staging-next 2025-03-13 (#389579)

2025-06-09 19:13:26 +03:00 · 2025-03-22 17:39:24 +01:00 · 2025-03-22 17:39:24 +01:00 · 3fcae17eab
commit 3fcae17eab
parent 8338df11c2 7233659eaf
366 changed files with 2126 additions and 2092 deletions
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -231,6 +231,9 @@

 - `services.cloudflare-dyndns.apiTokenFile` now must be just your Cloudflare api token. Previously it was supposed to be a file of the form `CLOUDFLARE_API_TOKEN=...`.

+- Emacs lisp build helpers, such as `emacs.pkgs.melpaBuild`, now enables `__structuredAttrs` by default.
+  Environment variables have to be passed via the `env` attribute.
+
 - `buildGoModule` now passes environment variables via the `env` attribute. `CGO_ENABLED` should now be specified with `env.CGO_ENABLED` when passing to buildGoModule. Direct specification of `CGO_ENABLED` is now redirected by a compatibility layer with a warning, but will become an error in future releases.

  Go-related environment variables previously shadowed by `buildGoModule` now results in errors when specified directly. Such variables include `GOOS` and `GOARCH`.
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@ -102,10 +102,10 @@ with lib;
        stdenv
        stdenvNoCC # for runCommand
        busybox
-        jq # for closureInfo
        # For boot.initrd.systemd
        makeInitrdNGTool
-      ];
+      ]
+      ++ jq.all; # for closureInfo

    boot.swraid.enable = true;
    # remove warning about unset mail
--- a/pkgs/applications/audio/cdparanoia/default.nix
+++ b/pkgs/applications/audio/cdparanoia/default.nix
@ -5,6 +5,7 @@
  fetchpatch,
  updateAutotoolsGnuConfigScriptsHook,
  autoreconfHook,
+  freebsd,
 }:

 stdenv.mkDerivation rec {
@ -37,7 +38,7 @@ stdenv.mkDerivation rec {
      })
    ]
    ++ [
-      # Has to come after darwin patches
+      # Has to come after darwin patches and before freebsd patches
      ./fix_private_keyword.patch
      # Order does not matter
      ./configure.patch
@ -62,13 +63,98 @@ stdenv.mkDerivation rec {
        hash = "sha256-krfprwls0L3hsNfoj2j69J5k1RTKEQtzE0fLYG9EJKo=";
      })
    ]
-    ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch;
+    ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
+    ++ [
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_low__interface.h";
+        hash = "sha256-bXrcRFCbU7/7/N+J8VGKGSxIB1m8XwoAlc/KTnt9wN0=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_scan__devices.c";
+        hash = "sha256-UD7SXeypF3bAqT7Y24UOrGZNaD8ZmpS2V7XQU+3VKXk=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<private\>/private_data/g' $out
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_cdda__interface.h";
+        hash = "sha256-JL4qe4LwmNp2jQFqTvyRjc6bixGqYr6BZmqsYIY9xhw=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_common__interface.c";
+        hash = "sha256-vw0oFM6w15YBaAK01FwVcSN+oztSfo5jL6OlGy0iWBg=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_cooked__interface.c";
+        hash = "sha256-g39dhxb8+K9BIb2/5cmkQ9GYjg4gDjj6sv+dXx93kQ4=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_interface.c";
+        hash = "sha256-LMWfbqLjbQM3L4H3orAxyyAHf1hVtFwfmZY8NmBLKzs=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<private\>/private_data/g' $out
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_scsi__interface.c";
+        hash = "sha256-dx6YCWW8J0e455phaYDUMiOCvp4DsfINjSEiEfnHaNI=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<private\>/private_data/g' $out
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-Makefile.in";
+        hash = "sha256-Wje2d58xrSWHJNktQRHcNSbh5yh6vMtpgc/3G4D1vrI=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+    ];

  nativeBuildInputs = [
    updateAutotoolsGnuConfigScriptsHook
    autoreconfHook
  ];

+  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isFreeBSD [
+    # cdparanoia shipped headers have #include <libcam.h>
+    # (it is part of the freebsd base system so this is reasonable
+    # but we want to keep the default freebsd libs, freebsd.libc, small)
+    freebsd.libcam
+  ];
+
+  env =
+    lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+      NIX_LDFLAGS = "-lcam";
+    }
+    // {
+      BSD_INSTALL_PROGRAM = "install";
+      BSD_INSTALL_LIB = "install";
+    };
+
  # Build system reuses the same object file names for shared and static
  # library. Occasionally fails in the middle:
  #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c
--- a/pkgs/applications/editors/emacs/build-support/generic.nix
+++ b/pkgs/applications/editors/emacs/build-support/generic.nix
@ -61,6 +61,7 @@ lib.extendMkDerivation {
      propagatedUserEnvPkgs = finalAttrs.packageRequires ++ propagatedUserEnvPkgs;

      strictDeps = args.strictDeps or true;
+      __structuredAttrs = args.__structuredAttrs or true;

      inherit turnCompilationWarningToError ignoreCompilationError;

--- a/pkgs/applications/misc/sl1-to-photon/default.nix
+++ b/pkgs/applications/misc/sl1-to-photon/default.nix
@ -31,7 +31,6 @@ buildPythonApplication rec {
  ];

  format = "setuptools";
-  dontUseSetuptoolsCheck = true;

  installPhase = ''
    install -D -m 0755 SL1_to_Photon.py $out/bin/${pname}
--- a/pkgs/applications/version-management/sourcehut/core.nix
+++ b/pkgs/applications/version-management/sourcehut/core.nix
@ -83,7 +83,6 @@ buildPythonPackage rec {

  PKGVER = version;

-  dontUseSetuptoolsCheck = true;
  pythonImportsCheck = [ "srht" ];

  meta = with lib; {
--- a/pkgs/applications/version-management/sourcehut/scm.nix
+++ b/pkgs/applications/version-management/sourcehut/scm.nix
@ -37,8 +37,6 @@ buildPythonPackage rec {
    export PKGVER=${version}
  '';

-  dontUseSetuptoolsCheck = true;
-
  pythonImportsCheck = [ "scmsrht" ];

  meta = with lib; {
--- a/pkgs/applications/version-management/sourcehut/todo.nix
+++ b/pkgs/applications/version-management/sourcehut/todo.nix
@ -72,8 +72,6 @@ buildPythonPackage rec {
    pytest
    factory-boy
  ];
-
-  dontUseSetuptoolsCheck = true;
  pythonImportsCheck = [ "todosrht" ];

  meta = with lib; {
--- a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
+++ b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
@ -1,15 +1,35 @@
 needsTarget=true
+targetValue=""
+
+declare -i n=0
+nParams=${#params[@]}
+while (("$n" < "$nParams")); do
+    p=${params[n]}
+    v=${params[n + 1]:-} # handle `p` being last one
+    n+=1

-for p in "${params[@]}"; do
    case "$p" in
-    -target | --target=*)
+    -target)
+        if [ -z "$v" ]; then
+            echo "Error: -target requires an argument" >&2
+            exit 1
+        fi
        needsTarget=false
-
-        echo "Warning: supplying the --target argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead." >&2
+        targetValue=$v
+        # skip parsing the value of -target
+        n+=1
+        ;;
+    --target=*)
+        needsTarget=false
+        targetValue="${p#*=}"
        ;;
    esac
 done

+if ! $needsTarget && [[ "$targetValue" != "@defaultTarget@" ]]; then
+    echo "Warning: supplying the --target $targetValue != @defaultTarget@ argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead." >&2
+fi
+
 if $needsTarget && [[ $0 != *cpp ]]; then
    extraBefore+=(-target @defaultTarget@ @machineFlags@)
 fi
--- a/pkgs/build-support/kernel/make-initrd.nix
+++ b/pkgs/build-support/kernel/make-initrd.nix
@ -20,7 +20,6 @@ let
 in
 {
  stdenvNoCC,
-  perl,
  cpio,
  ubootTools,
  lib,
@ -101,7 +100,6 @@ stdenvNoCC.mkDerivation (
    builder = ./make-initrd.sh;

    nativeBuildInputs = [
-      perl
      cpio
    ] ++ lib.optional makeUInitrd ubootTools;

@ -121,14 +119,7 @@ stdenvNoCC.mkDerivation (
    symlinks = map (x: x.symlink) contents;
    suffices = map (x: if x ? suffix then x.suffix else "none") contents;

-    # For obtaining the closure of `contents'.
-    # Note: we don't use closureInfo yet, as that won't build with nix-1.x.
-    # See #36268.
-    exportReferencesGraph = lib.zipListsWith (x: i: [
-      ("closure-${toValidStoreName (baseNameOf x.symlink)}-${toString i}")
-      x.object
-    ]) contents (lib.range 0 (lib.length contents - 1));
-    pathsFromGraph = ./paths-from-graph.pl;
+    closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = objects; }}";
  }
  // lib.optionalAttrs makeUInitrd {
    uInitrdCompression = uInitrdCompression;
--- a/pkgs/build-support/kernel/make-initrd.sh
+++ b/pkgs/build-support/kernel/make-initrd.sh
@ -24,7 +24,7 @@ done


 # Get the paths in the closure of `object'.
-storePaths=$(perl $pathsFromGraph closure-*)
+storePaths="$(cat $closureInfo/store-paths)"


 # Paths in cpio archives *must* be relative, otherwise the kernel
--- a/pkgs/build-support/kernel/paths-from-graph.pl
+++ b/pkgs/build-support/kernel/paths-from-graph.pl
@ -1,68 +0,0 @@
-# NOTE: this script is deprecated. Use closureInfo instead.
-
-# Parses a /nix/store/*-closure file and prints
-# various information.
-# By default, the nodes in the graph are printed to stdout.
-# If printRegistration is set, then the graph is written
-# as a registration file for a manifest is written
-# in the `nix-store --load-db' format.
-
-use strict;
-use File::Basename;
-
-my %storePaths;
-my %refs;
-
-# Each argument on the command line is a graph file.
-# The graph file contains line-triples and a variable
-# number of references:
-# <store-path>
-# <deriver>
-# <count>
-# <ref-#1>
-# ...
-# <ref-#count>
-foreach my $graph (@ARGV) {
-    open GRAPH, "<$graph" or die;
-
-    while (<GRAPH>) {
-        chomp;
-        my $storePath = "$_";
-        $storePaths{$storePath} = 1;
-
-        my $deriver = <GRAPH>; chomp $deriver;
-        my $count = <GRAPH>; chomp $count;
-
-        my @refs = ();
-        for (my $i = 0; $i < $count; ++$i) {
-            my $ref = <GRAPH>; chomp $ref;
-            push @refs, $ref;
-        }
-        $refs{$storePath} = \@refs;
-        
-    }
-    
-    close GRAPH;
-}
-
-
-if ($ENV{"printRegistration"} eq "1") {
-    # This is the format used by `nix-store --register-validity
-    # --hash-given' / `nix-store --load-db'.
-    foreach my $storePath (sort (keys %storePaths)) {
-        print "$storePath\n";
-        print "0000000000000000000000000000000000000000000000000000000000000000\n"; # !!! fix
-        print "0\n"; # !!! fix	
-        print "\n"; # don't care about preserving the deriver
-        print scalar(@{$refs{$storePath}}), "\n";
-        foreach my $ref (@{$refs{$storePath}}) {
-            print "$ref\n";
-        }
-    }
-}
-
-else {
-    foreach my $storePath (sort (keys %storePaths)) {
-        print "$storePath\n";
-    }
-}
--- a/pkgs/build-support/rust/hooks/cargo-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-build-hook.sh
@ -38,7 +38,7 @@ cargoBuildHook() {
    concatTo flagsArray cargoBuildFlags

    echoCmd 'cargoBuildHook flags' "${flagsArray[@]}"
-    cargo build "${flagsArray[@]}"
+    @setEnv@ cargo build "${flagsArray[@]}"

    if [ -n "${buildAndTestSubdir-}" ]; then
        popd
--- a/pkgs/build-support/rust/hooks/cargo-check-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-check-hook.sh
@ -37,7 +37,7 @@ cargoCheckHook() {
    concatTo flagsArray cargoTestFlags checkFlags checkFlagsArray

    echoCmd 'cargoCheckHook flags' "${flagsArray[@]}"
-    cargo test "${flagsArray[@]}"
+    @setEnv@ cargo test "${flagsArray[@]}"

    if [[ -n "${buildAndTestSubdir-}" ]]; then
        popd
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@ -27,6 +27,8 @@
      name = "cargo-build-hook.sh";
      substitutions = {
        inherit (stdenv.targetPlatform.rust) rustcTarget;
+        inherit (rust.envVars) setEnv;
+
      };
      passthru.tests =
        {
@ -44,6 +46,7 @@
      name = "cargo-check-hook.sh";
      substitutions = {
        inherit (stdenv.targetPlatform.rust) rustcTarget;
+        inherit (rust.envVars) setEnv;
      };
      passthru.tests =
        {
@ -136,6 +139,8 @@
      ];
      substitutions = {
        inherit (stdenv.targetPlatform.rust) rustcTarget;
+        inherit (rust.envVars) setEnv;
+
      };
    } ./maturin-build-hook.sh
  ) { };
--- a/pkgs/build-support/rust/hooks/maturin-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
@ -31,7 +31,7 @@ maturinBuildHook() {
    concatTo flagsArray maturinBuildFlags

    echoCmd 'maturinBuildHook flags' "${flagsArray[@]}"
-    maturin build "${flagsArray[@]}"
+    @setEnv@ maturin build "${flagsArray[@]}"

    if [ -n "${buildAndTestSubdir-}" ]; then
        popd
--- a/pkgs/build-support/setup-hooks/no-broken-symlinks.sh
+++ b/pkgs/build-support/setup-hooks/no-broken-symlinks.sh
@ -13,7 +13,8 @@ postFixupHooks+=(noBrokenSymlinksInAllOutputs)

 # A symlink is "dangling" if it points to a non-existent target.
 # A symlink is "reflexive" if it points to itself.
-# A symlink is considered "broken" if it is either dangling or reflexive.
+# A symlink is "unreadable" if the readlink command fails, e.g. because of permission errors.
+# A symlink is considered "broken" if it is either dangling, reflexive or unreadable.
 noBrokenSymlinks() {
  local -r output="${1:?}"
  local path
@ -21,6 +22,7 @@ noBrokenSymlinks() {
  local symlinkTarget
  local -i numDanglingSymlinks=0
  local -i numReflexiveSymlinks=0
+  local -i numUnreadableSymlinks=0

  # NOTE(@connorbaker): This hook doesn't check for cycles in symlinks.

@ -33,7 +35,11 @@ noBrokenSymlinks() {
  # NOTE: path is absolute because we're running `find` against an absolute path (`output`).
  while IFS= read -r -d $'\0' path; do
    pathParent="$(dirname "$path")"
-    symlinkTarget="$(readlink "$path")"
+    if ! symlinkTarget="$(readlink "$path")"; then
+      nixErrorLog "the symlink $path is unreadable"
+      numUnreadableSymlinks+=1
+      continue
+    fi

    # Canonicalize symlinkTarget to an absolute path.
    if [[ $symlinkTarget == /* ]]; then
@ -61,8 +67,8 @@ noBrokenSymlinks() {
    fi
  done < <(find "$output" -type l -print0)

-  if ((numDanglingSymlinks > 0 || numReflexiveSymlinks > 0)); then
-    nixErrorLog "found $numDanglingSymlinks dangling symlinks and $numReflexiveSymlinks reflexive symlinks"
+  if ((numDanglingSymlinks > 0 || numReflexiveSymlinks > 0 || numUnreadableSymlinks > 0)); then
+    nixErrorLog "found $numDanglingSymlinks dangling symlinks, $numReflexiveSymlinks reflexive symlinks and $numUnreadableSymlinks unreadable symlinks"
    exit 1
  fi
  return 0
--- a/pkgs/by-name/_1/_1oom/package.nix
+++ b/pkgs/by-name/_1/_1oom/package.nix
@ -6,6 +6,7 @@
  autoreconfHook,
  allegro,
  libsamplerate,
+  libGLU,
  libX11,
  libXext,
  SDL,
@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    allegro
    libsamplerate
+    libGLU
    libX11
    libXext
    SDL
--- a/pkgs/by-name/az/azimuth/package.nix
+++ b/pkgs/by-name/az/azimuth/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  libGL,
  SDL,
  which,
  installTool ? false,
@ -19,7 +20,10 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ which ];
-  buildInputs = [ SDL ];
+  buildInputs = [
+    libGL
+    SDL
+  ];

  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=maybe-uninitialized" ];

--- a/pkgs/by-name/bo/bonmin/package.nix
+++ b/pkgs/by-name/bo/bonmin/package.nix
@ -57,12 +57,6 @@ stdenv.mkDerivation rec {
    "--with-asl-lib=-lipoptamplinterface -lamplsolver"
  ];

-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
  # Fix doc install. Should not be necessary after next release
  # ref https://github.com/coin-or/Bonmin/commit/4f665bc9e489a73cb867472be9aea518976ecd28
  sourceRoot = "${src.name}/Bonmin";
--- a/pkgs/by-name/bo/borgmatic/package.nix
+++ b/pkgs/by-name/bo/borgmatic/package.nix
@ -30,7 +30,7 @@ python3Packages.buildPythonApplication rec {
    [
      flexmock
      pytestCheckHook
-      pytest-cov
+      pytest-cov-stub
    ]
    ++ optional-dependencies.apprise;

@ -40,11 +40,6 @@ python3Packages.buildPythonApplication rec {
    "test_borgmatic_version_matches_news_version"
  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '--cov-fail-under=100' ""
-  '';
-
  nativeBuildInputs = [ installShellFiles ];

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/by-name/bt/btanks/package.nix
+++ b/pkgs/by-name/bt/btanks/package.nix
@ -6,7 +6,9 @@
  fetchpatch,
  fetchurl,
  libGL,
+  libGLU,
  libvorbis,
+  libX11,
  lua,
  pkg-config,
  scons,
@ -62,6 +64,8 @@ stdenv.mkDerivation (finalAttrs: {
    SDL_image
    expat
    libGL
+    libGLU
+    libX11
    libvorbis
    lua
    smpeg
--- a/pkgs/by-name/ca/caprice32/package.nix
+++ b/pkgs/by-name/ca/caprice32/package.nix
@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  desktop-file-utils,
+  libGLU,
  libpng,
  pkg-config,
  SDL,
@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
    pkg-config
  ];
  buildInputs = [
+    libGLU
    libpng
    SDL
    freetype
--- a/pkgs/by-name/cf/cfitsio/package.nix
+++ b/pkgs/by-name/cf/cfitsio/package.nix
@ -31,6 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
    "--enable-reentrant"
  ];

+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    # concerning. upstream defines XOPEN_SOURCE=700 which makes FreeBSD very insistent on
+    # not showing us gethostbyname()
+    NIX_CFLAGS_COMPILE = "-D__BSD_VISIBLE=1";
+  };
+
  hardeningDisable = [ "format" ];

  # Shared-only build
@ -58,6 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
      xbreak
      hjones2199
    ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/ch/chromaprint/package.nix
+++ b/pkgs/by-name/ch/chromaprint/package.nix
@ -1,22 +1,31 @@
-{ lib
-, stdenv
-, fetchurl
-, fetchpatch
-, fetchpatch2
-, cmake
-, ninja
-, ffmpeg
-, darwin
-, zlib
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  fetchpatch2,
+  fetchurl,
+  cmake,
+  ninja,
+  ffmpeg-headless,
+  darwin,
+  zlib,
+  testers,
+  validatePkgConfig,
+  nix-update-script,
+  withExamples ? true,
+  withTools ? true,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "chromaprint";
  version = "1.5.1";

-  src = fetchurl {
-    url = "https://github.com/acoustid/chromaprint/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-oarY+juLGLeNN1Wzdn+v+au2ckLgG0eOyaZOGQ8zXhw=";
+  src = fetchFromGitHub {
+    owner = "acoustid";
+    repo = "chromaprint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bFplHaqXYvGbl8E8b/HUNFO4X+B/HPZjGTmuVFPjS3g=";
  };

  patches = [
@ -40,18 +49,64 @@ stdenv.mkDerivation rec {
    })
  ];

-  nativeBuildInputs = [ cmake ninja ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+    validatePkgConfig
+  ];

-  buildInputs = [ ffmpeg ] ++ lib.optionals stdenv.hostPlatform.isDarwin
-    (with darwin.apple_sdk.frameworks; [ Accelerate CoreGraphics CoreVideo zlib ]);
+  buildInputs =
+    [ ffmpeg-headless ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        Accelerate
+        CoreGraphics
+        CoreVideo
+        zlib
+      ]
+    );

-  cmakeFlags = [ "-DBUILD_EXAMPLES=ON" "-DBUILD_TOOLS=ON" ];
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_EXAMPLES" withExamples)
+    (lib.cmakeBool "BUILD_TOOLS" withTools)
+  ];

-  meta = with lib; {
-    homepage = "https://acoustid.org/chromaprint";
-    description = "AcoustID audio fingerprinting library";
-    mainProgram = "fpcalc";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.unix;
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
  };
-}
+
+  doCheck = true;
+  checkPhase =
+    let
+      exampleAudio = fetchurl {
+        name = "Dvorak_Symphony_9_1.mp3";
+        url = "https://archive.org/download/Dvorak_Symphony_9/01.Adagio-Allegro_Molto.mp3";
+        hash = "sha256-I+Ve3/OpL+3Joc928F8M21LhCH2eQfRtaJVx9mNOLW0=";
+        meta.license = lib.licenses.publicDomain;
+      };
+
+      # sha256 because actual output of fpcalc is quite long
+      expectedHash = "c47ae40e02caf798ff5ab4d91ff00cfdca8f6786c581662436941d3e000c9aac";
+    in
+    ''
+      runHook preCheck
+      tests/all_tests
+      ${lib.optionalString withTools "diff -u <(src/cmd/fpcalc ${exampleAudio} | sha256sum | cut -c-64) <(echo '${expectedHash}')"}
+      runHook postCheck
+    '';
+
+  meta =
+    {
+      changelog = "https://github.com/acoustid/chromaprint/releases/tag/v${finalAttrs.version}";
+      homepage = "https://acoustid.org/chromaprint";
+      description = "AcoustID audio fingerprinting library";
+      license = lib.licenses.lgpl21Plus;
+      platforms = lib.platforms.unix;
+      pkgConfigModules = [ "libchromaprint" ];
+    }
+    // lib.attrsets.optionalAttrs withTools {
+      mainProgram = "fpcalc";
+    };
+})
--- a/pkgs/by-name/cr/cryptsetup/package.nix
+++ b/pkgs/by-name/cr/cryptsetup/package.nix
@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
    ++ (lib.mapAttrsToList (lib.flip lib.enableFeature)) programs;

  nativeBuildInputs = [ pkg-config ] ++ lib.optionals rebuildMan [ asciidoctor ];
-  buildInputs = [
+  propagatedBuildInputs = [
    lvm2
    json_c
    openssl
@ -106,7 +106,10 @@ stdenv.mkDerivation rec {
    changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${version}/docs/v${version}-ReleaseNotes";
    license = lib.licenses.gpl2Plus;
    mainProgram = "cryptsetup";
-    maintainers = with lib.maintainers; [ raitobezarius ];
+    maintainers = with lib.maintainers; [
+      numinit
+      raitobezarius
+    ];
    platforms = with lib.platforms; linux;
  };
 }
--- a/pkgs/by-name/ec/eclib/package.nix
+++ b/pkgs/by-name/ec/eclib/package.nix
@ -41,13 +41,6 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    autoreconfHook
  ];
-
-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
  doCheck = true;
  meta = with lib; {
    description = "Elliptic curve tools";
--- a/pkgs/by-name/fa/faad2/package.nix
+++ b/pkgs/by-name/fa/faad2/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "faad2";
-  version = "2.11.1";
+  version = "2.11.2";

  src = fetchFromGitHub {
    owner = "knik0";
    repo = "faad2";
    rev = version;
-    hash = "sha256-E6oe7yjYy1SJo8xQkyUk1sSucKDMPxwUFVSAyrf4Pd8=";
+    hash = "sha256-JvmblrmE3doUMUwObBN2b+Ej+CDBWNemBsyYSCXGwo8=";
  };

  outputs = [
--- a/pkgs/by-name/fa/fast-float/package.nix
+++ b/pkgs/by-name/fa/fast-float/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fast-float";
-  version = "8.0.0";
+  version = "8.0.1";

  src = fetchFromGitHub {
    owner = "fastfloat";
    repo = "fast_float";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-shP+me3iqTRrsPGYrvcbnJNRZouQbW62T24xfkEgGSE=";
+    hash = "sha256-Y13JdBk8pZyg748fEOj+O/6gMAaqNXIE2fLY5tsMGB0=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/fl/flite/package.nix
+++ b/pkgs/by-name/fl/flite/package.nix
@ -31,14 +31,20 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-Tq5pyg3TiQt8CPqGXTyLOaGgaeLTmPp+Duw3+2VAF9g=";
  };

-  # https://github.com/festvox/flite/pull/60.
-  # Replaces `ar` with `$(AR)` in config/common_make_rules.
-  # Improves cross-compilation compatibility.
  patches = [
+    # https://github.com/festvox/flite/pull/60.
+    # Replaces `ar` with `$(AR)` in config/common_make_rules.
+    # Improves cross-compilation compatibility.
    (fetchpatch {
      url = "https://github.com/festvox/flite/commit/54c65164840777326bbb83517568e38a128122ef.patch";
      hash = "sha256-hvKzdX7adiqd9D+9DbnfNdqEULg1Hhqe1xElYxNM1B8=";
    })
+    # patch missing bsd conditions in configure
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/0d316feccaf89c1bd804d6001274426a7135c93a/audio/flite/files/patch-configure";
+      hash = "sha256-D2wOtmHFcuA8JRtIds03yPrBGtMuhLJHuufEQdpcB58=";
+      extraPrefix = "";
+    })
  ];

  buildInputs = lib.optional stdenv.hostPlatform.isLinux (
--- a/pkgs/by-name/gh/ghostscript/package.nix
+++ b/pkgs/by-name/gh/ghostscript/package.nix
@ -63,11 +63,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "ghostscript${lib.optionalString x11Support "-with-X"}";
-  version = "10.04.0";
+  version = "10.05.0";

  src = fetchurl {
    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${lib.replaceStrings ["."] [""] version}/ghostscript-${version}.tar.xz";
-    hash = "sha256-Un7vC2zQTs8cjXoReWxppS00/+Nq/KhqQAcpovwByIc=";
+    hash = "sha256-qsnE/fYYBadvYiABJzXBroMoE3iDFL/AQFXMDIlZuaM=";
  };

  patches = [
--- a/pkgs/by-name/gi/gi-docgen/package.nix
+++ b/pkgs/by-name/gi/gi-docgen/package.nix
@ -9,13 +9,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gi-docgen";
-  version = "2024.1";
+  version = "2025.3";

  format = "other";

  src = fetchurl {
    url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
-    hash = "sha256-hwx3+WIEYszknjVUKkLcFhL8hYcz6D274kjFNUWK7B4=";
+    hash = "sha256-iomli8D3ffw+iioONJf8OfVBOuNeVZfp7GFgq/juFNg=";
  };

  depsBuildBuild = [
--- a/pkgs/by-name/gi/giac/package.nix
+++ b/pkgs/by-name/gi/giac/package.nix
@ -106,12 +106,6 @@ stdenv.mkDerivation rec {
    substituteInPlace src/global.cc --replace 'browser="mozilla"' 'browser="xdg-open"'
  '';

-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
  nativeBuildInputs = [
    autoreconfHook
    texliveSmall
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@ -76,7 +76,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glib";
-  version = "2.82.4";
+  version = "2.82.5";

  outputs = [
    "bin"
@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-N90Id/6WTNFemicQsEShgw+xvZNlKm0Mtriy3/GHxwk=";
+    hash = "sha256-BcIDH5vfa1q6egbKhPC0rO0osZvxtQxqslzGdSd8vD8=";
  };

  patches =
@ -249,7 +249,6 @@ stdenv.mkDerivation (finalAttrs: {
      "-Dlibelf=disabled"
    ]
    ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
-      "-Db_lundef=false"
      "-Dxattr=false"
      "-Dsysprof=disabled" # sysprof-capture does not build on FreeBSD
    ];
--- a/pkgs/by-name/gl/glusterfs/package.nix
+++ b/pkgs/by-name/gl/glusterfs/package.nix
@ -159,12 +159,6 @@ stdenv.mkDerivation rec {
    "--localstatedir=/var"
  ];

-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
  nativeBuildInputs = [
    autoconf
    automake
--- a/pkgs/by-name/gn/gnujump/package.nix
+++ b/pkgs/by-name/gn/gnujump/package.nix
@ -4,6 +4,8 @@
  makeDesktopItem,
  copyDesktopItems,
  fetchurl,
+  libGL,
+  libGLU,
  SDL,
  SDL_image,
  SDL_mixer,
@ -19,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [ copyDesktopItems ];
  buildInputs = [
+    libGL
+    libGLU
    SDL
    SDL_image
    SDL_mixer
--- a/pkgs/by-name/gp/gpodder/package.nix
+++ b/pkgs/by-name/gp/gpodder/package.nix
@ -2,7 +2,6 @@
  lib,
  fetchFromGitHub,
  gitUpdater,
-  glibcLocales,
  adwaita-icon-theme,
  gobject-introspection,
  gtk3,
@ -35,7 +34,6 @@ python311Packages.buildPythonApplication rec {
  nativeBuildInputs = [
    intltool
    wrapGAppsHook3
-    glibcLocales
    gobject-introspection
  ];

@ -73,10 +71,6 @@ python311Packages.buildPythonApplication rec {
    "share/dbus-1/services/org.gpodder.service"
  ];

-  preBuild = ''
-    export LC_ALL="en_US.UTF-8"
-  '';
-
  installCheckPhase = ''
    LC_ALL=C PYTHONPATH=src/:$PYTHONPATH pytest --ignore=tests --ignore=src/gpodder/utilwin32ctypes.py --doctest-modules src/gpodder/util.py src/gpodder/jsonconfig.py
    LC_ALL=C PYTHONPATH=src/:$PYTHONPATH pytest tests --ignore=src/gpodder/utilwin32ctypes.py --ignore=src/mygpoclient --cov=gpodder
--- a/pkgs/by-name/gt/gtk4-layer-shell/package.nix
+++ b/pkgs/by-name/gt/gtk4-layer-shell/package.nix
@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  meson,
+  mesonEmulatorHook,
  ninja,
  pkg-config,
  gtk-doc,
@ -50,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
    docbook_xml_dtd_43
    vala
    wayland-scanner
-  ];
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];

  buildInputs = [
    gtk4
--- a/pkgs/by-name/hh/hhexen/package.nix
+++ b/pkgs/by-name/hh/hhexen/package.nix
@ -2,6 +2,8 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  libGL,
+  libGLU,
  SDL,
  SDL_mixer,
  autoreconfHook,
@ -25,6 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
+    libGL
+    libGLU
    SDL
    SDL_mixer
  ];
--- a/pkgs/by-name/hi/hifiscan/package.nix
+++ b/pkgs/by-name/hi/hifiscan/package.nix
@ -20,8 +20,6 @@ python3Packages.buildPythonApplication {
    pyqtgraph
  ];

-  dontUseSetuptoolsCheck = true;
-
  src = fetchPypi {
    inherit pname version hash;
  };
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "hwdata";
-  version = "0.392";
+  version = "0.393";

  src = fetchFromGitHub {
    owner = "vcrhonek";
    repo = "hwdata";
    rev = "v${version}";
-    hash = "sha256-DjtPoPZZwFmVRZTOG4A+2KXI6zw68QEwq0iFRoV+5c4=";
+    hash = "sha256-RDp5NY9VYD0gylvzYpg9BytfRdQ6dim1jJtv32yeF3k=";
  };

  configureFlags = [ "--datadir=${placeholder "out"}/share" ];
--- a/pkgs/by-name/ir/irrd/package.nix
+++ b/pkgs/by-name/ir/irrd/package.nix
@ -6,7 +6,7 @@
 , git
 , postgresql
 , postgresqlTestHook
-, redis
+, valkey
 }:

 let
@ -84,7 +84,7 @@ py.pkgs.buildPythonPackage rec {

  nativeCheckInputs = [
    git
-    redis
+    valkey
    postgresql
    postgresqlTestHook
  ] ++ (with py.pkgs; [
--- a/pkgs/by-name/ja/jack_oscrolloscope/package.nix
+++ b/pkgs/by-name/ja/jack_oscrolloscope/package.nix
@ -6,6 +6,7 @@
  libjack2,
  libGLU,
  libGL,
+  libX11,
  pkg-config,
 }:

@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
    libjack2
    libGLU
    libGL
+    libX11
  ];

  installPhase = ''
--- a/pkgs/by-name/le/lerc/package.nix
+++ b/pkgs/by-name/le/lerc/package.nix
@ -1,6 +1,7 @@
 {
  lib,
  stdenv,
+  buildPackages,
  fetchFromGitHub,
  fetchpatch,
  cmake,
@ -23,14 +24,28 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-IHY9QtNYsxPz/ksxRMZGHleT+/bawfTYNVRSTAuYQ7Y=";
  };

-  patches = [
-    # https://github.com/Esri/lerc/pull/227
-    (fetchpatch {
-      name = "use-cmake-install-full-dir.patch";
-      url = "https://github.com/Esri/lerc/commit/5462ca7f7dfb38c65e16f5abfd96873af177a0f8.patch";
-      hash = "sha256-qaNR3QwLe0AB6vu1nXOh9KhlPdWM3DmgCJj4d0VdOUk=";
-    })
-  ];
+  # Required to get the freebsd-ports patch to apply.
+  # There seem to be inconsistent line endings in this project - just converting the patch doesn't work
+  prePatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+    ${buildPackages.dos2unix}/bin/dos2unix src/LercLib/fpl_EsriHuffman.cpp src/LercLib/fpl_Lerc2Ext.cpp
+  '';
+
+  patches =
+    [
+      # https://github.com/Esri/lerc/pull/227
+      (fetchpatch {
+        name = "use-cmake-install-full-dir.patch";
+        url = "https://github.com/Esri/lerc/commit/5462ca7f7dfb38c65e16f5abfd96873af177a0f8.patch";
+        hash = "sha256-qaNR3QwLe0AB6vu1nXOh9KhlPdWM3DmgCJj4d0VdOUk=";
+      })
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/ee9e39ceb1af729ac33854b5f3de652cb5ce0eca/graphics/lerc/files/patch-_assert";
+        hash = "sha256-agvGqgIsKS8v43UZdTVxDRDGbZdj2+AzKoQONvQumB4=";
+        extraPrefix = "";
+      })
+    ];

  nativeBuildInputs = [
    cmake
--- a/pkgs/by-name/li/libcap/package.nix
+++ b/pkgs/by-name/li/libcap/package.nix
@ -21,11 +21,11 @@ assert usePam -> pam != null;

 stdenv.mkDerivation rec {
  pname = "libcap";
-  version = "2.73";
+  version = "2.74";

  src = fetchurl {
    url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    hash = "sha256-ZAX2CJz0zdjCcVQM2ZBlTXjdCxmJstm9og+TOnWnlaU=";
+    hash = "sha256-64UnHyiTGIZEtkUc7Izpn0VBSY8W/5+Eh3wvyHJxdxQ=";
  };

  outputs = [ "out" "dev" "lib" "man" "doc" ]
--- a/pkgs/by-name/li/libid3tag/CVE-2017-11550-and-CVE-2017-11551.patch
+++ b/pkgs/by-name/li/libid3tag/CVE-2017-11550-and-CVE-2017-11551.patch
@ -1,13 +0,0 @@
-Common subdirectories: libid3tag-0.15.1b/msvc++ and libid3tag-0.15.1b-patched/msvc++
-diff -uwp libid3tag-0.15.1b/utf16.c libid3tag-0.15.1b-patched/utf16.c
--- libid3tag-0.15.1b/utf16.c	2004-01-23 10:41:32.000000000 +0100
-+++ libid3tag-0.15.1b-patched/utf16.c	2018-11-01 13:12:00.866050641 +0100
-@@ -250,6 +250,8 @@ id3_ucs4_t *id3_utf16_deserialize(id3_by
-   id3_ucs4_t *ucs4;
- 
-   end = *ptr + (length & ~1);
-+  if (end == *ptr)
-+    return 0;
- 
-   utf16 = malloc((length / 2 + 1) * sizeof(*utf16));
-   if (utf16 == 0)
--- a/pkgs/by-name/li/libid3tag/debian-patches.patch
+++ b/pkgs/by-name/li/libid3tag/debian-patches.patch
@ -1,89 +0,0 @@
-diff --git a/compat.gperf b/compat.gperf
-index 4e24613..5635980 100644
--- a/compat.gperf
-+++ b/compat.gperf
-@@ -236,6 +236,10 @@ int id3_compat_fixup(struct id3_tag *tag)
-
-     encoding = id3_parse_uint(&data, 1);
-     string   = id3_parse_string(&data, end - data, encoding, 0);
-+    if (!string)
-+    {
-+	continue;
-+    }
-
-     if (id3_ucs4_length(string) < 4) {
-       free(string);
-diff --git a/genre.dat b/genre.dat
-index 17acab5..1f02779 100644
--- a/genre.dat
-+++ b/genre.dat
-@@ -277,8 +277,8 @@ static id3_ucs4_t const genre_PUNK_ROCK[] =
-   { 'P', 'u', 'n', 'k', ' ', 'R', 'o', 'c', 'k', 0 };
- static id3_ucs4_t const genre_DRUM_SOLO[] =
-   { 'D', 'r', 'u', 'm', ' ', 'S', 'o', 'l', 'o', 0 };
-static id3_ucs4_t const genre_A_CAPPELLA[] =
-  { 'A', ' ', 'C', 'a', 'p', 'p', 'e', 'l', 'l', 'a', 0 };
-+static id3_ucs4_t const genre_A_CAPELLA[] =
-+  { 'A', ' ', 'C', 'a', 'p', 'e', 'l', 'l', 'a', 0 };
- static id3_ucs4_t const genre_EURO_HOUSE[] =
-   { 'E', 'u', 'r', 'o', '-', 'H', 'o', 'u', 's', 'e', 0 };
- static id3_ucs4_t const genre_DANCE_HALL[] =
-@@ -452,7 +452,7 @@ static id3_ucs4_t const *const genre_table[] = {
-   genre_DUET,
-   genre_PUNK_ROCK,
-   genre_DRUM_SOLO,
-  genre_A_CAPPELLA,
-+  genre_A_CAPELLA,
-   genre_EURO_HOUSE,
-   genre_DANCE_HALL,
-   genre_GOA,
-diff --git a/genre.dat.in b/genre.dat.in
-index 872de40..e71e34b 100644
--- a/genre.dat.in
-+++ b/genre.dat.in
-@@ -153,7 +153,7 @@ Freestyle
- Duet
- Punk Rock
- Drum Solo
-A Cappella
-+A Capella
- Euro-House
- Dance Hall
- Goa
-diff --git a/parse.c b/parse.c
-index 86a3f21..947c249 100644
--- a/parse.c
-+++ b/parse.c
-@@ -165,6 +165,9 @@ id3_ucs4_t *id3_parse_string(id3_byte_t const **ptr, id3_length_t length,
-   case ID3_FIELD_TEXTENCODING_UTF_8:
-     ucs4 = id3_utf8_deserialize(ptr, length);
-     break;
-+  default:
-+  	/* FIXME: Unknown encoding! Print warning? */
-+	return NULL;
-   }
-
-   if (ucs4 && !full) {
-diff --git a/utf16.c b/utf16.c
-index 70ee9d5..6e60a75 100644
--- a/utf16.c
-+++ b/utf16.c
-@@ -282,5 +282,18 @@ id3_ucs4_t *id3_utf16_deserialize(id3_byte_t const **ptr, id3_length_t length,
-
-   free(utf16);
-
-+  if (end == *ptr && length % 2 != 0)
-+  {
-+     /* We were called with a bogus length.  It should always
-+      * be an even number.  We can deal with this in a few ways:
-+      * - Always give an error.
-+      * - Try and parse as much as we can and
-+      *   - return an error if we're called again when we
-+      *     already tried to parse everything we can.
-+      *   - tell that we parsed it, which is what we do here.
-+      */
-+     (*ptr)++;
-+  }
-+
-   return ucs4;
- }
--- a/pkgs/by-name/li/libid3tag/id3tag.pc
+++ b/pkgs/by-name/li/libid3tag/id3tag.pc
@ -1,11 +0,0 @@
-prefix=@out@
-exec_prefix=${prefix}
-libdir=${exec_prefix}/lib
-includedir=@dev@/include
-
-Name: libid3tag
-Description: ID3 tag manipulation library
-Version: @version@
-
-Libs: -L${libdir} -lid3tag
-Cflags: -I${includedir}
--- a/pkgs/by-name/li/libid3tag/package.nix
+++ b/pkgs/by-name/li/libid3tag/package.nix
@ -1,48 +1,50 @@
-{ lib, stdenv, fetchurl, zlib, gperf_3_0 }:
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  cmake,
+  gperf,
+  zlib,
+}:

 stdenv.mkDerivation rec {
  pname = "libid3tag";
-  version = "0.15.1b";
+  version = "0.16.3";

-  src = fetchurl {
-    url = "mirror://sourceforge/mad/libid3tag-${version}.tar.gz";
-    sha256 = "63da4f6e7997278f8a3fef4c6a372d342f705051d1eeb6a46a86b03610e26151";
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "tenacityteam";
+    repo = "libid3tag";
+    rev = version;
+    hash = "sha256-6/49rk7pmIpJRj32WmxC171NtdIOaMNhX8RD7o6Jbzs=";
  };

-  outputs = [ "out" "dev" ];
-  setOutputFlags = false;
+  postPatch = ''
+    substituteInPlace packaging/id3tag.pc.in \
+      --replace-fail "\''${prefix}/@CMAKE_INSTALL_LIBDIR@" "@CMAKE_INSTALL_FULL_LIBDIR@"
+  '';

  strictDeps = true;

-  nativeBuildInputs = [ gperf_3_0 ];
-
-  buildInputs = [ zlib ];
-
-  patches = [
-    ./debian-patches.patch
-    ./CVE-2017-11550-and-CVE-2017-11551.patch
+  nativeBuildInputs = [
+    cmake
+    gperf
  ];

-  preConfigure = ''
-    configureFlagsArray+=(
-      --includedir=$dev/include
-    )
-  '';
+  buildInputs = [
+    zlib
+  ];

-  postInstall = ''
-    mkdir -p $dev/lib/pkgconfig
-    cp ${./id3tag.pc} $dev/lib/pkgconfig/id3tag.pc
-    substituteInPlace $dev/lib/pkgconfig/id3tag.pc \
-      --subst-var-by out $out \
-      --subst-var-by dev $dev \
-      --subst-var-by version "${version}"
-  '';
-
-  meta = with lib; {
+  meta = {
    description = "ID3 tag manipulation library";
-    homepage = "https://mad.sourceforge.net/";
-    license = licenses.gpl2;
+    homepage = "https://codeberg.org/tenacityteam/libid3tag";
+    license = lib.licenses.gpl2Plus;
    maintainers = [ ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/by-name/li/liblc3/package.nix
+++ b/pkgs/by-name/li/liblc3/package.nix
@ -8,7 +8,7 @@

 let
  name = "liblc3";
-  version = "1.1.2";
+  version = "1.1.3";
 in
 stdenv.mkDerivation {
  pname = name;
@ -18,7 +18,7 @@ stdenv.mkDerivation {
    owner = "google";
    repo = "liblc3";
    rev = "v${version}";
-    sha256 = "sha256-OWuj68+YztIh/dPvwqjW7ch7Ph3aiEIDvO9rMkVIrQ8=";
+    sha256 = "sha256-4KsvCQ1JZaj0yCT7En7ZcNk0rA8LyDwwcSga2IoVd6A=";
  };

  outputs = [
--- a/pkgs/by-name/li/libnotify/package.nix
+++ b/pkgs/by-name/li/libnotify/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchpatch,
  meson,
  ninja,
  pkg-config,
@ -19,7 +20,7 @@

 stdenv.mkDerivation rec {
  pname = "libnotify";
-  version = "0.8.3";
+  version = "0.8.4";

  outputs = [
    "out"
@ -29,9 +30,20 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-7o8++UYVatNAb99F/u29zZMtvSEatPFvdeuk82+y9sA=";
+    hash = "sha256-j6BNTr3BVbCiOd+IvZ8J6PJznVcHoTkLQnq0mF+D0lo=";
  };

+  patches = [
+    # Revert to avoid manpages breakage:
+    #   https://gitlab.gnome.org/GNOME/libnotify/-/merge_requests/37#note_2366448
+    (fetchpatch {
+      revert = true;
+      name = "unbreak-man.path";
+      url = "https://gitlab.gnome.org/GNOME/libnotify/-/commit/2f99025b7ad54f29dc5236aa7dfcfa97d1c8efde.patch";
+      hash = "sha256-/qbBs+bJjzCR2I7swy0RTsTaXap+gkYzvfchobeOzPQ=";
+    })
+  ];
+
  mesonFlags = [
    # disable tests as we don't need to depend on GTK (2/3)
    "-Dtests=false"
--- a/pkgs/by-name/li/libqmi/build_doc_deps_by_default.patch
+++ b/pkgs/by-name/li/libqmi/build_doc_deps_by_default.patch
@ -0,0 +1,12 @@
+diff --git a/docs/reference/libqmi-glib/meson.build b/docs/reference/libqmi-glib/meson.build
+index 2f5cfc3..14e1aea 100644
+--- a/docs/reference/libqmi-glib/meson.build
+++ b/docs/reference/libqmi-glib/meson.build
+@@ -57,6 +57,7 @@ sections_txt = custom_target(
+   capture: true,
+   command: [find_program('cat'), '@INPUT@'] + gen_sections,
+   depends: gen_sections_deps,
+  build_by_default: true,
+ )
+ 
+ version_xml = configure_file(
--- a/pkgs/by-name/li/libqmi/package.nix
+++ b/pkgs/by-name/li/libqmi/package.nix
@ -88,6 +88,10 @@ stdenv.mkDerivation rec {
  ];

  doCheck = true;
+  patches = [
+    # https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/124
+    ./build_doc_deps_by_default.patch
+  ];

  postPatch = ''
    patchShebangs \
--- a/pkgs/by-name/li/libraw/package.nix
+++ b/pkgs/by-name/li/libraw/package.nix
@ -40,6 +40,10 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  postPatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+    substituteInPlace libraw*.pc.in --replace-fail -lstdc++ ""
+  '';
+
  passthru.tests = {
    inherit imagemagick hdrmerge freeimage;
    inherit (python3.pkgs) rawkit;
--- a/pkgs/by-name/li/libredirect/package.nix
+++ b/pkgs/by-name/li/libredirect/package.nix
@ -104,6 +104,7 @@ else
        # Provide a setup hook that injects our library into every process.
        mkdir -p "$hook/nix-support"
        cat <<SETUP_HOOK > "$hook/nix-support/setup-hook"
+        echo "Setting up libredirect"
        ${
          if stdenv.hostPlatform.isDarwin then
            ''
--- a/pkgs/by-name/li/libsepol/package.nix
+++ b/pkgs/by-name/li/libsepol/package.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  pname = "libsepol";
-  version = "3.8";
+  version = "3.8.1";
  se_url = "https://github.com/SELinuxProject/selinux/releases/download";

  outputs = [
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${se_url}/${version}/libsepol-${version}.tar.gz";
-    sha256 = "sha256-hE+9vwIzS5zgODOtimcQU/Z7QHbXLbTwPg7iZl7C61U=";
+    sha256 = "sha256-DnhwUwX5VavUwGVNN6VHfuJjSat0254rA6eGiJeuHd8=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
--- a/pkgs/by-name/li/libvisual/package.nix
+++ b/pkgs/by-name/li/libvisual/package.nix
@ -1,57 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  SDL,
-  autoreconfHook,
-  autoconf-archive,
-  glib,
-  pkg-config,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libvisual";
-  version = "0.4.2";
-
-  src = fetchFromGitHub {
-    owner = "Libvisual";
-    repo = "libvisual";
-    rev = "libvisual-${version}";
-    hash = "sha256-bDnpQODXB2Z6hezVoh7c6cklp6qpyDzVBAnwZD8Gros=";
-  };
-
-  sourceRoot = "${src.name}/libvisual";
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  strictDeps = true;
-  nativeBuildInputs = [
-    autoreconfHook
-    autoconf-archive
-    pkg-config
-  ];
-  buildInputs = [
-    SDL
-    glib
-  ];
-
-  configureFlags =
-    lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      # Remove when 0.5.x is published.
-      "--disable-lv-tool"
-    ]
-    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-      "ac_cv_func_malloc_0_nonnull=yes"
-      "ac_cv_func_realloc_0_nonnull=yes"
-    ];
-
-  meta = {
-    description = "Abstraction library for audio visualisations";
-    homepage = "https://sourceforge.net/projects/libvisual/";
-    license = lib.licenses.lgpl21Plus;
-    platforms = lib.platforms.linux ++ lib.platforms.freebsd;
-  };
-}
--- a/pkgs/by-name/li/libvmaf/package.nix
+++ b/pkgs/by-name/li/libvmaf/package.nix
@ -31,6 +31,14 @@ stdenv.mkDerivation (finalAttrs: {
    xxd
  ];

+  postPatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+    substituteInPlace meson.build --replace-fail '_XOPEN_SOURCE=600' '_XOPEN_SOURCE=700'
+  '';
+
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    NIX_CFLAGS_COMPILE = "-D__BSD_VISIBLE=1";
+  };
+
  mesonFlags = [ "-Denable_avx512=true" ];

  outputs = [
--- a/pkgs/by-name/ma/matrix-brandy/package.nix
+++ b/pkgs/by-name/ma/matrix-brandy/package.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  libX11,
  SDL,
 }:

@ -17,6 +18,7 @@ stdenv.mkDerivation rec {
  };

  buildInputs = [
+    libX11
    SDL
  ];

--- a/pkgs/by-name/me/mediagoblin/package.nix
+++ b/pkgs/by-name/me/mediagoblin/package.nix
@ -15,6 +15,12 @@ let
      celery = prev.celery.overridePythonAttrs {
        doCheck = false;
      };
+
+      kombu = prev.kombu.overridePythonAttrs {
+        # avoid conflicts with test only dependencies
+        doCheck = false;
+      };
+
      sqlalchemy = prev.sqlalchemy_1_4;
    };
  };
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@ -144,6 +144,7 @@ python3.pkgs.buildPythonApplication rec {
  '';

  setupHook = ./setup-hook.sh;
+  env.hostPlatform = stdenv.targetPlatform.system;

  meta = {
    homepage = "https://mesonbuild.com";
--- a/pkgs/by-name/me/meson/setup-hook.sh
+++ b/pkgs/by-name/me/meson/setup-hook.sh
@ -26,6 +26,11 @@ mesonConfigurePhase() {
        "--buildtype=${mesonBuildType:-plain}"
    )

+    # --no-undefined is universally a bad idea on freebsd because environ is in the csu
+    if [[ "@hostPlatform@" == *-freebsd ]]; then
+        flagsArray+=("-Db_lundef=false")
+    fi
+
    concatTo flagsArray mesonFlags mesonFlagsArray

    echoCmd 'mesonConfigurePhase flags' "${flagsArray[@]}"
--- a/pkgs/by-name/me/meterbridge/package.nix
+++ b/pkgs/by-name/me/meterbridge/package.nix
@ -3,6 +3,7 @@
  stdenv,
  fetchurl,
  pkg-config,
+  libGL,
  SDL,
  SDL_image,
  libjack2,
@ -24,6 +25,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
+    libGL
    SDL
    SDL_image
    libjack2
--- a/pkgs/by-name/mp/mp3fs/package.nix
+++ b/pkgs/by-name/mp/mp3fs/package.nix
@ -10,6 +10,7 @@
  autoreconfHook,
  pkg-config,
  pandoc,
+  zlib,
 }:

 stdenv.mkDerivation rec {
@ -25,21 +26,23 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace src/mp3fs.cc \
-      --replace "#include <fuse_darwin.h>" "" \
-      --replace "osxfuse_version()" "fuse_version()"
+      --replace-fail "#include <fuse_darwin.h>" "" \
+      --replace-fail "osxfuse_version()" "fuse_version()"
  '';

+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    pandoc
+  ];
+
  buildInputs = [
    flac
    fuse
    lame
    libid3tag
    libvorbis
-  ];
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-    pandoc
+    zlib
  ];

  enableParallelBuilding = true;
--- a/pkgs/by-name/na/naev/package.nix
+++ b/pkgs/by-name/na/naev/package.nix
@ -77,6 +77,12 @@ stdenv.mkDerivation rec {

  postPatch = ''
    patchShebangs --build dat/outfits/bioship/generate.py utils/build/*.py utils/*.py
+
+    # Add a missing include to fix the build against luajit-2.1.1741730670.
+    # Otherwise the build fails as:
+    #   src/lutf8lib.c:421:22: error: 'INT_MAX' undeclared (first use in this function)
+    # TODO: drop after 0.12.3 release
+    sed -i '1i#include <limits.h>' src/lutf8lib.c
  '';

  meta = {
--- a/pkgs/by-name/oc/octoprint/package.nix
+++ b/pkgs/by-name/oc/octoprint/package.nix
@ -238,8 +238,6 @@ let
                setup.py
            '';

-          dontUseSetuptoolsCheck = true;
-
          preCheck = ''
            export HOME=$(mktemp -d)
            rm pytest.ini
--- a/pkgs/by-name/op/openh264/package.nix
+++ b/pkgs/by-name/op/openh264/package.nix
@ -1,6 +1,7 @@
 {
  lib,
  fetchFromGitHub,
+  fetchpatch,
  gtest,
  meson,
  nasm,
@ -26,6 +27,15 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
  ];

+  patches = [
+    # https://github.com/cisco/openh264/pull/3867
+    (fetchpatch {
+      name = "freebsd-configure.patch";
+      url = "https://github.com/cisco/openh264/commit/ea8a1ad5791ee5c4e2ecf459aec235128d69b35b.patch";
+      hash = "sha256-pJvh9eRxFZQ+ob4WPu/x+jr1CCpgnug1uBViLfAtBDg=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    nasm
@ -58,6 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
        ++ lib.platforms.aarch64
        ++ lib.platforms.loongarch64
        ++ lib.platforms.riscv64
-      ) (lib.platforms.linux ++ lib.platforms.darwin);
+      ) lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/pe/persepolis/package.nix
+++ b/pkgs/by-name/pe/persepolis/package.nix
@ -38,15 +38,6 @@ python3.pkgs.buildPythonApplication rec {
    "\${qtWrapperArgs[@]}"
  ];

-  # The presence of these dependencies is checked during setuptoolsCheckPhase,
-  # but apart from that, they're not required during build, only runtime
-  nativeCheckInputs = [
-    libnotify
-    pulseaudio
-    sound-theme-freedesktop
-    ffmpeg
-  ];
-
  propagatedBuildInputs = [
    pulseaudio
    sound-theme-freedesktop
--- a/pkgs/by-name/po/poetry/unwrapped.nix
+++ b/pkgs/by-name/po/poetry/unwrapped.nix
@ -142,6 +142,12 @@ buildPythonPackage rec {
    "test_env_system_packages_are_relative_to_lib"
    "test_install_warning_corrupt_root"
    "test_project_plugins_are_installed_in_project_folder"
+    "test_application_command_not_found_messages"
+    # PermissionError: [Errno 13] Permission denied: '/build/pytest-of-nixbld/pytest-0/popen-gw3/test_find_poetry_managed_pytho1/.local/share/pypoetry/python/pypy@3.10.8/bin/python'
+    "test_list_poetry_managed"
+    "test_list_poetry_managed"
+    "test_find_all_with_poetry_managed"
+    "test_find_poetry_managed_pythons"
  ];

  pytestFlagsArray = [
--- a/pkgs/by-name/po/polkit/0001-build-Use-datarootdir-in-Meson-generated-pkg-config-.patch
+++ b/pkgs/by-name/po/polkit/0001-build-Use-datarootdir-in-Meson-generated-pkg-config-.patch
@ -1,4 +1,4 @@
-From 7ba07551dfcd4ef9a87b8f0d9eb8b91fabcb41b3 Mon Sep 17 00:00:00 2001
+From 5db2dee82bf652cca5fd782c19c8cc8e7ad5ed3e Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
 Date: Mon, 1 Nov 2021 14:17:17 +0100
 Subject: [PATCH] build: Use datarootdir in Meson-generated pkg-config files
@ -29,18 +29,17 @@ in the generated pkg-config files, mirroring Autotools.
 2. https://www.gnu.org/prep/standards/html_node/Directory-Variables.html
 3. https://blogs.gnome.org/hughsie/2014/06/16/datarootdir-v-s-datadir/
 ---
- src/polkit/meson.build | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
+ src/polkit/meson.build | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)

 diff --git a/src/polkit/meson.build b/src/polkit/meson.build
-index 63dc1e85..c92cb70f 100644
+index a7ce02b..9192a36 100644
 --- a/src/polkit/meson.build
 +++ b/src/polkit/meson.build
-@@ -113,9 +113,8 @@ pkg.generate(
+@@ -114,8 +114,8 @@ pkg.generate(
   requires: common_deps,
   variables: [
     'exec_prefix=${prefix}',
-    'datadir=' + ('${prefix}' / pk_datadir),
 -    'policydir=' + ('${datadir}' / pk_actiondir),
 -    'actiondir=' + ('${datadir}' / pk_actiondir),
 +    'policydir=' + ('${prefix}' / 'share' / pk_actiondir),
@ -49,5 +48,5 @@ index 63dc1e85..c92cb70f 100644
   ],
 )
 -- 
-GitLab
+2.48.1

--- a/pkgs/by-name/po/polkit/elogind.patch
+++ b/pkgs/by-name/po/polkit/elogind.patch
@ -1,66 +0,0 @@
-From 78e625dbafa8543b17ffaf9c42cf90c9cf9a612e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Wed, 8 May 2024 11:20:42 +0200
-Subject: [PATCH] Fix configuration with elogind
-
-Previously, it would try to get sysusers_dir from systemd even though
-systemd_dep was undefined.  Determining systemd_systemdsystemunitdir
-from systemd was already checking for systemd logind specifically, and
-systemd_sysusers_dir is only used in the systemd logind case, so move
-both of those into the systemd-logind-specific branch above.
-
-(cherry picked from commit b58b58af10c390ab9a11a4cfe6a4ff3d50cc0fa5)
---
- meson.build | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 2f81c90..0888322 100644
--- a/meson.build
-+++ b/meson.build
-@@ -202,6 +202,16 @@ if enable_logind
-     if not logind_dep.found()
-       logind_dep = dependency('libsystemd-login', not_found_message: 'libsystemd support requested but libsystemd or libsystemd-login library not found')
-     endif
-+
-+    # systemd unit / service files
-+    systemd_systemdsystemunitdir = get_option('systemdsystemunitdir')
-+    if systemd_systemdsystemunitdir == '' and session_tracking == 'libsystemd-login'
-+      systemd_dep = dependency('systemd', not_found_message: 'systemd required but not found, please provide a valid systemd user unit dir or disable it')
-+      # FIXME: systemd.pc file does not use variables with relative paths, so `define_variable` cannot be used
-+      systemd_systemdsystemunitdir = systemd_dep.get_pkgconfig_variable('systemdsystemunitdir')
-+    endif
-+
-+    systemd_sysusers_dir = systemd_dep.get_pkgconfig_variable('sysusers_dir', default: '/usr/lib/sysusers.d')
-   else
-     logind_dep = dependency('libelogind', not_found_message: 'libelogind support requested but libelogind library not found')
-   endif
-@@ -210,16 +220,6 @@ if enable_logind
-   config_h.set10('HAVE_' + func.to_upper(), cc.has_function(func, dependencies: logind_dep))
-   func = 'sd_pidfd_get_session'
-   config_h.set10('HAVE_' + func.to_upper(), cc.has_function(func, dependencies: logind_dep))
-
-  # systemd unit / service files
-  systemd_systemdsystemunitdir = get_option('systemdsystemunitdir')
-  if systemd_systemdsystemunitdir == '' and session_tracking == 'libsystemd-login'
-    systemd_dep = dependency('systemd', not_found_message: 'systemd required but not found, please provide a valid systemd user unit dir or disable it')
-    # FIXME: systemd.pc file does not use variables with relative paths, so `define_variable` cannot be used
-    systemd_systemdsystemunitdir = systemd_dep.get_pkgconfig_variable('systemdsystemunitdir')
-  endif
-
-  systemd_sysusers_dir = systemd_dep.get_pkgconfig_variable('sysusers_dir', default: '/usr/lib/sysusers.d')
- endif
- config_h.set('HAVE_LIBSYSTEMD', enable_logind)
- 
-@@ -404,7 +404,7 @@ output += '        introspection:            ' + enable_introspection.to_string(
- output += '        Distribution/OS:          ' + os_type + '\n'
- output += '        Authentication framework: ' + auth_fw + '\n'
- output += '        Session tracking:         ' + session_tracking + '\n'
-if enable_logind
-+if session_tracking == 'logind'
-   output += '        systemdsystemunitdir:     ' + systemd_systemdsystemunitdir + '\n'
- endif
- output += '        polkitd user:             ' + polkitd_user + ' \n'
-- 
-2.44.0
-
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@ -17,10 +17,10 @@
  libxslt,
  docbook-xsl-nons,
  dbus,
+  util-linux,
  docbook_xml_dtd_412,
  gtk-doc,
  coreutils,
-  fetchpatch,
  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdMinimal,
  systemdMinimal,
  elogind,
@ -41,7 +41,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "polkit";
-  version = "124";
+  version = "126";

  outputs = [
    "bin"
@ -54,22 +54,13 @@ stdenv.mkDerivation rec {
    owner = "polkit-org";
    repo = "polkit";
    rev = version;
-    hash = "sha256-Vc9G2xK6U1cX+xW2BnKp3oS/ACbSXS/lztbFP5oJOlM=";
+    hash = "sha256-ZSqgW//q5DFIsmY17U93mJcK/CHSCHphKTHsTxp40q8=";
  };

  patches = [
    # Allow changing base for paths in pkg-config file as before.
    # https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/100
    ./0001-build-Use-datarootdir-in-Meson-generated-pkg-config-.patch
-
-    ./elogind.patch
-
-    # FIXME: remove in the next release
-    # https://github.com/NixOS/nixpkgs/issues/18012
-    (fetchpatch {
-      url = "https://github.com/polkit-org/polkit/commit/f93c7466039ea3403e0576928aeb620b806d0cce.patch";
-      sha256 = "sha256-cF0nNovYmyr+XixpBgQFF0A+oJeSPGZgTkgDQkQuof8=";
-    })
  ];

  depsBuildBuild = [
@ -116,6 +107,7 @@ stdenv.mkDerivation rec {

  nativeCheckInputs = [
    dbus
+    util-linux # for mount
    (python3.pythonOnBuildForHost.withPackages (
      pp: with pp; [
        dbus-python
@ -127,67 +119,50 @@ stdenv.mkDerivation rec {
    ))
  ];

-  env =
-    {
-      PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
-      PKG_CONFIG_SYSTEMD_SYSUSERS_DIR = "${placeholder "out"}/lib/sysusers.d";
+  env = {
+    PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
+    PKG_CONFIG_SYSTEMD_SYSUSERS_DIR = "${placeholder "out"}/lib/sysusers.d";
+    PKG_CONFIG_SYSTEMD_TMPFILES_DIR = "${placeholder "out"}/lib/tmpfiles.d";

-      # HACK: We want to install policy files files to $out/share but polkit
-      # should read them from /run/current-system/sw/share on a NixOS system.
-      # Similarly for config files in /etc.
-      # With autotools, it was possible to override Make variables
-      # at install time but Meson does not support this
-      # so we need to convince it to install all files to a temporary
-      # location using DESTDIR and then move it to proper one in postInstall.
-      DESTDIR = "dest";
-    }
-    // lib.optionalAttrs (stdenv.cc.isGNU || stdenv.cc.isClang) {
-      NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
-    };
+    # HACK: We want to install policy files files to $out/share but polkit
+    # should read them from /run/current-system/sw/share on a NixOS system.
+    # Similarly for config files in /etc.
+    # With autotools, it was possible to override Make variables
+    # at install time but Meson does not support this
+    # so we need to convince it to install all files to a temporary
+    # location using DESTDIR and then move it to proper one in postInstall.
+    DESTDIR = "dest";
+  };

  mesonFlags =
    [
      "--datadir=${system}/share"
      "--sysconfdir=/etc"
      "-Dpolkitd_user=polkituser" # TODO? <nixos> config.ids.uids.polkituser
-      "-Dos_type=redhat" # only affects PAM includes
+      "-Dos_type=redhat" # affects PAM includes and privileged group name (wheel)
      "-Dintrospection=${lib.boolToString withIntrospection}"
      "-Dtests=${lib.boolToString doCheck}"
      "-Dgtk_doc=${lib.boolToString withIntrospection}"
      "-Dman=true"
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      "-Dsession_tracking=${if useSystemd then "libsystemd-login" else "libelogind"}"
+      "-Dsession_tracking=${if useSystemd then "logind" else "elogind"}"
    ];

  inherit doCheck;

  postPatch = ''
-    patchShebangs test/polkitbackend/polkitbackendjsauthoritytest-wrapper.py
+    patchShebangs \
+      test/wrapper.py

    # ‘libpolkit-agent-1.so’ should call the setuid wrapper on
    # NixOS.  Hard-coding the path is kinda ugly.  Maybe we can just
    # call through $PATH, but that might have security implications.
    substituteInPlace src/polkitagent/polkitagentsession.c \
-      --replace   'PACKAGE_PREFIX "/lib/polkit-1/'   '"${setuid}/'
+      --replace-fail 'PACKAGE_PREFIX "/lib/polkit-1/'   '"${setuid}/'
    substituteInPlace test/data/etc/polkit-1/rules.d/10-testing.rules \
-      --replace   /bin/true ${coreutils}/bin/true \
-      --replace   /bin/false ${coreutils}/bin/false
-  '';
-
-  postConfigure = lib.optionalString doCheck ''
-    # Unpacked by meson
-    chmod +x subprojects/mocklibc-1.0/bin/mocklibc
-    patchShebangs subprojects/mocklibc-1.0/bin/mocklibc
-  '';
-
-  checkPhase = ''
-    runHook preCheck
-
-    # tests need access to the system bus
-    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS meson test --print-errorlogs'
-
-    runHook postCheck
+      --replace-fail /bin/true ${coreutils}/bin/true \
+      --replace-fail /bin/false ${coreutils}/bin/false
  '';

  postInstall = ''
@ -212,6 +187,6 @@ stdenv.mkDerivation rec {
      # mandatory libpolkit-gobject shared library
      lib.systems.inspect.platformPatterns.isStatic
    ];
-    maintainers = teams.freedesktop.members ++ (with maintainers; [ ]);
+    maintainers = teams.freedesktop.members;
  };
 }
--- a/pkgs/by-name/po/polkit/system_bus.conf
+++ b/pkgs/by-name/po/polkit/system_bus.conf
@ -1,58 +0,0 @@
-<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
- "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
-<busconfig>
-  <!-- Our well-known bus type, do not change this -->
-  <type>system</type>
-
-  <!-- Fork into daemon mode -->
-  <fork/>
-
-  <!-- Enable logging to syslog -->
-  <syslog/>
-
-  <!-- Only allow socket-credentials-based authentication -->
-  <auth>EXTERNAL</auth>
-
-  <!-- Only listen on a local socket. (abstract=/path/to/socket 
-       means use abstract namespace, don't really create filesystem 
-       file; only Linux supports this. Use path=/whatever on other 
-       systems.) -->
-  <listen>unix:path=/tmp/system_bus_socket</listen>
-
-  <policy context="default">
-    <!-- All users can connect to system bus -->
-    <allow user="*"/>
-
-    <!-- Holes must be punched in service configuration files for
-         name ownership and sending method calls -->
-    <deny own="*"/>
-    <deny send_type="method_call"/>
-
-    <!-- Signals and reply messages (method returns, errors) are allowed
-         by default -->
-    <allow send_type="signal"/>
-    <allow send_requested_reply="true" send_type="method_return"/>
-    <allow send_requested_reply="true" send_type="error"/>
-
-    <!-- All messages may be received by default -->
-    <allow receive_type="method_call"/>
-    <allow receive_type="method_return"/>
-    <allow receive_type="error"/>
-    <allow receive_type="signal"/>
-
-    <!-- Allow anyone to talk to the message bus -->
-    <allow send_destination="org.freedesktop.DBus"
-           send_interface="org.freedesktop.DBus" />
-    <allow send_destination="org.freedesktop.DBus"
-           send_interface="org.freedesktop.DBus.Introspectable"/>
-    <!-- But disallow some specific bus services -->
-    <deny send_destination="org.freedesktop.DBus"
-          send_interface="org.freedesktop.DBus"
-          send_member="UpdateActivationEnvironment"/>
-    <deny send_destination="org.freedesktop.DBus"
-          send_interface="org.freedesktop.DBus.Debug.Stats"/>
-    <deny send_destination="org.freedesktop.DBus"
-          send_interface="org.freedesktop.systemd1.Activator"/>
-  </policy>
-
-</busconfig>
--- a/pkgs/by-name/pr/pre-commit/package.nix
+++ b/pkgs/by-name/pr/pre-commit/package.nix
@ -7,7 +7,6 @@
  coursier,
  dotnet-sdk,
  gitMinimal,
-  glibcLocales,
  go,
  nodejs,
  perl,
@ -52,7 +51,6 @@ buildPythonApplication rec {
    [
      cargo
      gitMinimal
-      glibcLocales
      go
      libiconv # For rust tests on Darwin
      perl
@ -101,7 +99,7 @@ buildPythonApplication rec {
    + ''
      export GIT_AUTHOR_NAME=test GIT_COMMITTER_NAME=test \
             GIT_AUTHOR_EMAIL=test@example.com GIT_COMMITTER_EMAIL=test@example.com \
-             VIRTUALENV_NO_DOWNLOAD=1 PRE_COMMIT_NO_CONCURRENCY=1 LANG=en_US.UTF-8
+             VIRTUALENV_NO_DOWNLOAD=1 PRE_COMMIT_NO_CONCURRENCY=1
    ''
    + lib.optionalString (!i686Linux) ''
      # Resolve `.NET location: Not found` errors for dotnet tests
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -103,6 +103,7 @@ python.pkgs.buildPythonApplication rec {
    "protobuf"
    "pycryptodome"
    "pyjwt"
+    "pypdf"
    "python-bidi"
    "qrcode"
    "redis"
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@ -7,13 +7,13 @@
 }:

 let
-  version = "1.1.394";
+  version = "1.1.396";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "pyright";
    tag = version;
-    hash = "sha256-zOJtv9ETolo3XmH+ztNJEmX319rV/CABDIw2crSxqqw=";
+    hash = "sha256-6YvjpLV1Jj5N0CgN9hE7C2X9BMYZBJegB0xpSBW8n5c=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@ -44,7 +44,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-RE1ZwMKgWu686/ejMB0E1CRix8MLv6lNoEkyAkvOC6U=";
+    npmDepsHash = "sha256-HwwVshop15nHE5oFuPIFmL5AduJ2z208cv2TbEAEMnY=";
    dontNpmBuild = true;
    installPhase = ''
      runHook preInstall
@ -58,7 +58,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-sQeHXfhm6u0at4vhFjGPwMmTdDomU6cJnolOFO6ynXA=";
+  npmDepsHash = "sha256-ywQimf2w5xXbNqcluv6Bi/wH7/QQG0U/r6Ferx9vbis=";

  postPatch = ''
    chmod +w ../../
--- a/pkgs/by-name/re/redis/package.nix
+++ b/pkgs/by-name/re/redis/package.nix
@ -66,6 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
  hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];

  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [ "-std=c11" ]);
+  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isFreeBSD "-lexecinfo";

  # darwin currently lacks a pure `pgrep` which is extensively used here
  doCheck = !stdenv.hostPlatform.isDarwin;
@ -93,6 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
      --timeout 2000 \
      --clients $NIX_BUILD_CORES \
      --tags -leaks \
+      --skipunit integration/aof-multi-part \
      --skipunit integration/failover # flaky and slow

    runHook postCheck
--- a/pkgs/by-name/rr/rrootage/package.nix
+++ b/pkgs/by-name/rr/rrootage/package.nix
@ -3,6 +3,8 @@
  stdenv,
  fetchpatch,
  fetchurl,
+  libGL,
+  libGLU,
  SDL,
  SDL_mixer,
  bulletml,
@ -47,6 +49,8 @@ stdenv.mkDerivation {
  '';

  buildInputs = [
+    libGL
+    libGLU
    SDL
    SDL_mixer
    bulletml
--- a/pkgs/by-name/sd/SDL_compat/package.nix
+++ b/pkgs/by-name/sd/SDL_compat/package.nix
@ -9,6 +9,7 @@
  libX11,
  mesa,
  pkg-config,
+  pkg-config-unwrapped,
  stdenv,
  # Boolean flags
  libGLSupported ? lib.elem stdenv.hostPlatform.system mesa.meta.platforms,
@ -39,6 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
      autoSignDarwinBinariesHook
    ];

+  # re-export PKG_CHECK_MODULES m4 macro used by sdl.m4
+  propagatedNativeBuildInputs = [ pkg-config-unwrapped ];
+
  buildInputs =
    [
      libX11
--- a/pkgs/by-name/se/selenium-manager/disable-telemetry.patch
+++ b/pkgs/by-name/se/selenium-manager/disable-telemetry.patch
@ -1,7 +1,7 @@
-diff --git a/rust/src/config.rs b/rust/src/config.rs
+diff --git a/src/config.rs b/src/config.rs
 index f7cd4f32ec..ec454127be 100644
--- a/rust/src/config.rs
-+++ b/rust/src/config.rs
+--- a/src/config.rs
+++ b/src/config.rs
@@ -120,7 +120,7 @@ impl ManagerConfig {
             avoid_browser_download: BooleanKey("avoid-browser-download", false).get_value(),
             language_binding: StringKey(vec!["language-binding"], "").get_value(),
--- a/pkgs/by-name/se/selenium-manager/package.nix
+++ b/pkgs/by-name/se/selenium-manager/package.nix
@ -7,25 +7,23 @@

 rustPlatform.buildRustPackage rec {
  pname = "selenium-manager";
-  version = "4.28.0";
+  version = "4.29.0";

  src = fetchFromGitHub {
    owner = "SeleniumHQ";
    repo = "selenium";
    tag = "selenium-${version}";
-    hash = "sha256-b5xwuZ4lcwLbGhJuEmHYrFXoaTW/M0ABdK3dvbpj8oM=";
+    hash = "sha256-IyMXgYl/TPTpe/Y0pFyJVKj4Mp0xbkg1LSCNHzFL3bE=";
  };

+  sourceRoot = "${src.name}/rust";
+
  patches = [
    ./disable-telemetry.patch
  ];

-  postPatch = ''
-    cd rust
-  '';
-
  useFetchCargoVendor = true;
-  cargoHash = "sha256-hXtF3qFzzM2TqpEP9JWdi7uU5TgFHF9lZO5bmZcEuDk=";
+  cargoHash = "sha256-MgnmEJif4Z4CcmBFkC5BJR67DMGm1ttObtl4LhAFw4g=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.SystemConfiguration
--- a/pkgs/by-name/se/setools/package.nix
+++ b/pkgs/by-name/se/setools/package.nix
@ -1,16 +1,17 @@
 {
  lib,
  fetchFromGitHub,
-  python3,
+  python3Packages,
  libsepol,
  libselinux,
  checkpolicy,
  withGraphics ? false,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "setools";
  version = "4.5.1";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "SELinuxProject";
@ -19,25 +20,32 @@ python3.pkgs.buildPythonApplication rec {
    hash = "sha256-/6dOzSz2Do4d6TSS50fuak0CysoQ532zJ0bJ532BUCE=";
  };

-  nativeBuildInputs = [ python3.pkgs.cython ];
+  build-system = with python3Packages; [
+    cython
+    setuptools
+  ];
+
  buildInputs = [ libsepol ];
-  propagatedBuildInputs =
-    with python3.pkgs;
+
+  dependencies =
+    with python3Packages;
    [
-      enum34
      libselinux
-      networkx
      setuptools
    ]
    ++ lib.optionals withGraphics [ pyqt5 ];

+  optional-dependencies = {
+    analysis = with python3Packages; [
+      networkx
+      pygraphviz
+    ];
+  };
+
  nativeCheckInputs = [
-    python3.pkgs.tox
+    python3Packages.tox
    checkpolicy
  ];
-  preCheck = ''
-    export CHECKPOLICY=${checkpolicy}/bin/checkpolicy
-  '';

  setupPyBuildFlags = [ "-i" ];

@ -45,10 +53,19 @@ python3.pkgs.buildPythonApplication rec {
    export SEPOL="${lib.getLib libsepol}/lib/libsepol.a"
  '';

-  meta = with lib; {
+  preCheck = ''
+    export CHECKPOLICY=${lib.getExe checkpolicy}
+  '';
+
+  meta = {
    description = "SELinux Policy Analysis Tools";
    homepage = "https://github.com/SELinuxProject/setools";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
+    changelog = "https://github.com/SELinuxProject/setools/blob/${version}/ChangeLog";
+    license = with lib.licenses; [
+      gpl2Only
+      lgpl21Plus
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/si/singular/package.nix
+++ b/pkgs/by-name/si/singular/package.nix
@ -119,12 +119,6 @@ stdenv.mkDerivation rec {
      -i '{}' ';'
  '';

-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  preConfigure = ''
-    substituteInPlace build-aux/ltmain.sh \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
  hardeningDisable = lib.optional stdenv.hostPlatform.isi686 "stackprotector";

  doCheck = true; # very basic checks, does not test any libraries
--- a/pkgs/by-name/sm/smpeg/package.nix
+++ b/pkgs/by-name/sm/smpeg/package.nix
@ -26,10 +26,9 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-nq/i7cFGpJXIuTwN/ScLMX7FN8NMdgdsRM9xOD3uycs=";
  };

-  patches = [
+  patches = lib.optionals (!stdenv.hostPlatform.isDarwin) [ ./libx11.patch ] ++ [
    ./format.patch
    ./gcc6.patch
-    ./libx11.patch
    ./gtk.patch
    # These patches remove use of the `register` storage class specifier,
    # allowing smpeg to build with clang 16, which defaults to C++17.
@ -93,7 +92,7 @@ stdenv.mkDerivation rec {
      --prefix PKG_CONFIG_PATH ":" "${lib.getDev SDL}/lib/pkgconfig"
  '';

-  NIX_LDFLAGS = "-lX11";
+  NIX_LDFLAGS = lib.optionalString (!stdenv.hostPlatform.isDarwin) "-lX11";

  meta = {
    homepage = "https://icculus.org/smpeg/";
--- a/pkgs/by-name/su/suricata/package.nix
+++ b/pkgs/by-name/su/suricata/package.nix
@ -27,7 +27,7 @@
  python3,
  zlib,
  redisSupport ? true,
-  redis,
+  valkey,
  hiredis,
  rustSupport ? true,
  rustc,
@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
    ]
    ++ lib.optional hyperscanSupport hyperscan
    ++ lib.optionals redisSupport [
-      redis
+      valkey
      hiredis
    ];

--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@ -8,6 +8,11 @@
  capabilitiesSupport ? stdenv.hostPlatform.isLinux,
  libcap_ng,
  libxcrypt,
+  # Disable this by default because `mount` is setuid. However, we also support
+  # "dlopen" as a value here. Note that the nixpkgs setuid wrapper and ld-linux.so will filter out LD_LIBRARY_PATH
+  # if you set this to dlopen, so ensure you're accessing it without the wrapper if you depend on that.
+  cryptsetupSupport ? false,
+  cryptsetup,
  ncursesSupport ? true,
  ncurses,
  pamSupport ? true,
@ -24,9 +29,11 @@
  gitUpdater,
 }:

+let
+  isMinimal = cryptsetupSupport == false && !nlsSupport && !ncursesSupport && !systemdSupport;
+in
 stdenv.mkDerivation rec {
-  pname =
-    "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
+  pname = "util-linux" + lib.optionalString isMinimal "-minimal";
  version = "2.40.4";

  src = fetchurl {
@ -88,6 +95,14 @@ stdenv.mkDerivation rec {
      "--disable-su" # provided by shadow
      (lib.enableFeature writeSupport "write")
      (lib.enableFeature nlsSupport "nls")
+      (lib.withFeatureAs (cryptsetupSupport != false) "cryptsetup" (
+        if cryptsetupSupport == true then
+          "yes"
+        else if cryptsetupSupport == "dlopen" then
+          "dlopen"
+        else
+          throw "invalid cryptsetupSupport value: ${toString cryptsetupSupport}"
+      ))
      (lib.withFeature ncursesSupport "ncursesw")
      (lib.withFeature systemdSupport "systemd")
      (lib.withFeatureAs systemdSupport "systemdsystemunitdir" "${placeholder "bin"}/lib/systemd/system/")
@ -117,10 +132,13 @@ stdenv.mkDerivation rec {
    "usrsbin_execdir=${placeholder "bin"}/sbin"
  ];

-  nativeBuildInputs = [
-    pkg-config
-    installShellFiles
-  ] ++ lib.optionals translateManpages [ po4a ];
+  nativeBuildInputs =
+    [
+      pkg-config
+      installShellFiles
+    ]
+    ++ lib.optionals translateManpages [ po4a ]
+    ++ lib.optionals (cryptsetupSupport == "dlopen") [ cryptsetup ];

  buildInputs =
    [
@ -128,6 +146,7 @@ stdenv.mkDerivation rec {
      libxcrypt
      sqlite
    ]
+    ++ lib.optionals (cryptsetupSupport == true) [ cryptsetup ]
    ++ lib.optionals pamSupport [ pam ]
    ++ lib.optionals capabilitiesSupport [ libcap_ng ]
    ++ lib.optionals ncursesSupport [ ncurses ]
@ -178,12 +197,12 @@ stdenv.mkDerivation rec {
    hasCol = stdenv.hostPlatform.libc == "glibc";
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
    description = "Set of system utilities for Linux";
    changelog = "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v${lib.versions.majorMinor version}/v${version}-ReleaseNotes";
    # https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/README.licensing
-    license = with licenses; [
+    license = with lib.licenses; [
      gpl2Only
      gpl2Plus
      gpl3Plus
@ -192,7 +211,8 @@ stdenv.mkDerivation rec {
      bsdOriginalUC
      publicDomain
    ];
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [ numinit ];
+    platforms = lib.platforms.unix;
    pkgConfigModules = [
      "blkid"
      "fdisk"
--- a/pkgs/by-name/wa/waydroid/package.nix
+++ b/pkgs/by-name/wa/waydroid/package.nix
@ -57,7 +57,6 @@ python3Packages.buildPythonApplication rec {

  dontUseSetuptoolsBuild = true;
  dontUsePipInstall = true;
-  dontUseSetuptoolsCheck = true;
  dontWrapPythonPrograms = true;
  dontWrapGApps = true;

--- a/pkgs/by-name/za/zammad/package.nix
+++ b/pkgs/by-name/za/zammad/package.nix
@ -14,7 +14,7 @@
  nodejs,
  pnpm_9,
  cacert,
-  redis,
+  valkey,
  dataDir ? "/var/lib/zammad",
 }:

@ -68,7 +68,7 @@ stdenvNoCC.mkDerivation {
  ];

  nativeBuildInputs = [
-    redis
+    valkey
    postgresql
    pnpm_9.configHook
    nodejs
--- a/pkgs/by-name/za/zap-chip/package.nix
+++ b/pkgs/by-name/za/zap-chip/package.nix
@ -10,16 +10,16 @@

 buildNpmPackage rec {
  pname = "zap-chip";
-  version = "2024.09.27";
+  version = "2025.02.26";

  src = fetchFromGitHub {
    owner = "project-chip";
    repo = "zap";
    rev = "v${version}";
-    hash = "sha256-Dc5rU4jJ6aJpk8mwL+XNSmtisYxF86VzXd/Aacd4p0o=";
+    hash = "sha256-oYw1CxeCr4dUpw7hhXjtB+QwTfBI7rG9jgfxWKZYsSc=";
  };

-  npmDepsHash = "sha256-ZFksGwKlXkz6XTs2QdalGB0hR16HfB69XQOFWI9X/KY=";
+  npmDepsHash = "sha256-dcnJfxgF1S2gyR+wPnBD4AFzix5Sdq2ZqDlXvWAFb8s=";

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
  env.CYPRESS_INSTALL_BINARY = "0";
--- a/pkgs/by-name/za/zaz/package.nix
+++ b/pkgs/by-name/za/zaz/package.nix
@ -6,6 +6,7 @@
  SDL,
  SDL_image,
  libgbm,
+  libGL,
  libtheora,
  libvorbis,
  libogg,
@ -29,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.getDev SDL)
    SDL_image
    libgbm
+    libGL
    libtheora
    libvorbis.dev
    libogg
--- a/pkgs/desktops/mate/caja/default.nix
+++ b/pkgs/desktops/mate/caja/default.nix
@ -46,12 +46,6 @@ stdenv.mkDerivation rec {

  configureFlags = [ "--disable-update-mimedb" ];

-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
  enableParallelBuilding = true;

  passthru.updateScript = mateUpdateScript { inherit pname; };
--- a/pkgs/desktops/mate/eom/default.nix
+++ b/pkgs/desktops/mate/eom/default.nix
@ -50,12 +50,6 @@ stdenv.mkDerivation rec {
    hicolor-icon-theme
  ];

-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace-warn 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
  enableParallelBuilding = true;

  passthru.updateScript = mateUpdateScript { inherit pname; };
--- a/pkgs/development/compilers/gcc/common/builder.nix
+++ b/pkgs/development/compilers/gcc/common/builder.nix
@ -278,7 +278,6 @@ originalAttrs:
      targetLibDir="''${targetConfig+$targetConfig/}lib"

      moveToOutput "$targetLibDir/lib*.so*" "''${!outputLib}"
-      moveToOutput "$targetLibDir/lib*.la"  "''${!outputLib}"
      moveToOutput "$targetLibDir/lib*.dylib" "''${!outputLib}"
      moveToOutput "$targetLibDir/lib*.dll.a" "''${!outputLib}"
      moveToOutput "$targetLibDir/lib*.dll" "''${!outputLib}"
@ -288,19 +287,18 @@ originalAttrs:
          moveToOutput "$targetLibDir/lib*.a" "''${!outputLib}"
      fi

-      for i in "''${!outputLib}"/$targetLibDir/*.{la,py}; do
+      for i in "''${!outputLib}"/$targetLibDir/*.py; do
          substituteInPlace "$i" --replace "$out" "''${!outputLib}"
      done

      # Multilib and cross can't exist at the same time, so just use lib64 here
      if [ -n "$enableMultilib" ]; then
          moveToOutput "lib64/lib*.so*" "''${!outputLib}"
-          moveToOutput "lib64/lib*.la"  "''${!outputLib}"
          moveToOutput "lib64/lib*.dylib" "''${!outputLib}"
          moveToOutput "lib64/lib*.dll.a" "''${!outputLib}"
          moveToOutput "lib64/lib*.dll" "''${!outputLib}"

-          for i in "''${!outputLib}"/lib64/*.{la,py}; do
+          for i in "''${!outputLib}"/lib64/*.py; do
              substituteInPlace "$i" --replace "$out" "''${!outputLib}"
          done
      fi
@ -313,6 +311,12 @@ originalAttrs:
      # More dependencies with the previous gcc or some libs (gccbug stores the build command line)
      rm -rf $out/bin/gccbug

+      # Remove .la files, they're not adjusted for the makeCompatibilitySymlink magic,
+      # which confuses libtool and leads to weird linking errors.
+      # Removing the files just makes libtool link .so files directly, which is usually
+      # what we want anyway.
+      find $out -name '*.la' -delete
+
      if type "install_name_tool"; then
          for i in "''${!outputLib}"/lib/*.*.dylib "''${!outputLib}"/lib/*.so.[0-9]; do
              install_name_tool -id "$i" "$i" || true
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@ -20,12 +20,12 @@ let
    };
    # By unofficial and very loose convention we keep the latest version of
    # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.5.0" = {
-      sha256 = "sha256-Lhiv0Ijkot8ht3uuLhcM5XDRHabSdgcpImXxzGqKGbE=";
-    };
    "2.5.1" = {
      sha256 = "sha256-QTOzbNFtFNYzlpw3/VHCyJqOpdbhYRVSgZ2R9xshn4s=";
    };
+    "2.5.2" = {
+      sha256 = "sha256-XcJ+un3aQz31P9dEHeixFHSoLNrBaJwfbOVfoGXWX6w=";
+    };
  };
  # Collection of pre-built SBCL binaries for platforms that need them for
  # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
--- a/pkgs/development/interpreters/luajit/2.0.nix
+++ b/pkgs/development/interpreters/luajit/2.0.nix
@ -9,13 +9,13 @@
 callPackage ./default.nix {
  # The patch version is the timestamp of the git commit,
  # obtain via `cat $(nix-build -A luajit_2_0.src)/.relver`
-  version = "2.0.1713483859";
+  version = "2.0.1741557863";

  src = fetchFromGitHub {
    owner = "LuaJIT";
    repo = "LuaJIT";
-    rev = "9b5e837ac2dfdc0638830c048a47ca9378c504d3";
-    hash = "sha256-GflF/sELSNanc9G4WMzoOadUBOFSs6OwqhAXa4sudWA=";
+    rev = "85c3f2fb6f59276ebf07312859a69d6d5a897f62";
+    hash = "sha256-5UIZ650M/0W08iX1ajaHvDbNgjbzZJ1akVwNbiDUeyY=";
  };

  extraMeta = {
--- a/pkgs/development/interpreters/luajit/2.1.nix
+++ b/pkgs/development/interpreters/luajit/2.1.nix
@ -8,13 +8,13 @@
 callPackage ./default.nix {
  # The patch version is the timestamp of the git commit,
  # obtain via `cat $(nix-build -A luajit_2_1.src)/.relver`
-  version = "2.1.1713773202";
+  version = "2.1.1741730670";

  src = fetchFromGitHub {
    owner = "LuaJIT";
    repo = "LuaJIT";
-    rev = "5790d253972c9d78a0c2aece527eda5b134bbbf7";
-    hash = "sha256-WG8AWDI182/9O7NrZlQ6ZH/esyYE2pWXMuSzWUuntSA=";
+    rev = "538a82133ad6fddfd0ca64de167c4aca3bc1a2da";
+    hash = "sha256-3DhNqVdojsWDo8mKJXIyTqFODIiKzThcAzHPdnoJaVM=";
  };

  inherit self passthruFun;
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@ -146,13 +146,60 @@ in
      };

  pytestCheckHook = callPackage (
-    { makePythonHook, pytest }:
+    {
+      makePythonHook,
+      pytest,
+      # For package tests
+      testers,
+      objprint,
+    }:
    makePythonHook {
      name = "pytest-check-hook";
      propagatedBuildInputs = [ pytest ];
      substitutions = {
        inherit pythonCheckInterpreter;
      };
+      passthru = {
+        tests = {
+          basic = objprint.overridePythonAttrs (previousPythonAttrs: {
+            pname = "test-pytestCheckHook-basic-${previousPythonAttrs.pname}";
+          });
+          disabledTests = objprint.overridePythonAttrs (previousPythonAttrs: {
+            pname = "test-pytestCheckHook-disabledTests-${previousPythonAttrs.pname}";
+            disabledTests = [
+              "test_print"
+            ] ++ previousPythonAttrs.disabledTests or [ ];
+          });
+          disabledTestPaths = objprint.overridePythonAttrs (previousPythonAttrs: {
+            pname = "test-pytestCheckHook-disabledTestPaths-${previousPythonAttrs.pname}";
+            disabledTestPaths = [
+              "tests/test_basic.py"
+            ] ++ previousPythonAttrs.disabledTestPaths or [ ];
+          });
+          disabledTestPaths-nonexistent = testers.testBuildFailure (
+            objprint.overridePythonAttrs (previousPythonAttrs: {
+              pname = "test-pytestCheckHook-disabledTestPaths-nonexistent-${previousPythonAttrs.pname}";
+              disabledTestPaths = [
+                "tests/test_foo.py"
+              ] ++ previousPythonAttrs.disabledTestPaths or [ ];
+            })
+          );
+          disabledTestPaths-glob = objprint.overridePythonAttrs (previousPythonAttrs: {
+            pname = "test-pytestCheckHook-disabledTestPaths-glob-${previousPythonAttrs.pname}";
+            disabledTestPaths = [
+              "tests/test_obj*.py"
+            ] ++ previousPythonAttrs.disabledTestPaths or [ ];
+          });
+          disabledTestPaths-glob-nonexistent = testers.testBuildFailure (
+            objprint.overridePythonAttrs (previousPythonAttrs: {
+              pname = "test-pytestCheckHook-disabledTestPaths-glob-nonexistent-${previousPythonAttrs.pname}";
+              disabledTestPaths = [
+                "tests/test_foo*.py"
+              ] ++ previousPythonAttrs.disabledTestPaths or [ ];
+            })
+          );
+        };
+      };
    } ./pytest-check-hook.sh
  ) { };

--- a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
@ -18,7 +18,7 @@ function pytestCheckPhase() {
    concatTo _pathsArray disabledTestPaths
    for path in "${_pathsArray[@]}"; do
        # Check if every path glob matches at least one path
-        @pythonCheckInterpreter@ <(cat <<EOF
+        @pythonCheckInterpreter@ - "$path" <<EOF
 import glob
 import sys
 path_glob=sys.argv[1]
@ -27,7 +27,6 @@ if not len(path_glob):
 if next(glob.iglob(path_glob), None) is None:
    sys.exit('Disabled tests path glob "{}" does not match any paths. Aborting'.format(path_glob))
 EOF
-        ) "$path"
        flagsArray+=("--ignore-glob=$path")
    done

--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@ -50,6 +50,9 @@ let
    stringLength
    ;

+  getOptionalAttrs =
+    names: attrs: lib.getAttrs (lib.intersectLists names (lib.attrNames attrs)) attrs;
+
  leftPadName =
    name: against:
    let
@ -196,8 +199,6 @@ in

  doCheck ? true,

-  disabledTestPaths ? [ ],
-
  # Allow passing in a custom stdenv to buildPython*
  stdenv ? python.stdenv,

@ -437,24 +438,14 @@ let
      installCheckPhase = attrs.checkPhase;
    }
    // optionalAttrs (attrs.doCheck or true) (
-      optionalAttrs (disabledTestPaths != [ ]) {
-        disabledTestPaths = disabledTestPaths;
-      }
-      // optionalAttrs (attrs ? disabledTests) {
-        disabledTests = attrs.disabledTests;
-      }
-      // optionalAttrs (attrs ? pytestFlags) {
-        pytestFlags = attrs.pytestFlags;
-      }
-      // optionalAttrs (attrs ? pytestFlagsArray) {
-        pytestFlagsArray = attrs.pytestFlagsArray;
-      }
-      // optionalAttrs (attrs ? unittestFlags) {
-        unittestFlags = attrs.unittestFlags;
-      }
-      // optionalAttrs (attrs ? unittestFlagsArray) {
-        unittestFlagsArray = attrs.unittestFlagsArray;
-      }
+      getOptionalAttrs [
+        "disabledTestPaths"
+        "disabledTests"
+        "pytestFlags"
+        "pytestFlagsArray"
+        "unittestFlags"
+        "unittestFlagsArray"
+      ] attrs
    )
  );

--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@ -71,13 +71,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "SDL2";
-  version = "2.32.0";
+  version = "2.32.2";

  src = fetchFromGitHub {
    owner = "libsdl-org";
    repo = "SDL";
    rev = "release-${finalAttrs.version}";
-    hash = "sha256-BdyMlttrDwQMoz+bO6bfU3bh0xKnT8yQF6nb6OGRbHw=";
+    hash = "sha256-Gtg8G1tRouGZbes1KhsXpYbItpNHYqJCiQKW/L77b+U=";
  };
  dontDisableStatic = if withStatic then 1 else 0;
  outputs = [
--- a/Show more
+++ b/Show more