Merge branch 'staging' into staging-next

2024-11-19 02:44:17 +03:00 · 2023-06-02 11:45:08 +02:00 · 2023-06-02 11:45:08 +02:00 · 8699d2cf1a
commit 8699d2cf1a
parent b2750f9ba0 52df2ba6b0
95 changed files with 676 additions and 432 deletions
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@ -38,6 +38,7 @@ with lib;
      gpsd = super.gpsd.override { guiSupport = false; };
      graphviz = super.graphviz-nox;
      gst_all_1 = super.gst_all_1 // {
+        gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; };
        gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableX11 = false; };
      };
      imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
--- a/nixos/tests/apparmor.nix
+++ b/nixos/tests/apparmor.nix
@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, ... } : {
+import ./make-test-python.nix ({ pkgs, lib, ... } : {
  name = "apparmor";
  meta.maintainers = with lib.maintainers; [ julm ];

@ -27,7 +27,7 @@ import ./make-test-python.nix ({ pkgs, ... } : {
      # 4. Using `diff` against the expected output.
      with subtest("apparmorRulesFromClosure"):
          machine.succeed(
-              "${pkgs.diffutils}/bin/diff ${pkgs.writeText "expected.rules" ''
+              "${pkgs.diffutils}/bin/diff -u ${pkgs.writeText "expected.rules" ''
                  mr ${pkgs.bash}/lib/**.so*,
                  r ${pkgs.bash},
                  r ${pkgs.bash}/etc/**,
@ -64,6 +64,12 @@ import ./make-test-python.nix ({ pkgs, ... } : {
                  r ${pkgs.libunistring}/lib/**,
                  r ${pkgs.libunistring}/share/**,
                  x ${pkgs.libunistring}/foo/**,
+                  mr ${pkgs.glibc.libgcc}/lib/**.so*,
+                  r ${pkgs.glibc.libgcc},
+                  r ${pkgs.glibc.libgcc}/etc/**,
+                  r ${pkgs.glibc.libgcc}/lib/**,
+                  r ${pkgs.glibc.libgcc}/share/**,
+                  x ${pkgs.glibc.libgcc}/foo/**,
              ''} ${pkgs.runCommand "actual.rules" { preferLocalBuild = true; } ''
                  ${pkgs.gnused}/bin/sed -e 's:^[^ ]* ${builtins.storeDir}/[^,/-]*-\([^/,]*\):\1 \0:' ${
                      pkgs.apparmorRulesFromClosure {
--- a/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch
+++ b/nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch
@ -0,0 +1,25 @@
+From d87a7513c6f2f2824203032ef27caeb84892ed7e Mon Sep 17 00:00:00 2001
+From: Will Fancher <elvishjerricco@gmail.com>
+Date: Tue, 30 May 2023 16:53:20 -0400
+Subject: [PATCH] Intentionally break the fat driver
+
+---
+ FatPkg/EnhancedFatDxe/ReadWrite.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/FatPkg/EnhancedFatDxe/ReadWrite.c b/FatPkg/EnhancedFatDxe/ReadWrite.c
+index 8f525044d1f1..32c62ff7817b 100644
+--- a/FatPkg/EnhancedFatDxe/ReadWrite.c
+++ b/FatPkg/EnhancedFatDxe/ReadWrite.c
+@@ -216,6 +216,11 @@ FatIFileAccess (
+   Volume = OFile->Volume;
+   Task   = NULL;
+ 
+  if (*BufferSize > (10U * 1024U * 1024U)) {
+    IFile->Position += 10U * 1024U * 1024U;
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+   //
+   // Write to a directory is unsupported
+   //
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@ -251,4 +251,29 @@ in
          machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/netbootxyz/netboot.xyz.efi")
    '';
  };
+
+  # See: [Firmware file size bug] in systemd/default.nix
+  uefiLargeFileWorkaround = makeTest {
+    name = "uefi-large-file-workaround";
+
+    nodes.machine = { pkgs, ... }: {
+      imports = [common];
+      virtualisation.efi.OVMF = pkgs.OVMF.overrideAttrs (old: {
+        # This patch deliberately breaks the FAT driver in EDK2 to
+        # exhibit (part of) the firmware bug that we are testing
+        # for. Files greater than 10MiB will fail to be read in a
+        # single Read() call, so systemd-boot will fail to load the
+        # initrd without a workaround. The number 10MiB was chosen
+        # because if it were smaller than the kernel size, even the
+        # LoadImage call would fail, which is not the failure mode
+        # we're testing for. It needs to be between the kernel size
+        # and the initrd size.
+        patches = old.patches or [] ++ [ ./systemd-boot-ovmf-broken-fat-driver.patch ];
+      });
+    };
+
+    testScript = ''
+      machine.wait_for_unit("multi-user.target")
+    '';
+  };
 }
--- a/pkgs/applications/audio/tetraproc/default.nix
+++ b/pkgs/applications/audio/tetraproc/default.nix
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    # Make sure Jack is avalable in $PATH for tetraproc
+    # Make sure Jack is available in $PATH for tetraproc
    wrapProgram $out/bin/tetraproc --prefix PATH : "${jack2}/bin"
  '';

--- a/pkgs/applications/editors/thonny/default.nix
+++ b/pkgs/applications/editors/thonny/default.nix
@ -42,7 +42,6 @@ buildPythonApplication rec {

  preFixup = ''
    wrapProgram "$out/bin/thonny" \
-       --set TK_LIBRARY "${tk}/lib/${tk.libPrefix}" \
       --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath ${python3.pkgs.jedi})
  '';

@ -64,6 +63,6 @@ buildPythonApplication rec {
    homepage = "https://www.thonny.org/";
    license = licenses.mit;
    maintainers = with maintainers; [ leenaars ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
    ./arm64-check.patch
  ];

-  outputs = [ "out" "doc" ]; # headers are just two and very small
+  outputs = [ "out" "dev" "doc" ];

  nativeBuildInputs = [ cmake ];

--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@ -47,12 +47,12 @@ let

 in
 stdenv.mkDerivation rec {
-  version = "1.21.1";
+  version = "1.22.1";
  pname = "mupdf";

  src = fetchurl {
    url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "sha256-sk3b4SUGzILeCNXNSUYUugg0b4F12x2YvPk4/5SSWlQ=";
+    sha256 = "sha256-1i88DkVuu8QucfWkfw+M0SzsK/Co1yt541+jWmU4slo=";
  };

  patches = [ ./0001-Use-command-v-in-favor-of-which.patch
--- a/pkgs/applications/version-management/tig/default.nix
+++ b/pkgs/applications/version-management/tig/default.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
    cp contrib/vim.tigrc $out/etc/

    # Note: Until https://github.com/jonas/tig/issues/940 is resolved it is best
-    # not to install the ZSH completion so that the fallback implemenation from
+    # not to install the ZSH completion so that the fallback implementation from
    # ZSH can be used (Completion/Unix/Command/_git: "_tig () { _git-log }"):
    #install -D contrib/tig-completion.zsh $out/share/zsh/site-functions/_tig

--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@ -116,7 +116,7 @@ stdenv.mkDerivation (rec {
    # Remove in-tree qemu stuff in case we build from a tar-ball
    rm -rf tools/qemu-xen tools/qemu-xen-traditional

-    # Fix shebangs, mainly for build-scipts
+    # Fix shebangs, mainly for build-scripts
    # We want to do this before getting prefetched stuff to speed things up
    # (prefetched stuff has lots of files)
    find . -type f | xargs sed -i 's@/usr/bin/\(python\|perl\)@/usr/bin/env \1@g'
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@ -17,8 +17,8 @@ branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 out=${out:-}
 http_proxy=${http_proxy:-}

-# allow overwritting cacert's ca-bundle.crt with a custom one
-# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE enviroment variables for the nix-daemon
+# allow overwriting cacert's ca-bundle.crt with a custom one
+# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE environment variables for the nix-daemon
 GIT_SSL_CAINFO=${NIX_GIT_SSL_CAINFO:-$GIT_SSL_CAINFO}

 # populated by clone_user_rev()
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@ -57,8 +57,8 @@

  # GCC
  gcc = [
-    "https://bigsearcher.com/mirrors/gcc/"
    "https://mirror.koddos.net/gcc/"
+    "https://bigsearcher.com/mirrors/gcc/"
    "ftp://ftp.nluug.nl/mirror/languages/gcc/"
    "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
    "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@ -6,9 +6,6 @@
 , passthru ? { }
 , patches ? [ ]

-  # Go tags, passed to go via -tag
-, tags ? [ ]
-
  # A function to override the go-modules derivation
 , overrideModAttrs ? (_oldAttrs: { })

@ -201,7 +198,7 @@ let

        declare -a flags
        flags+=($buildFlags "''${buildFlagsArray[@]}")
-        flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
+        flags+=(''${tags:+-tags=''${tags// /,}})
        flags+=(''${ldflags:+-ldflags="$ldflags"})
        flags+=("-p" "$NIX_BUILD_CORES")

--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@ -7,12 +7,6 @@
 , preFixup ? ""
 , shellHook ? ""

-# Go linker flags, passed to go via -ldflags
-, ldflags ? []
-
-# Go tags, passed to go via -tag
-, tags ? []
-
 # We want parallel builds by default
 , enableParallelBuilding ? true

@ -49,9 +43,6 @@

 , meta ? {}, ... } @ args:

-
-with builtins;
-
 let
  dep2src = goDep:
    {
@ -172,7 +163,7 @@ let

        declare -a flags
        flags+=($buildFlags "''${buildFlagsArray[@]}")
-        flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
+        flags+=(''${tags:+-tags=''${tags// /,}})
        flags+=(''${ldflags:+-ldflags="$ldflags"})
        flags+=("-p" "$NIX_BUILD_CORES")

--- a/pkgs/build-support/setup-hooks/auto-patchelf.py
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@ -109,7 +109,14 @@ def osabi_are_compatible(wanted: str, got: str) -> bool:


 def glob(path: Path, pattern: str, recursive: bool) -> Iterator[Path]:
-    return path.rglob(pattern) if recursive else path.glob(pattern)
+    if path.is_dir():
+        return path.rglob(pattern) if recursive else path.glob(pattern)
+    else:
+        # path.glob won't return anything if the path is not a directory.
+        # We extend that behavior by matching the file name against the pattern.
+        # This allows to pass single files instead of dirs to auto_patchelf,
+        # for greater control on the files to consider.
+        return [path] if path.match(pattern) else []


 cached_paths: Set[Path] = set()
@ -305,16 +312,21 @@ def main() -> None:
        "--no-recurse",
        dest="recursive",
        action="store_false",
-        help="Patch only the provided paths, and ignore their children")
+        help="Disable the recursive traversal of paths to patch.")
    parser.add_argument(
        "--paths", nargs="*", type=Path,
-        help="Paths whose content needs to be patched.")
+        help="Paths whose content needs to be patched."
+             " Single files and directories are accepted."
+             " Directories are traversed recursively by default.")
    parser.add_argument(
        "--libs", nargs="*", type=Path,
-        help="Paths where libraries are searched for.")
+        help="Paths where libraries are searched for."
+             " Single files and directories are accepted."
+             " Directories are not searched recursively.")
    parser.add_argument(
        "--runtime-dependencies", nargs="*", type=Path,
-        help="Paths to prepend to the runtime path of executable binaries.")
+        help="Paths to prepend to the runtime path of executable binaries."
+             " Subject to deduplication, which may imply some reordering.")
    parser.add_argument(
        "--append-rpaths",
        nargs="*",
--- a/pkgs/build-support/setup-hooks/role.bash
+++ b/pkgs/build-support/setup-hooks/role.bash
@ -1,8 +1,8 @@
-# Since the same derivation can be depend on in multiple ways, we need to
+# Since the same derivation can be depended on in multiple ways, we need to
 # accumulate *each* role (i.e. host and target platforms relative the depending
 # derivation) in which the derivation is used.
 #
-# The role is intened to be use as part of other variables names like
+# The role is intended to be used as part of other variables names like
 #  - $NIX_SOMETHING${role_post}

 function getRole() {
@ -49,7 +49,7 @@ function getTargetRoleEnvHook() {
    getRole "$depTargetOffset"
 }

-# This variant is inteneded specifically for code-prodocing tool wrapper scripts
+# This variant is intended specifically for code-producing tool wrapper scripts
 # `NIX_@wrapperName@_TARGET_*_@suffixSalt@` tracks this (needs to be an exported
 # env var so can't use fancier data structures).
 function getTargetRoleWrapper() {
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "binaryen";
-  version = "112";
+  version = "113";

  src = fetchFromGitHub {
    owner = "WebAssembly";
    repo = "binaryen";
    rev = "version_${version}";
-    hash = "sha256-xVumVmiLMHJp3SItE8eL8OBPeq58HtOOiK9LL8SP4CQ=";
+    hash = "sha256-w93LIlLRn3PmVNytjFg6KI4CQ9zQUUM9kySiWAtPbOA=";
  };

  nativeBuildInputs = [ cmake python3 ];
--- a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
+++ b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
@ -1,4 +1,4 @@
-From 67f54fde2b1683aae3800f7a86a4e507c1125be8 Mon Sep 17 00:00:00 2001
+From 4bbbb640934aa653bcfec0335798b77a8935b815 Mon Sep 17 00:00:00 2001
 From: Yureka <yuka@yuka.dev>
 Date: Sat, 7 Aug 2021 09:16:46 +0200
 Subject: [PATCH] emulate clang 'sysroot + /include' logic
@ -20,23 +20,23 @@ but it doesn't appear to work
 1 file changed, 6 insertions(+), 1 deletion(-)

 diff --git a/emcc.py b/emcc.py
-index 999314afc..0e23c066c 100755
+index ba8d1b556..7d89644c5 100755
 --- a/emcc.py
 +++ b/emcc.py
-@@ -759,7 +759,12 @@ def emsdk_ldflags(user_args):
+@@ -883,7 +883,12 @@ def parse_s_args(args):
 
 
 def emsdk_cflags(user_args):
-  cflags = ['--sysroot=' + shared.Cache.get_sysroot(absolute=True)]
+-  cflags = ['--sysroot=' + cache.get_sysroot(absolute=True)]
 +  cflags = [
-+    '--sysroot=' + shared.Cache.get_sysroot(absolute=True),
+    '--sysroot=' + cache.get_sysroot(absolute=True),
 +    '-resource-dir=@resourceDir@',
-+    '-idirafter' + shared.Cache.get_sysroot(absolute=True) + os.path.join('/include'),
+    '-idirafter' + cache.get_sysroot(absolute=True) + os.path.join('/include'),
 +    '-iwithsysroot' + os.path.join('/include','c++','v1')
 +  ]
 
   def array_contains_any_of(hay, needles):
     for n in needles:
 -- 
-2.32.0
+2.40.0

--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@ -8,7 +8,7 @@

 stdenv.mkDerivation rec {
  pname = "emscripten";
-  version = "3.1.24";
+  version = "3.1.39";

  llvmEnv = symlinkJoin {
    name = "emscripten-llvm-${version}";
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    name = "emscripten-node-modules-${version}";
    inherit pname version src;

-    npmDepsHash = "sha256-ejuHR2BpAUStWjuvQuGE6ko4byF4GBl6FJBshxlknQk=";
+    npmDepsHash = "sha256-NSpVXssXwx+94E1qhM3tt2fN2G0EuvPZSN+Xep2IRs8=";

    dontBuild = true;

@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "emscripten-core";
    repo = "emscripten";
-    sha256 = "sha256-1jW6ThxK6dThOO90l4Mc5yehVF3tI4HWipBWZAOztrk=";
+    sha256 = "sha256-hgndNMx+hvXyLzn6ip8Fhs+LAw98P3cqL8dJ+92jJmU=";
    rev = version;
  };

@ -42,17 +42,7 @@ stdenv.mkDerivation rec {
  patches = [
    (substituteAll {
      src = ./0001-emulate-clang-sysroot-include-logic.patch;
-      resourceDir = "${llvmEnv}/lib/clang/${llvmPackages.release_version}/";
-    })
-    # https://github.com/emscripten-core/emscripten/pull/18219
-    (fetchpatch {
-      url = "https://github.com/emscripten-core/emscripten/commit/afbc14950f021513c59cbeaced8807ef8253530a.patch";
-      sha256 = "sha256-+gJNTQJng9rWcGN3GAcMBB0YopKPnRp/r8CN9RSTClU=";
-    })
-    # https://github.com/emscripten-core/emscripten/pull/18220
-    (fetchpatch {
-      url = "https://github.com/emscripten-core/emscripten/commit/852982318f9fb692ba1dd1173f62e1eb21ae61ca.patch";
-      sha256 = "sha256-hmIOtpRx3PD3sDAahUcreSydydqcdSqArYvyLGgUgd8=";
+      resourceDir = "${llvmEnv}/lib/clang/16/";
    })
  ];

@ -108,17 +98,20 @@ stdenv.mkDerivation rec {

    # precompile libc (etc.) in all variants:
    pushd $TMPDIR
-    echo 'int __main_argc_argv() { return 42; }' >test.c
+    echo 'int __main_argc_argv( int a, int b ) { return 42; }' >test.c
    for LTO in -flto ""; do
      # wasm2c doesn't work with PIC
      $out/bin/emcc -s WASM2C -s STANDALONE_WASM $LTO test.c

      for BIND in "" "--bind"; do
-        for MT in "" "-s USE_PTHREADS"; do
-          for RELOCATABLE in "" "-s RELOCATABLE"; do
-            $out/bin/emcc $RELOCATABLE $BIND $MT $LTO test.c
-          done
-        done
+        # starting with emscripten 3.1.32+,
+        # if pthreads and relocatable are both used,
+        # _emscripten_thread_exit_joinable must be exported
+        # (see https://github.com/emscripten-core/emscripten/pull/18376)
+        # TODO: get library cache to build with both enabled and function exported
+        $out/bin/emcc $LTO $BIND test.c
+        $out/bin/emcc $LTO $BIND -s RELOCATABLE test.c
+        $out/bin/emcc $LTO $BIND -s USE_PTHREADS test.c
      done
    done
    popd
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@ -55,7 +55,7 @@ with lib;
 with builtins;

 let majorVersion = "12";
-    version = "${majorVersion}.2.0";
+    version = "${majorVersion}.3.0";
    disableBootstrap = !stdenv.hostPlatform.isDarwin && !profiledCompiler;

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@ -69,15 +69,19 @@ let majorVersion = "12";
        ../gcc-12-gfortran-driving.patch
        ../ppc-musl.patch
        ../install-info-files-serially.patch
+
+        # backport ICE fix on ccache code
+        ./lambda-ICE-PR109241.patch
      ]
      # We only apply this patch when building a native toolchain for aarch64-darwin, as it breaks building
      # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
-      ++ optional (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) (fetchpatch {
-        name = "gcc-12-darwin-aarch64-support.patch";
-        url = "https://github.com/Homebrew/formula-patches/raw/1d184289/gcc/gcc-12.2.0-arm.diff";
-        sha256 = "sha256-omclLslGi/2yCV4pNBMaIpPDMW3tcz/RXdupbNbeOHA=";
-      })
-      ++ optional langD ../libphobos.patch
+      ++ optionals (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) [
+        (fetchurl {
+          name = "gcc-12-darwin-aarch64-support.patch";
+          url = "https://raw.githubusercontent.com/Homebrew/formula-patches/f1188b90d610e2ed170b22512ff7435ba5c891e2/gcc/gcc-12.3.0.diff";
+          sha256 = "sha256-naL5ZNiurqfDBiPSU8PTbTmLqj25B+vjjiqc4fAFgYs=";
+        })
+      ] ++ optional langD ../libphobos.patch

      # backport fixes to build gccgo with musl libc
      ++ optionals (langGo && stdenv.hostPlatform.isMusl) [
@ -206,7 +210,7 @@ lib.pipe (stdenv.mkDerivation ({

  src = fetchurl {
    url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-5UnPnPNZSgDie2WJ1DItcOByDN0hPzm+tBgeBpJiMP8=";
+    sha256 = "sha256-lJpdT5nnhkIak7Uysi/6tVeN5zITaZdbka7Jet/ajDs=";
  };

  inherit patches;
--- a/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
+++ b/pkgs/development/compilers/gcc/12/lambda-ICE-PR109241.patch
@ -0,0 +1,77 @@
+https://gcc.gnu.org/PR109241
+
+Fix ICE on ccache.
+
+From 396a4e76afec30d2461638f569cae18955eb4ad2 Mon Sep 17 00:00:00 2001
+From: Jason Merrill <jason@redhat.com>
+Date: Wed, 22 Mar 2023 16:11:47 -0400
+Subject: [PATCH] c++: local class in nested generic lambda [PR109241]
+
+In this testcase, the tree walk to look for bare parameter packs was
+confused by finding a type with no TREE_BINFO.  But it should be fine that
+it's unset; we already checked for unexpanded packs at parse time.
+
+I also tried doing the partial instantiation of the local class, which is
+probably the long-term direction we want to go, but for stage 4 let's go
+with this safer change.
+
+	PR c++/109241
+
+gcc/cp/ChangeLog:
+
+	* pt.cc (find_parameter_packs_r): Handle null TREE_BINFO.
+
+gcc/testsuite/ChangeLog:
+
+	* g++.dg/cpp1y/lambda-generic-local-class2.C: New test.
+---
+ gcc/cp/pt.cc                                        | 12 ++++++++----
+ .../g++.dg/cpp1y/lambda-generic-local-class2.C      | 13 +++++++++++++
+ 2 files changed, 21 insertions(+), 4 deletions(-)
+ create mode 100644 gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+
+diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
+index c7f4a95a723..79bc9c014c8 100644
+--- a/gcc/cp/pt.cc
+++ b/gcc/cp/pt.cc
+@@ -4106,10 +4106,14 @@ find_parameter_packs_r (tree *tp, int *walk_subtrees, void* data)
+     case TAG_DEFN:
+       t = TREE_TYPE (t);
+       if (CLASS_TYPE_P (t))
+-	/* Local class, need to look through the whole definition.  */
+-	for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
+-	  cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
+-			ppd, ppd->visited);
+	{
+	  /* Local class, need to look through the whole definition.
+	     TYPE_BINFO might be unset for a partial instantiation.  */
+	  if (TYPE_BINFO (t))
+	    for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
+	      cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
+			    ppd, ppd->visited);
+	}
+       else
+ 	/* Enum, look at the values.  */
+ 	for (tree l = TYPE_VALUES (t); l; l = TREE_CHAIN (l))
+diff --git a/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+new file mode 100644
+index 00000000000..83856de1f41
+--- /dev/null
+++ b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+@@ -0,0 +1,13 @@
+// PR c++/109241
+// { dg-do compile { target c++14 } }
+// { dg-options "" } no pedantic
+
+void g() {
+  [](auto) {
+    [](auto) {
+      ({
+        struct A {};
+      });
+    };
+  }(1);
+}
+-- 
+2.40.1
+
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@ -77,29 +77,12 @@ in
 rec {
  lua5_4 = callPackage ./interpreter.nix {
    self = lua5_4;
-    version = "5.4.4";
-    hash = "sha256-Fkx4SWU7gK5nvsS3RzuIS/XMjS3KBWU0dewu0nuev2E=";
+    version = "5.4.6";
+    hash = "sha256-fV6huctqoLWco93hxq3LV++DobqOVDLA7NBr9DmzrYg=";
    makeWrapper = makeBinaryWrapper;
    inherit passthruFun;

-    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch
-      ++ [
-        (fetchpatch {
-          name = "CVE-2022-28805.patch";
-          url = "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa.patch";
-          sha256 = "sha256-YTwoolSnRNJIHFPVijSO6ZDw35BG5oWYralZ8qOb9y8=";
-          stripLen = 1;
-          extraPrefix = "src/";
-          excludes = [ "src/testes/*" ];
-        })
-        (fetchpatch {
-          name = "CVE-2022-33099.patch";
-          url = "https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf.patch";
-          sha256 = "sha256-qj1Dq1ojVoknALSa67jhgH3G3Kk4GtJP6ROFElVF+D0=";
-          stripLen = 1;
-          extraPrefix = "src/";
-        })
-      ];
+    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
  };

  lua5_4_compat = lua5_4.override({
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@ -88,7 +88,7 @@ stdenv.mkDerivation rec {

  dlopenPropagatedBuildInputs = [ ]
    # Propagated for #include <GLES/gl.h> in SDL_opengles.h.
-    ++ lib.optional openglSupport libGL
+    ++ lib.optional (openglSupport && !stdenv.isDarwin) libGL
    # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
    ++ lib.optionals x11Support [ libX11 ];

--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@ -13,7 +13,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ SDL2 freetype libGL ]
+  buildInputs = [ SDL2 freetype ]
+    ++ lib.optional (!stdenv.isDarwin) libGL
    ++ lib.optional stdenv.isDarwin darwin.libobjc;

  meta = with lib; {
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "libopenmpt";
-  version = "0.6.10";
+  version = "0.7.1";

  outputs = [ "out" "dev" "bin" ];

  src = fetchurl {
    url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "wlvo3A2sI87AJUh+WPGV5NFPfZSu3dX+RrIcBPHOJ3Q=";
+    hash = "sha256-vxddJkSLsTP3RxTzqIWecAC5NSL7NXdVnf/ANxYZEPk=";
  };

  enableParallelBuilding = true;
@ -39,9 +39,13 @@ stdenv.mkDerivation rec {
    portaudio
    libsndfile
    flac
-  ] ++ lib.optional usePulseAudio libpulseaudio;
+  ] ++ lib.optionals usePulseAudio [
+    libpulseaudio
+  ];

-  configureFlags = lib.optional (!usePulseAudio) "--without-pulseaudio";
+  configureFlags = [
+    (lib.strings.withFeature usePulseAudio "pulseaudio")
+  ];

  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@ -13,14 +13,15 @@

 stdenv.mkDerivation rec {
  pname = "c-ares";
-  version = "1.19.0";
-  outputs = [ "out" "dev" ];
+  version = "1.19.1";

  src = fetchurl {
    url = "https://c-ares.haxx.se/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-v866N+I/1TEpOCkALKwEAe9JptxVkj9/kiNlhbetHdM=";
+    sha256 = "sha256-MhcAOZty7Q4DfQB0xinndB9rLsLdqSlWq+PpZx0+Jo4=";
  };

+  outputs = [ "out" "dev" "man" ];
+
  nativeBuildInputs = lib.optionals withCMake [ cmake ];

  cmakeFlags = [] ++ lib.optionals stdenv.hostPlatform.isStatic [
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@ -63,6 +63,14 @@ in {
      sha256 = "sha256-8G98nsPz3MLEWPDX9F0jKgXC4hC4NNdFQLSpmW3ay2s=";
    })

+    # Fix clang build failures on newer LLVM versions
+    # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/119
+    (fetchpatch {
+      name = "fix-types.patch";
+      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/38e486b34d435130f2fb38c429e6016c3c82cd53.patch";
+      sha256 = "sha256-vmluOJSuTRiQHmbBBVCxOIkZ0O0ZEo0J4mgrUPn0SIo=";
+    })
+
    # Fix unexpected color addition on grayscale images (usually text).
    # Upstream fix: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114
    # Can be removed after 1.18 release
@ -71,6 +79,7 @@ in {
      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/4f4d89506f58a64b4829b1bb239bab9e46d63727.diff";
      sha256 = "sha256-mbTg67e7APfdELsuMAgXdY3xokWbGtHF7VDD5UyYqKM=";
    })
+
  ];

  outputs = [ "out" "dev" "devdoc" ];
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@ -67,6 +67,8 @@ stdenv.mkDerivation rec {
    ++ lib.optionals stdenv.isLinux [ audit libapparmor ];
  # ToDo: optional selinux?

+  __darwinAllowLocalNetworking = true;
+
  configureFlags = [
    "--enable-user-session"
    "--enable-xml-docs"
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@ -1,6 +1,6 @@
 import ./generic.nix rec {
-  version = "4.4.3";
-  sha256 = "sha256-zZDzG1hD+0AHqElzeGR6OVm+H5wqtdktloSPmEUzT/c=";
+  version = "4.4.4";
+  sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
  extraPatches = [
    {
      name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -126,7 +126,6 @@
 , withMultithread ? true # Multithreading via pthreads/win32 threads
 , withNetwork ? withHeadlessDeps # Network support
 , withPixelutils ? withHeadlessDeps # Pixel utils in libavutil
-, withLTO ? false # build with link-time optimization
 /*
 *  Program options
 */
@ -384,7 +383,6 @@ stdenv.mkDerivation (finalAttrs: {

    (enableFeature withSmallBuild "small")
    (enableFeature withRuntimeCPUDetection "runtime-cpudetect")
-    (enableFeature withLTO "lto")
    (enableFeature withGrayscale "gray")
    (enableFeature withSwscaleAlpha "swscale-alpha")
    (enableFeature withHardcodedTables "hardcoded-tables")
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "gettext";
-  version = "0.21";
+  version = "0.21.1";

  src = fetchurl {
    url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
-    sha256 = "04kbg1sx0ncfrsbr85ggjslqkzzb243fcw9nyh3rrv1a22ihszf7";
+    sha256 = "sha256-6MNlDh2M7odcTzVWQjgsHfgwWL1aEe6FVcDPJ21kbUU=";
  };
  patches = [
    ./absolute-paths.diff
@ -47,14 +47,6 @@ stdenv.mkDerivation rec {
  '' + lib.optionalString stdenv.hostPlatform.isCygwin ''
    sed -i -e "s/\(cldr_plurals_LDADD = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
    sed -i -e "s/\(libgettextsrc_la_LDFLAGS = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
-  '' +
-  # This change to gettext's vendored copy of gnulib is already
-  # merged upstream; we can drop this patch on the next version
-  # bump.  It must be applied twice because gettext vendors gnulib
-  # not once, but twice!
-  ''
-    patch -p2 -d gettext-tools/gnulib-lib/ < ${gnulib.passthru.longdouble-redirect-patch}
-    patch -p2 -d gettext-tools/libgrep/    < ${gnulib.passthru.longdouble-redirect-patch}
  '';

  strictDeps = true;
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@ -1,5 +1,11 @@
-{ lib, stdenv, buildPackages, fetchurl, pciutils
-, gitUpdater }:
+{ lib
+, stdenv
+, buildPackages
+, fetchurl
+, fetchpatch
+, pciutils
+, gitUpdater
+}:

 stdenv.mkDerivation rec {
  pname = "gnu-efi";
@ -10,6 +16,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-eAfpAzSTQ6ehQuu5NHA6KHIjXolojPWGwDKwoQh7yvQ=";
  };

+  patches = [
+    # riscv64: fix efibind.h missing/duplicate types
+    # https://sourceforge.net/p/gnu-efi/patches/88
+    (fetchpatch {
+      url = "https://sourceforge.net/p/gnu-efi/patches/88/attachment/riscv64-fix-efibind.h-missing-duplicate-types.patch";
+      hash = "sha256-fUAxj1/U9J2A1zMEdnh62+WnVmQ9hrrYwMFppBz1Y1g=";
+    })
+  ];
+
  buildInputs = [ pciutils ];

  hardeningDisable = [ "stackprotector" ];
@ -30,6 +45,6 @@ stdenv.mkDerivation rec {
    homepage = "https://sourceforge.net/projects/gnu-efi/";
    license = licenses.bsd3;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ nickcao ];
  };
 }
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@ -38,7 +38,6 @@
 , bluez
 , chromaprint
 , curl
-, directfb
 , fdk_aac
 , flite
 , gsm
@ -104,6 +103,7 @@
 , microdnsSupport ? false
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
+, guiSupport ? true, directfb
 }:

 stdenv.mkDerivation rec {
@ -183,9 +183,6 @@ stdenv.mkDerivation rec {
    libwebp
    xvidcore
    gnutls
-    libGL
-    libGLU
-    gtk3
    game-music-emu
    openssl
    libxml2
@ -220,7 +217,6 @@ stdenv.mkDerivation rec {
    mjpegtools

    chromaprint
-    directfb
    flite
    libdrm
    libgudev
@ -237,6 +233,13 @@ stdenv.mkDerivation rec {
    serd
    sord
    sratom
+
+    libGL
+    libGLU
+  ] ++ lib.optionals guiSupport [
+    gtk3
+  ] ++ lib.optionals (stdenv.isLinux && guiSupport) [
+    directfb
  ] ++ lib.optionals stdenv.isDarwin [
    # For unknown reasons the order is important, e.g. if
    # VideoToolbox is last, we get:
@ -297,10 +300,11 @@ stdenv.mkDerivation rec {
    "-Ddoc=disabled" # needs gstcuda to be enabled which is Linux-only
    "-Dnvcodec=disabled" # Linux-only
    "-Dva=disabled" # see comment on `libva` in `buildInputs`
+  ] ++ lib.optionals (!stdenv.isLinux || !guiSupport) [
+    "-Ddirectfb=disabled"
  ]
  ++ lib.optionals stdenv.isDarwin [
    "-Dchromaprint=disabled"
-    "-Ddirectfb=disabled"
    "-Dflite=disabled"
    "-Dkms=disabled" # renders to libdrm output
    "-Dlv2=disabled"
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@ -87,9 +87,9 @@ stdenv.mkDerivation (finalAttrs: {
    libpng
    libjpeg
    tremor
-    libGL
    pango
  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
    libvisual
  ] ++ lib.optionals stdenv.isDarwin [
    OpenGL
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@ -102,7 +102,7 @@ let
      "reqwest" # tests hang on darwin
      "threadshare" # tests cannot bind to localhost on darwin
      "webp" # not supported on darwin (upstream crate issue)
-    ] ++ lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
+    ] ++ lib.optionals (!gst-plugins-base.glEnabled) [
      # these require gstreamer-gl which requires darwin sdk bump
      "gtk4"
      "livesync"
@ -206,7 +206,7 @@ stdenv.mkDerivation rec {
    export CSOUND_LIB_DIR=${lib.getLib csound}/lib
  '' + lib.optionalString (lib.mutuallyExclusive [ "webrtc" "webrtchttp" ] selectedPlugins) ''
    sed -i "/\['gstreamer-webrtc-1\.0', 'gst-plugins-bad', 'gstwebrtc_dep', 'gstwebrtc'\]/d" meson.build
-  '' + lib.optionalString (stdenv.isDarwin && !stdenv.isAarch64) ''
+  '' + lib.optionalString (!gst-plugins-base.glEnabled) ''
    sed -i "/\['gstreamer-gl-1\.0', 'gst-plugins-base', 'gst_gl_dep', 'gstgl'\]/d" meson.build
  '';

--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@ -62,10 +62,11 @@ stdenv.mkDerivation rec {
    xorg.libXrandr
    xorg.libSM
    xorg.libICE
-    libGL
-    libGLU
    nasm
    libvpx
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
+    libGLU
  ];

  strictDeps = true;
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
  doCheck = true;
  checkTarget = "test";

+  enableParallelBuilding = true;
+
  meta = with lib; {
    description = "An HTTP message parser written in C";
    homepage = "https://github.com/nodejs/http-parser";
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@ -1,14 +1,24 @@
-{ lib, stdenv, fetchurl, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:

 stdenv.mkDerivation rec {
  pname = "json-c";
  version = "0.16";

-  src = fetchurl {
-    url    = "https://s3.amazonaws.com/json-c_releases/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-jkWsj5bsd5Hq87t+5Q6cIQC7vIe40PHQMMW6igKI2Ws=";
+  src = fetchFromGitHub {
+    owner = "json-c";
+    repo = "json-c";
+    rev = "json-c-0.16-20220414";
+    sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
  };

+  patches = [
+    # needed for emscripten, which uses LLVM 15+
+    (fetchpatch {
+      url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
+      sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
+    })
+  ];
+
  outputs = [ "out" "dev" ];

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@ -33,7 +33,10 @@ stdenv.mkDerivation rec {
    "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${addOpenGLRunpath.driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""

    "-Wno-error=array-bounds"
-  ] ++ lib.optional stdenv.cc.isClang "-Wno-error");
+  ] ++ lib.optionals stdenv.cc.isClang [
+    "-Wno-error"
+    "-Wno-int-conversion"
+  ]);

  configureFlags  = []
    # Indirectly: https://bugs.freedesktop.org/show_bug.cgi?id=35268
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@ -18,8 +18,6 @@ stdenv.mkDerivation rec {
  # Beware: non-bootstrap libidn2 is overridden by ./hack.nix
  outputs = [ "bin" "dev" "out" "info" "devdoc" ];

-  patches = lib.optional stdenv.isDarwin ./fix-error-darwin.patch;
-
  enableParallelBuilding = true;

  # The above patch causes the documentation to be regenerated, so the
--- a/pkgs/development/libraries/libidn2/fix-error-darwin.patch
+++ b/pkgs/development/libraries/libidn2/fix-error-darwin.patch
@ -1,20 +0,0 @@
-diff --git a/src/idn2.c b/src/idn2.c
-index 6abbc72..804f0f2 100644
--- a/src/idn2.c
-+++ b/src/idn2.c
-@@ -31,7 +31,6 @@
- #include <unistr.h>
- 
- /* Gnulib headers. */
-#include "error.h"
- #include "gettext.h"
- #define _(String) dgettext (PACKAGE, String)
- #include "progname.h"
-@@ -222,7 +219,7 @@ main (int argc, char *argv[])
-     }
- 
-   if (ferror (stdin))
-    error (EXIT_FAILURE, errno, "%s", _("input error"));
-+    perror (_("input error"));
- 
-   cmdline_parser_free (&args_info);
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@ -33,6 +33,10 @@ stdenv.mkDerivation rec {
    sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
  '';

+  # Don’t build examples, which are not installed and require additional dependencies not
+  # included in `buildInputs` such as libX11.
+  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
+
  # single output, otherwise cmake and .pc files point to the wrong directory
  # outputs = [ "out" "dev" ];

--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@ -2,21 +2,15 @@

 stdenv.mkDerivation rec {
  pname = "libssh2";
-  version = "1.10.0";
+  version = "1.11.0";

  src = fetchurl {
    url = "https://www.libssh2.org/download/libssh2-${version}.tar.gz";
-    sha256 = "sha256-LWTpDz3tOUuR06LndMogOkF59prr7gMAPlpvpiHkHVE=";
+    sha256 = "sha256-NzYWHkHiaTMk3rOMJs/cPv5iCdY0ukJY2xzs/2pa1GE=";
  };

  outputs = [ "out" "dev" "devdoc" ];

-  patches = [
-    # https://github.com/libssh2/libssh2/pull/700
-    # openssl: add support for LibreSSL 3.5.x
-    ./openssl_add_support_for_libressl_3_5.patch
-  ];
-
  buildInputs = [ openssl zlib ]
    ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;

--- a/pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch
+++ b/pkgs/development/libraries/libssh2/openssl_add_support_for_libressl_3_5.patch
@ -1,26 +0,0 @@
-From f0681a4573d7c7f7484d3157ddff7063a200295b Mon Sep 17 00:00:00 2001
-From: Viktor Szakats <commit@vsz.me>
-Date: Thu, 19 May 2022 13:25:06 +0000
-Subject: [PATCH] openssl: add support for LibreSSL 3.5.x
-
-LibreSSL 3.5.0 made more structures opaque, so let's enable existing
-support for that when building against these LibreSSL versions.
-
-Ref: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.0-relnotes.txt
---
- src/openssl.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/openssl.h b/src/openssl.h
-index 658b040..1733b9e 100644
--- a/src/openssl.h
-+++ b/src/openssl.h
-@@ -58,7 +58,8 @@
- #include <openssl/rand.h>
-
- #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
-    !defined(LIBRESSL_VERSION_NUMBER)
-+    !defined(LIBRESSL_VERSION_NUMBER) || \
-+    LIBRESSL_VERSION_NUMBER >= 0x3050000fL
- # define HAVE_OPAQUE_STRUCTS 1
- #endif
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@ -8,11 +8,11 @@
 stdenv.mkDerivation rec {
  pname = "libvterm-neovim";
  # Releases are not tagged, look at commit history to find latest release
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchurl {
    url = "https://www.leonerd.org.uk/code/libvterm/libvterm-${version}.tar.gz";
-    sha256 = "sha256-JaitnBVIU2jf0Kip3KGuyP6lwn2j+nTsUY1dN4fww5c=";
+    sha256 = "sha256-ketQiAafTm7atp4UxCEvbaAZLmVpWVbcBIAWoNq4vPY=";
  };

  nativeBuildInputs = [ perl libtool ];
--- a/pkgs/development/libraries/mesa/22.3.nix
+++ b/pkgs/development/libraries/mesa/22.3.nix
@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "22.3.7";
-  hash = "sha256-iUzi9KHC52F3zdIoRiAZLQ2jBmskPuwvux18838TBCw=";
-}
--- a/pkgs/development/libraries/mesa/23.0.nix
+++ b/pkgs/development/libraries/mesa/23.0.nix
@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "23.0.3";
-  hash = "sha256-OGNipdgN87CWY2tn80Dhzme3BbRHZ9W90R0u0QNxktU=";
-}
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -1,12 +1,10 @@
-{ version, hash }:
-
 { stdenv, lib, fetchurl, fetchpatch
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages_15, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
-, libglvnd, libunwind
+, libglvnd, libunwind, lm_sensors
 , vulkan-loader, glslang
 , galliumDrivers ?
  if stdenv.isLinux then
@ -87,6 +85,9 @@
 */

 let
+  version = "23.1.1";
+  hash = "sha256-omeQMe1bc7KcTwQqxk2W+DsM/khYYX3jLi78GWxlOkA=";
+
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
  branch = lib.versions.major version;
@ -145,11 +146,6 @@ self = stdenv.mkDerivation {
      "get_option('datadir')" "'${placeholder "out"}/share'"
    substituteInPlace src/amd/vulkan/meson.build --replace \
      "get_option('datadir')" "'${placeholder "out"}/share'"
-  ''
-  # TODO: can be removed >= 23.0.4 (most likely)
-  # https://gitlab.freedesktop.org/mesa/mesa/-/commit/035aa34ed5eb418339c0e2d2
-  + ''
-    sed '/--size_t-is-usize/d' -i src/gallium/frontends/rusticl/meson.build
  '';

  outputs = [ "out" "dev" "drivers" ]
@ -197,6 +193,10 @@ self = stdenv.mkDerivation {

    # To enable non-mesa gbm backends to be found (e.g. Nvidia)
    "-Dgbm-backends-path=${libglvnd.driverLink}/lib/gbm:${placeholder "out"}/lib/gbm"
+
+    # meson auto_features enables these features, but we do not want them
+    "-Dandroid-libbacktrace=disabled"
+
  ] ++ lib.optionals stdenv.isLinux [
    "-Dglvnd=true"

@ -219,10 +219,9 @@ self = stdenv.mkDerivation {
    libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
    libffi libvdpau libelf libXvMC
    libpthreadstubs openssl /*or another sha1 provider*/
-    zstd
+    zstd libunwind
  ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev ]
-    ++ lib.optionals stdenv.isDarwin [ libunwind ]
+    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
    ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator' ]
    ++ lib.optional withValgrind valgrind-light
    ++ lib.optional haveZink vulkan-loader
@ -253,6 +252,7 @@ self = stdenv.mkDerivation {
    if [ -n "$(shopt -s nullglob; echo "$out/lib/libxatracker"*)" -o -n "$(shopt -s nullglob; echo "$out/lib/libvulkan_"*)" ]; then
      # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
      mv -t $drivers/lib       \
+        $out/lib/libpowervr_rogue* \
        $out/lib/libxatracker* \
        $out/lib/libvulkan_*
    fi
@ -371,6 +371,9 @@ self = stdenv.mkDerivation {
    license = licenses.mit; # X11 variant, in most files
    platforms = platforms.mesaPlatforms;
    maintainers = with maintainers; [ primeos vcunat ]; # Help is welcome :)
+
+    # https://gitlab.freedesktop.org/mesa/mesa/-/issues/8634
+    broken = stdenv.isDarwin;
  };
 };

--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@ -10,16 +10,18 @@ diff --git a/meson_options.txt b/meson_options.txt
 index b8f753e2e1a..70d9071c8be 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -452,6 +452,12 @@ option(
+@@ -452,7 +452,14 @@ option(
   value : true,
   description : 'Enable direct rendering in GLX and EGL for DRI',
 )
+ 
 +option(
 +  'disk-cache-key',
 +  type : 'string',
 +  value : '',
 +  description : 'Mesa cache key.'
 +)
+
 option('egl-lib-suffix',
   type : 'string',
   value : '',
--- a/pkgs/development/libraries/nss/gcc-13-esr.patch
+++ b/pkgs/development/libraries/nss/gcc-13-esr.patch
@ -0,0 +1,44 @@
+https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
+https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+
+# HG changeset patch
+# User Sergei Trofimovich <slyich@gmail.com>
+# Date 1653552519 0
+# Node ID 21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+# Parent  ad1046e9eee5f5dc17dac7c9343e2f7f0da44b4e
+Bug 1771273 - cpputil/databuffer.h: add missing <cstdint> include r=nss-reviewers,mt
+
+Without the change build fails on this week's gcc-13 snapshot as:
+
+    ../../cpputil/databuffer.h:20:20: error: 'uint8_t' does not name a type
+       20 |   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
+          |                    ^~~~~~~
+    ../../cpputil/databuffer.h:14:1: note: 'uint8_t' is defined in header '<cstdint>'; did you forget to '#include <cstdint>'?
+       13 | #include <iostream>
+      +++ |+#include <cstdint>
+       14 |
+
+Differential Revision: https://phabricator.services.mozilla.com/D147404
+
+diff --git a/cpputil/databuffer.h b/cpputil/databuffer.h
+--- nss/cpputil/databuffer.h
+++ nss/cpputil/databuffer.h
+@@ -6,16 +6,17 @@
+ 
+ #ifndef databuffer_h__
+ #define databuffer_h__
+ 
+ #include <algorithm>
+ #include <cstring>
+ #include <iomanip>
+ #include <iostream>
+#include <cstdint>
+ 
+ namespace nss_test {
+ 
+ class DataBuffer {
+  public:
+   DataBuffer() : data_(nullptr), len_(0) {}
+   DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
+     Assign(d, l);
+
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@ -47,6 +47,11 @@ stdenv.mkDerivation rec {
      ./85_security_load_3.85+.patch
    )
    ./fix-cross-compilation.patch
+  ] ++ lib.optionals (lib.versionOlder version "3.89") [
+    # Backport gcc-13 build fix:
+    #  https://bugzilla.mozilla.org/show_bug.cgi?id=1771273
+    #  https://hg.mozilla.org/projects/nss/raw-rev/21e7aaa1f7d94bca15d997e5b4c2329b32fad21a
+    ./gcc-13-esr.patch
  ];

  patchFlags = [ "-p0" ];
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , unzip
@ -275,6 +276,21 @@ stdenv.mkDerivation {
  # Ensures that we use the system OpenEXR rather than the vendored copy of the source included with OpenCV.
  patches = [
    ./cmake-don-t-use-OpenCVFindOpenEXR.patch
+  ] ++ lib.optionals enableContrib [
+    (fetchpatch {
+      name = "CVE-2023-2617.patch";
+      url = "https://github.com/opencv/opencv_contrib/commit/ccc277247ac1a7aef0a90353edcdec35fbc5903c.patch";
+      stripLen = 2;
+      extraPrefix = [ "opencv_contrib/" ];
+      sha256 = "sha256-drZ+DVn+Pk4zAZJ+LgX5u3Tz7MU0AEI/73EVvxDP3AU=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-2618.patch";
+      url = "https://github.com/opencv/opencv_contrib/commit/ec406fa4748fb4b0630c1b986469e7918d5e8953.patch";
+      stripLen = 2;
+      extraPrefix = [ "opencv_contrib/" ];
+      sha256 = "sha256-cB5Tsh2fDOsc0BNtSzd6U/QoCjkd9yMW1QutUU69JJ0=";
+    })
  ] ++ lib.optional enableCuda ./cuda_opt_flow.patch;

  # This prevents cmake from using libraries in impure paths (which
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
    "devdoc"
  ];

+  __darwinAllowLocalNetworking = true;
+
  enableParallelBuilding = true;

  nativeBuildInputs = [
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@ -240,8 +240,8 @@ in {
  };

  openssl_3 = common {
-    version = "3.0.8";
-    sha256 = "sha256-bBPSvzj98x6sPOKjRwc2c/XWMmM5jx9p0N9KQSU+Sz4=";
+    version = "3.0.9";
+    sha256 = "sha256-6xqwR4FHQ2D3fDGKuJ2MWgOrw45j1lpgPKu/GwCh3JA=";
    patches = [
      ./3.0/nix-ssl-cert-file.patch

--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@ -16,8 +16,8 @@
  },
  "qtbase": {
    "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "d3b21bc8b70eaa1af848371dc1d34c4617c1f73c",
-    "sha256": "11yww09fgcqsxv4sk4cflxdsdpdqc0x9b3qw63asfpwrnv9qry0a"
+    "rev": "a196623892558623e467f20b67edb78794252a09",
+    "sha256": "0yna2k1w595xwh9bk268h31fjl2ff8cm185dmm0v5gr4w8h9yr4g"
  },
  "qtcharts": {
    "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@ -26,8 +26,8 @@
  },
  "qtconnectivity": {
    "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "0f9e49cde3b7ca40cd94e63d2f5d29f5b586d3d6",
-    "sha256": "1iwqa98ihzqqpqgwsj0lm4zkfwgag9k634sxjnx6gxvfq0h6d4nx"
+    "rev": "e6d37133affc71451129d84790c6c22227e64aff",
+    "sha256": "1bc1d0h2f1q0xfvr8p5fq1580bl8cs0qhdncm600v590z56cyika"
  },
  "qtdatavis3d": {
    "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
@ -36,8 +36,8 @@
  },
  "qtdeclarative": {
    "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "0e1bed3c3e27d44d86d6f68a8b93b96a4821575c",
-    "sha256": "0v4c3pls67ww6ffiscbp05yb2vv583zrxj8p4jcy3yxa06khniy5"
+    "rev": "039ce261b0f8061f8485f9c2eaf497a4d4395baa",
+    "sha256": "1kp2pnwfcwsxhy2w1sdg722d0kb1i6kx3a9r42gl1i9d73k8afi2"
  },
  "qtdoc": {
    "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@ -61,8 +61,8 @@
  },
  "qtlocation": {
    "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "2a8a48e9101236f118c2c4f0d79fae9c9d7b3f2a",
-    "sha256": "0ajvlqkm2641ahms34kg6a2hykvql1hxlm5nsaba7233hnfv3nsy"
+    "rev": "30fb93cf8521f2c0b3803903153d9034b7d7bcc2",
+    "sha256": "1b027hfc1m2nz0v906w08srmpyci3362arxc18cin334yhgghbx1"
  },
  "qtlottie": {
    "url": "https://invent.kde.org/qt/qt/qtlottie.git",
@ -101,8 +101,8 @@
  },
  "qtquickcontrols2": {
    "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "86a84eaa74c4071e5750f23b6e9911762880d391",
-    "sha256": "1zywq3ll49bzzvl6rzn4zpp96a4mdx0b9l5ic0x6zc4dr8c8jk5m"
+    "rev": "68a48018e34322edaf611639710b3edbe389e8c2",
+    "sha256": "04hswsamjmwgn63gs3rhxygvwjfqx5f0qifzp3gp6q4fw8lkgwpf"
  },
  "qtquicktimeline": {
    "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@ -146,8 +146,8 @@
  },
  "qtsvg": {
    "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "9b5ab29cbba1908fd4928e2bda2b93e418e36187",
-    "sha256": "0vnwhbkk40wj9rfy3fhjm9slra3y3j1mk67n3vnrzvmzrmpl4443"
+    "rev": "837b5163e17edbd3a9f098e9a1ab73febab419b4",
+    "sha256": "082i9q36d44g5a3jbw3ahvmmxikfai50wd2yq8xvkh8kr8xr7n5z"
  },
  "qttools": {
    "url": "https://invent.kde.org/qt/qt/qttools.git",
--- a/pkgs/development/libraries/sord/default.nix
+++ b/pkgs/development/libraries/sord/default.nix
@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
    hash = "sha256-S22Szpg6iXeana5t6EpbOtRstthgrJ4Z2cBrf7a9ZBk=";
  };

+  outputs = [ "out" "dev" "doc" "man" ];
+
  nativeBuildInputs = [
    doxygen
    meson
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@ -15,13 +15,13 @@ in

 stdenv.mkDerivation rec {
  pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.41.2";
+  version = "3.42.0";

  # nixpkgs-update: no auto update
  # NB! Make sure to update ./tools.nix src (in the same directory).
  src = fetchurl {
    url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-6YwQDdHaTjD6Rgdh2rfAuRpQt4XhZ/jFesxGUU+ulJk=";
+    hash = "sha256-erz9FhxuJ0LKXGwIldH4U8lA8gMwSgtJ2k4eyl0IjKY=";
  };

  outputs = [ "bin" "dev" "out" ];
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@ -4,12 +4,12 @@ let
  archiveVersion = import ./archive-version.nix lib;
  mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
    inherit pname;
-    version = "3.41.2";
+    version = "3.42.0";

    # nixpkgs-update: no auto update
    src = assert version == sqlite.version; fetchurl {
      url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-hxkfzsuLcH2aEO2xNgdoYxfXFpwIC5vcXTnQY1g3bMw=";
+      hash = "sha256-OMpWoxe+N/sAvZK8KA2bkgm9QAiyl9SDxB7B9geb+20=";
    };

    nativeBuildInputs = [ unzip ];
--- a/pkgs/development/libraries/tk/8.6.nix
+++ b/pkgs/development/libraries/tk/8.6.nix
@ -14,4 +14,8 @@ callPackage ./generic.nix (args // {
    sha256 = "sha256-LmX6BpojNlRAo8VsVWuGc7XjKig4ANjZslfj9YTOBnU=";
  };

+  patches = [
+    ./tk-8_6_13-find-library.patch
+  ];
+
 })
--- a/pkgs/development/libraries/tk/tk-8_6_13-find-library.patch
+++ b/pkgs/development/libraries/tk/tk-8_6_13-find-library.patch
@ -0,0 +1,25 @@
+diff --git a/generic/tkWindow.c b/generic/tkWindow.c
+index fa25553..ad45598 100644
+--- a/generic/tkWindow.c
+++ b/generic/tkWindow.c
+@@ -1045,6 +1045,7 @@ TkCreateMainWindow(
+ 
+     Tcl_SetVar2(interp, "tk_patchLevel", NULL, TK_PATCH_LEVEL, TCL_GLOBAL_ONLY);
+     Tcl_SetVar2(interp, "tk_version",    NULL, TK_VERSION,     TCL_GLOBAL_ONLY);
+    Tcl_SetVar2(interp, "tk_library",    NULL, TK_LIBRARY,     TCL_GLOBAL_ONLY);
+ 
+     tsdPtr->numMainWindows++;
+     return tkwin;
+diff --git a/unix/Makefile.in b/unix/Makefile.in
+index e98070e..f417753 100644
+--- a/unix/Makefile.in
+++ b/unix/Makefile.in
+@@ -1033,7 +1033,7 @@ tkVisual.o: $(GENERIC_DIR)/tkVisual.c
+ 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkVisual.c
+ 
+ tkWindow.o: $(GENERIC_DIR)/tkWindow.c tkUuid.h
+-	$(CC) -c $(CC_SWITCHES) -I. $(GENERIC_DIR)/tkWindow.c
+	$(CC) -c $(CC_SWITCHES) -I. -DTK_LIBRARY=\"${TK_LIBRARY}\" $(GENERIC_DIR)/tkWindow.c
+ 
+ tkButton.o: $(GENERIC_DIR)/tkButton.c
+ 	$(CC) -c $(CC_SWITCHES) $(GENERIC_DIR)/tkButton.c
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@ -40,6 +41,16 @@ stdenv.mkDerivation rec {
    sha256 = "+XLVCse6/czxE7HrmdyuNUBGhameVb/vFvOsg7Tel00=";
  };

+  patches = [
+    # Backport sqlite-3.42.0 compatibility:
+    #   https://gitlab.gnome.org/GNOME/tracker/-/merge_requests/600
+    (fetchpatch {
+      name = "sqlite-3.42.0.patch";
+      url = "https://gitlab.gnome.org/GNOME/tracker/-/commit/4cbbd1773a7367492fa3b3e3804839654e18a12a.patch";
+      hash = "sha256-w5D9I0P1DdyILhpjslh6ifojmlUiBoeFnxHPIr0rO3s=";
+    })
+  ];
+
  strictDeps = true;

  depsBuildBuild = [
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@ -3,38 +3,44 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+
+# build-system
 , setuptools
 , setuptools-scm
+
+# dependencies
+, exceptiongroup
 , idna
 , sniffio
-, typing-extensions
-, curio
+
+# optionals
+, trio
+
+# tests
 , hypothesis
-, mock
+, psutil
 , pytest-mock
 , pytest-xdist
 , pytestCheckHook
-, trio
 , trustme
 , uvloop
 }:

 buildPythonPackage rec {
  pname = "anyio";
-  version = "3.6.2";
+  version = "3.7.0";
  format = "pyproject";
+
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "agronholm";
    repo = pname;
    rev = version;
-    hash = "sha256-bootaulvx9zmobQGDirsMz5uxuLeCD9ggAvYkPaKnWo=";
+    hash = "sha256-uXPp2ycYl3T/ybZihDchImC/Yi4qgHI37ZeA+I6dg4c=";
  };

-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION=${version}
-  '';
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;

  nativeBuildInputs = [
    setuptools
@ -44,51 +50,52 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    idna
    sniffio
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    exceptiongroup
  ];

+  passthru.optional-dependencies = {
+    trio = [
+      trio
+    ];
+  };
+
  # trustme uses pyopenssl
  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);

  nativeCheckInputs = [
-    curio
    hypothesis
+    psutil
    pytest-mock
    pytest-xdist
    pytestCheckHook
-    trio
    trustme
+  ] ++ lib.optionals (pythonOlder "3.12") [
    uvloop
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    mock
-  ];
+  ] ++ passthru.optional-dependencies.trio;

  pytestFlagsArray = [
    "-W" "ignore::trio.TrioDeprecationWarning"
+    "-m" "'not network'"
  ];

  disabledTests = [
-    # block devices access
-    "test_is_block_device"
    # INTERNALERROR> AttributeError: 'NonBaseMultiError' object has no attribute '_exceptions'. Did you mean: 'exceptions'?
    "test_exception_group_children"
    "test_exception_group_host"
    "test_exception_group_filtering"
-    # regression in python 3.11.3 and 3.10.11
-    # https://github.com/agronholm/anyio/issues/550
-    "TestTLSStream"
-    "TestTLSListener"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # PermissionError: [Errno 1] Operation not permitted: '/dev/console'
+    "test_is_block_device"
  ];

  disabledTestPaths = [
    # lots of DNS lookups
    "tests/test_sockets.py"
-  ] ++ lib.optionals stdenv.isDarwin [
-    # darwin sandboxing limitations
-    "tests/streams/test_tls.py"
  ];

+  __darwinAllowLocalNetworking = true;
+
  pythonImportsCheck = [ "anyio" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff
+++ b/pkgs/development/python-modules/cffi/clang-pointer-substraction-warning.diff
@ -0,0 +1,11 @@
+diff -r c649a735cf82 testing/support.py
+--- a/testing/support.py	Thu Feb 23 05:42:01 2023 +0100
+++ b/testing/support.py	Sat May 20 21:46:56 2023 -0400
+@@ -112,6 +112,7 @@
+                               '-Wno-unreachable-code']
+         # special things for clang
+         extra_compile_args.append('-Qunused-arguments')
+        extra_compile_args.append('-Wno-null-pointer-subtraction')
+     else:
+         # assume a standard gcc
+         extra_compile_args = ['-Werror', '-Wall', '-Wextra', '-Wconversion',
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@ -50,6 +50,12 @@ if isPyPy then null else buildPythonPackage rec {
      ];
      hash = "sha256-+2daRTvxtyrCPimOEAmVbiVm1Bso9hxGbaAbd03E+ws=";
    })
+  ] ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc) "13") [
+    # -Wnull-pointer-subtraction is enabled with -Wextra. Suppress it to allow the following tests
+    # to run and pass when cffi is built with newer versions of clang:
+    # - testing/cffi1/test_verify1.py::test_enum_usage
+    # - testing/cffi1/test_verify1.py::test_named_pointer_as_argument
+    ./clang-pointer-substraction-warning.diff
  ] ++  lib.optionals (pythonAtLeast "3.11") [
    # Fix test that failed because python seems to have changed the exception format in the
    # final release. This patch should be included in the next version and can be removed when
--- a/pkgs/development/python-modules/flask/default.nix
+++ b/pkgs/development/python-modules/flask/default.nix
@ -19,12 +19,12 @@

 buildPythonPackage rec {
  pname = "flask";
-  version = "2.2.3";
+  version = "2.2.5";

  src = fetchPypi {
    pname = "Flask";
    inherit version;
-    hash = "sha256-frNzmEvxx3ACP86dsWTtDDNTzQtT8TD0aT2gynVqLm0=";
+    hash = "sha256-7e6bCn/yZiG9WowQ/0hK4oc3okENmbC7mmhQx/uXeqA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@ -73,6 +73,8 @@ buildPythonPackage rec {
    "poetry"
  ];

+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion";
+
  meta = with lib; {
    changelog = "https://github.com/python-poetry/poetry-core/blob/${src.rev}/CHANGELOG.md";
    description = "Core utilities for Poetry";
--- a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
+++ b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
@ -0,0 +1,51 @@
+From 1643ed0d8a9201732905bee51b096605d26aaaac Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Fri, 26 May 2023 00:10:45 -0400
+Subject: [PATCH] Fix test failures on Darwin on a case-sensitive fs
+
+This issue was encounetered while working on a contribution to nixpkgs.
+Nix allows the store to be installed on a separate, case-sensitive APFS
+volume. When the store is on a case-sensitive volume, these tests fail
+because they try to use `foundation` instead of `Foundation`.
+---
+ .../failing/78 framework dependency with version/meson.build    | 2 +-
+ test cases/objc/2 nsstring/meson.build                          | 2 +-
+ test cases/osx/6 multiframework/meson.build                     | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/test cases/failing/78 framework dependency with version/meson.build b/test cases/failing/78 framework dependency with version/meson.build
+index b7e04bab446..ee315ebcbd7 100644
+--- a/test cases/failing/78 framework dependency with version/meson.build	
+++ b/test cases/failing/78 framework dependency with version/meson.build	
+@@ -5,4 +5,4 @@ if host_machine.system() != 'darwin'
+ endif
+ 
+ # do individual frameworks have a meaningful version to test?  And multiple frameworks might be listed...
+-dep = dependency('appleframeworks', modules: 'foundation', version: '>0')
+dep = dependency('appleframeworks', modules: 'Foundation', version: '>0')
+diff --git a/test cases/objc/2 nsstring/meson.build b/test cases/objc/2 nsstring/meson.build
+index 94d2cf18ab4..2c483d50d68 100644
+--- a/test cases/objc/2 nsstring/meson.build	
+++ b/test cases/objc/2 nsstring/meson.build	
+@@ -1,7 +1,7 @@
+ project('nsstring', 'objc')
+ 
+ if host_machine.system() == 'darwin'
+-  dep = dependency('appleframeworks', modules : 'foundation')
+  dep = dependency('appleframeworks', modules : 'Foundation')
+ elif host_machine.system() == 'cygwin'
+   error('MESON_SKIP_TEST GNUstep is not packaged for Cygwin.')
+ else
+diff --git a/test cases/osx/6 multiframework/meson.build b/test cases/osx/6 multiframework/meson.build
+index 28846243b21..57e5d61560b 100644
+--- a/test cases/osx/6 multiframework/meson.build	
+++ b/test cases/osx/6 multiframework/meson.build	
+@@ -4,7 +4,7 @@ project('multiframework', 'objc')
+ # that causes a build failure when defining two modules. The
+ # arguments for the latter module overwrote the arguments for
+ # the first one rather than adding to them.
+-cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'foundation'])
+cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'Foundation'])
+ 
+ executable('deptester',
+   'main.m',
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@ -26,6 +26,10 @@ python3.pkgs.buildPythonApplication rec {
  };

  patches = [
+    # Fix Meson tests that fail when the Nix store is case-sensitive APFS.
+    # https://github.com/mesonbuild/meson/pull/11820
+    ./darwin-case-sensitive-fs.patch
+
    # Meson is currently inspecting fewer variables than autoconf does, which
    # makes it harder for us to use setup hooks, etc.  Taken from
    # https://github.com/mesonbuild/meson/pull/6827
--- a/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch
+++ b/pkgs/development/tools/misc/binutils/CVE-2023-1972.patch
@ -0,0 +1,23 @@
+diff --git a/bfd/elf.c b/bfd/elf.c
+index 027d0143735..185028cbd97 100644
+--- a/bfd/elf.c
+++ b/bfd/elf.c
+@@ -9030,6 +9030,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return_verdef;
+ 	}
+
+      if (amt == 0)
+	goto error_return_verdef;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return_verdef;
+@@ -9133,6 +9136,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
+ 	  bfd_set_error (bfd_error_file_too_big);
+ 	  goto error_return;
+ 	}
+      if (amt == 0)
+	goto error_return;
+       elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
+       if (elf_tdata (abfd)->verdef == NULL)
+ 	goto error_return;
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@ -88,6 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
    # not need to know binutils' BINDIR at all. It's an absolute path
    # where libraries are stored.
    ./plugins-no-BINDIR.patch
+
+    # CVE-2023-1972 fix to bfd/elf.c from:
+    # https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57
+    ./CVE-2023-1972.patch
  ]
  ++ lib.optional targetPlatform.isiOS ./support-ios.patch
  # Adds AVR-specific options to "size" for compatibility with Atmel's downstream distribution
--- a/pkgs/development/tools/misc/gperf/default.nix
+++ b/pkgs/development/tools/misc/gperf/default.nix
@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
    sha256 = "1qispg6i508rq8pkajh26cznwimbnj06wq9sd85vg95v8nwld1aq";
  };

+  patches = [
+    # Clang 16 defaults to C++17, which does not allow `register` as a storage class specifier.
+    ./gperf-c++17-register-fix.patch
+  ];
+
  enableParallelBuilding = true;

  meta = {
--- a/pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch
+++ b/pkgs/development/tools/misc/gperf/gperf-c++17-register-fix.patch
@ -0,0 +1,13 @@
+diff --git a/lib/getline.cc b/lib/getline.cc
+index c57c633..0984a7c 100644
+--- a/lib/getline.cc
+++ b/lib/getline.cc
+@@ -55,7 +55,7 @@ getstr (char **lineptr, size_t *n, FILE *stream, char terminator, size_t offset)
+ 
+   for (;;)
+     {
+-      register int c = getc (stream);
+      int c = getc (stream);
+ 
+       /* We always want at least one char left in the buffer, since we
+          always (unless we get an error while reading the first char)
--- a/pkgs/development/tools/misc/pkg-config/default.nix
+++ b/pkgs/development/tools/misc/pkg-config/default.nix
@ -35,6 +35,9 @@ stdenv.mkDerivation rec {
         "ac_cv_func_posix_getgrgid_r=yes"
       ];

+  # Silence "incompatible integer to pointer conversion passing 'gsize'" when building with Clang.
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-int-conversion";
+
  enableParallelBuilding = true;
  doCheck = true;

--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "cups";
-  version = "2.4.2";
+  version = "2.4.3";

  src = fetchurl {
    url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "sha256-8DzLQLCH0eMJQKQOAUHcu6Jj85l0wg658lIQZsnGyQg=";
+    sha256 = "sha256-nd65jyDpyfSvEhwrEFPnQgt5vWdw8a3tKGYwPSdSb28=";
  };

  outputs = [ "out" "lib" "dev" "man" ];
@ -134,7 +134,12 @@ stdenv.mkDerivation rec {
        --replace "Exec=htmlview" "Exec=xdg-open"
    '';

-  passthru.tests.nixos = nixosTests.printing;
+  passthru.tests = {
+    inherit (nixosTests)
+      printing-service
+      printing-socket
+    ;
+  };

  meta = with lib; {
    homepage = "https://openprinting.github.io/cups/";
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
@ -32,6 +32,9 @@ in appleDerivation {

    substituteInPlace Makefile --replace perl true

+    substituteInPlace colldef.tproj/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
+
    for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
      substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
        --replace /usr/share/locale "" \
@ -42,6 +45,10 @@ in appleDerivation {

  preBuild = ''
    cp -r --no-preserve=all ${recentAdvCmds}/colldef .
+
+    substituteInPlace colldef/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
+
    pushd colldef
    mv locale/collate.h .
    flex -t -8 -i scan.l > scan.c
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@ -6,6 +6,8 @@ appleDerivation {
  patchPhase = ''
    substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
      --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
+    substituteInPlace colldef/scan.l \
+      --replace 'static orderpass = 0;' 'static int orderpass = 0;'
  '';

  # pkill requires special private headers that are unavailable in
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@ -34,7 +34,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
      --replace "-Werror " ""

    substituteInPlace SETUP/kextsymboltool/Makefile \
-      --replace "-lstdc++" "-lc++"
+      --replace "-lstdc++" "-lc++ -lc++abi"

    substituteInPlace libsyscall/xcodescripts/mach_install_mig.sh \
      --replace "/usr/include" "/include" \
--- a/pkgs/os-specific/darwin/rewrite-tbd/default.nix
+++ b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkg-config, libyaml }:
+{ stdenv, lib, fetchFromGitHub, libyaml }:

 stdenv.mkDerivation {
  pname = "rewrite-tbd";
@ -11,9 +11,17 @@ stdenv.mkDerivation {
    sha256 = "08sk91zwj6n9x2ymwid2k7y0rwv5b7p6h1b25ipx1dv0i43p6v1a";
  };

-  nativeBuildInputs = [ cmake pkg-config ];
+  # Nix takes care of these paths. Avoiding the use of `pkg-config` prevents an infinite recursion.
+  postPatch = ''
+    substituteInPlace Makefile.boot \
+      --replace '$(shell pkg-config --cflags yaml-0.1)' "" \
+      --replace '$(shell pkg-config --libs yaml-0.1)' "-lyaml"
+  '';
+
  buildInputs = [ libyaml ];

+  makeFlags = [ "-f" "Makefile.boot" "PREFIX=${placeholder "out"}"];
+
  meta = with lib; {
    homepage = "https://github.com/thefloweringash/rewrite-tbd/";
    description = "Rewrite filepath in .tbd to Nix applicable format";
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@ -22,7 +22,7 @@
 }:

 let
-  apparmor-version = "3.1.3";
+  apparmor-version = "3.1.4";

  apparmor-meta = component: with lib; {
    homepage = "https://apparmor.net/";
@ -36,7 +36,7 @@ let
    owner = "apparmor";
    repo = "apparmor";
    rev = "v${apparmor-version}";
-    hash = "sha256-6N1BStOXKui6BxSriWVoOkvyGRUJ4btsloHh/SsG/JE=";
+    hash = "sha256-YWPdIUd+2x74tqiW+YX8NKh3jxSKhD+5zdiDMjhPzpE=";
  };

  aa-teardown = writeShellScript "aa-teardown" ''
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@ -7,14 +7,14 @@

 stdenv.mkDerivation rec {
  pname = "ell";
-  version = "0.56";
+  version = "0.57";

  outputs = [ "out" "dev" ];

  src = fetchgit {
    url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
    rev = version;
-    sha256 = "sha256-aCQ7I4XgxswQRfzzZG3MYe+W3dPWWex5MErMc0ZilSA=";
+    sha256 = "sha256-9d9WMCByQ1TKWpzWe5msts1LG+BKKqwCgaMBbD74/+4=";
  };

  nativeBuildInputs = [
--- a/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch
+++ b/pkgs/os-specific/linux/kernel/fix-em-ice-bonding.patch
@ -1,87 +0,0 @@
-From 1640688018f329559c61352646f283f98938af31 Mon Sep 17 00:00:00 2001
-From: Cole Helbling <cole.helbling@determinate.systems>
-Date: Thu, 16 Feb 2023 09:30:21 -0800
-Subject: [PATCH] Revert "RDMA/irdma: Report the correct link speed"
-
-This reverts commit 425c9bd06b7a70796d880828d15c11321bdfb76d.
-
-Some Equinix Metal instances, such as a3.large.x86, m3.large.x86
-(specific hardware revisions), and n3.large.x86, use the `ice` kernel
-driver for their network cards, in conjunction with bonded devices.
-However, this commit caused a regression where these bonded devices
-would deadlock. This was initially reported by Jaroslav Pulchart on
-the netdev mailing list[1], and there were follow-up patches from Dave
-Ertman[2][3] that attempted to fix this but were not up to snuff for
-various reasons[4].
-
-Specifically, v2 of the patch ([3]) appears to fix the issue on some
-devices (tested with 8086:159B network cards), while it is still broken
-on others (such as an 8086:1593 network card).
-
-We revert the patch exposing the issue until upstream has a working
-solution in order to make Equinix Metal instances work reliably again.
-
-[1]: https://lore.kernel.org/netdev/CAK8fFZ6A_Gphw_3-QMGKEFQk=sfCw1Qmq0TVZK3rtAi7vb621A@mail.gmail.com/
-[2]: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230111183145.1497367-1-david.m.ertman@intel.com/
-[3]: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20230215191757.1826508-1-david.m.ertman@intel.com/
-[4]: https://lore.kernel.org/netdev/cb31a911-ba80-e2dc-231f-851757cfd0b8@intel.com/T/#m6e53f8c43093693c10268140126abe99e082dc1c
---
- drivers/infiniband/hw/irdma/verbs.c | 35 ++++++++++++++++++++++++++---
- 1 file changed, 32 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
-index c5971a840b87..911902d2b93e 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
-+++ b/drivers/infiniband/hw/irdma/verbs.c
-@@ -60,6 +60,36 @@ static int irdma_query_device(struct ib_device *ibdev,
- 	return 0;
- }
- 
-+/**
-+ * irdma_get_eth_speed_and_width - Get IB port speed and width from netdev speed
-+ * @link_speed: netdev phy link speed
-+ * @active_speed: IB port speed
-+ * @active_width: IB port width
-+ */
-+static void irdma_get_eth_speed_and_width(u32 link_speed, u16 *active_speed,
-+					  u8 *active_width)
-+{
-+	if (link_speed <= SPEED_1000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_SDR;
-+	} else if (link_speed <= SPEED_10000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_FDR10;
-+	} else if (link_speed <= SPEED_20000) {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_DDR;
-+	} else if (link_speed <= SPEED_25000) {
-+		*active_width = IB_WIDTH_1X;
-+		*active_speed = IB_SPEED_EDR;
-+	} else if (link_speed <= SPEED_40000) {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_FDR10;
-+	} else {
-+		*active_width = IB_WIDTH_4X;
-+		*active_speed = IB_SPEED_EDR;
-+	}
-+}
-+
- /**
-  * irdma_query_port - get port attributes
-  * @ibdev: device pointer from stack
-@@ -87,9 +117,8 @@ static int irdma_query_port(struct ib_device *ibdev, u32 port,
- 		props->state = IB_PORT_DOWN;
- 		props->phys_state = IB_PORT_PHYS_STATE_DISABLED;
- 	}
-
-	ib_get_eth_speed(ibdev, port, &props->active_speed,
-			 &props->active_width);
-+	irdma_get_eth_speed_and_width(SPEED_100000, &props->active_speed,
-+				      &props->active_width);
- 
- 	if (rdma_protocol_roce(ibdev, 1)) {
- 		props->gid_tbl_len = 32;
-- 
-2.39.0
-
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@ -58,11 +58,6 @@
    patch = ./export-rt-sched-migrate.patch;
  };

-  fix-em-ice-bonding = {
-    name = "fix-em-ice-bonding";
-    patch = ./fix-em-ice-bonding.patch;
-  };
-
  CVE-2023-32233 = rec {
    name = "CVE-2023-32233";
    patch = fetchpatch {
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
  };

+  outputs = [ "out" "dev" "man" ];
+
  configureFlags = [
    "--without-python"
  ];
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -190,6 +190,16 @@ stdenv.mkDerivation (finalAttrs: {
    ./0017-inherit-systemd-environment-when-calling-generators.patch
    ./0018-core-don-t-taint-on-unmerged-usr.patch
    ./0019-tpm2_context_init-fix-driver-name-checking.patch
+
+    (fetchpatch {
+      # https://github.com/systemd/systemd/pull/25948
+      #
+      # [Firmware file size bug]: Some UEFI firmwares fail on large
+      # reads. Now that systemd-boot loads initrd itself, systems with
+      # such firmware won't boot without this fix
+      url = "https://github.com/systemd/systemd/commit/3ed1d966f00b002ed822ca9de116252bd91fe6c3.patch";
+      hash = "sha256-pwXrLTScqgnvfddlzUBZpwsoMrvRLcZPp6e4whMcyL4=";
+    })
  ] ++ lib.optional stdenv.hostPlatform.isMusl (
    let
      oe-core = fetchzip {
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, zlib, shadow
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, zlib, shadow
 , capabilitiesSupport ? stdenv.isLinux
 , libcap_ng
 , libxcrypt
@ -28,6 +28,16 @@ stdenv.mkDerivation rec {

  patches = [
    ./rtcwake-search-PATH-for-shutdown.patch
+
+    # FIXME: backport mount fixes for older kernels, remove in next release
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/f94a7760ed7ce81389a6059f020238981627a70d.diff";
+      hash = "sha256-UorqDeECK8pBePkmpo2x90p/jP3rCMshyPCyijSX1wo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/util-linux/util-linux/commit/1bd85b64632280d6bf0e86b4ff29da8b19321c5f.diff";
+      hash = "sha256-dgu4de5ul/si7Vzwe8lr9NvsdI1CWfDQKuqvARaY6sE=";
+    })
  ];

  outputs = [ "bin" "dev" "out" "lib" "man" ];
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@ -29,13 +29,23 @@ if [ -n "$__structuredAttrs" ]; then
        export "$outputName=${outputs[$outputName]}"
    done

+    # Before Nix 2.4, $NIX_ATTRS_*_FILE was named differently:
+    # https://github.com/NixOS/nix/commit/27ce722
+    if [[ -n "${ATTRS_JSON_FILE:-}" ]]; then
+        export NIX_ATTRS_JSON_FILE="$ATTRS_JSON_FILE"
+    fi
+
+    if [[ -n "${ATTRS_SH_FILE:-}" ]]; then
+        export NIX_ATTRS_SH_FILE="$ATTRS_SH_FILE"
+    fi
+
    # $NIX_ATTRS_JSON_FILE pointed to the wrong location in sandbox
    # https://github.com/NixOS/nix/issues/6736; please keep around until the
    # fix reaches *every patch version* that's >= lib/minver.nix
-    if ! [[ -e "$NIX_ATTRS_JSON_FILE" ]]; then
+    if ! [[ -e "${NIX_ATTRS_JSON_FILE:-}" ]]; then
        export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
    fi
-    if ! [[ -e "$NIX_ATTRS_SH_FILE" ]]; then
+    if ! [[ -e "${NIX_ATTRS_SH_FILE:-}" ]]; then
        export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
    fi
 else
--- a/pkgs/tools/compression/lz4/default.nix
+++ b/pkgs/tools/compression/lz4/default.nix
@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
  ]
    # TODO make full dictionary
    ++ lib.optional stdenv.hostPlatform.isMinGW "TARGET_OS=MINGW"
+    ++ lib.optional stdenv.hostPlatform.isLinux "TARGET_OS=Linux"
    ;

  doCheck = false; # tests take a very long time
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@ -10,7 +10,6 @@
 , fontconfig
 , gd
 , gts
-, libdevil
 , libjpeg
 , libpng
 , libtool
@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
    fontconfig
    gd
    gts
-    libdevil
    pango
    bash
  ] ++ optionals withXorg (with xorg; [ libXrender libXaw libXpm ])
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@ -32,18 +32,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "coreutils" + (optionalString (!minimal) "-full");
-  version = "9.1";
+  version = "9.3";

  src = fetchurl {
    url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz";
-    sha256 = "sha256-YaH0ENeLp+fzelpPUObRMgrKMzdUhKMlXt3xejhYBCM=";
+    hash = "sha256-rbz8/omSNbceh2jc8HzVMlILf1T5qAZIQ/jRmakEu6o=";
  };

-  patches = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
-    # Workaround for https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51433
-    ./disable-seek-hole.patch
-  ];
-
  postPatch = ''
    # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems.
    sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh
--- a/pkgs/tools/misc/coreutils/disable-seek-hole.patch
+++ b/pkgs/tools/misc/coreutils/disable-seek-hole.patch
@ -1,43 +0,0 @@
-diff --git a/src/copy.c b/src/copy.c
-index cb9018f93..2a4ccc061 100644
--- a/src/copy.c
-+++ b/src/copy.c
-@@ -502,7 +502,7 @@ write_zeros (int fd, off_t n_bytes)
-   return true;
- }
-
-#ifdef SEEK_HOLE
-+#if 0
- /* Perform an efficient extent copy, if possible.  This avoids
-    the overhead of detecting holes in hole-introducing/preserving
-    copy, and thus makes copying sparse files much more efficient.
-@@ -1095,7 +1095,7 @@ infer_scantype (int fd, struct stat const *sb,
-          && ST_NBLOCKS (*sb) < sb->st_size / ST_NBLOCKSIZE))
-     return PLAIN_SCANTYPE;
-
-#ifdef SEEK_HOLE
-+#if 0
-   scan_inference->ext_start = lseek (fd, 0, SEEK_DATA);
-   if (0 <= scan_inference->ext_start)
-     return LSEEK_SCANTYPE;
-@@ -1377,7 +1377,7 @@ copy_reg (char const *src_name, char const *dst_name,
-       off_t n_read;
-       bool wrote_hole_at_eof = false;
-       if (! (
-#ifdef SEEK_HOLE
-+#if 0
-              scantype == LSEEK_SCANTYPE
-              ? lseek_copy (source_desc, dest_desc, buf, buf_size, hole_size,
-                            scan_inference.ext_start, src_open_sb.st_size,
-diff --git a/tests/seek-data-capable b/tests/seek-data-capable
-index cc6372214..6e7a9ec1e 100644
--- a/tests/seek-data-capable
-+++ b/tests/seek-data-capable
-@@ -1,5 +1,7 @@
- import sys, os, errno, platform
-
-+sys.exit(1)
-+
- # Pass an _empty_ file
- if len(sys.argv) != 2:
-     sys.exit(1)
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@ -5,10 +5,10 @@ let
  };
 in rec {
  openconnect = common rec {
-    version = "9.01";
+    version = "9.12";
    src = fetchurl {
      url = "ftp://ftp.infradead.org/pub/openconnect/openconnect-${version}.tar.gz";
-      sha256 = "sha256-s9f6+DDpeTKZ1qQegdhM1KPieJwUjJ5ZjkWFAQCQ5Mc=";
+      sha256 = "sha256-or7c46pN/nXjbkB+SOjovJHUbe9TNayVZPv5G9SyQT4=";
    };
  };

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7303,7 +7303,7 @@ with pkgs;
  easeprobe = callPackage ../tools/misc/easeprobe { };

  emscripten = callPackage ../development/compilers/emscripten {
-    llvmPackages = llvmPackages_14;
+    llvmPackages = llvmPackages_16;
  };

  emscriptenPackages = recurseIntoAttrs (callPackage ./emscripten-packages.nix { });
@ -8230,7 +8230,6 @@ with pkgs;
  graphviz-nox = callPackage ../tools/graphics/graphviz {
    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
    withXorg = false;
-    libdevil = libdevil-nox;
  };

  grass-sass = callPackage ../tools/misc/grass-sass { };
@ -23046,17 +23045,10 @@ with pkgs;
  # Default libGLU
  libGLU = mesa_glu;

-  # Keep Mesa 22.3 for now because 23.0 does not build on Darwin.
-  # FIXME: remove, also investigate why we even need Mesa on Darwin.
-  mesa_22_3 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/22.3.nix {
+  mesa = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa {
    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
    inherit (darwin.apple_sdk_11_0.libs) Xplugin;
  };
-  mesa_23_0 = darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/23.0.nix {
-    inherit (darwin.apple_sdk_11_0.frameworks) OpenGL;
-    inherit (darwin.apple_sdk_11_0.libs) Xplugin;
-  };
-  mesa = if stdenv.isDarwin then mesa_22_3 else mesa_23_0;

  mesa_glu =  callPackage ../development/libraries/mesa-glu {
    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@ -66,7 +66,10 @@ rec {
        echo "Compiling a custom test"
        set -x
        emcc -O2 -s EMULATE_FUNCTION_POINTER_CASTS=1 xmllint.o \
-        ./.libs/libxml2.a `pkg-config zlib --cflags` `pkg-config zlib --libs` -o ./xmllint.test.js \
+        ./.libs/''
+      + pkgs.lib.optionalString pkgs.stdenv.isDarwin "libxml2.dylib "
+      + pkgs.lib.optionalString (!pkgs.stdenv.isDarwin) "libxml2.a "
+      + '' `pkg-config zlib --cflags` `pkg-config zlib --libs` -o ./xmllint.test.js \
        --embed-file ./test/xmlid/id_err1.xml

        echo "Using node to execute the test which basically outputs an error on stderr which we grep for"
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@ -154,7 +154,6 @@ in {
      kernelPatches = [
        kernelPatches.bridge_stp_helper
        kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
      ];
    };

@ -170,7 +169,6 @@ in {
      kernelPatches = [
        kernelPatches.bridge_stp_helper
        kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
      ];
    };

@ -178,7 +176,6 @@ in {
      kernelPatches = [
        kernelPatches.bridge_stp_helper
        kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
        kernelPatches.export-rt-sched-migrate
      ];
    };
@ -187,7 +184,6 @@ in {
      kernelPatches = [
        kernelPatches.bridge_stp_helper
        kernelPatches.request_key_helper
-        kernelPatches.fix-em-ice-bonding
      ];
    };

--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@ -89,7 +89,7 @@ with import ./release-lib.nix { inherit supportedSystems nixpkgsArgs; };
  man-pages = linux;
  mc = all;
  mdadm = linux;
-  mesa = mesaPlatforms;
+  mesa = linux;
  mingetty = linux;
  mktemp = all;
  monotone = linux;