staging-next 2025-03-13 (#389579)

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -231,6 +231,9 @@
 
 - `services.cloudflare-dyndns.apiTokenFile` now must be just your Cloudflare api token. Previously it was supposed to be a file of the form `CLOUDFLARE_API_TOKEN=...`.
 
+- Emacs lisp build helpers, such as `emacs.pkgs.melpaBuild`, now enables `__structuredAttrs` by default.
+  Environment variables have to be passed via the `env` attribute.
+
 - `buildGoModule` now passes environment variables via the `env` attribute. `CGO_ENABLED` should now be specified with `env.CGO_ENABLED` when passing to buildGoModule. Direct specification of `CGO_ENABLED` is now redirected by a compatibility layer with a warning, but will become an error in future releases.
 
   Go-related environment variables previously shadowed by `buildGoModule` now results in errors when specified directly. Such variables include `GOOS` and `GOARCH`.

nixos/modules/profiles/installation-device.nix

@@ -102,10 +102,10 @@ with lib;
         stdenv
         stdenvNoCC # for runCommand
         busybox
-        jq # for closureInfo
         # For boot.initrd.systemd
         makeInitrdNGTool
-      ];
+      ]
+      ++ jq.all; # for closureInfo
 
     boot.swraid.enable = true;
     # remove warning about unset mail

pkgs/applications/audio/cdparanoia/default.nix

@@ -5,6 +5,7 @@
   fetchpatch,
   updateAutotoolsGnuConfigScriptsHook,
   autoreconfHook,
+  freebsd,
 }:
 
 stdenv.mkDerivation rec {
@@ -37,7 +38,7 @@ stdenv.mkDerivation rec {
       })
     ]
     ++ [
-      # Has to come after darwin patches
+      # Has to come after darwin patches and before freebsd patches
       ./fix_private_keyword.patch
       # Order does not matter
       ./configure.patch
@@ -62,13 +63,98 @@ stdenv.mkDerivation rec {
         hash = "sha256-krfprwls0L3hsNfoj2j69J5k1RTKEQtzE0fLYG9EJKo=";
       })
     ]
-    ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch;
+    ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
+    ++ [
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_low__interface.h";
+        hash = "sha256-bXrcRFCbU7/7/N+J8VGKGSxIB1m8XwoAlc/KTnt9wN0=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_scan__devices.c";
+        hash = "sha256-UD7SXeypF3bAqT7Y24UOrGZNaD8ZmpS2V7XQU+3VKXk=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<private\>/private_data/g' $out
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_cdda__interface.h";
+        hash = "sha256-JL4qe4LwmNp2jQFqTvyRjc6bixGqYr6BZmqsYIY9xhw=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_common__interface.c";
+        hash = "sha256-vw0oFM6w15YBaAK01FwVcSN+oztSfo5jL6OlGy0iWBg=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_cooked__interface.c";
+        hash = "sha256-g39dhxb8+K9BIb2/5cmkQ9GYjg4gDjj6sv+dXx93kQ4=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_interface.c";
+        hash = "sha256-LMWfbqLjbQM3L4H3orAxyyAHf1hVtFwfmZY8NmBLKzs=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<private\>/private_data/g' $out
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_scsi__interface.c";
+        hash = "sha256-dx6YCWW8J0e455phaYDUMiOCvp4DsfINjSEiEfnHaNI=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<private\>/private_data/g' $out
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-Makefile.in";
+        hash = "sha256-Wje2d58xrSWHJNktQRHcNSbh5yh6vMtpgc/3G4D1vrI=";
+        extraPrefix = "";
+        postFetch = ''
+          sed -E -i -e 's/\<Linux\>/__linux__/g' $out
+        '';
+      })
+    ];
 
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
     autoreconfHook
   ];
 
+  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isFreeBSD [
+    # cdparanoia shipped headers have #include <libcam.h>
+    # (it is part of the freebsd base system so this is reasonable
+    # but we want to keep the default freebsd libs, freebsd.libc, small)
+    freebsd.libcam
+  ];
+
+  env =
+    lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+      NIX_LDFLAGS = "-lcam";
+    }
+    // {
+      BSD_INSTALL_PROGRAM = "install";
+      BSD_INSTALL_LIB = "install";
+    };
+
   # Build system reuses the same object file names for shared and static
   # library. Occasionally fails in the middle:
   #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c

pkgs/applications/editors/emacs/build-support/generic.nix

@@ -61,6 +61,7 @@ lib.extendMkDerivation {
       propagatedUserEnvPkgs = finalAttrs.packageRequires ++ propagatedUserEnvPkgs;
 
       strictDeps = args.strictDeps or true;
+      __structuredAttrs = args.__structuredAttrs or true;
 
       inherit turnCompilationWarningToError ignoreCompilationError;
 

pkgs/applications/misc/sl1-to-photon/default.nix

@@ -31,7 +31,6 @@ buildPythonApplication rec {
   ];
 
   format = "setuptools";
-  dontUseSetuptoolsCheck = true;
 
   installPhase = ''
     install -D -m 0755 SL1_to_Photon.py $out/bin/${pname}

pkgs/applications/version-management/sourcehut/core.nix

@@ -83,7 +83,6 @@ buildPythonPackage rec {
 
   PKGVER = version;
 
-  dontUseSetuptoolsCheck = true;
   pythonImportsCheck = [ "srht" ];
 
   meta = with lib; {

pkgs/applications/version-management/sourcehut/scm.nix

@@ -37,8 +37,6 @@ buildPythonPackage rec {
     export PKGVER=${version}
   '';
 
-  dontUseSetuptoolsCheck = true;
-
   pythonImportsCheck = [ "scmsrht" ];
 
   meta = with lib; {

pkgs/applications/version-management/sourcehut/todo.nix

@@ -72,8 +72,6 @@ buildPythonPackage rec {
     pytest
     factory-boy
   ];
-
-  dontUseSetuptoolsCheck = true;
   pythonImportsCheck = [ "todosrht" ];
 
   meta = with lib; {

pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh

@@ -1,15 +1,35 @@
 needsTarget=true
+targetValue=""
+
+declare -i n=0
+nParams=${#params[@]}
+while (("$n" < "$nParams")); do
+    p=${params[n]}
+    v=${params[n + 1]:-} # handle `p` being last one
+    n+=1
 
-for p in "${params[@]}"; do
     case "$p" in
-    -target | --target=*)
+    -target)
+        if [ -z "$v" ]; then
+            echo "Error: -target requires an argument" >&2
+            exit 1
+        fi
         needsTarget=false
-
+        targetValue=$v
-        echo "Warning: supplying the --target argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead." >&2
+        # skip parsing the value of -target
+        n+=1
+        ;;
+    --target=*)
+        needsTarget=false
+        targetValue="${p#*=}"
         ;;
     esac
 done
 
+if ! $needsTarget && [[ "$targetValue" != "@defaultTarget@" ]]; then
+    echo "Warning: supplying the --target $targetValue != @defaultTarget@ argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead." >&2
+fi
+
 if $needsTarget && [[ $0 != *cpp ]]; then
     extraBefore+=(-target @defaultTarget@ @machineFlags@)
 fi

pkgs/build-support/kernel/make-initrd.nix

@@ -20,7 +20,6 @@ let
 in
 {
   stdenvNoCC,
-  perl,
   cpio,
   ubootTools,
   lib,
@@ -101,7 +100,6 @@ stdenvNoCC.mkDerivation (
     builder = ./make-initrd.sh;
 
     nativeBuildInputs = [
-      perl
       cpio
     ] ++ lib.optional makeUInitrd ubootTools;
 
@@ -121,14 +119,7 @@ stdenvNoCC.mkDerivation (
     symlinks = map (x: x.symlink) contents;
     suffices = map (x: if x ? suffix then x.suffix else "none") contents;
 
-    # For obtaining the closure of `contents'.
+    closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = objects; }}";
-    # Note: we don't use closureInfo yet, as that won't build with nix-1.x.
-    # See #36268.
-    exportReferencesGraph = lib.zipListsWith (x: i: [
-      ("closure-${toValidStoreName (baseNameOf x.symlink)}-${toString i}")
-      x.object
-    ]) contents (lib.range 0 (lib.length contents - 1));
-    pathsFromGraph = ./paths-from-graph.pl;
   }
   // lib.optionalAttrs makeUInitrd {
     uInitrdCompression = uInitrdCompression;

pkgs/build-support/kernel/make-initrd.sh

@@ -24,7 +24,7 @@ done
 
 
 # Get the paths in the closure of `object'.
-storePaths=$(perl $pathsFromGraph closure-*)
+storePaths="$(cat $closureInfo/store-paths)"
 
 
 # Paths in cpio archives *must* be relative, otherwise the kernel

pkgs/build-support/kernel/paths-from-graph.pl

@@ -1,68 +0,0 @@
-# NOTE: this script is deprecated. Use closureInfo instead.
-
-# Parses a /nix/store/*-closure file and prints
-# various information.
-# By default, the nodes in the graph are printed to stdout.
-# If printRegistration is set, then the graph is written
-# as a registration file for a manifest is written
-# in the `nix-store --load-db' format.
-
-use strict;
-use File::Basename;
-
-my %storePaths;
-my %refs;
-
-# Each argument on the command line is a graph file.
-# The graph file contains line-triples and a variable
-# number of references:
-# <store-path>
-# <deriver>
-# <count>
-# <ref-#1>
-# ...
-# <ref-#count>
-foreach my $graph (@ARGV) {
-    open GRAPH, "<$graph" or die;
-
-    while (<GRAPH>) {
-        chomp;
-        my $storePath = "$_";
-        $storePaths{$storePath} = 1;
-
-        my $deriver = <GRAPH>; chomp $deriver;
-        my $count = <GRAPH>; chomp $count;
-
-        my @refs = ();
-        for (my $i = 0; $i < $count; ++$i) {
-            my $ref = <GRAPH>; chomp $ref;
-            push @refs, $ref;
-        }
-        $refs{$storePath} = \@refs;
-        
-    }
-    
-    close GRAPH;
-}
-
-
-if ($ENV{"printRegistration"} eq "1") {
-    # This is the format used by `nix-store --register-validity
-    # --hash-given' / `nix-store --load-db'.
-    foreach my $storePath (sort (keys %storePaths)) {
-        print "$storePath\n";
-        print "0000000000000000000000000000000000000000000000000000000000000000\n"; # !!! fix
-        print "0\n"; # !!! fix	
-        print "\n"; # don't care about preserving the deriver
-        print scalar(@{$refs{$storePath}}), "\n";
-        foreach my $ref (@{$refs{$storePath}}) {
-            print "$ref\n";
-        }
-    }
-}
-
-else {
-    foreach my $storePath (sort (keys %storePaths)) {
-        print "$storePath\n";
-    }
-}

pkgs/build-support/rust/hooks/cargo-build-hook.sh

@@ -38,7 +38,7 @@ cargoBuildHook() {
     concatTo flagsArray cargoBuildFlags
 
     echoCmd 'cargoBuildHook flags' "${flagsArray[@]}"
-    cargo build "${flagsArray[@]}"
+    @setEnv@ cargo build "${flagsArray[@]}"
 
     if [ -n "${buildAndTestSubdir-}" ]; then
         popd

pkgs/build-support/rust/hooks/cargo-check-hook.sh

@@ -37,7 +37,7 @@ cargoCheckHook() {
     concatTo flagsArray cargoTestFlags checkFlags checkFlagsArray
 
     echoCmd 'cargoCheckHook flags' "${flagsArray[@]}"
-    cargo test "${flagsArray[@]}"
+    @setEnv@ cargo test "${flagsArray[@]}"
 
     if [[ -n "${buildAndTestSubdir-}" ]]; then
         popd

pkgs/build-support/rust/hooks/default.nix

@@ -27,6 +27,8 @@
       name = "cargo-build-hook.sh";
       substitutions = {
         inherit (stdenv.targetPlatform.rust) rustcTarget;
+        inherit (rust.envVars) setEnv;
+
       };
       passthru.tests =
         {
@@ -44,6 +46,7 @@
       name = "cargo-check-hook.sh";
       substitutions = {
         inherit (stdenv.targetPlatform.rust) rustcTarget;
+        inherit (rust.envVars) setEnv;
       };
       passthru.tests =
         {
@@ -136,6 +139,8 @@
       ];
       substitutions = {
         inherit (stdenv.targetPlatform.rust) rustcTarget;
+        inherit (rust.envVars) setEnv;
+
       };
     } ./maturin-build-hook.sh
   ) { };

pkgs/build-support/rust/hooks/maturin-build-hook.sh

@@ -31,7 +31,7 @@ maturinBuildHook() {
     concatTo flagsArray maturinBuildFlags
 
     echoCmd 'maturinBuildHook flags' "${flagsArray[@]}"
-    maturin build "${flagsArray[@]}"
+    @setEnv@ maturin build "${flagsArray[@]}"
 
     if [ -n "${buildAndTestSubdir-}" ]; then
         popd

pkgs/build-support/setup-hooks/no-broken-symlinks.sh

@@ -13,7 +13,8 @@ postFixupHooks+=(noBrokenSymlinksInAllOutputs)
 
 # A symlink is "dangling" if it points to a non-existent target.
 # A symlink is "reflexive" if it points to itself.
-# A symlink is considered "broken" if it is either dangling or reflexive.
+# A symlink is "unreadable" if the readlink command fails, e.g. because of permission errors.
+# A symlink is considered "broken" if it is either dangling, reflexive or unreadable.
 noBrokenSymlinks() {
   local -r output="${1:?}"
   local path
@@ -21,6 +22,7 @@ noBrokenSymlinks() {
   local symlinkTarget
   local -i numDanglingSymlinks=0
   local -i numReflexiveSymlinks=0
+  local -i numUnreadableSymlinks=0
 
   # NOTE(@connorbaker): This hook doesn't check for cycles in symlinks.
 
@@ -33,7 +35,11 @@ noBrokenSymlinks() {
   # NOTE: path is absolute because we're running `find` against an absolute path (`output`).
   while IFS= read -r -d $'\0' path; do
     pathParent="$(dirname "$path")"
-    symlinkTarget="$(readlink "$path")"
+    if ! symlinkTarget="$(readlink "$path")"; then
+      nixErrorLog "the symlink $path is unreadable"
+      numUnreadableSymlinks+=1
+      continue
+    fi
 
     # Canonicalize symlinkTarget to an absolute path.
     if [[ $symlinkTarget == /* ]]; then
@@ -61,8 +67,8 @@ noBrokenSymlinks() {
     fi
   done < <(find "$output" -type l -print0)
 
-  if ((numDanglingSymlinks > 0 || numReflexiveSymlinks > 0)); then
+  if ((numDanglingSymlinks > 0 || numReflexiveSymlinks > 0 || numUnreadableSymlinks > 0)); then
-    nixErrorLog "found $numDanglingSymlinks dangling symlinks and $numReflexiveSymlinks reflexive symlinks"
+    nixErrorLog "found $numDanglingSymlinks dangling symlinks, $numReflexiveSymlinks reflexive symlinks and $numUnreadableSymlinks unreadable symlinks"
     exit 1
   fi
   return 0

pkgs/by-name/_1/_1oom/package.nix

@@ -6,6 +6,7 @@
   autoreconfHook,
   allegro,
   libsamplerate,
+  libGLU,
   libX11,
   libXext,
   SDL,
@@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     allegro
     libsamplerate
+    libGLU
     libX11
     libXext
     SDL

pkgs/by-name/az/azimuth/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  libGL,
   SDL,
   which,
   installTool ? false,
@@ -19,7 +20,10 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ which ];
-  buildInputs = [ SDL ];
+  buildInputs = [
+    libGL
+    SDL
+  ];
 
   env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=maybe-uninitialized" ];
 

pkgs/by-name/bo/bonmin/package.nix

@@ -57,12 +57,6 @@ stdenv.mkDerivation rec {
     "--with-asl-lib=-lipoptamplinterface -lamplsolver"
   ];
 
-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
   # Fix doc install. Should not be necessary after next release
   # ref https://github.com/coin-or/Bonmin/commit/4f665bc9e489a73cb867472be9aea518976ecd28
   sourceRoot = "${src.name}/Bonmin";

pkgs/by-name/bo/borgmatic/package.nix

@@ -30,7 +30,7 @@ python3Packages.buildPythonApplication rec {
     [
       flexmock
       pytestCheckHook
-      pytest-cov
+      pytest-cov-stub
     ]
     ++ optional-dependencies.apprise;
 
@@ -40,11 +40,6 @@ python3Packages.buildPythonApplication rec {
     "test_borgmatic_version_matches_news_version"
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '--cov-fail-under=100' ""
-  '';
-
   nativeBuildInputs = [ installShellFiles ];
 
   propagatedBuildInputs = with python3Packages; [

pkgs/by-name/bt/btanks/package.nix

@@ -6,7 +6,9 @@
   fetchpatch,
   fetchurl,
   libGL,
+  libGLU,
   libvorbis,
+  libX11,
   lua,
   pkg-config,
   scons,
@@ -62,6 +64,8 @@ stdenv.mkDerivation (finalAttrs: {
     SDL_image
     expat
     libGL
+    libGLU
+    libX11
     libvorbis
     lua
     smpeg

pkgs/by-name/ca/caprice32/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   desktop-file-utils,
+  libGLU,
   libpng,
   pkg-config,
   SDL,
@@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
   buildInputs = [
+    libGLU
     libpng
     SDL
     freetype

pkgs/by-name/cf/cfitsio/package.nix

@@ -31,6 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-reentrant"
   ];
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    # concerning. upstream defines XOPEN_SOURCE=700 which makes FreeBSD very insistent on
+    # not showing us gethostbyname()
+    NIX_CFLAGS_COMPILE = "-D__BSD_VISIBLE=1";
+  };
+
   hardeningDisable = [ "format" ];
 
   # Shared-only build
@@ -58,6 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
       xbreak
       hjones2199
     ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ch/chromaprint/package.nix

@@ -1,22 +1,31 @@
-{ lib
+{
-, stdenv
+  lib,
-, fetchurl
+  stdenv,
-, fetchpatch
+  fetchFromGitHub,
-, fetchpatch2
+  fetchpatch,
-, cmake
+  fetchpatch2,
-, ninja
+  fetchurl,
-, ffmpeg
+  cmake,
-, darwin
+  ninja,
-, zlib
+  ffmpeg-headless,
+  darwin,
+  zlib,
+  testers,
+  validatePkgConfig,
+  nix-update-script,
+  withExamples ? true,
+  withTools ? true,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "chromaprint";
   version = "1.5.1";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/acoustid/chromaprint/releases/download/v${version}/${pname}-${version}.tar.gz";
+    owner = "acoustid";
-    sha256 = "sha256-oarY+juLGLeNN1Wzdn+v+au2ckLgG0eOyaZOGQ8zXhw=";
+    repo = "chromaprint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bFplHaqXYvGbl8E8b/HUNFO4X+B/HPZjGTmuVFPjS3g=";
   };
 
   patches = [
@@ -40,18 +49,64 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ cmake ninja ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+    validatePkgConfig
+  ];
 
-  buildInputs = [ ffmpeg ] ++ lib.optionals stdenv.hostPlatform.isDarwin
+  buildInputs =
-    (with darwin.apple_sdk.frameworks; [ Accelerate CoreGraphics CoreVideo zlib ]);
+    [ ffmpeg-headless ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        Accelerate
+        CoreGraphics
+        CoreVideo
+        zlib
+      ]
+    );
 
-  cmakeFlags = [ "-DBUILD_EXAMPLES=ON" "-DBUILD_TOOLS=ON" ];
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_EXAMPLES" withExamples)
+    (lib.cmakeBool "BUILD_TOOLS" withTools)
+  ];
 
-  meta = with lib; {
+  passthru = {
-    homepage = "https://acoustid.org/chromaprint";
+    updateScript = nix-update-script { };
-    description = "AcoustID audio fingerprinting library";
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-    mainProgram = "fpcalc";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.unix;
   };
-}
+
+  doCheck = true;
+  checkPhase =
+    let
+      exampleAudio = fetchurl {
+        name = "Dvorak_Symphony_9_1.mp3";
+        url = "https://archive.org/download/Dvorak_Symphony_9/01.Adagio-Allegro_Molto.mp3";
+        hash = "sha256-I+Ve3/OpL+3Joc928F8M21LhCH2eQfRtaJVx9mNOLW0=";
+        meta.license = lib.licenses.publicDomain;
+      };
+
+      # sha256 because actual output of fpcalc is quite long
+      expectedHash = "c47ae40e02caf798ff5ab4d91ff00cfdca8f6786c581662436941d3e000c9aac";
+    in
+    ''
+      runHook preCheck
+      tests/all_tests
+      ${lib.optionalString withTools "diff -u <(src/cmd/fpcalc ${exampleAudio} | sha256sum | cut -c-64) <(echo '${expectedHash}')"}
+      runHook postCheck
+    '';
+
+  meta =
+    {
+      changelog = "https://github.com/acoustid/chromaprint/releases/tag/v${finalAttrs.version}";
+      homepage = "https://acoustid.org/chromaprint";
+      description = "AcoustID audio fingerprinting library";
+      license = lib.licenses.lgpl21Plus;
+      platforms = lib.platforms.unix;
+      pkgConfigModules = [ "libchromaprint" ];
+    }
+    // lib.attrsets.optionalAttrs withTools {
+      mainProgram = "fpcalc";
+    };
+})

pkgs/by-name/cr/cryptsetup/package.nix

@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
     ++ (lib.mapAttrsToList (lib.flip lib.enableFeature)) programs;
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals rebuildMan [ asciidoctor ];
-  buildInputs = [
+  propagatedBuildInputs = [
     lvm2
     json_c
     openssl
@@ -106,7 +106,10 @@ stdenv.mkDerivation rec {
     changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${version}/docs/v${version}-ReleaseNotes";
     license = lib.licenses.gpl2Plus;
     mainProgram = "cryptsetup";
-    maintainers = with lib.maintainers; [ raitobezarius ];
+    maintainers = with lib.maintainers; [
+      numinit
+      raitobezarius
+    ];
     platforms = with lib.platforms; linux;
   };
 }

pkgs/by-name/ec/eclib/package.nix

@@ -41,13 +41,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoreconfHook
   ];
-
-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
   doCheck = true;
   meta = with lib; {
     description = "Elliptic curve tools";

pkgs/by-name/fa/faad2/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "faad2";
-  version = "2.11.1";
+  version = "2.11.2";
 
   src = fetchFromGitHub {
     owner = "knik0";
     repo = "faad2";
     rev = version;
-    hash = "sha256-E6oe7yjYy1SJo8xQkyUk1sSucKDMPxwUFVSAyrf4Pd8=";
+    hash = "sha256-JvmblrmE3doUMUwObBN2b+Ej+CDBWNemBsyYSCXGwo8=";
   };
 
   outputs = [

pkgs/by-name/fa/fast-float/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fast-float";
-  version = "8.0.0";
+  version = "8.0.1";
 
   src = fetchFromGitHub {
     owner = "fastfloat";
     repo = "fast_float";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-shP+me3iqTRrsPGYrvcbnJNRZouQbW62T24xfkEgGSE=";
+    hash = "sha256-Y13JdBk8pZyg748fEOj+O/6gMAaqNXIE2fLY5tsMGB0=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/fl/flite/package.nix

@@ -31,14 +31,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Tq5pyg3TiQt8CPqGXTyLOaGgaeLTmPp+Duw3+2VAF9g=";
   };
 
-  # https://github.com/festvox/flite/pull/60.
-  # Replaces `ar` with `$(AR)` in config/common_make_rules.
-  # Improves cross-compilation compatibility.
   patches = [
+    # https://github.com/festvox/flite/pull/60.
+    # Replaces `ar` with `$(AR)` in config/common_make_rules.
+    # Improves cross-compilation compatibility.
     (fetchpatch {
       url = "https://github.com/festvox/flite/commit/54c65164840777326bbb83517568e38a128122ef.patch";
       hash = "sha256-hvKzdX7adiqd9D+9DbnfNdqEULg1Hhqe1xElYxNM1B8=";
     })
+    # patch missing bsd conditions in configure
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/0d316feccaf89c1bd804d6001274426a7135c93a/audio/flite/files/patch-configure";
+      hash = "sha256-D2wOtmHFcuA8JRtIds03yPrBGtMuhLJHuufEQdpcB58=";
+      extraPrefix = "";
+    })
   ];
 
   buildInputs = lib.optional stdenv.hostPlatform.isLinux (

pkgs/by-name/gh/ghostscript/package.nix

@@ -63,11 +63,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ghostscript${lib.optionalString x11Support "-with-X"}";
-  version = "10.04.0";
+  version = "10.05.0";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${lib.replaceStrings ["."] [""] version}/ghostscript-${version}.tar.xz";
-    hash = "sha256-Un7vC2zQTs8cjXoReWxppS00/+Nq/KhqQAcpovwByIc=";
+    hash = "sha256-qsnE/fYYBadvYiABJzXBroMoE3iDFL/AQFXMDIlZuaM=";
   };
 
   patches = [

pkgs/by-name/gi/gi-docgen/package.nix

@@ -9,13 +9,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2024.1";
+  version = "2025.3";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
-    hash = "sha256-hwx3+WIEYszknjVUKkLcFhL8hYcz6D274kjFNUWK7B4=";
+    hash = "sha256-iomli8D3ffw+iioONJf8OfVBOuNeVZfp7GFgq/juFNg=";
   };
 
   depsBuildBuild = [

pkgs/by-name/gi/giac/package.nix

@@ -106,12 +106,6 @@ stdenv.mkDerivation rec {
     substituteInPlace src/global.cc --replace 'browser="mozilla"' 'browser="xdg-open"'
   '';
 
-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
   nativeBuildInputs = [
     autoreconfHook
     texliveSmall

pkgs/by-name/gl/glib/package.nix

@@ -76,7 +76,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.82.4";
+  version = "2.82.5";
 
   outputs = [
     "bin"
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-N90Id/6WTNFemicQsEShgw+xvZNlKm0Mtriy3/GHxwk=";
+    hash = "sha256-BcIDH5vfa1q6egbKhPC0rO0osZvxtQxqslzGdSd8vD8=";
   };
 
   patches =
@@ -249,7 +249,6 @@ stdenv.mkDerivation (finalAttrs: {
       "-Dlibelf=disabled"
     ]
     ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
-      "-Db_lundef=false"
       "-Dxattr=false"
       "-Dsysprof=disabled" # sysprof-capture does not build on FreeBSD
     ];

pkgs/by-name/gl/glusterfs/package.nix

@@ -159,12 +159,6 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
   ];
 
-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
   nativeBuildInputs = [
     autoconf
     automake

pkgs/by-name/gn/gnujump/package.nix

@@ -4,6 +4,8 @@
   makeDesktopItem,
   copyDesktopItems,
   fetchurl,
+  libGL,
+  libGLU,
   SDL,
   SDL_image,
   SDL_mixer,
@@ -19,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ copyDesktopItems ];
   buildInputs = [
+    libGL
+    libGLU
     SDL
     SDL_image
     SDL_mixer

pkgs/by-name/gp/gpodder/package.nix

@@ -2,7 +2,6 @@
   lib,
   fetchFromGitHub,
   gitUpdater,
-  glibcLocales,
   adwaita-icon-theme,
   gobject-introspection,
   gtk3,
@@ -35,7 +34,6 @@ python311Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     intltool
     wrapGAppsHook3
-    glibcLocales
     gobject-introspection
   ];
 
@@ -73,10 +71,6 @@ python311Packages.buildPythonApplication rec {
     "share/dbus-1/services/org.gpodder.service"
   ];
 
-  preBuild = ''
-    export LC_ALL="en_US.UTF-8"
-  '';
-
   installCheckPhase = ''
     LC_ALL=C PYTHONPATH=src/:$PYTHONPATH pytest --ignore=tests --ignore=src/gpodder/utilwin32ctypes.py --doctest-modules src/gpodder/util.py src/gpodder/jsonconfig.py
     LC_ALL=C PYTHONPATH=src/:$PYTHONPATH pytest tests --ignore=src/gpodder/utilwin32ctypes.py --ignore=src/mygpoclient --cov=gpodder

pkgs/by-name/gt/gtk4-layer-shell/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   meson,
+  mesonEmulatorHook,
   ninja,
   pkg-config,
   gtk-doc,
@@ -50,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     docbook_xml_dtd_43
     vala
     wayland-scanner
-  ];
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
 
   buildInputs = [
     gtk4

pkgs/by-name/hh/hhexen/package.nix

@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  libGL,
+  libGLU,
   SDL,
   SDL_mixer,
   autoreconfHook,
@@ -25,6 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    libGL
+    libGLU
     SDL
     SDL_mixer
   ];

pkgs/by-name/hi/hifiscan/package.nix

@@ -20,8 +20,6 @@ python3Packages.buildPythonApplication {
     pyqtgraph
   ];
 
-  dontUseSetuptoolsCheck = true;
-
   src = fetchPypi {
     inherit pname version hash;
   };

pkgs/by-name/hw/hwdata/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.392";
+  version = "0.393";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-DjtPoPZZwFmVRZTOG4A+2KXI6zw68QEwq0iFRoV+5c4=";
+    hash = "sha256-RDp5NY9VYD0gylvzYpg9BytfRdQ6dim1jJtv32yeF3k=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];

pkgs/by-name/ir/irrd/package.nix

@@ -6,7 +6,7 @@
 , git
 , postgresql
 , postgresqlTestHook
-, redis
+, valkey
 }:
 
 let
@@ -84,7 +84,7 @@ py.pkgs.buildPythonPackage rec {
 
   nativeCheckInputs = [
     git
-    redis
+    valkey
     postgresql
     postgresqlTestHook
   ] ++ (with py.pkgs; [

pkgs/by-name/ja/jack_oscrolloscope/package.nix

@@ -6,6 +6,7 @@
   libjack2,
   libGLU,
   libGL,
+  libX11,
   pkg-config,
 }:
 
@@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
     libjack2
     libGLU
     libGL
+    libX11
   ];
 
   installPhase = ''

pkgs/by-name/le/lerc/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  buildPackages,
   fetchFromGitHub,
   fetchpatch,
   cmake,
@@ -23,14 +24,28 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IHY9QtNYsxPz/ksxRMZGHleT+/bawfTYNVRSTAuYQ7Y=";
   };
 
-  patches = [
+  # Required to get the freebsd-ports patch to apply.
-    # https://github.com/Esri/lerc/pull/227
+  # There seem to be inconsistent line endings in this project - just converting the patch doesn't work
-    (fetchpatch {
+  prePatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
-      name = "use-cmake-install-full-dir.patch";
+    ${buildPackages.dos2unix}/bin/dos2unix src/LercLib/fpl_EsriHuffman.cpp src/LercLib/fpl_Lerc2Ext.cpp
-      url = "https://github.com/Esri/lerc/commit/5462ca7f7dfb38c65e16f5abfd96873af177a0f8.patch";
+  '';
-      hash = "sha256-qaNR3QwLe0AB6vu1nXOh9KhlPdWM3DmgCJj4d0VdOUk=";
+
-    })
+  patches =
-  ];
+    [
+      # https://github.com/Esri/lerc/pull/227
+      (fetchpatch {
+        name = "use-cmake-install-full-dir.patch";
+        url = "https://github.com/Esri/lerc/commit/5462ca7f7dfb38c65e16f5abfd96873af177a0f8.patch";
+        hash = "sha256-qaNR3QwLe0AB6vu1nXOh9KhlPdWM3DmgCJj4d0VdOUk=";
+      })
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/ee9e39ceb1af729ac33854b5f3de652cb5ce0eca/graphics/lerc/files/patch-_assert";
+        hash = "sha256-agvGqgIsKS8v43UZdTVxDRDGbZdj2+AzKoQONvQumB4=";
+        extraPrefix = "";
+      })
+    ];
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/li/libcap/package.nix

@@ -21,11 +21,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.73";
+  version = "2.74";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    hash = "sha256-ZAX2CJz0zdjCcVQM2ZBlTXjdCxmJstm9og+TOnWnlaU=";
+    hash = "sha256-64UnHyiTGIZEtkUc7Izpn0VBSY8W/5+Eh3wvyHJxdxQ=";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" ]

pkgs/by-name/li/libid3tag/CVE-2017-11550-and-CVE-2017-11551.patch

@@ -1,13 +0,0 @@
-Common subdirectories: libid3tag-0.15.1b/msvc++ and libid3tag-0.15.1b-patched/msvc++
-diff -uwp libid3tag-0.15.1b/utf16.c libid3tag-0.15.1b-patched/utf16.c
---- libid3tag-0.15.1b/utf16.c	2004-01-23 10:41:32.000000000 +0100
-+++ libid3tag-0.15.1b-patched/utf16.c	2018-11-01 13:12:00.866050641 +0100
-@@ -250,6 +250,8 @@ id3_ucs4_t *id3_utf16_deserialize(id3_by
-   id3_ucs4_t *ucs4;
- 
-   end = *ptr + (length & ~1);
-+  if (end == *ptr)
-+    return 0;
- 
-   utf16 = malloc((length / 2 + 1) * sizeof(*utf16));
-   if (utf16 == 0)

pkgs/by-name/li/libid3tag/debian-patches.patch

@@ -1,89 +0,0 @@
-diff --git a/compat.gperf b/compat.gperf
-index 4e24613..5635980 100644
---- a/compat.gperf
-+++ b/compat.gperf
-@@ -236,6 +236,10 @@ int id3_compat_fixup(struct id3_tag *tag)
-
-     encoding = id3_parse_uint(&data, 1);
-     string   = id3_parse_string(&data, end - data, encoding, 0);
-+    if (!string)
-+    {
-+	continue;
-+    }
-
-     if (id3_ucs4_length(string) < 4) {
-       free(string);
-diff --git a/genre.dat b/genre.dat
-index 17acab5..1f02779 100644
---- a/genre.dat
-+++ b/genre.dat
-@@ -277,8 +277,8 @@ static id3_ucs4_t const genre_PUNK_ROCK[] =
-   { 'P', 'u', 'n', 'k', ' ', 'R', 'o', 'c', 'k', 0 };
- static id3_ucs4_t const genre_DRUM_SOLO[] =
-   { 'D', 'r', 'u', 'm', ' ', 'S', 'o', 'l', 'o', 0 };
--static id3_ucs4_t const genre_A_CAPPELLA[] =
--  { 'A', ' ', 'C', 'a', 'p', 'p', 'e', 'l', 'l', 'a', 0 };
-+static id3_ucs4_t const genre_A_CAPELLA[] =
-+  { 'A', ' ', 'C', 'a', 'p', 'e', 'l', 'l', 'a', 0 };
- static id3_ucs4_t const genre_EURO_HOUSE[] =
-   { 'E', 'u', 'r', 'o', '-', 'H', 'o', 'u', 's', 'e', 0 };
- static id3_ucs4_t const genre_DANCE_HALL[] =
-@@ -452,7 +452,7 @@ static id3_ucs4_t const *const genre_table[] = {
-   genre_DUET,
-   genre_PUNK_ROCK,
-   genre_DRUM_SOLO,
--  genre_A_CAPPELLA,
-+  genre_A_CAPELLA,
-   genre_EURO_HOUSE,
-   genre_DANCE_HALL,
-   genre_GOA,
-diff --git a/genre.dat.in b/genre.dat.in
-index 872de40..e71e34b 100644
---- a/genre.dat.in
-+++ b/genre.dat.in
-@@ -153,7 +153,7 @@ Freestyle
- Duet
- Punk Rock
- Drum Solo
--A Cappella
-+A Capella
- Euro-House
- Dance Hall
- Goa
-diff --git a/parse.c b/parse.c
-index 86a3f21..947c249 100644
---- a/parse.c
-+++ b/parse.c
-@@ -165,6 +165,9 @@ id3_ucs4_t *id3_parse_string(id3_byte_t const **ptr, id3_length_t length,
-   case ID3_FIELD_TEXTENCODING_UTF_8:
-     ucs4 = id3_utf8_deserialize(ptr, length);
-     break;
-+  default:
-+  	/* FIXME: Unknown encoding! Print warning? */
-+	return NULL;
-   }
-
-   if (ucs4 && !full) {
-diff --git a/utf16.c b/utf16.c
-index 70ee9d5..6e60a75 100644
---- a/utf16.c
-+++ b/utf16.c
-@@ -282,5 +282,18 @@ id3_ucs4_t *id3_utf16_deserialize(id3_byte_t const **ptr, id3_length_t length,
-
-   free(utf16);
-
-+  if (end == *ptr && length % 2 != 0)
-+  {
-+     /* We were called with a bogus length.  It should always
-+      * be an even number.  We can deal with this in a few ways:
-+      * - Always give an error.
-+      * - Try and parse as much as we can and
-+      *   - return an error if we're called again when we
-+      *     already tried to parse everything we can.
-+      *   - tell that we parsed it, which is what we do here.
-+      */
-+     (*ptr)++;
-+  }
-+
-   return ucs4;
- }

pkgs/by-name/li/libid3tag/id3tag.pc

@@ -1,11 +0,0 @@
-prefix=@out@
-exec_prefix=${prefix}
-libdir=${exec_prefix}/lib
-includedir=@dev@/include
-
-Name: libid3tag
-Description: ID3 tag manipulation library
-Version: @version@
-
-Libs: -L${libdir} -lid3tag
-Cflags: -I${includedir}

pkgs/by-name/li/libid3tag/package.nix

@@ -1,48 +1,50 @@
-{ lib, stdenv, fetchurl, zlib, gperf_3_0 }:
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  cmake,
+  gperf,
+  zlib,
+}:
 
 stdenv.mkDerivation rec {
   pname = "libid3tag";
-  version = "0.15.1b";
+  version = "0.16.3";
 
-  src = fetchurl {
+  outputs = [
-    url = "mirror://sourceforge/mad/libid3tag-${version}.tar.gz";
+    "out"
-    sha256 = "63da4f6e7997278f8a3fef4c6a372d342f705051d1eeb6a46a86b03610e26151";
+    "dev"
+  ];
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "tenacityteam";
+    repo = "libid3tag";
+    rev = version;
+    hash = "sha256-6/49rk7pmIpJRj32WmxC171NtdIOaMNhX8RD7o6Jbzs=";
   };
 
-  outputs = [ "out" "dev" ];
+  postPatch = ''
-  setOutputFlags = false;
+    substituteInPlace packaging/id3tag.pc.in \
+      --replace-fail "\''${prefix}/@CMAKE_INSTALL_LIBDIR@" "@CMAKE_INSTALL_FULL_LIBDIR@"
+  '';
 
   strictDeps = true;
 
-  nativeBuildInputs = [ gperf_3_0 ];
+  nativeBuildInputs = [
-
+    cmake
-  buildInputs = [ zlib ];
+    gperf
-
-  patches = [
-    ./debian-patches.patch
-    ./CVE-2017-11550-and-CVE-2017-11551.patch
   ];
 
-  preConfigure = ''
+  buildInputs = [
-    configureFlagsArray+=(
+    zlib
-      --includedir=$dev/include
+  ];
-    )
-  '';
 
-  postInstall = ''
+  meta = {
-    mkdir -p $dev/lib/pkgconfig
-    cp ${./id3tag.pc} $dev/lib/pkgconfig/id3tag.pc
-    substituteInPlace $dev/lib/pkgconfig/id3tag.pc \
-      --subst-var-by out $out \
-      --subst-var-by dev $dev \
-      --subst-var-by version "${version}"
-  '';
-
-  meta = with lib; {
     description = "ID3 tag manipulation library";
-    homepage = "https://mad.sourceforge.net/";
+    homepage = "https://codeberg.org/tenacityteam/libid3tag";
-    license = licenses.gpl2;
+    license = lib.licenses.gpl2Plus;
     maintainers = [ ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/li/liblc3/package.nix

@@ -8,7 +8,7 @@
 
 let
   name = "liblc3";
-  version = "1.1.2";
+  version = "1.1.3";
 in
 stdenv.mkDerivation {
   pname = name;
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     owner = "google";
     repo = "liblc3";
     rev = "v${version}";
-    sha256 = "sha256-OWuj68+YztIh/dPvwqjW7ch7Ph3aiEIDvO9rMkVIrQ8=";
+    sha256 = "sha256-4KsvCQ1JZaj0yCT7En7ZcNk0rA8LyDwwcSga2IoVd6A=";
   };
 
   outputs = [

pkgs/by-name/li/libnotify/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -19,7 +20,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libnotify";
-  version = "0.8.3";
+  version = "0.8.4";
 
   outputs = [
     "out"
@@ -29,9 +30,20 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-7o8++UYVatNAb99F/u29zZMtvSEatPFvdeuk82+y9sA=";
+    hash = "sha256-j6BNTr3BVbCiOd+IvZ8J6PJznVcHoTkLQnq0mF+D0lo=";
   };
 
+  patches = [
+    # Revert to avoid manpages breakage:
+    #   https://gitlab.gnome.org/GNOME/libnotify/-/merge_requests/37#note_2366448
+    (fetchpatch {
+      revert = true;
+      name = "unbreak-man.path";
+      url = "https://gitlab.gnome.org/GNOME/libnotify/-/commit/2f99025b7ad54f29dc5236aa7dfcfa97d1c8efde.patch";
+      hash = "sha256-/qbBs+bJjzCR2I7swy0RTsTaXap+gkYzvfchobeOzPQ=";
+    })
+  ];
+
   mesonFlags = [
     # disable tests as we don't need to depend on GTK (2/3)
     "-Dtests=false"

pkgs/by-name/li/libqmi/build_doc_deps_by_default.patch

@@ -0,0 +1,12 @@
+diff --git a/docs/reference/libqmi-glib/meson.build b/docs/reference/libqmi-glib/meson.build
+index 2f5cfc3..14e1aea 100644
+--- a/docs/reference/libqmi-glib/meson.build
++++ b/docs/reference/libqmi-glib/meson.build
+@@ -57,6 +57,7 @@ sections_txt = custom_target(
+   capture: true,
+   command: [find_program('cat'), '@INPUT@'] + gen_sections,
+   depends: gen_sections_deps,
++  build_by_default: true,
+ )
+ 
+ version_xml = configure_file(

pkgs/by-name/li/libqmi/package.nix

@@ -88,6 +88,10 @@ stdenv.mkDerivation rec {
   ];
 
   doCheck = true;
+  patches = [
+    # https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/124
+    ./build_doc_deps_by_default.patch
+  ];
 
   postPatch = ''
     patchShebangs \

pkgs/by-name/li/libraw/package.nix

@@ -40,6 +40,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+    substituteInPlace libraw*.pc.in --replace-fail -lstdc++ ""
+  '';
+
   passthru.tests = {
     inherit imagemagick hdrmerge freeimage;
     inherit (python3.pkgs) rawkit;

pkgs/by-name/li/libredirect/package.nix

@@ -104,6 +104,7 @@ else
         # Provide a setup hook that injects our library into every process.
         mkdir -p "$hook/nix-support"
         cat <<SETUP_HOOK > "$hook/nix-support/setup-hook"
+        echo "Setting up libredirect"
         ${
           if stdenv.hostPlatform.isDarwin then
             ''

pkgs/by-name/li/libsepol/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "3.8";
+  version = "3.8.1";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${se_url}/${version}/libsepol-${version}.tar.gz";
-    sha256 = "sha256-hE+9vwIzS5zgODOtimcQU/Z7QHbXLbTwPg7iZl7C61U=";
+    sha256 = "sha256-DnhwUwX5VavUwGVNN6VHfuJjSat0254rA6eGiJeuHd8=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''

pkgs/by-name/li/libvisual/package.nix

@@ -1,57 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  SDL,
-  autoreconfHook,
-  autoconf-archive,
-  glib,
-  pkg-config,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libvisual";
-  version = "0.4.2";
-
-  src = fetchFromGitHub {
-    owner = "Libvisual";
-    repo = "libvisual";
-    rev = "libvisual-${version}";
-    hash = "sha256-bDnpQODXB2Z6hezVoh7c6cklp6qpyDzVBAnwZD8Gros=";
-  };
-
-  sourceRoot = "${src.name}/libvisual";
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  strictDeps = true;
-  nativeBuildInputs = [
-    autoreconfHook
-    autoconf-archive
-    pkg-config
-  ];
-  buildInputs = [
-    SDL
-    glib
-  ];
-
-  configureFlags =
-    lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      # Remove when 0.5.x is published.
-      "--disable-lv-tool"
-    ]
-    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-      "ac_cv_func_malloc_0_nonnull=yes"
-      "ac_cv_func_realloc_0_nonnull=yes"
-    ];
-
-  meta = {
-    description = "Abstraction library for audio visualisations";
-    homepage = "https://sourceforge.net/projects/libvisual/";
-    license = lib.licenses.lgpl21Plus;
-    platforms = lib.platforms.linux ++ lib.platforms.freebsd;
-  };
-}

pkgs/by-name/li/libvmaf/package.nix

@@ -31,6 +31,14 @@ stdenv.mkDerivation (finalAttrs: {
     xxd
   ];
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+    substituteInPlace meson.build --replace-fail '_XOPEN_SOURCE=600' '_XOPEN_SOURCE=700'
+  '';
+
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    NIX_CFLAGS_COMPILE = "-D__BSD_VISIBLE=1";
+  };
+
   mesonFlags = [ "-Denable_avx512=true" ];
 
   outputs = [

pkgs/by-name/ma/matrix-brandy/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  libX11,
   SDL,
 }:
 
@@ -17,6 +18,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
+    libX11
     SDL
   ];
 

pkgs/by-name/me/mediagoblin/package.nix

@@ -15,6 +15,12 @@ let
       celery = prev.celery.overridePythonAttrs {
         doCheck = false;
       };
+
+      kombu = prev.kombu.overridePythonAttrs {
+        # avoid conflicts with test only dependencies
+        doCheck = false;
+      };
+
       sqlalchemy = prev.sqlalchemy_1_4;
     };
   };

pkgs/by-name/me/meson/package.nix

@@ -144,6 +144,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   setupHook = ./setup-hook.sh;
+  env.hostPlatform = stdenv.targetPlatform.system;
 
   meta = {
     homepage = "https://mesonbuild.com";

pkgs/by-name/me/meson/setup-hook.sh

@@ -26,6 +26,11 @@ mesonConfigurePhase() {
         "--buildtype=${mesonBuildType:-plain}"
     )
 
+    # --no-undefined is universally a bad idea on freebsd because environ is in the csu
+    if [[ "@hostPlatform@" == *-freebsd ]]; then
+        flagsArray+=("-Db_lundef=false")
+    fi
+
     concatTo flagsArray mesonFlags mesonFlagsArray
 
     echoCmd 'mesonConfigurePhase flags' "${flagsArray[@]}"

pkgs/by-name/me/meterbridge/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   pkg-config,
+  libGL,
   SDL,
   SDL_image,
   libjack2,
@@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
+    libGL
     SDL
     SDL_image
     libjack2

pkgs/by-name/mp/mp3fs/package.nix

@@ -10,6 +10,7 @@
   autoreconfHook,
   pkg-config,
   pandoc,
+  zlib,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,21 +26,23 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/mp3fs.cc \
-      --replace "#include <fuse_darwin.h>" "" \
+      --replace-fail "#include <fuse_darwin.h>" "" \
-      --replace "osxfuse_version()" "fuse_version()"
+      --replace-fail "osxfuse_version()" "fuse_version()"
   '';
 
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    pandoc
+  ];
+
   buildInputs = [
     flac
     fuse
     lame
     libid3tag
     libvorbis
-  ];
+    zlib
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-    pandoc
   ];
 
   enableParallelBuilding = true;

pkgs/by-name/na/naev/package.nix

@@ -77,6 +77,12 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs --build dat/outfits/bioship/generate.py utils/build/*.py utils/*.py
+
+    # Add a missing include to fix the build against luajit-2.1.1741730670.
+    # Otherwise the build fails as:
+    #   src/lutf8lib.c:421:22: error: 'INT_MAX' undeclared (first use in this function)
+    # TODO: drop after 0.12.3 release
+    sed -i '1i#include <limits.h>' src/lutf8lib.c
   '';
 
   meta = {

pkgs/by-name/oc/octoprint/package.nix

@@ -238,8 +238,6 @@ let
                 setup.py
             '';
 
-          dontUseSetuptoolsCheck = true;
-
           preCheck = ''
             export HOME=$(mktemp -d)
             rm pytest.ini

pkgs/by-name/op/openh264/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch,
   gtest,
   meson,
   nasm,
@@ -26,6 +27,15 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
+  patches = [
+    # https://github.com/cisco/openh264/pull/3867
+    (fetchpatch {
+      name = "freebsd-configure.patch";
+      url = "https://github.com/cisco/openh264/commit/ea8a1ad5791ee5c4e2ecf459aec235128d69b35b.patch";
+      hash = "sha256-pJvh9eRxFZQ+ob4WPu/x+jr1CCpgnug1uBViLfAtBDg=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     nasm
@@ -58,6 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
         ++ lib.platforms.aarch64
         ++ lib.platforms.loongarch64
         ++ lib.platforms.riscv64
-      ) (lib.platforms.linux ++ lib.platforms.darwin);
+      ) lib.platforms.unix;
   };
 })

pkgs/by-name/pe/persepolis/package.nix

@@ -38,15 +38,6 @@ python3.pkgs.buildPythonApplication rec {
     "\${qtWrapperArgs[@]}"
   ];
 
-  # The presence of these dependencies is checked during setuptoolsCheckPhase,
-  # but apart from that, they're not required during build, only runtime
-  nativeCheckInputs = [
-    libnotify
-    pulseaudio
-    sound-theme-freedesktop
-    ffmpeg
-  ];
-
   propagatedBuildInputs = [
     pulseaudio
     sound-theme-freedesktop

pkgs/by-name/po/poetry/unwrapped.nix

@@ -142,6 +142,12 @@ buildPythonPackage rec {
     "test_env_system_packages_are_relative_to_lib"
     "test_install_warning_corrupt_root"
     "test_project_plugins_are_installed_in_project_folder"
+    "test_application_command_not_found_messages"
+    # PermissionError: [Errno 13] Permission denied: '/build/pytest-of-nixbld/pytest-0/popen-gw3/test_find_poetry_managed_pytho1/.local/share/pypoetry/python/pypy@3.10.8/bin/python'
+    "test_list_poetry_managed"
+    "test_list_poetry_managed"
+    "test_find_all_with_poetry_managed"
+    "test_find_poetry_managed_pythons"
   ];
 
   pytestFlagsArray = [

pkgs/by-name/po/polkit/0001-build-Use-datarootdir-in-Meson-generated-pkg-config-.patch

@@ -1,4 +1,4 @@
-From 7ba07551dfcd4ef9a87b8f0d9eb8b91fabcb41b3 Mon Sep 17 00:00:00 2001
+From 5db2dee82bf652cca5fd782c19c8cc8e7ad5ed3e Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
 Date: Mon, 1 Nov 2021 14:17:17 +0100
 Subject: [PATCH] build: Use datarootdir in Meson-generated pkg-config files
@@ -29,18 +29,17 @@ in the generated pkg-config files, mirroring Autotools.
 2. https://www.gnu.org/prep/standards/html_node/Directory-Variables.html
 3. https://blogs.gnome.org/hughsie/2014/06/16/datarootdir-v-s-datadir/
 ---
- src/polkit/meson.build | 5 ++---
+ src/polkit/meson.build | 4 ++--
- 1 file changed, 2 insertions(+), 3 deletions(-)
+ 1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/src/polkit/meson.build b/src/polkit/meson.build
-index 63dc1e85..c92cb70f 100644
+index a7ce02b..9192a36 100644
 --- a/src/polkit/meson.build
 +++ b/src/polkit/meson.build
-@@ -113,9 +113,8 @@ pkg.generate(
+@@ -114,8 +114,8 @@ pkg.generate(
    requires: common_deps,
    variables: [
      'exec_prefix=${prefix}',
--    'datadir=' + ('${prefix}' / pk_datadir),
 -    'policydir=' + ('${datadir}' / pk_actiondir),
 -    'actiondir=' + ('${datadir}' / pk_actiondir),
 +    'policydir=' + ('${prefix}' / 'share' / pk_actiondir),
@@ -49,5 +48,5 @@ index 63dc1e85..c92cb70f 100644
    ],
  )
 -- 
-GitLab
+2.48.1
 

pkgs/by-name/po/polkit/elogind.patch

@@ -1,66 +0,0 @@
-From 78e625dbafa8543b17ffaf9c42cf90c9cf9a612e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Wed, 8 May 2024 11:20:42 +0200
-Subject: [PATCH] Fix configuration with elogind
-
-Previously, it would try to get sysusers_dir from systemd even though
-systemd_dep was undefined.  Determining systemd_systemdsystemunitdir
-from systemd was already checking for systemd logind specifically, and
-systemd_sysusers_dir is only used in the systemd logind case, so move
-both of those into the systemd-logind-specific branch above.
-
-(cherry picked from commit b58b58af10c390ab9a11a4cfe6a4ff3d50cc0fa5)
----
- meson.build | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 2f81c90..0888322 100644
---- a/meson.build
-+++ b/meson.build
-@@ -202,6 +202,16 @@ if enable_logind
-     if not logind_dep.found()
-       logind_dep = dependency('libsystemd-login', not_found_message: 'libsystemd support requested but libsystemd or libsystemd-login library not found')
-     endif
-+
-+    # systemd unit / service files
-+    systemd_systemdsystemunitdir = get_option('systemdsystemunitdir')
-+    if systemd_systemdsystemunitdir == '' and session_tracking == 'libsystemd-login'
-+      systemd_dep = dependency('systemd', not_found_message: 'systemd required but not found, please provide a valid systemd user unit dir or disable it')
-+      # FIXME: systemd.pc file does not use variables with relative paths, so `define_variable` cannot be used
-+      systemd_systemdsystemunitdir = systemd_dep.get_pkgconfig_variable('systemdsystemunitdir')
-+    endif
-+
-+    systemd_sysusers_dir = systemd_dep.get_pkgconfig_variable('sysusers_dir', default: '/usr/lib/sysusers.d')
-   else
-     logind_dep = dependency('libelogind', not_found_message: 'libelogind support requested but libelogind library not found')
-   endif
-@@ -210,16 +220,6 @@ if enable_logind
-   config_h.set10('HAVE_' + func.to_upper(), cc.has_function(func, dependencies: logind_dep))
-   func = 'sd_pidfd_get_session'
-   config_h.set10('HAVE_' + func.to_upper(), cc.has_function(func, dependencies: logind_dep))
--
--  # systemd unit / service files
--  systemd_systemdsystemunitdir = get_option('systemdsystemunitdir')
--  if systemd_systemdsystemunitdir == '' and session_tracking == 'libsystemd-login'
--    systemd_dep = dependency('systemd', not_found_message: 'systemd required but not found, please provide a valid systemd user unit dir or disable it')
--    # FIXME: systemd.pc file does not use variables with relative paths, so `define_variable` cannot be used
--    systemd_systemdsystemunitdir = systemd_dep.get_pkgconfig_variable('systemdsystemunitdir')
--  endif
--
--  systemd_sysusers_dir = systemd_dep.get_pkgconfig_variable('sysusers_dir', default: '/usr/lib/sysusers.d')
- endif
- config_h.set('HAVE_LIBSYSTEMD', enable_logind)
- 
-@@ -404,7 +404,7 @@ output += '        introspection:            ' + enable_introspection.to_string(
- output += '        Distribution/OS:          ' + os_type + '\n'
- output += '        Authentication framework: ' + auth_fw + '\n'
- output += '        Session tracking:         ' + session_tracking + '\n'
--if enable_logind
-+if session_tracking == 'logind'
-   output += '        systemdsystemunitdir:     ' + systemd_systemdsystemunitdir + '\n'
- endif
- output += '        polkitd user:             ' + polkitd_user + ' \n'
--- 
-2.44.0
-

pkgs/by-name/po/polkit/package.nix

@@ -17,10 +17,10 @@
   libxslt,
   docbook-xsl-nons,
   dbus,
+  util-linux,
   docbook_xml_dtd_412,
   gtk-doc,
   coreutils,
-  fetchpatch,
   useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdMinimal,
   systemdMinimal,
   elogind,
@@ -41,7 +41,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "polkit";
-  version = "124";
+  version = "126";
 
   outputs = [
     "bin"
@@ -54,22 +54,13 @@ stdenv.mkDerivation rec {
     owner = "polkit-org";
     repo = "polkit";
     rev = version;
-    hash = "sha256-Vc9G2xK6U1cX+xW2BnKp3oS/ACbSXS/lztbFP5oJOlM=";
+    hash = "sha256-ZSqgW//q5DFIsmY17U93mJcK/CHSCHphKTHsTxp40q8=";
   };
 
   patches = [
     # Allow changing base for paths in pkg-config file as before.
     # https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/100
     ./0001-build-Use-datarootdir-in-Meson-generated-pkg-config-.patch
-
-    ./elogind.patch
-
-    # FIXME: remove in the next release
-    # https://github.com/NixOS/nixpkgs/issues/18012
-    (fetchpatch {
-      url = "https://github.com/polkit-org/polkit/commit/f93c7466039ea3403e0576928aeb620b806d0cce.patch";
-      sha256 = "sha256-cF0nNovYmyr+XixpBgQFF0A+oJeSPGZgTkgDQkQuof8=";
-    })
   ];
 
   depsBuildBuild = [
@@ -116,6 +107,7 @@ stdenv.mkDerivation rec {
 
   nativeCheckInputs = [
     dbus
+    util-linux # for mount
     (python3.pythonOnBuildForHost.withPackages (
       pp: with pp; [
         dbus-python
@@ -127,67 +119,50 @@ stdenv.mkDerivation rec {
     ))
   ];
 
-  env =
+  env = {
-    {
+    PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
-      PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
+    PKG_CONFIG_SYSTEMD_SYSUSERS_DIR = "${placeholder "out"}/lib/sysusers.d";
-      PKG_CONFIG_SYSTEMD_SYSUSERS_DIR = "${placeholder "out"}/lib/sysusers.d";
+    PKG_CONFIG_SYSTEMD_TMPFILES_DIR = "${placeholder "out"}/lib/tmpfiles.d";
 
-      # HACK: We want to install policy files files to $out/share but polkit
+    # HACK: We want to install policy files files to $out/share but polkit
-      # should read them from /run/current-system/sw/share on a NixOS system.
+    # should read them from /run/current-system/sw/share on a NixOS system.
-      # Similarly for config files in /etc.
+    # Similarly for config files in /etc.
-      # With autotools, it was possible to override Make variables
+    # With autotools, it was possible to override Make variables
-      # at install time but Meson does not support this
+    # at install time but Meson does not support this
-      # so we need to convince it to install all files to a temporary
+    # so we need to convince it to install all files to a temporary
-      # location using DESTDIR and then move it to proper one in postInstall.
+    # location using DESTDIR and then move it to proper one in postInstall.
-      DESTDIR = "dest";
+    DESTDIR = "dest";
-    }
+  };
-    // lib.optionalAttrs (stdenv.cc.isGNU || stdenv.cc.isClang) {
-      NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
-    };
 
   mesonFlags =
     [
       "--datadir=${system}/share"
       "--sysconfdir=/etc"
       "-Dpolkitd_user=polkituser" # TODO? <nixos> config.ids.uids.polkituser
-      "-Dos_type=redhat" # only affects PAM includes
+      "-Dos_type=redhat" # affects PAM includes and privileged group name (wheel)
       "-Dintrospection=${lib.boolToString withIntrospection}"
       "-Dtests=${lib.boolToString doCheck}"
       "-Dgtk_doc=${lib.boolToString withIntrospection}"
       "-Dman=true"
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
-      "-Dsession_tracking=${if useSystemd then "libsystemd-login" else "libelogind"}"
+      "-Dsession_tracking=${if useSystemd then "logind" else "elogind"}"
     ];
 
   inherit doCheck;
 
   postPatch = ''
-    patchShebangs test/polkitbackend/polkitbackendjsauthoritytest-wrapper.py
+    patchShebangs \
+      test/wrapper.py
 
     # ‘libpolkit-agent-1.so’ should call the setuid wrapper on
     # NixOS.  Hard-coding the path is kinda ugly.  Maybe we can just
     # call through $PATH, but that might have security implications.
     substituteInPlace src/polkitagent/polkitagentsession.c \
-      --replace   'PACKAGE_PREFIX "/lib/polkit-1/'   '"${setuid}/'
+      --replace-fail 'PACKAGE_PREFIX "/lib/polkit-1/'   '"${setuid}/'
     substituteInPlace test/data/etc/polkit-1/rules.d/10-testing.rules \
-      --replace   /bin/true ${coreutils}/bin/true \
+      --replace-fail /bin/true ${coreutils}/bin/true \
-      --replace   /bin/false ${coreutils}/bin/false
+      --replace-fail /bin/false ${coreutils}/bin/false
-  '';
-
-  postConfigure = lib.optionalString doCheck ''
-    # Unpacked by meson
-    chmod +x subprojects/mocklibc-1.0/bin/mocklibc
-    patchShebangs subprojects/mocklibc-1.0/bin/mocklibc
-  '';
-
-  checkPhase = ''
-    runHook preCheck
-
-    # tests need access to the system bus
-    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS meson test --print-errorlogs'
-
-    runHook postCheck
   '';
 
   postInstall = ''
@@ -212,6 +187,6 @@ stdenv.mkDerivation rec {
       # mandatory libpolkit-gobject shared library
       lib.systems.inspect.platformPatterns.isStatic
     ];
-    maintainers = teams.freedesktop.members ++ (with maintainers; [ ]);
+    maintainers = teams.freedesktop.members;
   };
 }

pkgs/by-name/po/polkit/system_bus.conf

@@ -1,58 +0,0 @@
-<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
- "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
-<busconfig>
-  <!-- Our well-known bus type, do not change this -->
-  <type>system</type>
-
-  <!-- Fork into daemon mode -->
-  <fork/>
-
-  <!-- Enable logging to syslog -->
-  <syslog/>
-
-  <!-- Only allow socket-credentials-based authentication -->
-  <auth>EXTERNAL</auth>
-
-  <!-- Only listen on a local socket. (abstract=/path/to/socket 
-       means use abstract namespace, don't really create filesystem 
-       file; only Linux supports this. Use path=/whatever on other 
-       systems.) -->
-  <listen>unix:path=/tmp/system_bus_socket</listen>
-
-  <policy context="default">
-    <!-- All users can connect to system bus -->
-    <allow user="*"/>
-
-    <!-- Holes must be punched in service configuration files for
-         name ownership and sending method calls -->
-    <deny own="*"/>
-    <deny send_type="method_call"/>
-
-    <!-- Signals and reply messages (method returns, errors) are allowed
-         by default -->
-    <allow send_type="signal"/>
-    <allow send_requested_reply="true" send_type="method_return"/>
-    <allow send_requested_reply="true" send_type="error"/>
-
-    <!-- All messages may be received by default -->
-    <allow receive_type="method_call"/>
-    <allow receive_type="method_return"/>
-    <allow receive_type="error"/>
-    <allow receive_type="signal"/>
-
-    <!-- Allow anyone to talk to the message bus -->
-    <allow send_destination="org.freedesktop.DBus"
-           send_interface="org.freedesktop.DBus" />
-    <allow send_destination="org.freedesktop.DBus"
-           send_interface="org.freedesktop.DBus.Introspectable"/>
-    <!-- But disallow some specific bus services -->
-    <deny send_destination="org.freedesktop.DBus"
-          send_interface="org.freedesktop.DBus"
-          send_member="UpdateActivationEnvironment"/>
-    <deny send_destination="org.freedesktop.DBus"
-          send_interface="org.freedesktop.DBus.Debug.Stats"/>
-    <deny send_destination="org.freedesktop.DBus"
-          send_interface="org.freedesktop.systemd1.Activator"/>
-  </policy>
-
-</busconfig>

pkgs/by-name/pr/pre-commit/package.nix

@@ -7,7 +7,6 @@
   coursier,
   dotnet-sdk,
   gitMinimal,
-  glibcLocales,
   go,
   nodejs,
   perl,
@@ -52,7 +51,6 @@ buildPythonApplication rec {
     [
       cargo
       gitMinimal
-      glibcLocales
       go
       libiconv # For rust tests on Darwin
       perl
@@ -101,7 +99,7 @@ buildPythonApplication rec {
     + ''
       export GIT_AUTHOR_NAME=test GIT_COMMITTER_NAME=test \
              GIT_AUTHOR_EMAIL=test@example.com GIT_COMMITTER_EMAIL=test@example.com \
-             VIRTUALENV_NO_DOWNLOAD=1 PRE_COMMIT_NO_CONCURRENCY=1 LANG=en_US.UTF-8
+             VIRTUALENV_NO_DOWNLOAD=1 PRE_COMMIT_NO_CONCURRENCY=1
     ''
     + lib.optionalString (!i686Linux) ''
       # Resolve `.NET location: Not found` errors for dotnet tests

pkgs/by-name/pr/pretix/package.nix

@@ -103,6 +103,7 @@ python.pkgs.buildPythonApplication rec {
     "protobuf"
     "pycryptodome"
     "pyjwt"
+    "pypdf"
     "python-bidi"
     "qrcode"
     "redis"

pkgs/by-name/py/pyright/package.nix

@@ -7,13 +7,13 @@
 }:
 
 let
-  version = "1.1.394";
+  version = "1.1.396";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "pyright";
     tag = version;
-    hash = "sha256-zOJtv9ETolo3XmH+ztNJEmX319rV/CABDIw2crSxqqw=";
+    hash = "sha256-6YvjpLV1Jj5N0CgN9hE7C2X9BMYZBJegB0xpSBW8n5c=";
   };
 
   patchedPackageJSON = runCommand "package.json" { } ''
@@ -44,7 +44,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-RE1ZwMKgWu686/ejMB0E1CRix8MLv6lNoEkyAkvOC6U=";
+    npmDepsHash = "sha256-HwwVshop15nHE5oFuPIFmL5AduJ2z208cv2TbEAEMnY=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -58,7 +58,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-sQeHXfhm6u0at4vhFjGPwMmTdDomU6cJnolOFO6ynXA=";
+  npmDepsHash = "sha256-ywQimf2w5xXbNqcluv6Bi/wH7/QQG0U/r6Ferx9vbis=";
 
   postPatch = ''
     chmod +w ../../

pkgs/by-name/re/redis/package.nix

@@ -66,6 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
   hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
 
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [ "-std=c11" ]);
+  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isFreeBSD "-lexecinfo";
 
   # darwin currently lacks a pure `pgrep` which is extensively used here
   doCheck = !stdenv.hostPlatform.isDarwin;
@@ -93,6 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
       --timeout 2000 \
       --clients $NIX_BUILD_CORES \
       --tags -leaks \
+      --skipunit integration/aof-multi-part \
       --skipunit integration/failover # flaky and slow
 
     runHook postCheck

pkgs/by-name/rr/rrootage/package.nix

@@ -3,6 +3,8 @@
   stdenv,
   fetchpatch,
   fetchurl,
+  libGL,
+  libGLU,
   SDL,
   SDL_mixer,
   bulletml,
@@ -47,6 +49,8 @@ stdenv.mkDerivation {
   '';
 
   buildInputs = [
+    libGL
+    libGLU
     SDL
     SDL_mixer
     bulletml

pkgs/by-name/sd/SDL_compat/package.nix

@@ -9,6 +9,7 @@
   libX11,
   mesa,
   pkg-config,
+  pkg-config-unwrapped,
   stdenv,
   # Boolean flags
   libGLSupported ? lib.elem stdenv.hostPlatform.system mesa.meta.platforms,
@@ -39,6 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
       autoSignDarwinBinariesHook
     ];
 
+  # re-export PKG_CHECK_MODULES m4 macro used by sdl.m4
+  propagatedNativeBuildInputs = [ pkg-config-unwrapped ];
+
   buildInputs =
     [
       libX11

pkgs/by-name/se/selenium-manager/disable-telemetry.patch

@@ -1,7 +1,7 @@
-diff --git a/rust/src/config.rs b/rust/src/config.rs
+diff --git a/src/config.rs b/src/config.rs
 index f7cd4f32ec..ec454127be 100644
---- a/rust/src/config.rs
+--- a/src/config.rs
-+++ b/rust/src/config.rs
++++ b/src/config.rs
 @@ -120,7 +120,7 @@ impl ManagerConfig {
              avoid_browser_download: BooleanKey("avoid-browser-download", false).get_value(),
              language_binding: StringKey(vec!["language-binding"], "").get_value(),

pkgs/by-name/se/selenium-manager/package.nix

@@ -7,25 +7,23 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "selenium-manager";
-  version = "4.28.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "SeleniumHQ";
     repo = "selenium";
     tag = "selenium-${version}";
-    hash = "sha256-b5xwuZ4lcwLbGhJuEmHYrFXoaTW/M0ABdK3dvbpj8oM=";
+    hash = "sha256-IyMXgYl/TPTpe/Y0pFyJVKj4Mp0xbkg1LSCNHzFL3bE=";
   };
 
+  sourceRoot = "${src.name}/rust";
+
   patches = [
     ./disable-telemetry.patch
   ];
 
-  postPatch = ''
-    cd rust
-  '';
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hXtF3qFzzM2TqpEP9JWdi7uU5TgFHF9lZO5bmZcEuDk=";
+  cargoHash = "sha256-MgnmEJif4Z4CcmBFkC5BJR67DMGm1ttObtl4LhAFw4g=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration

pkgs/by-name/se/setools/package.nix

@@ -1,16 +1,17 @@
 {
   lib,
   fetchFromGitHub,
-  python3,
+  python3Packages,
   libsepol,
   libselinux,
   checkpolicy,
   withGraphics ? false,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "setools";
   version = "4.5.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
@@ -19,25 +20,32 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-/6dOzSz2Do4d6TSS50fuak0CysoQ532zJ0bJ532BUCE=";
   };
 
-  nativeBuildInputs = [ python3.pkgs.cython ];
+  build-system = with python3Packages; [
+    cython
+    setuptools
+  ];
+
   buildInputs = [ libsepol ];
-  propagatedBuildInputs =
+
-    with python3.pkgs;
+  dependencies =
+    with python3Packages;
     [
-      enum34
       libselinux
-      networkx
       setuptools
     ]
     ++ lib.optionals withGraphics [ pyqt5 ];
 
+  optional-dependencies = {
+    analysis = with python3Packages; [
+      networkx
+      pygraphviz
+    ];
+  };
+
   nativeCheckInputs = [
-    python3.pkgs.tox
+    python3Packages.tox
     checkpolicy
   ];
-  preCheck = ''
-    export CHECKPOLICY=${checkpolicy}/bin/checkpolicy
-  '';
 
   setupPyBuildFlags = [ "-i" ];
 
@@ -45,10 +53,19 @@ python3.pkgs.buildPythonApplication rec {
     export SEPOL="${lib.getLib libsepol}/lib/libsepol.a"
   '';
 
-  meta = with lib; {
+  preCheck = ''
+    export CHECKPOLICY=${lib.getExe checkpolicy}
+  '';
+
+  meta = {
     description = "SELinux Policy Analysis Tools";
     homepage = "https://github.com/SELinuxProject/setools";
-    license = licenses.gpl2Only;
+    changelog = "https://github.com/SELinuxProject/setools/blob/${version}/ChangeLog";
-    platforms = platforms.linux;
+    license = with lib.licenses; [
+      gpl2Only
+      lgpl21Plus
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/si/singular/package.nix

@@ -119,12 +119,6 @@ stdenv.mkDerivation rec {
       -i '{}' ';'
   '';
 
-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  preConfigure = ''
-    substituteInPlace build-aux/ltmain.sh \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
   hardeningDisable = lib.optional stdenv.hostPlatform.isi686 "stackprotector";
 
   doCheck = true; # very basic checks, does not test any libraries

pkgs/by-name/sm/smpeg/package.nix

@@ -26,10 +26,9 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-nq/i7cFGpJXIuTwN/ScLMX7FN8NMdgdsRM9xOD3uycs=";
   };
 
-  patches = [
+  patches = lib.optionals (!stdenv.hostPlatform.isDarwin) [ ./libx11.patch ] ++ [
     ./format.patch
     ./gcc6.patch
-    ./libx11.patch
     ./gtk.patch
     # These patches remove use of the `register` storage class specifier,
     # allowing smpeg to build with clang 16, which defaults to C++17.
@@ -93,7 +92,7 @@ stdenv.mkDerivation rec {
       --prefix PKG_CONFIG_PATH ":" "${lib.getDev SDL}/lib/pkgconfig"
   '';
 
-  NIX_LDFLAGS = "-lX11";
+  NIX_LDFLAGS = lib.optionalString (!stdenv.hostPlatform.isDarwin) "-lX11";
 
   meta = {
     homepage = "https://icculus.org/smpeg/";

pkgs/by-name/su/suricata/package.nix

@@ -27,7 +27,7 @@
   python3,
   zlib,
   redisSupport ? true,
-  redis,
+  valkey,
   hiredis,
   rustSupport ? true,
   rustc,
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optional hyperscanSupport hyperscan
     ++ lib.optionals redisSupport [
-      redis
+      valkey
       hiredis
     ];
 

pkgs/by-name/ut/util-linux/package.nix

@@ -8,6 +8,11 @@
   capabilitiesSupport ? stdenv.hostPlatform.isLinux,
   libcap_ng,
   libxcrypt,
+  # Disable this by default because `mount` is setuid. However, we also support
+  # "dlopen" as a value here. Note that the nixpkgs setuid wrapper and ld-linux.so will filter out LD_LIBRARY_PATH
+  # if you set this to dlopen, so ensure you're accessing it without the wrapper if you depend on that.
+  cryptsetupSupport ? false,
+  cryptsetup,
   ncursesSupport ? true,
   ncurses,
   pamSupport ? true,
@@ -24,9 +29,11 @@
   gitUpdater,
 }:
 
+let
+  isMinimal = cryptsetupSupport == false && !nlsSupport && !ncursesSupport && !systemdSupport;
+in
 stdenv.mkDerivation rec {
-  pname =
+  pname = "util-linux" + lib.optionalString isMinimal "-minimal";
-    "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
   version = "2.40.4";
 
   src = fetchurl {
@@ -88,6 +95,14 @@ stdenv.mkDerivation rec {
       "--disable-su" # provided by shadow
       (lib.enableFeature writeSupport "write")
       (lib.enableFeature nlsSupport "nls")
+      (lib.withFeatureAs (cryptsetupSupport != false) "cryptsetup" (
+        if cryptsetupSupport == true then
+          "yes"
+        else if cryptsetupSupport == "dlopen" then
+          "dlopen"
+        else
+          throw "invalid cryptsetupSupport value: ${toString cryptsetupSupport}"
+      ))
       (lib.withFeature ncursesSupport "ncursesw")
       (lib.withFeature systemdSupport "systemd")
       (lib.withFeatureAs systemdSupport "systemdsystemunitdir" "${placeholder "bin"}/lib/systemd/system/")
@@ -117,10 +132,13 @@ stdenv.mkDerivation rec {
     "usrsbin_execdir=${placeholder "bin"}/sbin"
   ];
 
-  nativeBuildInputs = [
+  nativeBuildInputs =
-    pkg-config
+    [
-    installShellFiles
+      pkg-config
-  ] ++ lib.optionals translateManpages [ po4a ];
+      installShellFiles
+    ]
+    ++ lib.optionals translateManpages [ po4a ]
+    ++ lib.optionals (cryptsetupSupport == "dlopen") [ cryptsetup ];
 
   buildInputs =
     [
@@ -128,6 +146,7 @@ stdenv.mkDerivation rec {
       libxcrypt
       sqlite
     ]
+    ++ lib.optionals (cryptsetupSupport == true) [ cryptsetup ]
     ++ lib.optionals pamSupport [ pam ]
     ++ lib.optionals capabilitiesSupport [ libcap_ng ]
     ++ lib.optionals ncursesSupport [ ncurses ]
@@ -178,12 +197,12 @@ stdenv.mkDerivation rec {
     hasCol = stdenv.hostPlatform.libc == "glibc";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
     description = "Set of system utilities for Linux";
     changelog = "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v${lib.versions.majorMinor version}/v${version}-ReleaseNotes";
     # https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/README.licensing
-    license = with licenses; [
+    license = with lib.licenses; [
       gpl2Only
       gpl2Plus
       gpl3Plus
@@ -192,7 +211,8 @@ stdenv.mkDerivation rec {
       bsdOriginalUC
       publicDomain
     ];
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [ numinit ];
+    platforms = lib.platforms.unix;
     pkgConfigModules = [
       "blkid"
       "fdisk"

pkgs/by-name/wa/waydroid/package.nix

@@ -57,7 +57,6 @@ python3Packages.buildPythonApplication rec {
 
   dontUseSetuptoolsBuild = true;
   dontUsePipInstall = true;
-  dontUseSetuptoolsCheck = true;
   dontWrapPythonPrograms = true;
   dontWrapGApps = true;
 

pkgs/by-name/za/zammad/package.nix

@@ -14,7 +14,7 @@
   nodejs,
   pnpm_9,
   cacert,
-  redis,
+  valkey,
   dataDir ? "/var/lib/zammad",
 }:
 
@@ -68,7 +68,7 @@ stdenvNoCC.mkDerivation {
   ];
 
   nativeBuildInputs = [
-    redis
+    valkey
     postgresql
     pnpm_9.configHook
     nodejs

pkgs/by-name/za/zap-chip/package.nix

@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "zap-chip";
-  version = "2024.09.27";
+  version = "2025.02.26";
 
   src = fetchFromGitHub {
     owner = "project-chip";
     repo = "zap";
     rev = "v${version}";
-    hash = "sha256-Dc5rU4jJ6aJpk8mwL+XNSmtisYxF86VzXd/Aacd4p0o=";
+    hash = "sha256-oYw1CxeCr4dUpw7hhXjtB+QwTfBI7rG9jgfxWKZYsSc=";
   };
 
-  npmDepsHash = "sha256-ZFksGwKlXkz6XTs2QdalGB0hR16HfB69XQOFWI9X/KY=";
+  npmDepsHash = "sha256-dcnJfxgF1S2gyR+wPnBD4AFzix5Sdq2ZqDlXvWAFb8s=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   env.CYPRESS_INSTALL_BINARY = "0";

pkgs/by-name/za/zaz/package.nix

@@ -6,6 +6,7 @@
   SDL,
   SDL_image,
   libgbm,
+  libGL,
   libtheora,
   libvorbis,
   libogg,
@@ -29,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.getDev SDL)
     SDL_image
     libgbm
+    libGL
     libtheora
     libvorbis.dev
     libogg

pkgs/desktops/mate/caja/default.nix

@@ -46,12 +46,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-update-mimedb" ];
 
-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
   enableParallelBuilding = true;
 
   passthru.updateScript = mateUpdateScript { inherit pname; };

pkgs/desktops/mate/eom/default.nix

@@ -50,12 +50,6 @@ stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  # FIXME: ugly hack for https://github.com/NixOS/nixpkgs/pull/389009
-  postConfigure = ''
-    substituteInPlace libtool \
-      --replace-warn 'for search_ext in .la $std_shrext .so .a' 'for search_ext in $std_shrext .so .a'
-  '';
-
   enableParallelBuilding = true;
 
   passthru.updateScript = mateUpdateScript { inherit pname; };

pkgs/development/compilers/gcc/common/builder.nix

@@ -278,7 +278,6 @@ originalAttrs:
       targetLibDir="''${targetConfig+$targetConfig/}lib"
 
       moveToOutput "$targetLibDir/lib*.so*" "''${!outputLib}"
-      moveToOutput "$targetLibDir/lib*.la"  "''${!outputLib}"
       moveToOutput "$targetLibDir/lib*.dylib" "''${!outputLib}"
       moveToOutput "$targetLibDir/lib*.dll.a" "''${!outputLib}"
       moveToOutput "$targetLibDir/lib*.dll" "''${!outputLib}"
@@ -288,19 +287,18 @@ originalAttrs:
           moveToOutput "$targetLibDir/lib*.a" "''${!outputLib}"
       fi
 
-      for i in "''${!outputLib}"/$targetLibDir/*.{la,py}; do
+      for i in "''${!outputLib}"/$targetLibDir/*.py; do
           substituteInPlace "$i" --replace "$out" "''${!outputLib}"
       done
 
       # Multilib and cross can't exist at the same time, so just use lib64 here
       if [ -n "$enableMultilib" ]; then
           moveToOutput "lib64/lib*.so*" "''${!outputLib}"
-          moveToOutput "lib64/lib*.la"  "''${!outputLib}"
           moveToOutput "lib64/lib*.dylib" "''${!outputLib}"
           moveToOutput "lib64/lib*.dll.a" "''${!outputLib}"
           moveToOutput "lib64/lib*.dll" "''${!outputLib}"
 
-          for i in "''${!outputLib}"/lib64/*.{la,py}; do
+          for i in "''${!outputLib}"/lib64/*.py; do
               substituteInPlace "$i" --replace "$out" "''${!outputLib}"
           done
       fi
@@ -313,6 +311,12 @@ originalAttrs:
       # More dependencies with the previous gcc or some libs (gccbug stores the build command line)
       rm -rf $out/bin/gccbug
 
+      # Remove .la files, they're not adjusted for the makeCompatibilitySymlink magic,
+      # which confuses libtool and leads to weird linking errors.
+      # Removing the files just makes libtool link .so files directly, which is usually
+      # what we want anyway.
+      find $out -name '*.la' -delete
+
       if type "install_name_tool"; then
           for i in "''${!outputLib}"/lib/*.*.dylib "''${!outputLib}"/lib/*.so.[0-9]; do
               install_name_tool -id "$i" "$i" || true

pkgs/development/compilers/sbcl/default.nix

@@ -20,12 +20,12 @@ let
     };
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.5.0" = {
-      sha256 = "sha256-Lhiv0Ijkot8ht3uuLhcM5XDRHabSdgcpImXxzGqKGbE=";
-    };
     "2.5.1" = {
       sha256 = "sha256-QTOzbNFtFNYzlpw3/VHCyJqOpdbhYRVSgZ2R9xshn4s=";
     };
+    "2.5.2" = {
+      sha256 = "sha256-XcJ+un3aQz31P9dEHeixFHSoLNrBaJwfbOVfoGXWX6w=";
+    };
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other

pkgs/development/interpreters/luajit/2.0.nix

@@ -9,13 +9,13 @@
 callPackage ./default.nix {
   # The patch version is the timestamp of the git commit,
   # obtain via `cat $(nix-build -A luajit_2_0.src)/.relver`
-  version = "2.0.1713483859";
+  version = "2.0.1741557863";
 
   src = fetchFromGitHub {
     owner = "LuaJIT";
     repo = "LuaJIT";
-    rev = "9b5e837ac2dfdc0638830c048a47ca9378c504d3";
+    rev = "85c3f2fb6f59276ebf07312859a69d6d5a897f62";
-    hash = "sha256-GflF/sELSNanc9G4WMzoOadUBOFSs6OwqhAXa4sudWA=";
+    hash = "sha256-5UIZ650M/0W08iX1ajaHvDbNgjbzZJ1akVwNbiDUeyY=";
   };
 
   extraMeta = {

pkgs/development/interpreters/luajit/2.1.nix

@@ -8,13 +8,13 @@
 callPackage ./default.nix {
   # The patch version is the timestamp of the git commit,
   # obtain via `cat $(nix-build -A luajit_2_1.src)/.relver`
-  version = "2.1.1713773202";
+  version = "2.1.1741730670";
 
   src = fetchFromGitHub {
     owner = "LuaJIT";
     repo = "LuaJIT";
-    rev = "5790d253972c9d78a0c2aece527eda5b134bbbf7";
+    rev = "538a82133ad6fddfd0ca64de167c4aca3bc1a2da";
-    hash = "sha256-WG8AWDI182/9O7NrZlQ6ZH/esyYE2pWXMuSzWUuntSA=";
+    hash = "sha256-3DhNqVdojsWDo8mKJXIyTqFODIiKzThcAzHPdnoJaVM=";
   };
 
   inherit self passthruFun;

pkgs/development/interpreters/python/hooks/default.nix

@@ -146,13 +146,60 @@ in
       };
 
   pytestCheckHook = callPackage (
-    { makePythonHook, pytest }:
+    {
+      makePythonHook,
+      pytest,
+      # For package tests
+      testers,
+      objprint,
+    }:
     makePythonHook {
       name = "pytest-check-hook";
       propagatedBuildInputs = [ pytest ];
       substitutions = {
         inherit pythonCheckInterpreter;
       };
+      passthru = {
+        tests = {
+          basic = objprint.overridePythonAttrs (previousPythonAttrs: {
+            pname = "test-pytestCheckHook-basic-${previousPythonAttrs.pname}";
+          });
+          disabledTests = objprint.overridePythonAttrs (previousPythonAttrs: {
+            pname = "test-pytestCheckHook-disabledTests-${previousPythonAttrs.pname}";
+            disabledTests = [
+              "test_print"
+            ] ++ previousPythonAttrs.disabledTests or [ ];
+          });
+          disabledTestPaths = objprint.overridePythonAttrs (previousPythonAttrs: {
+            pname = "test-pytestCheckHook-disabledTestPaths-${previousPythonAttrs.pname}";
+            disabledTestPaths = [
+              "tests/test_basic.py"
+            ] ++ previousPythonAttrs.disabledTestPaths or [ ];
+          });
+          disabledTestPaths-nonexistent = testers.testBuildFailure (
+            objprint.overridePythonAttrs (previousPythonAttrs: {
+              pname = "test-pytestCheckHook-disabledTestPaths-nonexistent-${previousPythonAttrs.pname}";
+              disabledTestPaths = [
+                "tests/test_foo.py"
+              ] ++ previousPythonAttrs.disabledTestPaths or [ ];
+            })
+          );
+          disabledTestPaths-glob = objprint.overridePythonAttrs (previousPythonAttrs: {
+            pname = "test-pytestCheckHook-disabledTestPaths-glob-${previousPythonAttrs.pname}";
+            disabledTestPaths = [
+              "tests/test_obj*.py"
+            ] ++ previousPythonAttrs.disabledTestPaths or [ ];
+          });
+          disabledTestPaths-glob-nonexistent = testers.testBuildFailure (
+            objprint.overridePythonAttrs (previousPythonAttrs: {
+              pname = "test-pytestCheckHook-disabledTestPaths-glob-nonexistent-${previousPythonAttrs.pname}";
+              disabledTestPaths = [
+                "tests/test_foo*.py"
+              ] ++ previousPythonAttrs.disabledTestPaths or [ ];
+            })
+          );
+        };
+      };
     } ./pytest-check-hook.sh
   ) { };
 

pkgs/development/interpreters/python/hooks/pytest-check-hook.sh

@@ -18,7 +18,7 @@ function pytestCheckPhase() {
     concatTo _pathsArray disabledTestPaths
     for path in "${_pathsArray[@]}"; do
         # Check if every path glob matches at least one path
-        @pythonCheckInterpreter@ <(cat <<EOF
+        @pythonCheckInterpreter@ - "$path" <<EOF
 import glob
 import sys
 path_glob=sys.argv[1]
@@ -27,7 +27,6 @@ if not len(path_glob):
 if next(glob.iglob(path_glob), None) is None:
     sys.exit('Disabled tests path glob "{}" does not match any paths. Aborting'.format(path_glob))
 EOF
-        ) "$path"
         flagsArray+=("--ignore-glob=$path")
     done
 

pkgs/development/interpreters/python/mk-python-derivation.nix

@@ -50,6 +50,9 @@ let
     stringLength
     ;
 
+  getOptionalAttrs =
+    names: attrs: lib.getAttrs (lib.intersectLists names (lib.attrNames attrs)) attrs;
+
   leftPadName =
     name: against:
     let
@@ -196,8 +199,6 @@ in
 
   doCheck ? true,
 
-  disabledTestPaths ? [ ],
-
   # Allow passing in a custom stdenv to buildPython*
   stdenv ? python.stdenv,
 
@@ -437,24 +438,14 @@ let
       installCheckPhase = attrs.checkPhase;
     }
     // optionalAttrs (attrs.doCheck or true) (
-      optionalAttrs (disabledTestPaths != [ ]) {
+      getOptionalAttrs [
-        disabledTestPaths = disabledTestPaths;
+        "disabledTestPaths"
-      }
+        "disabledTests"
-      // optionalAttrs (attrs ? disabledTests) {
+        "pytestFlags"
-        disabledTests = attrs.disabledTests;
+        "pytestFlagsArray"
-      }
+        "unittestFlags"
-      // optionalAttrs (attrs ? pytestFlags) {
+        "unittestFlagsArray"
-        pytestFlags = attrs.pytestFlags;
+      ] attrs
-      }
-      // optionalAttrs (attrs ? pytestFlagsArray) {
-        pytestFlagsArray = attrs.pytestFlagsArray;
-      }
-      // optionalAttrs (attrs ? unittestFlags) {
-        unittestFlags = attrs.unittestFlags;
-      }
-      // optionalAttrs (attrs ? unittestFlagsArray) {
-        unittestFlagsArray = attrs.unittestFlagsArray;
-      }
     )
   );
 

pkgs/development/libraries/SDL2/default.nix

@@ -71,13 +71,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2";
-  version = "2.32.0";
+  version = "2.32.2";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-BdyMlttrDwQMoz+bO6bfU3bh0xKnT8yQF6nb6OGRbHw=";
+    hash = "sha256-Gtg8G1tRouGZbes1KhsXpYbItpNHYqJCiQKW/L77b+U=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [