attribute.
 
 ```nix
 pet = buildGoModule rec {
@@ -115,7 +115,7 @@ done
 
 ## Attributes used by the builders {#ssec-go-common-attributes}
 
-Many attributes [controlling the build phase](#variables-controlling-the-build-phase) are respected by both `buildGoModule` and `buildGoPackage`. Note that `buildGoModule` reads the following attributes also when building the `vendor/` go-modules fixed output derivation as well:
+Many attributes [controlling the build phase](#variables-controlling-the-build-phase) are respected by both `buildGoModule` and `buildGoPackage`. Note that `buildGoModule` reads the following attributes also when building the `vendor/` goModules fixed output derivation as well:
 
 - [`sourceRoot`](#var-stdenv-sourceRoot)
 - [`prePatch`](#var-stdenv-prePatch)

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -110,6 +110,8 @@
 
 - DocBook option documentation is no longer supported, all module documentation now uses markdown.
 
+- `buildGoModule` `go-modules` attrs have been renamed to `goModules`.
+
 - `services.fail2ban.jails` can now be configured with attribute sets defining settings and filters instead of lines. The stringed options `daemonConfig` and `extraSettings` have respectively been replaced by `daemonSettings` and `jails.DEFAULT.settings` which use attribute sets.
 
 - The module [services.ankisyncd](#opt-services.ankisyncd.package) has been switched to [anki-sync-server-rs](https://github.com/ankicommunity/anki-sync-server-rs) from the old python version, which was difficult to update, had not been updated in a while, and did not support recent versions of anki.

nixos/tests/installed-tests/default.nix

@@ -107,5 +107,6 @@ in
   malcontent = callInstalledTest ./malcontent.nix {};
   ostree = callInstalledTest ./ostree.nix {};
   pipewire = callInstalledTest ./pipewire.nix {};
+  upower = callInstalledTest ./upower.nix {};
   xdg-desktop-portal = callInstalledTest ./xdg-desktop-portal.nix {};
 }

nixos/tests/installed-tests/upower.nix

@@ -0,0 +1,9 @@
+{ pkgs, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.upower;
+
+  testConfig = {
+    services.upower.enable = true;
+  };
+}

pkgs/applications/audio/fluidsynth/default.nix

@@ -1,19 +1,29 @@
-{ stdenv, lib, fetchFromGitHub, buildPackages, pkg-config, cmake
+{ stdenv, lib, fetchFromGitHub, fetchpatch, buildPackages, pkg-config, cmake
 , alsa-lib, glib, libjack2, libsndfile, libpulseaudio
 , AppKit, AudioUnit, CoreAudio, CoreMIDI, CoreServices
 }:
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-BSJu3jB7b5G2ThXBUHUNnBGl55EXe3nIzdBdgfOWDSM=";
+    sha256 = "sha256-RqhlpvMbRSwdcY2uuFAdJnihN3aObcLVMuvCZ294dgo=";
   };
 
+  patches = [
+    # Fixes bad CMAKE_INSTALL_PREFIX + CMAKE_INSTALL_LIBDIR concatenation for Darwin install name dir
+    # Remove when PR merged & in release
+    (fetchpatch {
+      name = "0001-Fix-incorrect-way-of-turning-CMAKE_INSTALL_LIBDIR-absolute.patch";
+      url = "https://github.com/FluidSynth/fluidsynth/pull/1261/commits/03cd38dd909fc24aa39553d869afbb4024416de8.patch";
+      hash = "sha256-nV+MbFttnbNBO4zWnPLpnnEuoiESkV9BGFlUS9tQQfk=";
+    })
+  ];
+
   outputs = [ "out" "dev" "man" ];
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
@@ -24,8 +34,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-Denable-framework=off"
-    # set CMAKE_INSTALL_NAME_DIR to correct value on darwin
-    "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
   meta = with lib; {

pkgs/applications/networking/cluster/k3s/update-script.sh

@@ -114,7 +114,7 @@ cat >versions.nix <<EOF
 EOF
 
 set +e
-K3S_VENDOR_SHA256=$(nix-prefetch -I nixpkgs=${NIXPKGS_ROOT} "{ sha256 }: (import ${NIXPKGS_ROOT}. {}).k3s_1_${MINOR_VERSION}.go-modules.overrideAttrs (_: { vendorSha256 = sha256; })")
+K3S_VENDOR_SHA256=$(nix-prefetch -I nixpkgs=${NIXPKGS_ROOT} "{ sha256 }: (import ${NIXPKGS_ROOT}. {}).k3s_1_${MINOR_VERSION}.goModules.overrideAttrs (_: { vendorSha256 = sha256; })")
 set -e
 
 if [ -n "${K3S_VENDOR_SHA256:-}" ]; then

pkgs/applications/networking/cluster/kfctl/default.nix

@@ -28,6 +28,6 @@ buildGoModule rec {
     homepage = "https://github.com/kubeflow/kfctl";
     license = licenses.asl20;
     maintainers = with maintainers; [ mvnetbiz ];
-    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.goModules --check
   };
 }

pkgs/applications/networking/cluster/kubemqctl/default.nix

@@ -21,6 +21,6 @@ buildGoModule rec {
     description = "Kubemqctl is a command line interface (CLI) for Kubemq Kubernetes Message Broker.";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ brianmcgee ];
-    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.goModules --check
   };
 }

pkgs/applications/networking/cluster/terraform-providers/update-provider

@@ -151,7 +151,7 @@ update_attr hash "${hash}"
 old_vendor_hash="$(read_attr vendorHash)"
 if [[ ${old_vendor_hash} != null ]]; then
   echo_provider "calculating vendorHash"
-  vendorHash=$(generate_hash go-modules)
+  vendorHash=$(generate_hash goModules)
   update_attr vendorHash "${vendorHash}"
 fi
 

pkgs/applications/system/mgmt/default.nix

@@ -20,7 +20,7 @@ buildGoModule rec {
     hash = "sha256-jurZvEtiaTjWeDkmCJDIFlTzR5EVglfoDxkFgOilo8s=";
   };
 
-  # patching must be done in prebuild, so it is shared with go-modules
+  # patching must be done in prebuild, so it is shared with goModules
   # see https://github.com/NixOS/nixpkgs/issues/208036
   preBuild = ''
     for file in `find -name Makefile -type f`; do

pkgs/applications/terminal-emulators/kitty/default.nix

@@ -43,7 +43,7 @@ buildPythonApplication rec {
     pname = "kitty-go-modules";
     inherit src version;
     vendorHash = "sha256-jk2EcYVuhV/UQfHAIfpnn8ZIZnwjA/o8YRXmpoC85Vc=";
-  }).go-modules;
+  }).goModules;
 
   buildInputs = [
     harfbuzz
@@ -229,7 +229,6 @@ buildPythonApplication rec {
   '';
 
   passthru = {
-    go-modules = goModules; # allow for updateScript to handle vendorHash
     tests.test = nixosTests.terminal-emulators.kitty;
     updateScript = nix-update-script {};
   };

pkgs/applications/version-management/forgejo/default.nix

@@ -88,7 +88,7 @@ buildGoModule rec {
       --prefix PATH : ${lib.makeBinPath [ bash git gzip openssh ]}
   '';
 
-  # $data is not available in go-modules.drv and preBuild isn't needed
+  # $data is not available in goModules.drv and preBuild isn't needed
   overrideModAttrs = (_: {
     postPatch = null;
     preBuild = null;

pkgs/applications/version-management/git-hound/default.nix

@@ -26,6 +26,6 @@ buildGoModule rec {
     homepage = "https://github.com/tillson/git-hound";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
-    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.goModules --check
   };
 }

pkgs/applications/version-management/mercurial/default.nix

@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.4.5";
+    version = "6.5";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-sLSwC4smOci+OHOUeW8EJb6zOTFN9+cpN/jd0qQbG4o=";
+      sha256 = "sha256-pWA9DTlev2f+XSeruzvTf8wBhx7POUx5NnLSweaL5+c=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-shB2MRGATTg4l6pJ9FVYfBtnrX/eEHRvPhc8GZTA9ns=";
+      sha256 = "sha256-umjOU3OmTdPmLS4IWncqmKxSa6J4KXwTlGhylFt6TQo=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;

pkgs/applications/version-management/sourcehut/fix-gqlgen-trimpath.nix

@@ -3,7 +3,7 @@
 }:
 {
   overrideModAttrs = (_: {
-    # No need to workaround -trimpath: it's not used in go-modules,
+    # No need to workaround -trimpath: it's not used in goModules,
     # but do download `go generate`'s dependencies nonetheless.
     preBuild = ''
       go generate ./loaders

pkgs/applications/virtualization/singularity/generic.nix

@@ -93,7 +93,7 @@ in
   inherit pname version src;
 
   # Override vendorHash with the output got from
-  # nix-prefetch -E "{ sha256 }: ((import ./. { }).apptainer.override { vendorHash = sha256; }).go-modules"
+  # nix-prefetch -E "{ sha256 }: ((import ./. { }).apptainer.override { vendorHash = sha256; }).goModules"
   # or with `null` when using vendored source tarball.
   inherit vendorHash deleteVendor proxyVendor;
 

pkgs/applications/virtualization/singularity/packages.nix

@@ -18,7 +18,7 @@ let
       };
 
       # Update by running
-      # nix-prefetch -E "{ sha256 }: ((import ./. { }).apptainer.override { vendorHash = sha256; }).go-modules"
+      # nix-prefetch -E "{ sha256 }: ((import ./. { }).apptainer.override { vendorHash = sha256; }).goModules"
       # at the root directory of the Nixpkgs repository
       vendorHash = "sha256-PfFubgR/W1WBXIsRO+Kg7hA6ebeAcRiJlTlAZbnl19A=";
 
@@ -49,7 +49,7 @@ let
       };
 
       # Update by running
-      # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).go-modules"
+      # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).goModules"
       # at the root directory of the Nixpkgs repository
       vendorHash = "sha256-mBhlH6LSmcJuc6HbU/3Q9ii7vJkW9jcikBWCl8oeMOk=";
 

pkgs/build-support/buildenv/builder.pl

@@ -126,7 +126,7 @@ sub findFiles {
     return if
         $relName eq "/propagated-build-inputs" ||
         $relName eq "/nix-support" ||
-        $relName =~ /info\/dir/ ||
+        $relName =~ /info\/dir$/ ||
         ( $relName =~ /^\/share\/mime\// && !( $relName =~ /^\/share\/mime\/packages/ ) ) ||
         $baseName eq "perllocal.pod" ||
         $baseName eq "log" ||

pkgs/build-support/fetchgit/nix-prefetch-git

@@ -390,6 +390,7 @@ print_results() {
   "date": "$(json_escape "$commitDateStrict8601")",
   "path": "$(json_escape "$finalPath")",
   "$(json_escape "$hashType")": "$(json_escape "$hash")",
+  "hash": "$(nix-hash --to-sri --type $hashType $hash)",
   "fetchLFS": $([[ -n "$fetchLFS" ]] && echo true || echo false),
   "fetchSubmodules": $([[ -n "$fetchSubmodules" ]] && echo true || echo false),
   "deepClone": $([[ -n "$deepClone" ]] && echo true || echo false),

pkgs/build-support/go/module.nix

@@ -6,7 +6,7 @@
 , passthru ? { }
 , patches ? [ ]
 
-  # A function to override the go-modules derivation
+  # A function to override the goModules derivation
 , overrideModAttrs ? (_oldAttrs: { })
 
   # path to go.mod and go.sum directory
@@ -52,9 +52,9 @@ assert (args' ? vendorHash && args' ? vendorSha256) -> throw "both `vendorHash`
 let
   args = removeAttrs args' [ "overrideModAttrs" "vendorSha256" "vendorHash" ];
 
-  go-modules = if (vendorHash == null) then "" else
+  goModules = if (vendorHash == null) then "" else
   (stdenv.mkDerivation {
-    name = "${name}-go-modules";
+    name = "${name}-goModules";
 
     nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [ go git cacert ];
 
@@ -163,10 +163,10 @@ let
       cd "$modRoot"
     '' + lib.optionalString (vendorHash != null) ''
       ${if proxyVendor then ''
-        export GOPROXY=file://${go-modules}
+        export GOPROXY=file://${goModules}
       '' else ''
         rm -rf vendor
-        cp -r --reflink=auto ${go-modules} vendor
+        cp -r --reflink=auto ${goModules} vendor
       ''}
     '' + ''
 
@@ -288,7 +288,7 @@ let
 
     disallowedReferences = lib.optional (!allowGoReference) go;
 
-    passthru = passthru // { inherit go go-modules vendorHash; } // { inherit (args') vendorSha256; };
+    passthru = passthru // { inherit go goModules vendorHash; } // { inherit (args') vendorSha256; };
 
     meta = {
       # Add default meta information

pkgs/development/compilers/gcc/10/default.nix

@@ -214,10 +214,7 @@ lib.pipe (stdenv.mkDerivation ({
             )
           '';
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { })

pkgs/development/compilers/gcc/11/default.nix

@@ -228,10 +228,7 @@ lib.pipe (stdenv.mkDerivation ({
             )
           '';
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { })

pkgs/development/compilers/gcc/12/default.nix

@@ -271,10 +271,7 @@ lib.pipe (stdenv.mkDerivation ({
             )
           '';
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

pkgs/development/compilers/gcc/13/default.nix

@@ -265,10 +265,7 @@ lib.pipe (stdenv.mkDerivation ({
             )
           '';
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

pkgs/development/compilers/gcc/4.8/default.nix

@@ -232,10 +232,7 @@ lib.pipe (stdenv.mkDerivation ({
         ''
     else null;
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler langJava withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler langJava
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { })

pkgs/development/compilers/gcc/4.9/default.nix

@@ -253,10 +253,7 @@ lib.pipe (stdenv.mkDerivation ({
         ''
     else null;
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler langJava withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler langJava
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { })

pkgs/development/compilers/gcc/6/default.nix

@@ -269,10 +269,7 @@ lib.pipe (stdenv.mkDerivation ({
         ))
     );
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler langJava withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler langJava
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { })

pkgs/development/compilers/gcc/7/default.nix

@@ -218,10 +218,7 @@ lib.pipe (stdenv.mkDerivation ({
         )
       '';
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { })

pkgs/development/compilers/gcc/8/default.nix

@@ -199,10 +199,7 @@ lib.pipe (stdenv.mkDerivation ({
             )
           '';
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { })

pkgs/development/compilers/gcc/9/default.nix

@@ -213,10 +213,7 @@ lib.pipe (stdenv.mkDerivation ({
           )
         '';
 
-  # kludge to prevent a mass-rebuild; will be removed in a PR sent to staging
+  inherit noSysDirs staticCompiler withoutTargetLibc
-  crossStageStatic = withoutTargetLibc;
-
-  inherit noSysDirs staticCompiler
     libcCross crossMingw;
 
   inherit (callFile ../common/dependencies.nix { })

pkgs/development/compilers/gcc/builder.sh

@@ -135,7 +135,7 @@ if test "$noSysDirs" = "1"; then
         )
     fi
 
-    if test "$crossStageStatic" == 1; then
+    if test "$withoutTargetLibc" == 1; then
         # We don't want the gcc build to assume there will be a libc providing
         # limits.h in this stage
         makeFlagsArray+=(
@@ -167,7 +167,7 @@ preConfigure() {
         rm -Rf zlib
     fi
 
-    if test -n "$crossMingw" -a -n "$crossStageStatic"; then
+    if test -n "$crossMingw" -a -n "$withoutTargetLibc"; then
         mkdir -p ../mingw
         # --with-build-sysroot expects that:
         cp -R $libcCross/include ../mingw
@@ -185,8 +185,9 @@ preConfigure() {
 
 
 postConfigure() {
-    # Don't store the configure flags in the resulting executables.
+    # Avoid store paths when embedding ./configure flags into gcc.
-    sed -e '/TOPLEVEL_CONFIGURE_ARGUMENTS=/d' -i Makefile
+    # Mangled arguments are still useful when reporting bugs upstream.
+    sed -e "/TOPLEVEL_CONFIGURE_ARGUMENTS=/ s|$NIX_STORE/[a-z0-9]\{32\}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" -i Makefile
 }
 
 

pkgs/development/compilers/go/1.20.nix

@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.20.5";
+  version = "1.20.6";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-mhXBM7os+v55ZS9IFbYufPwmf2jfG5RUxqsqPKi5aog=";
+    hash = "sha256-Yu5bxvtVuLro9wXgy434bWRTYmtOz5MnnihnCS4Lf3A=";
   };
 
   strictDeps = true;

pkgs/development/compilers/rust/1_70.nix

@@ -15,7 +15,6 @@
 , CoreFoundation, Security, SystemConfiguration
 , pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
 , makeRustPlatform
-, llvmPackages_11
 , llvmPackages_16, llvm_16
 } @ args:
 
@@ -27,8 +26,6 @@ import ./default.nix {
   llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForTarget = pkgsBuildTarget.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
 
-  llvmBootstrapForDarwin = llvmPackages_11;
-
   # For use at runtime
   llvmShared = llvm_16.override { enableSharedLibraries = true; };
 
@@ -60,4 +57,4 @@ import ./default.nix {
   rustcPatches = [ ];
 }
 
-(builtins.removeAttrs args [ "pkgsBuildHost" "llvmPackages_11" "llvmPackages_16" "llvm_16"])
+(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildBuild" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])

pkgs/development/compilers/rust/default.nix

@@ -5,7 +5,6 @@
 , bootstrapHashes
 , selectRustPackage
 , rustcPatches ? []
-, llvmBootstrapForDarwin
 , llvmShared
 , llvmSharedForBuild
 , llvmSharedForHost
@@ -16,7 +15,6 @@
 , buildPackages
 , newScope, callPackage
 , CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild
 , makeRustPlatform
 }:
 
@@ -69,11 +67,6 @@ in
 
         # Use boot package set to break cycle
         inherit (bootstrapRustPackages) cargo rustc;
-      } // lib.optionalAttrs (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) {
-        stdenv = llvmBootstrapForDarwin.stdenv;
-        pkgsBuildBuild = pkgsBuildBuild // { targetPackages.stdenv = llvmBootstrapForDarwin.stdenv; };
-        pkgsBuildHost = pkgsBuildBuild // { targetPackages.stdenv = llvmBootstrapForDarwin.stdenv; };
-        pkgsBuildTarget = pkgsBuildTarget // { targetPackages.stdenv = llvmBootstrapForDarwin.stdenv; };
       });
       rustfmt = self.callPackage ./rustfmt.nix {
         inherit Security;

pkgs/development/compilers/vala/default.nix

@@ -10,17 +10,15 @@ let
     withGraphviz ? false
   }:
   let
-    # Patches from the openembedded-core project to build vala without graphviz
+    # Build vala (valadoc) without graphviz support. Inspired from the openembedded-core project.
-    # support. We need to apply an additional patch to allow building when the
+    # https://github.com/openembedded/openembedded-core/blob/a5440d4288e09d3e/meta/recipes-devtools/vala/vala/disable-graphviz.patch
-    # header file isn't available at all, but that patch (./gvc-compat.patch)
-    # can be shared between all versions of Vala so far.
     graphvizPatch =
       {
         "0.48" = ./disable-graphviz-0.46.1.patch;
 
         "0.54" = ./disable-graphviz-0.46.1.patch;
 
-        "0.56" = ./disable-graphviz-0.46.1.patch;
+        "0.56" = ./disable-graphviz-0.56.8.patch;
 
       }.${lib.versions.majorMinor version} or (throw "no graphviz patch for this version of vala");
 
@@ -47,7 +45,7 @@ let
     # If we're disabling graphviz, apply the patches and corresponding
     # configure flag. We also need to override the path to the valac compiler
     # so that it can be used to regenerate documentation.
-    patches        = lib.optionals disableGraphviz [ graphvizPatch ./gvc-compat.patch ];
+    patches        = lib.optionals disableGraphviz [ graphvizPatch ];
     configureFlags = lib.optional  disableGraphviz "--disable-graphviz";
     # when cross-compiling ./compiler/valac is valac for host
     # so add the build vala in nativeBuildInputs
@@ -103,8 +101,8 @@ in rec {
   };
 
   vala_0_56 = generic {
-    version = "0.56.7";
+    version = "0.56.9";
-    sha256 = "PTnHWW1fqa6L/q5HZmn4EfcFe397kwhHiie2hEPYsAM=";
+    sha256 = "VVeMfE8Ges4CjlQYBq8kD4CEy2/wzFVMqorAjL+Lzi8=";
   };
 
   vala = vala_0_56;

pkgs/development/compilers/vala/disable-graphviz-0.46.1.patch

@@ -259,3 +259,22 @@ index 5aa4afdea..e79b0b8f5 100644
  
  		return this;
  	}
+diff --git i/libvaladoc/Makefile.am w/libvaladoc/Makefile.am
+index 8dc398cf1..a5d8a45b4 100644
+--- i/libvaladoc/Makefile.am
++++ w/libvaladoc/Makefile.am
+@@ -176,9 +176,13 @@ endif
+ libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
+ 	libvaladoc.vala.stamp \
+ 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
+-	gvc-compat.c \
+ 	$(NULL)
+ 
++if ENABLE_GRAPHVIZ
++libvaladoc@PACKAGE_SUFFIX@_la_SOURCES += \
++	gvc-compat.c
++endif
++
+ valadoc@PACKAGE_SUFFIX@.vapi valadoc.h: libvaladoc.vala.stamp
+ libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
+ 	$(VALA_V)$(VALAC) \

pkgs/development/compilers/vala/disable-graphviz-0.56.8.patch

@@ -0,0 +1,173 @@
+diff --git a/configure.ac b/configure.ac
+index 088e8f3b5..bded3c54c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -196,13 +196,15 @@ AC_SUBST(GMODULE_LIBS)
+ 
+ AC_ARG_WITH(cgraph, AS_HELP_STRING([--with-cgraph], [Required flag for cross-compilation to define capability of graphviz]), [], with_cgraph=check)
+ AC_ARG_ENABLE(valadoc, AS_HELP_STRING([--disable-valadoc], [Disable valadoc]), enable_valadoc=$enableval, enable_valadoc=yes)
++AC_ARG_ENABLE(graphviz, AS_HELP_STRING([--disable-graphviz], [Disable graphviz usage for valadoc]), enable_graphviz=$enableval, enable_graphviz=yes)
+ AS_IF([test "$VALAC" != :], [FOUND_VALAC_VERION=`$VALAC --version | sed 's/Vala  *//'`
+ 	AS_VERSION_COMPARE(["$FOUND_VALAC_VERION"], ["$VALAC_VALADOC_REQUIRED"], [
+ 		AC_MSG_WARN([Force disable build of valadoc, valac >= $VALAC_VALADOC_REQUIRED is required])
+ 		enable_valadoc=no
+ 	])
+ ])
+-if test x$enable_valadoc = xyes; then
++if test x$enable_valadoc = xyes && test x$enable_graphviz = xyes; then
++	VALAFLAGS="$VALAFLAGS -D HAVE_GRAPHVIZ"
+ 	PKG_CHECK_MODULES(LIBGVC, libgvc >= $LIBGVC_REQUIRED)
+ 	AC_MSG_CHECKING([for CGRAPH])
+ 	cgraph_tmp_LIBADD="$LIBADD"
+@@ -244,6 +246,7 @@ if test x$enable_valadoc = xyes; then
+ fi
+ AM_CONDITIONAL(HAVE_CGRAPH, test "$have_cgraph" = "yes")
+ AM_CONDITIONAL(ENABLE_VALADOC, test x$enable_valadoc = xyes)
++AM_CONDITIONAL(ENABLE_GRAPHVIZ, test x$enable_graphviz = xyes)
+ 
+ AC_PATH_PROG([G_IR_COMPILER], [g-ir-compiler], :)
+ AM_CONDITIONAL(HAVE_G_IR_COMPILER, test "$G_IR_COMPILER" != :)
+diff --git a/libvaladoc/Makefile.am b/libvaladoc/Makefile.am
+index dad9a9e99..e23266606 100644
+--- a/libvaladoc/Makefile.am
++++ b/libvaladoc/Makefile.am
+@@ -119,10 +119,6 @@ libvaladoc_la_VALASOURCES = \
+ 	content/tablerow.vala \
+ 	content/taglet.vala \
+ 	content/text.vala \
+-	charts/chart.vala \
+-	charts/chartfactory.vala \
+-	charts/hierarchychart.vala \
+-	charts/simplechartfactory.vala \
+ 	parser/manyrule.vala \
+ 	parser/oneofrule.vala \
+ 	parser/optionalrule.vala \
+@@ -149,19 +145,34 @@ libvaladoc_la_VALASOURCES = \
+ 	highlighter/codetoken.vala \
+ 	highlighter/highlighter.vala \
+ 	html/basicdoclet.vala \
+-	html/htmlchartfactory.vala \
+ 	html/linkhelper.vala \
+ 	html/cssclassresolver.vala \
+ 	html/htmlmarkupwriter.vala \
+ 	html/htmlrenderer.vala \
+ 	$(NULL)
+ 
++if ENABLE_GRAPHVIZ
++libvaladoc_la_VALASOURCES += \
++	charts/chart.vala \
++	charts/chartfactory.vala \
++	charts/hierarchychart.vala \
++	charts/simplechartfactory.vala \
++	html/htmlchartfactory.vala \
++	$(NULL)
++endif
++
+ libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
+ 	libvaladoc.vala.stamp \
+ 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
+-	gvc-compat.c \
+ 	$(NULL)
+ 
++if ENABLE_GRAPHVIZ
++libvaladoc@PACKAGE_SUFFIX@_la_SOURCES += \
++	gvc-compat.c
++
++LIBGVC_PKG = --vapidir $(top_srcdir)/vapi --pkg libgvc
++endif
++
+ valadoc@PACKAGE_SUFFIX@.vapi valadoc.h: libvaladoc.vala.stamp
+ libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
+ 	$(VALA_V)$(VALAC) \
+@@ -174,7 +185,7 @@ libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
+ 		--library valadoc \
+ 		--vapi valadoc@PACKAGE_SUFFIX@.vapi \
+ 		--vapidir $(top_srcdir)/vapi --pkg gmodule-2.0 \
+-		--vapidir $(top_srcdir)/vapi --pkg libgvc \
++		$(LIBGVC_PKG) \
+ 		--vapidir $(top_srcdir)/gee --pkg gee \
+ 		--vapidir $(top_srcdir)/vala --pkg vala \
+ 		--vapidir $(top_srcdir)/ccode --pkg ccode \
+@@ -206,6 +217,9 @@ nodist_pkgconfig_DATA = valadoc@PACKAGE_SUFFIX@.pc
+ 
+ valadoc@PACKAGE_SUFFIX@.pc: valadoc.pc
+ 	cp $< $@
++if !ENABLE_GRAPHVIZ
++	sed -i "s/libgvc //g" $@
++endif
+ 
+ vapidir = $(datadir)/vala/vapi
+ dist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.vapi
+@@ -213,6 +227,9 @@ nodist_vapi_DATA = valadoc@PACKAGE_SUFFIX@.deps
+ 
+ valadoc@PACKAGE_SUFFIX@.deps: valadoc.deps
+ 	cp $< $@
++if !ENABLE_GRAPHVIZ
++	sed -i "s/libgvc//g" $@
++endif
+ 
+ EXTRA_DIST = \
+ 	$(libvaladoc_la_VALASOURCES) \
+diff --git a/libvaladoc/html/basicdoclet.vala b/libvaladoc/html/basicdoclet.vala
+index f4999efd4..03871d687 100644
+--- a/libvaladoc/html/basicdoclet.vala
++++ b/libvaladoc/html/basicdoclet.vala
+@@ -46,7 +46,11 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
+ 	protected HtmlRenderer _renderer;
+ 	protected Html.MarkupWriter writer;
+ 	protected Html.CssClassResolver cssresolver;
++#if HAVE_GRAPHVIZ
+ 	protected Charts.Factory image_factory;
++#else
++	protected void* image_factory;
++#endif
+ 	protected ErrorReporter reporter;
+ 	protected string package_list_link = "../index.html";
+ 
+@@ -120,7 +124,9 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
+ 		this.linker = new LinkHelper ();
+ 
+ 		_renderer = new HtmlRenderer (settings, this.linker, this.cssresolver);
++#if HAVE_GRAPHVIZ
+ 		this.image_factory = new SimpleChartFactory (settings, linker);
++#endif
+ 	}
+ 
+ 
+@@ -1028,6 +1034,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
+ 	}
+ 
+ 	protected void write_image_block (Api.Node element) {
++#if HAVE_GRAPHVIZ
+ 		if (element is Class || element is Interface || element is Struct) {
+ 			unowned string format = (settings.use_svg_images ? "svg" : "png");
+ 			var chart = new Charts.Hierarchy (image_factory, element);
+@@ -1047,6 +1054,7 @@ public abstract class Valadoc.Html.BasicDoclet : Api.Visitor, Doclet {
+ 									   this.get_img_path_html (element, format)});
+ 			writer.add_usemap (chart);
+ 		}
++#endif
+ 	}
+ 
+ 	public void write_namespace_content (Namespace node, Api.Node? parent) {
+diff --git a/libvaladoc/html/htmlmarkupwriter.vala b/libvaladoc/html/htmlmarkupwriter.vala
+index 5aa4afdea..e79b0b8f5 100644
+--- a/libvaladoc/html/htmlmarkupwriter.vala
++++ b/libvaladoc/html/htmlmarkupwriter.vala
+@@ -51,12 +51,16 @@ public class Valadoc.Html.MarkupWriter : Valadoc.MarkupWriter {
+ 		}
+ 	}
+ 
++#if HAVE_GRAPHVIZ
+ 	public unowned MarkupWriter add_usemap (Charts.Chart chart) {
+ 		string? buf = (string?) chart.write_buffer ("cmapx");
+ 		if (buf != null) {
+ 			raw_text ("\n");
+ 			raw_text ((!) buf);
+ 		}
++#else
++	public unowned MarkupWriter add_usemap (void* chart) {
++#endif
+ 
+ 		return this;
+ 	}

pkgs/development/compilers/vala/gvc-compat.patch

@@ -1,19 +0,0 @@
-diff --git i/libvaladoc/Makefile.am w/libvaladoc/Makefile.am
-index 8dc398cf1..a5d8a45b4 100644
---- i/libvaladoc/Makefile.am
-+++ w/libvaladoc/Makefile.am
-@@ -176,9 +176,13 @@ endif
- libvaladoc@PACKAGE_SUFFIX@_la_SOURCES = \
- 	libvaladoc.vala.stamp \
- 	$(libvaladoc_la_VALASOURCES:.vala=.c) \
--	gvc-compat.c \
- 	$(NULL)
- 
-+if ENABLE_GRAPHVIZ
-+libvaladoc@PACKAGE_SUFFIX@_la_SOURCES += \
-+	gvc-compat.c
-+endif
-+
- valadoc@PACKAGE_SUFFIX@.vapi valadoc.h: libvaladoc.vala.stamp
- libvaladoc.vala.stamp: $(libvaladoc_la_VALASOURCES)
- 	$(VALA_V)$(VALAC) \

pkgs/development/interpreters/perl/intepreter.nix

@@ -195,9 +195,11 @@ stdenv.mkDerivation (rec {
       substituteInPlace "$out"/lib/perl5/*/*/Config_heavy.pl \
         --replace "${libcInc}" /no-such-path \
         --replace "${
-            if stdenv.hasCC then stdenv.cc.cc else "/no-such-path"
+            if stdenv.hasCC then stdenv.cc else "/no-such-path"
           }" /no-such-path \
-        --replace "${stdenv.cc}" /no-such-path \
+        --replace "${
+            if stdenv.hasCC && stdenv.cc.cc != null then stdenv.cc.cc else "/no-such-path"
+        }" /no-such-path \
         --replace "$man" /no-such-path
     '' + lib.optionalString crossCompiling
       ''

pkgs/development/interpreters/ruby/rubygems/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.16";
+  version = "3.4.17";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-T58wDLMOCPPwoPuXdZvpXeF7yERXvW1lPxVqe8zFs6M=";
+    hash = "sha256-SvqqlGPiqHeZQ0Mvulbgc5bM7E1O3HK7BtnbiscG0vE=";
   };
 
   patches = [

pkgs/development/libraries/at-spi2-core/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -32,6 +33,14 @@ stdenv.mkDerivation rec {
     sha256 = "NzFt9DypmJzlOdVM9CmnaMKLs4oLNJUL6t0EIYJ+31U=";
   };
 
+  patches = [
+    # Fix implicit declaration of `strcasecmp`, which is an error on clang 16.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/at-spi2-core/-/merge_requests/147.patch";
+      hash = "sha256-UU2n//Z9F1SyUGyuDKsiwZDyThsp/tJprz/zolDDTyw=";
+    })
+  ];
+
   nativeBuildInputs = [
     glib
     meson

pkgs/development/libraries/db/db-4.8.nix

@@ -3,8 +3,11 @@
 import ./generic.nix (args // {
   version = "4.8.30";
   sha256 = "0ampbl2f0hb1nix195kz1syrqqxpmvnvnfvphambj7xjrl3iljg0";
-  extraPatches = [ ./clang-4.8.patch ./CVE-2017-10140-4.8-cwd-db_config.patch ]
+  extraPatches = [
-    ++ lib.optionals stdenv.isDarwin [ ./darwin-mutexes-4.8.patch ];
+    ./clang-4.8.patch
+    ./CVE-2017-10140-4.8-cwd-db_config.patch
+    ./darwin-mutexes-4.8.patch
+  ];
 
   drvArgs.hardeningDisable = [ "format" ];
   drvArgs.doCheck = false;

pkgs/development/libraries/db/db-5.3.nix

@@ -3,6 +3,9 @@
 import ./generic.nix (args // {
   version = "5.3.28";
   sha256 = "0a1n5hbl7027fbz5lm0vp0zzfp1hmxnz14wx3zl9563h83br5ag0";
-  extraPatches = [ ./clang-5.3.patch ./CVE-2017-10140-cwd-db_config.patch ]
+  extraPatches = [
-    ++ lib.optionals stdenv.isDarwin [ ./darwin-mutexes.patch ];
+    ./clang-5.3.patch
+    ./CVE-2017-10140-cwd-db_config.patch
+    ./darwin-mutexes.patch
+  ];
 })

pkgs/development/libraries/db/db-6.0.nix

@@ -4,6 +4,9 @@ import ./generic.nix (args // {
   version = "6.0.20";
   sha256 = "00r2aaglq625y8r9xd5vw2y070plp88f1mb2gbq3kqsl7128lsl0";
   license = lib.licenses.agpl3;
-  extraPatches = [ ./clang-6.0.patch ./CVE-2017-10140-cwd-db_config.patch ]
+  extraPatches = [
-    ++ lib.optionals stdenv.isDarwin [ ./darwin-mutexes.patch ];
+    ./clang-6.0.patch
+    ./CVE-2017-10140-cwd-db_config.patch
+    ./darwin-mutexes.patch
+  ];
 })

pkgs/development/libraries/db/db-6.2.nix

@@ -4,6 +4,9 @@ import ./generic.nix (args // {
   version = "6.2.23";
   sha256 = "1isxx4jfmnh913jzhp8hhfngbk6dsg46f4kjpvvc56maj64jqqa7";
   license = lib.licenses.agpl3;
-  extraPatches = [ ./clang-6.0.patch ./CVE-2017-10140-cwd-db_config.patch ]
+  extraPatches = [
-    ++ lib.optionals stdenv.isDarwin [ ./darwin-mutexes.patch ];
+    ./clang-6.0.patch
+    ./CVE-2017-10140-cwd-db_config.patch
+    ./darwin-mutexes.patch
+  ];
 })

pkgs/development/libraries/db/generic.nix

@@ -10,9 +10,6 @@
 , drvArgs ? {}
 }:
 
-let
-  shouldReconfigure = stdenv.cc.isClang;
-in
 stdenv.mkDerivation (rec {
   pname = "db";
   inherit version;
@@ -24,16 +21,16 @@ stdenv.mkDerivation (rec {
 
   # The provided configure script features `main` returning implicit `int`, which causes
   # configure checks to work incorrectly with clang 16.
-  nativeBuildInputs = lib.optionals stdenv.cc.isClang [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook ];
 
   patches = extraPatches;
 
   outputs = [ "bin" "out" "dev" ];
 
   # Required when regenerated the configure script to make sure the vendored macros are found.
-  autoreconfFlags = lib.optionalString shouldReconfigure [ "-fi" "-Iaclocal" "-Iaclocal_java" ];
+  autoreconfFlags = [ "-fi" "-Iaclocal" "-Iaclocal_java" ];
 
-  preAutoreconf = lib.optionalString shouldReconfigure ''
+  preAutoreconf = ''
     pushd dist
     # Upstream’s `dist/s_config` cats everything into `aclocal.m4`, but that doesn’t work with
     # autoreconfHook, so cat `config.m4` to another file. Otherwise, it won’t be found by `aclocal`.
@@ -43,7 +40,7 @@ stdenv.mkDerivation (rec {
   # This isn’t pretty. The version information is kept separate from the configure script.
   # After the configure script is regenerated, the version information has to be replaced with the
   # contents of `dist/RELEASE`.
-  postAutoreconf = lib.optionalString shouldReconfigure ''
+  postAutoreconf = ''
     (
       declare -a vars=(
         "DB_VERSION_FAMILY"

pkgs/development/libraries/gjs/default.nix

@@ -31,13 +31,13 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "gjs";
-  version = "1.76.0";
+  version = "1.76.2";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-pj8VaWSxNgU+q1HqATEU59fBk7dRjSjAQLawLDyTOm0=";
+    sha256 = "sha256-99jJ1lPqb9eK/kpQcg4EaqK/wHj9pjXdEwZ90ZnGJdQ=";
   };
 
   patches = [

pkgs/development/libraries/glib-networking/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glib-networking";
-  version = "2.76.0";
+  version = "2.76.1";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "FJoFoXnmKaU4viVmKqMktJnXxFScUVHbU3PngKG/G5o=";
+    sha256 = "XGmKmZTd5R79+xAmpWaYoiHWJQ6J3FDrzd2nuBSApCs=";
   };
 
   patches = [

pkgs/development/libraries/glib/default.nix

@@ -56,11 +56,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.76.3";
+  version = "2.76.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "wL5ETkA9fDGE0fOU+J8LZEcQtekzG1T6TotQN4E60yo=";
+    sha256 = "WloZHJaDbhZqd3H36myisAacYDx9o8uhzTjRaUo5Xdo=";
   };
 
   patches = lib.optionals stdenv.isDarwin [

pkgs/development/libraries/gstreamer/bad/default.nix

@@ -192,6 +192,7 @@ stdenv.mkDerivation rec {
     libfreeaptx
     zxing-cpp
     usrsctp
+    wildmidi
   ] ++ lib.optionals opencvSupport [
     opencv4
   ] ++ lib.optionals enableZbar [
@@ -212,9 +213,6 @@ stdenv.mkDerivation rec {
     wayland
     wayland-protocols
   ] ++ lib.optionals (!stdenv.isDarwin) [
-    # wildmidi requires apple's OpenAL
-    # TODO: package apple's OpenAL, fix wildmidi, include on Darwin
-    wildmidi
     # TODO: mjpegtools uint64_t is not compatible with guint64 on Darwin
     mjpegtools
 
@@ -318,7 +316,6 @@ stdenv.mkDerivation rec {
     "-Duvch264=disabled" # requires gudev
     "-Dv4l2codecs=disabled" # requires gudev
     "-Dladspa=disabled" # requires lrdf
-    "-Dwildmidi=disabled" # see dependencies above
   ] ++ lib.optionals (!stdenv.isLinux || !stdenv.isx86_64) [
     "-Dqsv=disabled" # Linux (and Windows) x86 only
   ] ++ lib.optionals (!gst-plugins-base.glEnabled) [

pkgs/development/libraries/gupnp/1.6.nix

@@ -1,6 +1,5 @@
 { stdenv
 , lib
-, fetchpatch
 , fetchurl
 , meson
 , ninja
@@ -17,24 +16,15 @@
 
 stdenv.mkDerivation rec {
   pname = "gupnp";
-  version = "1.6.3";
+  version = "1.6.4";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-T09Biwe4EWTfH3q2EuKOTAFsLQhbik85+XlF+LFe4kg=";
+    sha256 = "sha256-1sPQNYOET6UqvgAwQxhgB/DIQUX+OwD6slmVvtqb5Vo=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/32
-      name = "gi-docgen-as-native-dep.patch";
-      url = "https://gitlab.gnome.org/GNOME/gupnp/-/commit/11d4a33cff1f5d8b8ad4b80c4506246a9e0dff8f.diff";
-      hash = "sha256-+p4vzUG2v+7mxtQ5AUcEI7SW0cDX6XlzqlyegF+I1Go=";
-    })
-  ];
-
   depsBuildBuild = [
     pkg-config
   ];

pkgs/development/libraries/gupnp/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch2
 , meson
 , ninja
 , pkg-config
@@ -33,6 +34,13 @@ stdenv.mkDerivation rec {
   patches = [
     # Bring .pc file in line with our patched pkg-config.
     ./0001-pkg-config-Declare-header-dependencies-as-public.patch
+
+    # Fix build against libxml2 2.11
+    # https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/34
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/gupnp/-/commit/bc56f02b0f89e96f2bd74af811903d9931965f58.patch";
+      hash = "sha256-KCHlq7Es+WLIWKgIgGVTaHarVQIiZPEi5r6nMAhXTgY=";
+    })
   ];
 
   depsBuildBuild = [

pkgs/development/libraries/iso-codes/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iso-codes";
-  version = "4.11.0";
+  version = "4.15.0";
 
   src = fetchurl {
     url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz";
-    sha256 = "sha256-QI95nfQTVGj6fKNetrBcQAS+pEPYHKWLibLkgkAagrs=";
+    sha256 = "sha256-uDtUudfdbrh3OAs+xG83CwXa8sv6ExxhLwNZjWVMDvg=";
   };
 
   nativeBuildInputs = [ gettext python3 ];

pkgs/development/libraries/libassuan/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libassuan";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-jowvzJgvnKZ9y7HZXi3HRrFzmkZovCCzo8W+Yy7bNOQ=";
+    sha256 = "sha256-6f0nIY1TlJBOTjl4j5sXQnEcPmtBaJoxqjOAvVqk9CY=";
   };
 
   outputs = [ "out" "dev" "info" ];

pkgs/development/libraries/libdc1394/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdc1394";
-  version = "2.2.6";
+  version = "2.2.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/libdc1394/${pname}-${version}.tar.gz";
-    sha256 = "1v8gq54n1pg8izn7s15yylwjf8r1l1dmzbm2yvf6pv2fmb4mz41b";
+    sha256 = "sha256-U3zreN087ycaGD9KF2GR0c7PhfAlUg5r03WLDhnmYJ8=";
   };
 
   buildInputs = [ libusb1 ]

pkgs/development/libraries/libde265/default.nix

@@ -1,13 +1,12 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , pkg-config
 
 , callPackage
 
-# for passthru.tests
+  # for passthru.tests
 , imagemagick
 , libheif
 , imlib2Full
@@ -15,29 +14,16 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: rec {
-  version = "1.0.11";
+  version = "1.0.12";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-0aRUh5h49fnjBjy42A5fWYHnhnQ4CFoeSIXZilZewW8=";
+    hash = "sha256-pl1r3n4T4FcJ4My/wCE54R2fmTdrlJOvgb2U0MZf1BI=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-27102.patch";
-      url = "https://github.com/strukturag/libde265/commit/0b1752abff97cb542941d317a0d18aa50cb199b1.patch";
-      sha256 = "sha256-q0NKuk2r5RQT9MJpRO3CTPj6VqYRBnffs9yZ+GM+lNc=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-27103.patch";
-      url = "https://github.com/strukturag/libde265/commit/d6bf73e765b7a23627bfd7a8645c143fd9097995.patch";
-      sha256 = "sha256-vxciVzSuVCVDpdz+TKg2tMWp2ArubYji5GLaR9VP4F0=";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   enableParallelBuilding = true;

pkgs/development/libraries/libgudev/default.nix

@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchurl
 , pkg-config
 , meson
@@ -9,42 +10,23 @@
 , vala
 , gobject-introspection
 , fetchpatch
+, glibcLocales
+, umockdev
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libgudev";
-  version = "237";
+  version = "238";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/libgudev/${lib.versions.majorMinor finalAttrs.version}/libgudev-${finalAttrs.version}.tar.xz";
-    sha256 = "1al6nr492nzbm8ql02xhzwci2kwb1advnkaky3j9636jf08v41hd";
+    hash = "sha256-YSZqsa/J1z28YKiyr3PpnS/f9H2ZVE0IV2Dk+mZ7XdE=";
   };
 
-  patches = [
-    # https://gitlab.gnome.org/GNOME/libgudev/-/merge_requests/27
-    (fetchpatch {
-      name = "gir-dep";
-      url = "https://gitlab.gnome.org/GNOME/libgudev/-/commit/6bdde16a0cfde462502fce1d9a7eb6ec33f388bb.diff";
-      sha256 = "sha256-bDtLUxOLEgyJURshqEQC4YCBTUVzQQP4qoWL786b3Z8=";
-    })
-    (fetchpatch {
-      name = "vapi-dep";
-      url = "https://gitlab.gnome.org/GNOME/libgudev/-/commit/d1f6457910842ba869c9871e7a2131fbe0d6b6be.diff";
-      sha256 = "sha256-/PY8ziZST/vQvksJm69a3O6/YesknIxCDvj0z40piik=";
-    })
-    (fetchpatch {
-      name = "gtk-doc-dep";
-      url = "https://gitlab.gnome.org/GNOME/libgudev/-/commit/34336cbadbcaac8b9b029f730eed0bdf4c633617.diff";
-      sha256 = "sha256-Bk05xe69LGqWH1uhLMZhwbVMSsCTyBrrOvqWic2TTd4=";
-    })
-  ];
-
   strictDeps = true;
 
-  depsBuildBuild = [ pkg-config ];
-
   nativeBuildInputs = [
     pkg-config
     meson
@@ -59,14 +41,16 @@ stdenv.mkDerivation rec {
     glib
   ];
 
-  mesonFlags = [
+  checkInputs = [
-    # There's a dependency cycle with umockdev and the tests fail to LD_PRELOAD anyway
+    glibcLocales
-    "-Dtests=disabled"
+    umockdev
   ];
 
+  doCheck = true;
+
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "libgudev";
       versionPolicy = "none";
     };
   };
@@ -78,4 +62,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.lgpl2Plus;
   };
-}
+})

pkgs/development/libraries/libnftnl/default.nix

@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.5";
+  version = "1.2.6";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
-    hash = "sha256-lm3gqBIMilPbhZiJdJNov7LLoMTwtMGjDSZOzMRfEiY=";
+    hash = "sha256-zurqLNkhR9oZ8To1p/GkvCdn/4l+g45LR5z1S1nHd/Q=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/libraries/libopus/default.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./fix-pkg-config-paths.patch
+    # Some tests time out easily on slower machines
+    ./test-timeout.patch
     # Fix meson build for arm64. Remove with next release
     # https://gitlab.xiph.org/xiph/opus/-/merge_requests/59
     (fetchpatch {

pkgs/development/libraries/libopus/test-timeout.patch

@@ -0,0 +1,16 @@
+diff --git a/tests/meson.build b/tests/meson.build
+index 5f3ac9d..74b2de7 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -1,8 +1,8 @@
+ # Tests that link to libopus
+ opus_tests = [
+-  ['test_opus_api'],
+-  ['test_opus_decode', [], 60],
+-  ['test_opus_encode', 'opus_encode_regressions.c', 120],
++  ['test_opus_api', [], 60],
++  ['test_opus_decode', [], 120],
++  ['test_opus_encode', 'opus_encode_regressions.c', 240],
+   ['test_opus_padding'],
+   ['test_opus_projection'],
+ ]

pkgs/development/libraries/libqmi/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch2
 , meson
 , ninja
 , pkg-config
@@ -24,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.32.2";
+  version = "1.32.4";
 
   outputs = [ "out" "dev" ]
     ++ lib.optional withIntrospection "devdoc";
@@ -34,18 +33,9 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libqmi";
     rev = version;
-    hash = "sha256-XIbeWgkPiJL8hN8Rb6KFt5Q5sG3KsiEQr0EnhwmI6h8=";
+    hash = "sha256-cczGvoD+2+G6uiAt0Iv1BO4/FqzO9bkqhFsEwOfp7qw=";
   };
 
-  patches = [
-    # Fix pkg-config file missing qrtr in Requires.
-    # https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/99
-    (fetchpatch2 {
-      url = "https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/commit/7d08150910974c6bd2c29f887c2c6d4a3526e085.patch";
-      hash = "sha256-LFrlm2ZqLqewLGO2FxL5kFYbZ7HaxdxvVHsFHYSgZ4Y=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja

pkgs/development/libraries/librdf/raptor2.nix

@@ -35,6 +35,13 @@ stdenv.mkDerivation rec {
       url = "https://github.com/dajobe/raptor/commit/fa1ef9a27d8762f5588ac2e92554a188e73dee9f.diff";
       sha256 = "sha256-zXIbrYGgC9oTpiD0WUikT4vRdc9b6bsyfnDkwUSlqao=";
     })
+    # pull upstream fix for libxml2-2.11 API compatibility:
+    #   https://github.com/dajobe/raptor/pull/58
+    (fetchpatch {
+      name = "libxml2-2.11.patch";
+      url = "https://github.com/dajobe/raptor/commit/4dbc4c1da2a033c497d84a1291c46f416a9cac51.patch";
+      hash = "sha256-fHfvncGymzMtxjwtakCNSr/Lem12UPIHAAcAac648w4=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config cmake perl bison flex ];

pkgs/development/libraries/librsvg/default.nix

@@ -30,30 +30,32 @@
 , nix
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.55.1";
+  version = "2.56.2";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
   ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    sha256 = "a69IqdOlb9E7v7ufH3Z1myQLcKH6Ig/SOEdNZqkm+Yw=";
+    sha256 = "PsPE2Pc+C6S5EwAmlp6DccCStzQpjTbi/bPrSvzsEgA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
+    inherit (finalAttrs) src;
-    name = "${pname}-${version}";
+    name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-nRmOB9Jo+mmB0+wXrQvoII4e0ucV7bNCDeuk6CbcPdk=";
+    hash = "sha256-GIEpZ5YMvmYQLcaLXseXQ6gIF7ICtUKq28JCVJ3PEYk=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };
 
   strictDeps = true;
 
-  depsBuildBuild = [ pkg-config ];
+  depsBuildBuild = [
+    pkg-config
+  ];
 
   nativeBuildInputs = [
     gdk-pixbuf
@@ -137,6 +139,13 @@ stdenv.mkDerivation rec {
     # Merge gdkpixbuf and librsvg loaders
     cat ${lib.getLib gdk-pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache > $GDK_PIXBUF/loaders.cache.tmp
     mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
+
+    mkdir -p "$out/share/bash-completion/completions/"
+    $out/bin/rsvg-convert --completion bash > "$out/share/bash-completion/completions/rsvg-convert"
+    mkdir -p "$out/share/zsh/site-functions/"
+    $out/bin/rsvg-convert --completion zsh > "$out/share/zsh/site-functions/_rsvg-convert"
+    mkdir -p "$out/share/fish/vendor_completions.d/"
+    $out/bin/rsvg-convert --completion fish > "$out/share/fish/vendor_completions.d/rsvg-convert.fish"
   '';
 
   postFixup = lib.optionalString withIntrospection ''
@@ -189,4 +198,4 @@ stdenv.mkDerivation rec {
     mainProgram = "rsvg-convert";
     platforms = platforms.unix;
   };
-}
+})

pkgs/development/libraries/libva/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.18.0";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "sha256-VD+CTF0QLfzrUr4uFiyDlZux3MqsyyuJF/cXuhOFzwo=";
+    sha256 = "sha256-M6mAHvGl4d9EqdkDBSxSbpZUCUcrkpnf+hfo16L3eHs=";
   };
 
   outputs = [ "dev" "out" ];

pkgs/development/libraries/libxcrypt/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxcrypt";
-  version = "4.4.35";
+  version = "4.4.36";
 
   src = fetchurl {
     url = "https://github.com/besser82/libxcrypt/releases/download/v${finalAttrs.version}/libxcrypt-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qMk1UFtV8d8NF/i/1ZRox8Zwmh0xgxsPjj4EWrj9RV0=";
+    hash = "sha256-5eH0yu4KAd4q7ibjE4gH1tPKK45nKHlm0f79ZeH9iUM=";
   };
 
   outputs = [

pkgs/development/libraries/libxml2/default.nix

@@ -34,7 +34,7 @@ in
 let
 libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.10.4";
+  version = "2.11.4";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
@@ -43,24 +43,9 @@ libxml = stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-    sha256 = "7QyRxYRQCPGTZznk7uIDVTHByUdCxlQfRO5m2IWUjUU=";
+    sha256 = "c34df4qz8TlynKE6JJT9F78w3bS3pCfPM2JSyrV/V/c=";
   };
 
-  patches = [
-    # Upstream bugs:
-    #   https://bugzilla.gnome.org/show_bug.cgi?id=789714
-    #   https://gitlab.gnome.org/GNOME/libxml2/issues/64
-    # Patch from https://bugzilla.opensuse.org/show_bug.cgi?id=1065270 ,
-    # but only the UTF-8 part.
-    # Can also be mitigated by fixing malformed XML inputs, such as in
-    # https://gitlab.gnome.org/GNOME/gnumeric/merge_requests/3 .
-    # Other discussion:
-    #   https://github.com/itstool/itstool/issues/22
-    #   https://github.com/NixOS/nixpkgs/pull/63174
-    #   https://github.com/NixOS/nixpkgs/pull/72342
-    ./utf8-xmlErrorFuncHandler.patch
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [

pkgs/development/libraries/libxml2/utf8-xmlErrorFuncHandler.patch

@@ -1,30 +0,0 @@
-Index: libxml2-2.9.5/python/libxml.c
-===================================================================
---- libxml2-2.9.5.orig/python/libxml.c
-+++ libxml2-2.9.5/python/libxml.c
-@@ -1620,6 +1620,7 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNU
-     PyObject *message;
-     PyObject *result;
-     char str[1000];
-+    unsigned char *ptr = (unsigned char *)str;
- 
- #ifdef DEBUG_ERROR
-     printf("libxml_xmlErrorFuncHandler(%p, %s, ...) called\n", ctx, msg);
-@@ -1636,10 +1637,16 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNU
- 	    str[999] = 0;
-         va_end(ap);
- 
-+#if PY_MAJOR_VERSION >= 3
-+        /* Ensure the error string doesn't start at UTF8 continuation. */
-+        while (*ptr && (*ptr & 0xc0) == 0x80)
-+            ptr++;
-+#endif
-+
-         list = PyTuple_New(2);
-         PyTuple_SetItem(list, 0, libxml_xmlPythonErrorFuncCtxt);
-         Py_XINCREF(libxml_xmlPythonErrorFuncCtxt);
--        message = libxml_charPtrConstWrap(str);
-+        message = libxml_charPtrConstWrap(ptr);
-         PyTuple_SetItem(list, 1, message);
-         result = PyEval_CallObject(libxml_xmlPythonErrorFuncHandler, list);
-         Py_XDECREF(list);

pkgs/development/libraries/libxslt/default.nix

@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libxslt";
-  version = "1.1.37";
+  version = "1.1.38";
 
   outputs = [ "bin" "dev" "out" "doc" "devdoc" ] ++ lib.optional pythonSupport "py";
   outputMan = "bin";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Oksn3IAnzNYUZyWVAzbx7FIJKPMg8UTrX6eZCuYSOrQ=";
+    sha256 = "HzJFBCWBmgmsr/Krelp/ii7HlW5QXXvutF6EPQ4eyrE=";
   };
 
   strictDeps = true;

pkgs/development/libraries/mutest/default.nix

@@ -1,20 +1,22 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , fetchFromGitHub
 , meson
 , ninja
+, unstableGitUpdater
 }:
 
 stdenv.mkDerivation {
   pname = "mutest";
-  version = "unstable-2019-08-26";
+  version = "0-unstable-2023-02-24";
 
   outputs = [ "out" "dev" ];
 
   src = fetchFromGitHub {
     owner = "ebassi";
     repo = "mutest";
-    rev = "e6246c9ae4f36ffe8c021f0a80438f6c7a6efa3a";
+    rev = "18a20071773f7c4b75e82a931ef9b916b273b3e5";
-    sha256 = "0gdqwq6fvk06wld4rhnw5752hahrvhd69zrci045x25rwx90x26q";
+    sha256 = "z0kASte0/I48Fgxhblu24MjGHidWomhfFOhfStGtPn4=";
   };
 
   nativeBuildInputs = [
@@ -24,8 +26,12 @@ stdenv.mkDerivation {
 
   doCheck = true;
 
+  passthru = {
+    updateScript = unstableGitUpdater { };
+  };
+
   meta = with lib; {
-    homepage = "https://ebassi.github.io/mutest/mutest.md.html";
+    homepage = "https://github.com/ebassi/mutest";
     description = "A BDD testing framework for C, inspired by Mocha";
     license = licenses.mit;
     maintainers = with maintainers; [ jtojnar ];

pkgs/development/libraries/ncurses/default.nix

@@ -139,6 +139,13 @@ stdenv.mkDerivation (finalAttrs: {
       done
     done
 
+    # add pkg-config aliases for libraries that are built-in to libncurses(w)
+    for library in tinfo tic; do
+      for suffix in "" w; do
+        ln -svf ncurses$suffix.pc $dev/lib/pkgconfig/$library$suffix.pc
+      done
+    done
+
     # move some utilities to $bin
     # these programs are used at runtime and don't really belong in $dev
     moveToOutput "bin/clear" "$out"

pkgs/development/libraries/openexr/default.nix

@@ -41,11 +41,13 @@ stdenv.mkDerivation rec {
     ./gcc-13.patch
   ];
 
-  # tests are determined to use /var/tmp on unix
   postPatch = ''
+    # tests are determined to use /var/tmp on unix
     find . -name tmpDir.h | while read -r f ; do
       substituteInPlace $f --replace '/var/tmp' "$TMPDIR"
     done
+    # On slower machines this test can take more than the default 1500 seconds
+    echo 'set_tests_properties(OpenEXR.IlmImf PROPERTIES TIMEOUT 3000)' >> OpenEXR/IlmImfTest/CMakeLists.txt
   '';
 
   cmakeFlags = [

pkgs/development/libraries/openldap/default.nix

@@ -1,11 +1,9 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 
 # dependencies
 , cyrus_sasl
-, db
 , groff
 , libsodium
 , libtool
@@ -19,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "openldap";
-  version = "2.6.4";
+  version = "2.6.5";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
-    hash = "sha256-1RcE5QF4QwwGzz2KoXTaZrrfVZdHpH2SC7VLLUqkCZE=";
+    hash = "sha256-Lieo1PTCr4/oQLVzJxwgqhY+JJh/l2UhRkQpD1vrONk=";
   };
 
   # TODO: separate "out" and "bin"
@@ -46,7 +44,6 @@ stdenv.mkDerivation rec {
     (cyrus_sasl.override {
       inherit openssl;
     })
-    db
     libsodium
     libtool
     openssl

pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch

@@ -0,0 +1,54 @@
+From 6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tomas@openssl.org>
+Date: Tue, 4 Jul 2023 17:30:35 +0200
+Subject: [PATCH] Do not ignore empty associated data with AES-SIV mode
+
+The AES-SIV mode allows for multiple associated data items
+authenticated separately with any of these being 0 length.
+
+The provided implementation ignores such empty associated data
+which is incorrect in regards to the RFC 5297 and is also
+a security issue because such empty associated data then become
+unauthenticated if an application expects to authenticate them.
+
+Fixes CVE-2023-2975
+
+Reviewed-by: Matt Caswell <matt@openssl.org>
+Reviewed-by: Paul Dale <pauli@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/21384)
+
+(cherry picked from commit c426c281cfc23ab182f7d7d7a35229e7db1494d9)
+---
+ .../implementations/ciphers/cipher_aes_siv.c   | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/providers/implementations/ciphers/cipher_aes_siv.c b/providers/implementations/ciphers/cipher_aes_siv.c
+index 45010b90db2a..b396c8651a32 100644
+--- a/providers/implementations/ciphers/cipher_aes_siv.c
++++ b/providers/implementations/ciphers/cipher_aes_siv.c
+@@ -120,14 +120,18 @@ static int siv_cipher(void *vctx, unsigned char *out, size_t *outl,
+     if (!ossl_prov_is_running())
+         return 0;
+ 
+-    if (inl == 0) {
+-        *outl = 0;
+-        return 1;
+-    }
++    /* Ignore just empty encryption/decryption call and not AAD. */
++    if (out != NULL) {
++        if (inl == 0) {
++            if (outl != NULL)
++                *outl = 0;
++            return 1;
++        }
+ 
+-    if (outsize < inl) {
+-        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
+-        return 0;
++        if (outsize < inl) {
++            ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
++            return 0;
++        }
+     }
+ 
+     if (ctx->hw->cipher(ctx, out, in, inl) <= 0)

pkgs/development/libraries/openssl/default.nix

@@ -251,6 +251,9 @@ in {
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
+      # https://www.openssl.org/news/secadv/20230714.txt
+      ./3.0/CVE-2023-2975.patch
+
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)

pkgs/development/libraries/p11-kit/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p11-kit";
-  version = "0.24.1";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "p11-glue";
     repo = pname;
     rev = version;
-    hash = "sha256-1QIMEGBZsqLYU3v5ZswD5K9VcIGLBovJlC10lBHhH7c=";
+    hash = "sha256-paLiRYgYshuedgDgW2nEsv4/Loq6qFyQMjfBJwqtHzw=";
   };
 
   outputs = [ "out" "bin" "dev"];

pkgs/development/libraries/tracker/default.nix

@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker";
-  version = "3.5.1";
+  version = "3.5.3";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "+XLVCse6/czxE7HrmdyuNUBGhameVb/vFvOsg7Tel00=";
+    sha256 = "FGbIsIl75dngVth+EK1YkntYgDPwGvLxplaokhw6KO4=";
   };
 
   patches = [

pkgs/development/libraries/umockdev/default.nix

@@ -18,14 +18,14 @@
 , which
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "umockdev";
   version = "0.17.17";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "https://github.com/martinpitt/umockdev/releases/download/${version}/${pname}-${version}.tar.xz";
+    url = "https://github.com/martinpitt/umockdev/releases/download/${finalAttrs.version}/umockdev-${finalAttrs.version}.tar.xz";
     sha256 = "sha256-IOYhseRYsyADz+qZc5tngkuGZShUqLzjPiYSTjR/32w=";
   };
 
@@ -50,10 +50,13 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     systemd
-    libgudev
     libpcap
   ];
 
+  checkInputs = lib.optionals finalAttrs.passthru.withGudev [
+    libgudev
+  ];
+
   nativeCheckInputs = [
     python3
     which
@@ -81,12 +84,25 @@ stdenv.mkDerivation rec {
     ln -s "$PWD/libumockdev-preload.so.0" "$out/lib/libumockdev-preload.so.0"
   '';
 
+  passthru = {
+    # libgudev is needed for an optional test but it itself relies on umockdev for testing.
+    withGudev = false;
+
+    tests = {
+      withGudev = finalAttrs.finalPackage.overrideAttrs (attrs: {
+        passthru = attrs.passthru // {
+          withGudev = true;
+        };
+      });
+    };
+  };
+
   meta = with lib; {
     homepage = "https://github.com/martinpitt/umockdev";
-    changelog = "https://github.com/martinpitt/umockdev/releases/tag/${version}";
+    changelog = "https://github.com/martinpitt/umockdev/releases/tag/${finalAttrs.version}";
     description = "Mock hardware devices for creating unit tests";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ flokli ];
     platforms = with platforms; linux;
   };
-}
+})

pkgs/development/libraries/wayland/protocols.nix

@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation rec {
   pname = "wayland-protocols";
-  version = "1.31";
+  version = "1.32";
 
   # https://gitlab.freedesktop.org/wayland/wayland-protocols/-/issues/48
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform && stdenv.targetPlatform.linker == "bfd" && wayland.withLibraries;
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
-    hash = "sha256-oH+nIu2HZ27AINhncUvJovJMRk2nORLzlwbu71IZ4jg=";
+    hash = "sha256-dFl5nTQMgpa2le+FfAfd7yTFoJsJq2p097kmQNKxuhE=";
   };
 
   postPatch = lib.optionalString doCheck ''

pkgs/development/libraries/wildmidi/default.nix

@@ -1,5 +1,8 @@
-{ lib, stdenv, fetchFromGitHub, cmake, alsa-lib, freepats }:
+{ lib, stdenv, fetchFromGitHub, writeTextFile, cmake, alsa-lib, OpenAL, freepats }:
 
+let
+  defaultCfgPath = "${placeholder "out"}/etc/wildmidi/wildmidi.cfg";
+in
 stdenv.mkDerivation rec {
   pname = "wildmidi";
   version = "0.4.5";
@@ -13,21 +16,34 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ alsa-lib stdenv.cc.libc/*couldn't find libm*/ ];
+  buildInputs = lib.optionals stdenv.buildPlatform.isLinux [
+    alsa-lib stdenv.cc.libc/*couldn't find libm*/
+  ] ++ lib.optionals stdenv.buildPlatform.isDarwin [
+    OpenAL
+  ];
 
   preConfigure = ''
-    substituteInPlace CMakeLists.txt \
-      --replace /etc/wildmidi $out/etc
     # https://github.com/Mindwerks/wildmidi/issues/236
     substituteInPlace src/wildmidi.pc.in \
       --replace '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
       --replace '$'{exec_prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
   '';
 
-  postInstall = ''
+  cmakeFlags = [
-    mkdir "$out"/etc
+    "-DWILDMIDI_CFG=${defaultCfgPath}"
-    echo "dir ${freepats}" > "$out"/etc/wildmidi.cfg
+  ];
-    echo "source ${freepats}/freepats.cfg" >> "$out"/etc/wildmidi.cfg
+
+  postInstall = let
+    defaultCfg = writeTextFile {
+      name = "wildmidi.cfg";
+      text = ''
+        dir ${freepats}
+        source ${freepats}/freepats.cfg
+      '';
+    };
+  in ''
+    mkdir -p "$(dirname ${defaultCfgPath})"
+    ln -s ${defaultCfg} ${defaultCfgPath}
   '';
 
   meta = with lib; {
@@ -39,7 +55,7 @@ stdenv.mkDerivation rec {
     homepage = "https://wildmidi.sourceforge.net/";
     # The library is LGPLv3, the wildmidi executable is GPLv3
     license = licenses.lgpl3;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = [ maintainers.bjornfor ];
   };
 }

pkgs/development/lua-modules/lib.nix

@@ -89,7 +89,13 @@ rec {
     , rocksSubdir
     }: let
       rocksTrees = lib.imap0
-        (i: dep: { name = "dep-${toString i}"; root = "${dep}"; rocks_dir = "${dep}/${dep.rocksSubdir}"; })
+        (i: dep: {
+          name = "dep-${toString i}";
+          root = "${dep}";
+          # packages built by buildLuaPackage or luarocks doesn't contain rocksSubdir
+          # hence a default here
+          rocks_dir = if dep ? rocksSubdir then "${dep}/${dep.rocksSubdir}" else "${dep.pname}-${dep.version}-rocks";
+        })
         requiredLuaRocks;
 
       # Explicitly point luarocks to the relevant locations for multiple-output

pkgs/development/python-modules/Cython/default.nix

@@ -24,12 +24,12 @@ let
 
 in buildPythonPackage rec {
   pname = "cython";
-  version = "0.29.34";
+  version = "0.29.36";
 
   src = fetchPypi {
     pname = "Cython";
     inherit version;
-    hash = "sha256-GQloj117Uhpgw5bSC7qeR6Gy0nhL+whUAeHh59KaKag=";
+    hash = "sha256-QcDP0tdU44PJ7rle/8mqSrhH0Ml0cHfd18Dctow7wB8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aiohttp/default.nix

@@ -48,6 +48,12 @@ buildPythonPackage rec {
       url = "https://github.com/aio-libs/aiohttp/commit/5718879cdb6a98bf48810a994b78bc02abaf3e07.patch";
       hash = "sha256-4UynkTZOzWzusQ2+MPZszhFA8I/PJNLeT/hHF/fASy8=";
     })
+    (fetchpatch {
+      # https://github.com/aio-libs/aiohttp/pull/7260
+      # Merged upstream, should likely be dropped post-3.8.4
+      url = "https://github.com/aio-libs/aiohttp/commit/7dcc235cafe0c4521bbbf92f76aecc82fee33e8b.patch";
+      hash = "sha256-ZzhlE50bmA+e2XX2RH1FuWQHZIAa6Dk/hZjxPoX5t4g=";
+    })
   ];
 
   postPatch = ''

pkgs/development/python-modules/certifi/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2022.12.07";
+  version = "2023.05.07";
 
   disabled = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    hash = "sha256-r6TJ6YGL0cygz+F6g6wiqBfBa/QKhynZ92C6lHTZ2rI=";
+    hash = "sha256-KXm0CtuZJL9VgFeY+DV0rdjaKqPQCqcoGPCkeGieTX8=";
   };
 
   patches = [

pkgs/development/python-modules/constantly/default.nix

@@ -1,20 +1,36 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib, buildPythonPackage, fetchFromGitHub, twisted }:
-}:
-buildPythonPackage rec {
-  pname = "constantly";
-  version = "15.1.0";
 
-  src = fetchPypi {
+let
-    inherit pname version;
+  self = buildPythonPackage rec {
-    sha256 = "0dgwdla5kfpqz83hfril716inm41hgn9skxskvi77605jbmp4qsq";
+    pname = "constantly";
+    version = "15.1.0";
+
+    src = fetchFromGitHub {
+      owner = "twisted";
+      repo = "constantly";
+      rev = version;
+      hash = "sha256-0RPK5Vy0b6V4ubvm+vfNOAua7Qpa6j+G+QNExFuHgUU=";
+    };
+
+    # would create dependency loop with twisted
+    doCheck = false;
+
+    nativeCheckInputs = [ twisted ];
+
+    checkPhase = ''
+      trial constantly
+    '';
+
+    pythonImportsCheck = [ "constantly" ];
+
+    passthru.tests.constantly = self.overrideAttrs (_: { doInstallCheck = true; });
+
+    meta = with lib; {
+      homepage = "https://github.com/twisted/constantly";
+      description = "symbolic constant support";
+      license = licenses.mit;
+      maintainers = [ ];
+    };
   };
-
+in
-  pythonImportsCheck = [ "constantly" ];
+self
-
-  meta = with lib; {
-    homepage = "https://github.com/twisted/constantly";
-    description = "symbolic constant support";
-    license = licenses.mit;
-    maintainers = [ ];
-  };
-}

pkgs/development/python-modules/exceptiongroup/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.1.0";
+  version = "1.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "exceptiongroup";
     rev = version;
-    hash = "sha256-XQcYYz4MOxWj9QlgM6KuwBaCHjYzGRkQw3cN5WBSnAo=";
+    hash = "sha256-19taP6adzmO4zH2As1OTXeYNFj6KwjhxBr09X+SrZRk=";
   };
 
   nativeBuildInputs = [
@@ -33,12 +33,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = if (pythonAtLeast "3.11") then [
-    # regression in 3.11.4
-    # https://github.com/agronholm/exceptiongroup/issues/64
-    "test_catch_handler_raises"
-  ] else null;
-
   pythonImportsCheck = [
     "exceptiongroup"
   ];

pkgs/development/python-modules/importlib-metadata/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "6.0.0";
+  version = "6.8.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    hash = "sha256-41S+3rYO+mr/3MiuEhtzVEp6p0FW0EcxGUj21xHNN40=";
+    hash = "sha256-26zniS2MDErBrQlmYiMvgx1OZPTEVFvVMBaj6dRlR0M=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +45,6 @@ buildPythonPackage rec {
     description = "Read metadata from Python packages";
     homepage = "https://importlib-metadata.readthedocs.io/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ fab ];
+    maintainers = with maintainers; [ fab AndersonTorres ];
   };
 }

pkgs/development/python-modules/numpy/default.nix

@@ -18,7 +18,7 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 let
   cfg = writeTextFile {
     name = "site.cfg";
-    text = (lib.generators.toINI {} {
+    text = lib.generators.toINI {} {
       ${blas.implementation} = {
         include_dirs = "${lib.getDev blas}/include:${lib.getDev lapack}/include";
         library_dirs = "${blas}/lib:${lapack}/lib";
@@ -35,7 +35,7 @@ let
         library_dirs = "${blas}/lib";
         runtime_library_dirs = "${blas}/lib";
       };
-    });
+    };
   };
 in buildPythonPackage rec {
   pname = "numpy";
@@ -56,6 +56,14 @@ in buildPythonPackage rec {
     ./numpy-distutils-C++.patch
   ];
 
+  postPatch = ''
+    # fails with multiple errors because we are not using the pinned setuptools version
+    # see https://github.com/numpy/numpy/blob/v1.25.0/pyproject.toml#L7
+    #   error: option --single-version-externally-managed not recognized
+    #   TypeError: dist must be a Distribution instance
+    rm numpy/core/tests/test_cython.py
+  '';
+
   nativeBuildInputs = [ gfortran cython ];
   buildInputs = [ blas lapack ];
 
@@ -83,7 +91,7 @@ in buildPythonPackage rec {
   checkPhase = ''
     runHook preCheck
     pushd "$out"
-    ${python.interpreter} -c 'import numpy; numpy.test("fast", verbose=10)'
+    ${python.interpreter} -c 'import numpy, sys; sys.exit(numpy.test("fast", verbose=10) is False)'
     popd
     runHook postCheck
   '';

pkgs/development/python-modules/orjson/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.8.11";
+  version = "3.9.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,13 +25,13 @@ buildPythonPackage rec {
     owner = "ijl";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-TFoagWUtd/nJceNaptgPp4aTR/tBCmxpiZIVJwOlia4=";
+    hash = "sha256-uEwlrWPQbctCMiIz4fdXe2GDr2SSHaMzmYzzrECerxg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-/x+0/I3WFxPwVu2LliTgr42SuJX7VjOLe/SGai5OgAw=";
+    hash = "sha256-U/WenkO7ecZQOGEppBlLtlXGtbpbS7e+Ic1hg/AnKSk=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pillow/default.nix

@@ -3,6 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, fetchpatch
 , isPyPy
 , defusedxml, olefile, freetype, libjpeg, zlib, libtiff, libwebp, libxcrypt, tcl, lcms2, tk, libX11
 , libxcb, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook
@@ -12,7 +13,7 @@
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "9.4.0";
+  version = "9.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,9 +21,17 @@ import ./generic.nix (rec {
   src = fetchPypi {
     pname = "Pillow";
     inherit version;
-    hash = "sha256-ocLXeARI65P7zDeJvzkWqlcg2ULjeUX0BWaAMX8c0j4=";
+    hash = "sha256-v1SEedM2cm16Ds6252fhefveN4M65CeUYCYxoHDWMPE=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Fixed type handling for include and lib directories; Remove with 10.0.0
+      url = "https://github.com/python-pillow/Pillow/commit/0ec0a89ead648793812e11739e2a5d70738c6be5.patch";
+      hash = "sha256-m5R5fLflnbJXbRxFlTjT2X3nKdC05tippMoJUDsJmy0=";
+    })
+  ];
+
   passthru.tests = {
     inherit imageio matplotlib pilkit pydicom reportlab;
   };

pkgs/development/python-modules/protobuf/default.nix

@@ -1,10 +1,12 @@
 { buildPackages
-, lib
 , buildPythonPackage
-, protobuf
-, isPyPy
 , fetchpatch
+, isPyPy
+, lib
+, protobuf
+, pytestCheckHook
 , pythonAtLeast
+, tzdata
 }:
 
 let
@@ -21,8 +23,6 @@ buildPythonPackage {
     then "${toString (lib.toInt versionMajor + 1)}.${versionMinor}.${versionPatch}"
     else protobuf.version;
 
-  disabled = isPyPy;
-
   sourceRoot = "source/python";
 
   patches = lib.optionals (pythonAtLeast "3.11") [
@@ -41,6 +41,8 @@ buildPythonPackage {
     fi
   '';
 
+  nativeBuildInputs = lib.optional isPyPy tzdata;
+
   buildInputs = [ protobuf ];
 
   propagatedNativeBuildInputs = [
@@ -50,6 +52,20 @@ buildPythonPackage {
 
   setupPyGlobalFlags = [ "--cpp_implementation" ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = lib.optionals isPyPy [
+    # error message differs
+    "testInvalidTimestamp"
+    # requires tracemalloc which pypy does not implement
+    # https://foss.heptapod.net/pypy/pypy/-/issues/3048
+    "testUnknownFieldsNoMemoryLeak"
+    # assertion is not raised for some reason
+    "testStrictUtf8Check"
+  ];
+
   pythonImportsCheck = [
     "google.protobuf"
     "google.protobuf.internal._api_implementation" # Verify that --cpp_implementation worked

pkgs/development/python-modules/pytest-timeout/default.nix

@@ -4,7 +4,6 @@
 , pytest
 , pytestCheckHook
 , pexpect
-, pytest-cov
 }:
 
 buildPythonPackage rec {
@@ -24,7 +23,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pexpect
-    pytest-cov
   ];
 
   disabledTests = [

pkgs/development/python-modules/pyudev/default.nix

@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "pyudev";
-  version = "0.24.0";
+  version = "0.24.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sqOv4cmep1H4KWZSVX6sVZh02iobHsBiUXhwbsWjRfM=";
+    hash = "sha256-deVNNyGPWsRbDaHw/ZzF5SajysPvHPrUEM96sziwFHE=";
   };
 
   postPatch = ''

pkgs/development/python-modules/requests-mock/default.nix

@@ -1,33 +1,40 @@
-{ lib, buildPythonPackage, fetchPypi, python
+{ lib
-, mock
+, buildPythonPackage
+, fetchPypi
+, fixtures
 , purl
+, pytestCheckHook
+, python
 , requests
+, requests-futures
 , six
-, testrepository
 , testtools
-, pytest
 }:
 
 buildPythonPackage rec {
   pname = "requests-mock";
-  version = "1.10.0";
+  version = "1.11.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WcnDJBmp+xroPsJC2Y6InEW9fXpl1IN1zCQ+wIRBZYs=";
+    hash = "sha256-7xC1crSJpfKOCbcIaXIIxKOyuJ74Cp8BWENA6jV+w8Q=";
   };
 
-  patchPhase = ''
-    sed -i 's@python@${python.interpreter}@' .testr.conf
-  '';
-
   propagatedBuildInputs = [ requests six ];
 
-  nativeCheckInputs = [ mock purl testrepository testtools pytest ];
+  nativeCheckInputs = [
+    fixtures
+    purl
+    pytestCheckHook
+    requests-futures
+    testtools
+  ];
 
   meta = with lib; {
     description = "Mock out responses from the requests package";
     homepage = "https://requests-mock.readthedocs.io";
+    changelog = "https://github.com/jamielennox/requests-mock/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = [ ];
   };

pkgs/development/python-modules/sh/default.nix

@@ -3,10 +3,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , poetry-core
-, python
-, lsof
-, glibcLocales
-, coreutils
 , pytestCheckHook
  }:
 
@@ -47,6 +43,9 @@ buildPythonPackage rec {
     "test_unicode_path"
     # fails to import itself after modifying the environment
     "test_environment"
+    # timing sensitive through usage of sleep(1) and signal handling
+    # https://github.com/amoffat/sh/issues/684
+    "test_general_signal"
   ] ++ lib.optionals stdenv.isDarwin [
     # Disable tests that fail on Darwin sandbox
     "test_background_exception"

pkgs/development/python-modules/sqlalchemy/default.nix

@@ -1,7 +1,6 @@
 { lib
 , isPyPy
 , pythonOlder
-, fetchPypi
 , fetchFromGitHub
 , buildPythonPackage
 
@@ -41,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "2.0.17";
+  version = "2.0.18";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -50,7 +49,7 @@ buildPythonPackage rec {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-thwPqyxhojyHZpo7LK6nl69Z1B1Z6+WR1dAdlVrgiaY=";
+    hash = "sha256-juZIFlmgwGFFhv+3DsMx6k1QRcGLQyTOwR5Hii8A68c=";
   };
 
   nativeBuildInputs =[
@@ -143,6 +142,7 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # typing correctness, not interesting
     "test/ext/mypy"
+    "test/typing"
     # slow and high memory usage, not interesting
     "test/aaa_profiling"
   ];

pkgs/development/python-modules/yapf/default.nix

@@ -3,25 +3,34 @@
 , fetchPypi
 , isPyPy
 , nose
+, importlib-metadata
+, platformdirs
+, tomli
 }:
 
 buildPythonPackage rec {
   pname = "yapf";
-  version = "0.32.0";
+  version = "0.40.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-o/UIXTfvfj4ATEup+bPkDFT/GQHNER8FFFrjE6fGfRs=";
+    hash = "sha256-lYWH61yOxshgEZqcJdAq3fMKRPdaoVKkIg0w5WqYA3w=";
   };
 
   # nose is unavailable on pypy
   doCheck = !isPyPy;
 
+  propagatedBuildInputs = [
+    importlib-metadata
+    platformdirs
+    tomli
+  ];
+
   nativeCheckInputs = [
     nose
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/google/yapf";
     description = "Yet Another Python Formatter";
     longDescription = ''
@@ -44,7 +53,7 @@ buildPythonPackage rec {
       that a programmer would write if they were following the style guide. It
       takes away some of the drudgery of maintaining your code.
     '';
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
-    maintainers = with maintainers; [ AndersonTorres siddharthist ];
+    maintainers = with lib.maintainers; [ AndersonTorres siddharthist ];
   };
 }

pkgs/development/python-modules/yarl/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.8.2";
+  version = "1.9.2";
 
   disabled = pythonOlder "3.7";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SdQ0AsbjATrQl4YCv2v1MoU1xI0ZIwS5G5ejxnkLFWI=";
+    hash = "sha256-BKudS59YfAbYAcKr/pMXt3zfmWxlqQ1ehOzEUBCCNXE=";
   };
 
   patches = [
@@ -51,10 +51,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    "test_not_a_scheme2"
-  ];
-
   postCheck = ''
     popd
   '';

pkgs/development/ruby-modules/bundler/default.nix

@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.16";
+  version = "2.4.17";
-  source.sha256 = "sha256-FjRuBn1YnZUgCoDzPFEbMLii6JASiFJbLTKS4hdenWk=";
+  source.sha256 = "sha256-2EV6XnbJ0VPUuw/R/9Kj9Y+/CQyzRIub16Ah0T8ORK0=";
   dontPatchShebangs = true;
 
   postFixup = ''

pkgs/development/tools/kcli/default.nix

@@ -20,6 +20,6 @@ buildGoModule rec {
     homepage = "https://github.com/cswank/kcli";
     license = licenses.mit;
     maintainers = with maintainers; [ cswank ];
-    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.goModules --check
   };
 }

pkgs/development/tools/misc/itstool/default.nix

@@ -1,19 +1,33 @@
-{ stdenv, lib, fetchurl, python3 }:
+{ stdenv
+, lib
+, fetchurl
+, python3
+}:
 
 stdenv.mkDerivation rec {
   pname = "itstool";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchurl {
     url = "http://files.itstool.org/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1acjgf8zlyk7qckdk19iqaca4jcmywd7vxjbcs1mm6kaf8icqcv2";
+    hash = "sha256-a5p80poSu5VZj1dQ6HY87niDahogf4W3TYsydbJ+h8o=";
   };
 
   strictDeps = true;
 
-  nativeBuildInputs = [ python3 python3.pkgs.wrapPython ];
+  nativeBuildInputs = [
-  buildInputs = [ python3 python3.pkgs.libxml2 ];
+    python3
-  pythonPath = [ python3.pkgs.libxml2 ];
+    python3.pkgs.wrapPython
+  ];
+
+  buildInputs = [
+    python3
+    python3.pkgs.libxml2
+  ];
+
+  pythonPath = [
+    python3.pkgs.libxml2
+  ];
 
   postFixup = ''
     wrapPythonPrograms