From 8562dc924d89825ed829ea3f086896871d96fd3c Mon Sep 17 00:00:00 2001
From: tilpner <git@tilpner.com>
Date: Sun, 3 Sep 2023 23:36:39 +0200
Subject: [PATCH 01/89] nixos/prometheus: add remote{Read, Write}.headers
 options

---
 nixos/modules/services/monitoring/prometheus/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index 19ee3ae6f7da..c91328a34e84 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -1430,6 +1430,10 @@ let
       remote_timeout = mkOpt types.str ''
         Timeout for requests to the remote write endpoint.
       '';
+      headers = mkOpt (types.attrsOf types.str) ''
+        Custom HTTP headers to be sent along with each remote write request.
+        Be aware that headers that are set by Prometheus itself can't be overwritten.
+      '';
       write_relabel_configs = mkOpt (types.listOf promTypes.relabel_config) ''
         List of remote write relabel configurations.
       '';
@@ -1525,6 +1529,10 @@ let
       remote_timeout = mkOpt types.str ''
         Timeout for requests to the remote read endpoint.
       '';
+      headers = mkOpt (types.attrsOf types.str) ''
+        Custom HTTP headers to be sent along with each remote read request.
+        Be aware that headers that are set by Prometheus itself can't be overwritten.
+      '';
       read_recent = mkOpt types.bool ''
         Whether reads should be made for queries for time ranges that
         the local storage should have complete data for.

From 671020de387e8a7d2d5cf2a91ab6c88e4a10ad2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.me>
Date: Mon, 9 Oct 2023 21:51:00 +0200
Subject: [PATCH 02/89] vimPlugins.nfnl: init at 2023-09-08

---
 pkgs/applications/editors/vim/plugins/generated.nix  | 12 ++++++++++++
 .../editors/vim/plugins/vim-plugin-names             |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index f529df13170a..0fdc8c8e0f82 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -6466,6 +6466,18 @@ final: prev:
     meta.homepage = "https://github.com/fiatjaf/neuron.vim/";
   };
 
+  nfnl = buildVimPlugin {
+    pname = "nfnl";
+    version = "2023-09-08";
+    src = fetchFromGitHub {
+      owner = "Olical";
+      repo = "nfnl";
+      rev = "979dbfc48bcb601a9107764a99f9459cb5bd4051";
+      sha256 = "0m1yf62w4r75amva8708c4i0qvhgfia2i9p64z6i6589mq4mw6ip";
+    };
+    meta.homepage = "https://github.com/Olical/nfnl/";
+  };
+
   nginx-vim = buildVimPlugin {
     pname = "nginx.vim";
     version = "2023-01-25";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 64f721cee38c..5c6068945012 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -542,6 +542,7 @@ https://github.com/Xuyuanp/nerdtree-git-plugin/,,
 https://github.com/miversen33/netman.nvim/,HEAD,
 https://github.com/oberblastmeister/neuron.nvim/,,
 https://github.com/fiatjaf/neuron.vim/,,
+https://github.com/Olical/nfnl/,main,
 https://github.com/chr4/nginx.vim/,,
 https://github.com/EdenEast/nightfox.nvim/,,
 https://github.com/zah/nim.vim/,,

From 0acd1c038fe790343996cf59b9f76b805967b77f Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Thu, 2 Nov 2023 16:36:51 +0000
Subject: [PATCH 03/89] =?UTF-8?q?prometheus-xmpp-alerts:=200.5.6=20?=
 =?UTF-8?q?=E2=86=92=200.5.8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adapted for upstream's pyproject migration.
---
 .../monitoring/prometheus/xmpp-alerts.nix      | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/pkgs/servers/monitoring/prometheus/xmpp-alerts.nix b/pkgs/servers/monitoring/prometheus/xmpp-alerts.nix
index f9d9ce499b5f..da6013b9b5ec 100644
--- a/pkgs/servers/monitoring/prometheus/xmpp-alerts.nix
+++ b/pkgs/servers/monitoring/prometheus/xmpp-alerts.nix
@@ -9,27 +9,18 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "prometheus-xmpp-alerts";
-  version = "0.5.6";
+  version = "0.5.8";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "jelmer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PwShGS1rbfZCK5OS6Cnn+mduOpWAD4fC69mcGB5GB1c=";
+    sha256 = "sha256-iwqcowwJktZQfdxykpsw/MweAPY0KF7ojVwvk1LP8a4=";
   };
 
-  patches = [
-    # Required until https://github.com/jelmer/prometheus-xmpp-alerts/pull/33 is merged
-    # and contained in a release
-    (fetchpatch {
-      name = "Fix-outdated-entrypoint-definiton.patch";
-      url = "https://github.com/jelmer/prometheus-xmpp-alerts/commit/c41dd41dbd3c781b874bcf0708f6976e6252b621.patch";
-      hash = "sha256-G7fRLSXbkI5EDgGf4n9xSVs54IPD0ev8rTEFffRvLY0=";
-    })
-  ];
-
   postPatch = ''
-    substituteInPlace setup.cfg \
+    substituteInPlace pyproject.toml \
       --replace "bs4" "beautifulsoup4"
   '';
 
@@ -46,6 +37,7 @@ python3Packages.buildPythonApplication rec {
   ]);
 
   nativeCheckInputs = with python3Packages; [
+    setuptools
     unittestCheckHook
     pytz
   ];

From a1c24a7517effb013d892b7b1a44112bb5d68f9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81tila=20Saraiva?= <atilasaraiva@gmail.com>
Date: Sun, 19 Nov 2023 16:56:55 -0700
Subject: [PATCH 04/89] zotero_7: init at 7.0.0-beta

---
 pkgs/applications/office/zotero/zotero_7.nix | 150 +++++++++++++++++++
 pkgs/top-level/all-packages.nix              |   2 +
 2 files changed, 152 insertions(+)
 create mode 100644 pkgs/applications/office/zotero/zotero_7.nix

diff --git a/pkgs/applications/office/zotero/zotero_7.nix b/pkgs/applications/office/zotero/zotero_7.nix
new file mode 100644
index 000000000000..a59cc33cc8d6
--- /dev/null
+++ b/pkgs/applications/office/zotero/zotero_7.nix
@@ -0,0 +1,150 @@
+{ lib
+, stdenv
+, fetchurl
+, wrapGAppsHook
+, autoPatchelfHook
+, makeDesktopItem
+, atk
+, cairo
+, coreutils
+, curl
+, cups
+, dbus-glib
+, dbus
+, dconf
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, glibc
+, gtk3
+, libX11
+, libXScrnSaver
+, libxcb
+, libXcomposite
+, libXcursor
+, libXdamage
+, libXext
+, libXfixes
+, libXi
+, libXinerama
+, libXrender
+, libXt
+, libnotify
+, gnome
+, libGLU
+, libGL
+, nspr
+, nss
+, pango
+, gsettings-desktop-schemas
+, alsa-lib
+, libXtst
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zotero";
+  version = "7.0.0-beta";
+
+  src = fetchurl {
+    url = "https://download.zotero.org/client/beta/${version}.51%2B7c5600913/Zotero-${version}.51%2B7c5600913_linux-x86_64.tar.bz2";
+    hash = "sha256-zJ+jG7zlvWq+WEYOPyMIhqHPfsUe9tn0cbRyibQ7bFw=";
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    autoPatchelfHook
+  ];
+  buildInputs = [
+    gsettings-desktop-schemas
+    glib
+    gtk3
+    gnome.adwaita-icon-theme
+    dconf
+    libXtst
+    alsa-lib
+    stdenv.cc.cc
+    atk
+    cairo
+    curl
+    cups
+    dbus-glib
+    dbus
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    glibc
+    gtk3
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libxcb
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXinerama
+    libXrender
+    libXt
+    libnotify
+    libGLU
+    libGL
+    nspr
+    nss
+    pango
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+  dontStrip = true;
+
+
+  desktopItem = makeDesktopItem {
+    name = "zotero";
+    exec = "zotero -url %U";
+    icon = "zotero";
+    comment = meta.description;
+    desktopName = "Zotero";
+    genericName = "Reference Management";
+    categories = [ "Office" "Database" ];
+    startupNotify = true;
+    mimeTypes = [ "x-scheme-handler/zotero" "text/plain" ];
+  };
+
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$prefix/usr/lib/zotero-bin-${version}"
+    cp -r * "$prefix/usr/lib/zotero-bin-${version}"
+    mkdir -p "$out/bin"
+    ln -s "$prefix/usr/lib/zotero-bin-${version}/zotero" "$out/bin/"
+
+    # install desktop file and icons.
+    mkdir -p $out/share/applications
+    cp ${desktopItem}/share/applications/* $out/share/applications/
+    for size in 16 32 48 256; do
+      install -Dm444 chrome/icons/default/default$size.png \
+        $out/share/icons/hicolor/''${size}x''${size}/apps/zotero.png
+    done
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ coreutils ]}
+    )
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.zotero.org";
+    description = "Collect, organize, cite, and share your research sources";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.agpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ i077 ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6934627702a0..b0112f2112c6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -36955,6 +36955,8 @@ with pkgs;
 
   zotero = callPackage ../applications/office/zotero { };
 
+  zotero_7 = callPackage ../applications/office/zotero/zotero_7.nix { };
+
   zscroll = callPackage ../applications/misc/zscroll { };
 
   zsteg = callPackage ../tools/security/zsteg { };

From 96fb9249cdcaf2d71a84921dbc6eb126a01f91ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81tila=20Saraiva?= <atilasaraiva@gmail.com>
Date: Wed, 22 Nov 2023 11:05:57 -0700
Subject: [PATCH 05/89] zotero_7: swapping maintainer from i077 to atila

---
 pkgs/applications/office/zotero/zotero_7.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/office/zotero/zotero_7.nix b/pkgs/applications/office/zotero/zotero_7.nix
index a59cc33cc8d6..2164e44154ae 100644
--- a/pkgs/applications/office/zotero/zotero_7.nix
+++ b/pkgs/applications/office/zotero/zotero_7.nix
@@ -145,6 +145,6 @@ stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ i077 ];
+    maintainers = with maintainers; [ atila ];
   };
 }

From 9b9df554a2f655ac9b7dc1963ed0726e1952c537 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.me>
Date: Thu, 30 Nov 2023 20:32:23 +0100
Subject: [PATCH 06/89] vimPlugins.nvim-ts-rainbow: deprecate

https://github.com/mrjones2014/nvim-ts-rainbow/ and
https://github.com/HiPhish/nvim-ts-rainbow2 are deprecated, causing
problems with latest neovim. Use https://github.com/HiPhish/rainbow-delimiters.nvim instead.
---
 .../editors/vim/plugins/aliases.nix           |  2 ++
 .../editors/vim/plugins/generated.nix         | 23 -------------------
 .../editors/vim/plugins/vim-plugin-names      |  2 --
 3 files changed, 2 insertions(+), 25 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/aliases.nix b/pkgs/applications/editors/vim/plugins/aliases.nix
index 6915198f0961..174d7416a736 100644
--- a/pkgs/applications/editors/vim/plugins/aliases.nix
+++ b/pkgs/applications/editors/vim/plugins/aliases.nix
@@ -93,6 +93,8 @@ mapAliases (with prev; {
   neoinclude          = neoinclude-vim;
   neomru              = neomru-vim;
   neosnippet          = neosnippet-vim;
+  nvim-ts-rainbow     = throw "nvim-ts-rainbow has been deprecated: Use rainbow-delimiters-nvim"; # Added 2023-11-30
+  nvim-ts-rainbow2    = throw "nvim-ts-rainbow2 has been deprecated: Use rainbow-delimiters-nvim"; # Added 2023-11-30
   The_NERD_Commenter  = nerdcommenter;
   The_NERD_tree       = nerdtree;
   open-browser        = open-browser-vim;
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 179d90c7199b..423abbf13d82 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7690,29 +7690,6 @@ final: prev:
     meta.homepage = "https://github.com/joosepalviste/nvim-ts-context-commentstring/";
   };
 
-  nvim-ts-rainbow = buildVimPlugin {
-    pname = "nvim-ts-rainbow";
-    version = "2023-06-07";
-    src = fetchFromGitHub {
-      owner = "mrjones2014";
-      repo = "nvim-ts-rainbow";
-      rev = "8312b513ce930e7669a1721befbe56f2e1853301";
-      sha256 = "16s8kppsn9m831ymcz5w3kpnq40sxg98nykd0gz3hfj27hinqag5";
-    };
-    meta.homepage = "https://github.com/mrjones2014/nvim-ts-rainbow/";
-  };
-
-  nvim-ts-rainbow2 = buildVimPlugin {
-    pname = "nvim-ts-rainbow2";
-    version = "2023-07-12";
-    src = fetchgit {
-      url = "https://gitlab.com/HiPhish/nvim-ts-rainbow2";
-      rev = "b3120cd5ae9ca524af9cb602f41e12e301fa985f";
-      sha256 = "0mjg0pkd8wv8cfar30lkyywdrd3g5lz36bbsfb7lrqi7kbksyzxv";
-    };
-    meta.homepage = "https://gitlab.com/HiPhish/nvim-ts-rainbow2";
-  };
-
   nvim-ufo = buildVimPlugin {
     pname = "nvim-ufo";
     version = "2023-11-23";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 4f7d3b239633..fbe9c33d23c8 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -645,8 +645,6 @@ https://github.com/nvim-treesitter/nvim-treesitter-textobjects/,,
 https://github.com/RRethy/nvim-treesitter-textsubjects/,HEAD,
 https://github.com/windwp/nvim-ts-autotag/,,
 https://github.com/joosepalviste/nvim-ts-context-commentstring/,,
-https://github.com/mrjones2014/nvim-ts-rainbow/,,
-https://gitlab.com/HiPhish/nvim-ts-rainbow2,HEAD,
 https://github.com/kevinhwang91/nvim-ufo/,HEAD,
 https://github.com/samjwill/nvim-unception/,HEAD,
 https://github.com/kyazdani42/nvim-web-devicons/,,

From abe69649526224d9dcd95260f0ee519f9f74baec Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 2 Dec 2023 04:20:00 +0000
Subject: [PATCH 07/89] emacsPackages.lspce: unstable-2023-10-30 ->
 unstable-2023-12-01

Diff: https://github.com/zbelial/lspce/compare/34c59787bcdbf414c92d9b3bf0a0f5306cb98d64...1958b6fcdfb6288aa17fa42360315d6c4aa85991
---
 .../manual-packages/lspce/default.nix         | 31 +++++++------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lspce/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lspce/default.nix
index 29157c802411..67b1b600390e 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lspce/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lspce/default.nix
@@ -9,13 +9,13 @@
 }:
 
 let
-  version = "unstable-2023-10-30";
+  version = "unstable-2023-12-01";
 
   src = fetchFromGitHub {
     owner = "zbelial";
     repo = "lspce";
-    rev = "34c59787bcdbf414c92d9b3bf0a0f5306cb98d64";
-    hash = "sha256-kUHGdeJo2zXA410FqXGclgXmgWrll30Zv8fSprcmnIo=";
+    rev = "1958b6fcdfb6288aa17fa42360315d6c4aa85991";
+    hash = "sha256-HUIRm1z6xNJWgX7ykujzniBrOTh76D3dJHrm0LR3nuQ=";
   };
 
   meta = {
@@ -30,17 +30,19 @@ let
     inherit version src meta;
     pname = "lspce-module";
 
-    cargoHash = "sha256-eqSromwJrFhtJWedDVJivfbKpAtSFEtuCP098qOxFgI=";
+    cargoHash = "sha256-qMLwdZwqrK7bPXL1bIbOqM7xQPpeiO8FDoje0CEJeXQ=";
 
     checkFlags = [
       # flaky test
       "--skip=msg::tests::serialize_request_with_null_params"
     ];
 
-    postFixup = ''
+    postInstall = ''
+      mkdir -p $out/share/emacs/site-lisp
       for f in $out/lib/*; do
-        mv $f $out/lib/lspce-module.''${f##*.}
+        mv $f $out/share/emacs/site-lisp/lspce-module.''${f##*.}
       done
+      rmdir $out/lib
     '';
   };
 in
@@ -48,25 +50,16 @@ trivialBuild rec {
   inherit version src meta;
   pname = "lspce";
 
-  preBuild = ''
-    ln -s ${lspce-module}/lib/lspce-module* .
-
-    # Fix byte-compilation
-    substituteInPlace lspce-util.el \
-      --replace "(require 'yasnippet)" "(require 'yasnippet)(require 'url-util)"
-    substituteInPlace lspce-calltree.el \
-      --replace "(require 'compile)" "(require 'compile)(require 'cl-lib)"
-  '';
-
   buildInputs = propagatedUserEnvPkgs;
 
   propagatedUserEnvPkgs = [
     f
     markdown-mode
     yasnippet
+    lspce-module
   ];
 
-  postInstall = ''
-    install lspce-module* $LISPDIR
-  '';
+  passthru = {
+    inherit lspce-module;
+  };
 }

From 94a3c175826801407a66f4f992407755fdebf83d Mon Sep 17 00:00:00 2001
From: Jeff Huffman <tejing@tejing.com>
Date: Fri, 24 Nov 2023 22:51:50 -0500
Subject: [PATCH 08/89] lib.systems.elaborate: add libDir attribute

---
 lib/systems/default.nix                   | 7 +++++++
 pkgs/os-specific/linux/nix-ld/default.nix | 8 ++------
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 9eec21cbf21b..6137d47e91a2 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -89,6 +89,13 @@ rec {
         # is why we use the more obscure "bfd" and not "binutils" for this
         # choice.
         else                                     "bfd";
+      # The standard lib directory name that non-nixpkgs binaries distributed
+      # for this platform normally assume.
+      libDir = if final.isLinux then
+        if final.isx86_64 || final.isMips64 || final.isPower64
+        then "lib64"
+        else "lib"
+      else null;
       extensions = lib.optionalAttrs final.hasSharedLibraries {
         sharedLibrary =
           if      final.isDarwin  then ".dylib"
diff --git a/pkgs/os-specific/linux/nix-ld/default.nix b/pkgs/os-specific/linux/nix-ld/default.nix
index 5eebe6773147..bb6489ecdb17 100644
--- a/pkgs/os-specific/linux/nix-ld/default.nix
+++ b/pkgs/os-specific/linux/nix-ld/default.nix
@@ -5,11 +5,7 @@
 , ninja
 , nixosTests
 }:
-let
-  libDir = if builtins.elem stdenv.system [ "x86_64-linux" "mips64-linux" "powerpc64le-linux" ]
-           then "/lib64"
-           else "/lib";
-in
+
 stdenv.mkDerivation rec {
   pname = "nix-ld";
   version = "1.2.2";
@@ -36,7 +32,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/nix-support
 
-    ldpath=${libDir}/$(basename $(< ${stdenv.cc}/nix-support/dynamic-linker))
+    ldpath=/${stdenv.hostPlatform.libDir}/$(basename $(< ${stdenv.cc}/nix-support/dynamic-linker))
     echo "$ldpath" > $out/nix-support/ldpath
     mkdir -p $out/lib/tmpfiles.d/
     cat > $out/lib/tmpfiles.d/nix-ld.conf <<EOF

From bf6f0d3cf4e1ed8c146b4e028b80be26383f5036 Mon Sep 17 00:00:00 2001
From: Jeff Huffman <tejing@tejing.com>
Date: Mon, 27 Nov 2023 06:50:25 -0500
Subject: [PATCH 09/89] nixos/ldso: init module

---
 nixos/modules/config/ldso.nix     | 58 +++++++++++++++++++++++++++++++
 nixos/modules/module-list.nix     |  1 +
 nixos/modules/programs/nix-ld.nix |  2 +-
 3 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 nixos/modules/config/ldso.nix

diff --git a/nixos/modules/config/ldso.nix b/nixos/modules/config/ldso.nix
new file mode 100644
index 000000000000..e5ae13a21145
--- /dev/null
+++ b/nixos/modules/config/ldso.nix
@@ -0,0 +1,58 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) last splitString mkOption types mdDoc optionals;
+
+  libDir = pkgs.stdenv.hostPlatform.libDir;
+  ldsoBasename = last (splitString "/" pkgs.stdenv.cc.bintools.dynamicLinker);
+
+  pkgs32 = pkgs.pkgsi686Linux;
+  libDir32 = pkgs32.stdenv.hostPlatform.libDir;
+  ldsoBasename32 = last (splitString "/" pkgs32.stdenv.cc.bintools.dynamicLinker);
+in {
+  options = {
+    environment.ldso = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = mdDoc ''
+        The executable to link into the normal FHS location of the ELF loader.
+      '';
+    };
+
+    environment.ldso32 = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = mdDoc ''
+        The executable to link into the normal FHS location of the 32-bit ELF loader.
+
+        This currently only works on x86_64 architectures.
+      '';
+    };
+  };
+
+  config = {
+    assertions = [
+      { assertion = isNull config.environment.ldso32 || pkgs.stdenv.isx86_64;
+        message = "Option environment.ldso32 currently only works on x86_64.";
+      }
+    ];
+
+    systemd.tmpfiles.rules = (
+      if isNull config.environment.ldso then [
+        "r /${libDir}/${ldsoBasename} - - - - -"
+      ] else [
+        "d /${libDir} 0755 root root - -"
+        "L+ /${libDir}/${ldsoBasename} - - - - ${config.environment.ldso}"
+      ]
+    ) ++ optionals pkgs.stdenv.isx86_64 (
+      if isNull config.environment.ldso32 then [
+        "r /${libDir32}/${ldsoBasename32} - - - - -"
+      ] else [
+        "d /${libDir32} 0755 root root - -"
+        "L+ /${libDir32}/${ldsoBasename32} - - - - ${config.environment.ldso32}"
+      ]
+    );
+  };
+
+  meta.maintainers = with lib.maintainers; [ tejing ];
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index fee7c35ed8f4..e2b1e4a58733 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -12,6 +12,7 @@
   ./config/iproute2.nix
   ./config/krb5/default.nix
   ./config/ldap.nix
+  ./config/ldso.nix
   ./config/locale.nix
   ./config/malloc.nix
   ./config/mysql.nix
diff --git a/nixos/modules/programs/nix-ld.nix b/nixos/modules/programs/nix-ld.nix
index e3a9bb16410c..6f36ce33640c 100644
--- a/nixos/modules/programs/nix-ld.nix
+++ b/nixos/modules/programs/nix-ld.nix
@@ -47,7 +47,7 @@ in
   };
 
   config = lib.mkIf config.programs.nix-ld.enable {
-    systemd.tmpfiles.packages = [ cfg.package ];
+    environment.ldso = "${cfg.package}/libexec/nix-ld";
 
     environment.systemPackages = [ nix-ld-libraries ];
 

From 5d7e9d25ac15513b5cfe2f42d5a84cceba713fe7 Mon Sep 17 00:00:00 2001
From: Sophie Tauchert <sophie@999eagle.moe>
Date: Mon, 4 Dec 2023 09:53:11 +0100
Subject: [PATCH 10/89] borgbackup: 1.2.6 -> 1.2.7

---
 pkgs/tools/backup/borgbackup/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/backup/borgbackup/default.nix b/pkgs/tools/backup/borgbackup/default.nix
index e11f3f1ad498..33c5aa527218 100644
--- a/pkgs/tools/backup/borgbackup/default.nix
+++ b/pkgs/tools/backup/borgbackup/default.nix
@@ -16,12 +16,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.2.6";
+  version = "1.2.7";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-t6b48IYDnu7HkHC5FPPGUe1/NhLJZTdK+RDSd8eiE50=";
+    hash = "sha256-9j8oozg8BBlxzsh7BhyjmoFbX9RF2ySqgXLKxBfZQRo=";
   };
 
   postPatch = ''

From 853e859ac8b77fc15a2f6efcaa1fd17047c528de Mon Sep 17 00:00:00 2001
From: Adam Stephens <adam@valkor.net>
Date: Wed, 6 Dec 2023 10:20:05 -0500
Subject: [PATCH 11/89] vault-bin: 1.15.3 -> 1.15.4

---
 pkgs/tools/security/vault/vault-bin.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index e7516cc83d0d..abb548e68775 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src =
     let
@@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       sha256 = selectSystem {
-        x86_64-linux = "sha256-rRXpRxuslOvvNgK6W0BG/LWs2sAGGCuSxcbVbsmrtN0=";
-        aarch64-linux = "sha256-vD/S+aZGa+JFRBV9WML9WbhrFpB8FynM62ZJ0zkWtDU=";
-        i686-linux = "sha256-Y9KpL0kZxlgfkBSyXJVSND2hSJ1y+FuXKPK0/P2YX2w=";
-        x86_64-darwin = "sha256-i85GQSJK7dPoLP7XBrz7CiISCG8KbGylL++ecy/CXRY=";
-        aarch64-darwin = "sha256-eZAuUNbigJ/kye8p3yu+Qf+p47IkxKJntR2sGFpM+j8=";
+        x86_64-linux = "sha256-E1tNqPkaZVnJXtV+ENt2Ajpdq0AYMPZSFMLAFiSxknY=";
+        aarch64-linux = "sha256-p+pYU4WenDHZmQQQFTm2ttHjxL+63NWy8G+cbAZLJEI=";
+        i686-linux = "sha256-FoClSgz/QAD7uktFcYmKsCXnS8kIm8a7BLd2N29Z/fE=";
+        x86_64-darwin = "sha256-Lykhs/tTFDBqk8SJ26k712oMUAhXlmBeNNi3Ve/M1B4=";
+        aarch64-darwin = "sha256-r9OamlIgFUGgIFX1baQCdBsDGmPwZoTVu+Zab99KnhM=";
       };
     in
     fetchzip {

From 7cf8d6878561e8b2e4b1186f79f1c0e66963bdac Mon Sep 17 00:00:00 2001
From: Adam Stephens <adam@valkor.net>
Date: Wed, 6 Dec 2023 10:22:29 -0500
Subject: [PATCH 12/89] vault: 1.14.7 -> 1.14.8

Diff: https://github.com/hashicorp/vault/compare/v1.14.7...v1.14.8

Changelog: https://github.com/hashicorp/vault/blob/v1.14.8/CHANGELOG.md
---
 pkgs/tools/security/vault/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index c13f33f9115e..e86c160dbd4b 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.14.7";
+  version = "1.14.8";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "sha256-ubMHvKV5OOmQOrjm2J56/XCxsj+qDBPOKgS6hF75g28=";
+    sha256 = "sha256-sGCODCBgsxyr96zu9ntPmMM/gHVBBO+oo5+XsdbCK4E=";
   };
 
   vendorHash = "sha256-zpHjZjgCgf4b2FAJQ22eVgq0YGoVvxGYJ3h/3ZRiyrQ=";

From 99df6a7a5474b80edc5cf7f6a377964889d8c2fe Mon Sep 17 00:00:00 2001
From: x10an14 <x10an14@users.noreply.github.com>
Date: Fri, 8 Dec 2023 13:11:45 +0100
Subject: [PATCH 13/89] cargo-cyclonedx: 0.3.8 -> 0.4.1

@Co-authored-by: @Reasonable-Solutions <carl.hedgren@nav.no>
---
 pkgs/development/tools/rust/cargo-cyclonedx/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-cyclonedx/default.nix b/pkgs/development/tools/rust/cargo-cyclonedx/default.nix
index c8769abc8a68..acfd450f209a 100644
--- a/pkgs/development/tools/rust/cargo-cyclonedx/default.nix
+++ b/pkgs/development/tools/rust/cargo-cyclonedx/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-cyclonedx";
-  version = "0.3.8";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-rust-cargo";
     rev = "${pname}-${version}";
-    hash = "sha256-6XW8aCXepbVnTubbM4sfRIC87uYSCEbuj+jJcPayEEU=";
+    hash = "sha256-JrusJsMjaWAsWAssU+q87BCH2ouLfthIw47ypwBkR9o=";
   };
 
-  cargoHash = "sha256-BG/vfa5L6Iibfon3A5TP8/K8jbJsWqc+axdvIXc7GmM=";
+  cargoHash = "sha256-QzEojbwBF7s3C+LlFWle0+8DVtyEljuqAcMAyRJqFcs=";
 
   nativeBuildInputs = [
     pkg-config

From d28abe1cc627d21707c9ae7b74822638e7fc1a78 Mon Sep 17 00:00:00 2001
From: Robert Medeiros <robert@crimeminister.org>
Date: Fri, 8 Dec 2023 15:42:16 -0500
Subject: [PATCH 14/89] iroh: 0.5.1 -> 0.11.0

---
 pkgs/applications/networking/iroh/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/iroh/default.nix b/pkgs/applications/networking/iroh/default.nix
index 2e2ef6ee6ccc..ac525fd2fa11 100644
--- a/pkgs/applications/networking/iroh/default.nix
+++ b/pkgs/applications/networking/iroh/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "iroh";
-  version = "0.5.1";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
-    rev = "${pname}-v${version}";
-    hash = "sha256-p1OvXso5szo8ZCnCTKgDzCEMJgiePXQMhVYOkWVZrbE=";
+    rev = "v${version}";
+    hash = "sha256-b3XpKAV/K+69tQmjM1CGzoOTcaQHB6q3gpoSa/YFwak=";
   };
 
-  cargoHash = "sha256-QqMBEYaIQ6PqO7w7Yd1jVr0zHARsVaJtZzWytmDksZQ=";
+  cargoHash = "sha256-dnEEque40qi7vuUxY/UDZ5Kz8LTuz0GvYVjTxl8eMvI=";
 
   buildInputs = lib.optionals stdenv.isDarwin (
     with darwin.apple_sdk.frameworks; [

From 70ada52c57f8951f0cf8d82945effb6ba9f689fc Mon Sep 17 00:00:00 2001
From: tilpner <git@tilpner.com>
Date: Sun, 10 Dec 2023 18:24:31 +0100
Subject: [PATCH 15/89] vivictpp: 0.3.1 -> 1.0.0

---
 pkgs/applications/video/vivictpp/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/video/vivictpp/default.nix b/pkgs/applications/video/vivictpp/default.nix
index 9b8a8773b1b4..e2fc34340fc5 100644
--- a/pkgs/applications/video/vivictpp/default.nix
+++ b/pkgs/applications/video/vivictpp/default.nix
@@ -7,7 +7,7 @@
 , cacert }:
 
 let
-  version = "0.3.1";
+  version = "1.0.0";
   withSubprojects = stdenv.mkDerivation {
     name = "sources-with-subprojects";
 
@@ -15,7 +15,7 @@ let
       owner = "vivictorg";
       repo = "vivictpp";
       rev = "v${version}";
-      hash = "sha256-6YfYeUrM7cq8hnOPMq0Uq/HToFBDri0N/r0SU0LeT/Y=";
+      hash = "sha256-dCtMjemEjXe63ELAfQhzJl3GecqWLcjL2y5Htn6hYgU=";
     };
 
     nativeBuildInputs = [
@@ -33,7 +33,7 @@ let
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-lIm2Bwy61St9d1e6QSm5ZpSIDR9ucaQKBPHATTDEgW4=";
+    outputHash = "sha256-a7NBQJt5T+KwP8Djc8TQiVLNZF8UcXlXrv2G/dZ54aM=";
   };
 in stdenv.mkDerivation rec {
   pname = "vivictpp";

From 0863f6d2da0be5e8d7e3fb316ef58cdfe145220b Mon Sep 17 00:00:00 2001
From: Jeff Huffman <tejing@tejing.com>
Date: Thu, 23 Nov 2023 22:03:03 -0500
Subject: [PATCH 16/89] nixos/stub-ld: init module

---
 .../manual/release-notes/rl-2405.section.md   |  4 +
 nixos/modules/config/stub-ld.nix              | 56 ++++++++++++++
 nixos/modules/module-list.nix                 |  1 +
 nixos/modules/profiles/minimal.nix            |  2 +
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/stub-ld.nix                       | 73 +++++++++++++++++++
 6 files changed, 137 insertions(+)
 create mode 100644 nixos/modules/config/stub-ld.nix
 create mode 100644 nixos/tests/stub-ld.nix

diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index bfd4bcee63d3..cf55994d1c1f 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -10,6 +10,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `screen`'s module has been cleaned, and will now require you to set `programs.screen.enable` in order to populate `screenrc` and add the program to the environment.
 
+- NixOS now installs a stub ELF loader that prints an informative error message when users attempt to run binaries not made for NixOS.
+   - This can be disabled through the `environment.stub-ld.enable` option.
+   - If you use `programs.nix-ld.enable`, no changes are needed. The stub will be disabled automatically.
+
 ## New Services {#sec-release-24.05-new-services}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/config/stub-ld.nix b/nixos/modules/config/stub-ld.nix
new file mode 100644
index 000000000000..14c07466d061
--- /dev/null
+++ b/nixos/modules/config/stub-ld.nix
@@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) optionalString mkOption types mdDoc mkIf mkDefault;
+
+  cfg = config.environment.stub-ld;
+
+  message = ''
+    NixOS cannot run dynamically linked executables intended for generic
+    linux environments out of the box. For more information, see:
+    https://nix.dev/permalink/stub-ld
+  '';
+
+  stub-ld-for = pkgsArg: messageArg: pkgsArg.pkgsStatic.runCommandCC "stub-ld" {
+    nativeBuildInputs = [ pkgsArg.unixtools.xxd ];
+    inherit messageArg;
+  } ''
+    printf "%s" "$messageArg" | xxd -i -n message >main.c
+    cat <<EOF >>main.c
+    #include <stdio.h>
+    int main(int argc, char * argv[]) {
+      fprintf(stderr, "Could not start dynamically linked executable: %s\n", argv[0]);
+      fwrite(message, sizeof(unsigned char), message_len, stderr);
+      return 127; // matches behavior of bash and zsh without a loader. fish uses 139
+    }
+    EOF
+    $CC -Os main.c -o $out
+  '';
+
+  pkgs32 = pkgs.pkgsi686Linux;
+
+  stub-ld = stub-ld-for pkgs message;
+  stub-ld32 = stub-ld-for pkgs32 message;
+in {
+  options = {
+    environment.stub-ld = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = mdDoc ''
+          Install a stub ELF loader to print an informative error message
+          in the event that a user attempts to run an ELF binary not
+          compiled for NixOS.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.ldso = mkDefault stub-ld;
+    environment.ldso32 = mkIf pkgs.stdenv.isx86_64 (mkDefault stub-ld32);
+  };
+
+  meta.maintainers = with lib.maintainers; [ tejing ];
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e2b1e4a58733..7625a17a169d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -29,6 +29,7 @@
   ./config/resolvconf.nix
   ./config/shells-environment.nix
   ./config/stevenblack.nix
+  ./config/stub-ld.nix
   ./config/swap.nix
   ./config/sysctl.nix
   ./config/system-environment.nix
diff --git a/nixos/modules/profiles/minimal.nix b/nixos/modules/profiles/minimal.nix
index 75f355b4a002..b76740f7cc58 100644
--- a/nixos/modules/profiles/minimal.nix
+++ b/nixos/modules/profiles/minimal.nix
@@ -21,6 +21,8 @@ with lib;
   # Perl is a default package.
   environment.defaultPackages = mkDefault [ ];
 
+  environment.stub-ld.enable = false;
+
   # The lessopen package pulls in Perl.
   programs.less.lessopen = mkDefault null;
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e0572e3bed9c..d980ccb128bb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -787,6 +787,7 @@ in {
   step-ca = handleTestOn ["x86_64-linux"] ./step-ca.nix {};
   stratis = handleTest ./stratis {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
+  stub-ld = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stub-ld.nix {};
   stunnel = handleTest ./stunnel.nix {};
   sudo = handleTest ./sudo.nix {};
   sudo-rs = handleTest ./sudo-rs.nix {};
diff --git a/nixos/tests/stub-ld.nix b/nixos/tests/stub-ld.nix
new file mode 100644
index 000000000000..25161301741b
--- /dev/null
+++ b/nixos/tests/stub-ld.nix
@@ -0,0 +1,73 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "stub-ld";
+
+  nodes.machine = { lib, ... }:
+    {
+      environment.stub-ld.enable = true;
+
+      specialisation.nostub = {
+        inheritParentConfig = true;
+
+        configuration = { ... }: {
+          environment.stub-ld.enable = lib.mkForce false;
+        };
+      };
+    };
+
+  testScript = let
+    libDir = pkgs.stdenv.hostPlatform.libDir;
+    ldsoBasename = lib.last (lib.splitString "/" pkgs.stdenv.cc.bintools.dynamicLinker);
+
+    check32 = pkgs.stdenv.isx86_64;
+    pkgs32 = pkgs.pkgsi686Linux;
+
+    libDir32 = pkgs32.stdenv.hostPlatform.libDir;
+    ldsoBasename32 = lib.last (lib.splitString "/" pkgs32.stdenv.cc.bintools.dynamicLinker);
+
+    test-exec = builtins.mapAttrs (n: v: pkgs.runCommand "test-exec-${n}" { src = pkgs.fetchurl v; } "mkdir -p $out;cd $out;tar -xzf $src") {
+      x86_64-linux.url = "https://github.com/rustic-rs/rustic/releases/download/v0.6.1/rustic-v0.6.1-x86_64-unknown-linux-gnu.tar.gz";
+      x86_64-linux.hash = "sha256-3zySzx8MKFprMOi++yr2ZGASE0aRfXHQuG3SN+kWUCI=";
+      i686-linux.url = "https://github.com/rustic-rs/rustic/releases/download/v0.6.1/rustic-v0.6.1-i686-unknown-linux-gnu.tar.gz";
+      i686-linux.hash = "sha256-fWNiATFeg0B2pfB5zndlnzGn7Ztl8diVS1rFLEDnSLU=";
+      aarch64-linux.url = "https://github.com/rustic-rs/rustic/releases/download/v0.6.1/rustic-v0.6.1-aarch64-unknown-linux-gnu.tar.gz";
+      aarch64-linux.hash = "sha256-hnldbd2cctQIAhIKoEZLIWY8H3jiFBClkNy2UlyyvAs=";
+    };
+    exec-name = "rustic";
+
+    if32 = pythonStatement: if check32 then pythonStatement else "pass";
+  in
+    ''
+      machine.start()
+      machine.wait_for_unit("multi-user.target")
+
+      with subtest("Check for stub (enabled, initial)"):
+          machine.succeed('test -L /${libDir}/${ldsoBasename}')
+          ${if32 "machine.succeed('test -L /${libDir32}/${ldsoBasename32}')"}
+
+      with subtest("Try FHS executable"):
+          machine.copy_from_host('${test-exec.${pkgs.system}}','test-exec')
+          machine.succeed('if test-exec/${exec-name} 2>outfile; then false; else [ $? -eq 127 ];fi')
+          machine.succeed('grep -qi nixos outfile')
+          ${if32 "machine.copy_from_host('${test-exec.${pkgs32.system}}','test-exec32')"}
+          ${if32 "machine.succeed('if test-exec32/${exec-name} 2>outfile32; then false; else [ $? -eq 127 ];fi')"}
+          ${if32 "machine.succeed('grep -qi nixos outfile32')"}
+
+      with subtest("Disable stub"):
+          machine.succeed("/run/booted-system/specialisation/nostub/bin/switch-to-configuration test")
+
+      with subtest("Check for stub (disabled)"):
+          machine.fail('test -e /${libDir}/${ldsoBasename}')
+          ${if32 "machine.fail('test -e /${libDir32}/${ldsoBasename32}')"}
+
+      with subtest("Create file in stub location (to be overwritten)"):
+          machine.succeed('mkdir -p /${libDir};touch /${libDir}/${ldsoBasename}')
+          ${if32 "machine.succeed('mkdir -p /${libDir32};touch /${libDir32}/${ldsoBasename32}')"}
+
+      with subtest("Re-enable stub"):
+          machine.succeed("/run/booted-system/bin/switch-to-configuration test")
+
+      with subtest("Check for stub (enabled, final)"):
+          machine.succeed('test -L /${libDir}/${ldsoBasename}')
+          ${if32 "machine.succeed('test -L /${libDir32}/${ldsoBasename32}')"}
+    '';
+})

From 0a25fb88804101493c5c83be51201d17edaaab48 Mon Sep 17 00:00:00 2001
From: Bouke van der Bijl <i@bou.ke>
Date: Mon, 11 Dec 2023 14:18:01 +0100
Subject: [PATCH 17/89] librealsense: 2.45.0 -> 2.54.2

---
 .../libraries/librealsense/default.nix        | 17 +------
 .../py_pybind11_no_external_download.patch    | 48 +++++--------------
 .../librealsense/py_sitepackage_dir.patch     | 15 ------
 3 files changed, 14 insertions(+), 66 deletions(-)
 delete mode 100644 pkgs/development/libraries/librealsense/py_sitepackage_dir.patch

diff --git a/pkgs/development/libraries/librealsense/default.nix b/pkgs/development/libraries/librealsense/default.nix
index aec9cfaaf91a..4c7b54d965a9 100644
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@@ -23,7 +23,7 @@ assert enablePython -> pythonPackages != null;
 
 stdenv.mkDerivation rec {
   pname = "librealsense";
-  version = "2.45.0";
+  version = "2.54.2";
 
   outputs = [ "out" "dev" ];
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     owner = "IntelRealSense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0aqf48zl7825v7x8c3x5w4d17m4qq377f1mn6xyqzf9b0dnk4i1j";
+    sha256 = "sha256-EbnIHnsUgsqN/SVv4m9H7K8gfwni+u82+M55QBstAGI=";
   };
 
   buildInputs = [
@@ -42,22 +42,9 @@ stdenv.mkDerivation rec {
     ++ lib.optionals enableGUI [ mesa gtk3 glfw libGLU curl ];
 
   patches = [
-    # fix build on aarch64-darwin
-    # https://github.com/IntelRealSense/librealsense/pull/9253
-    (fetchpatch {
-      url = "https://github.com/IntelRealSense/librealsense/commit/beb4c44debc8336de991c983274cad841eb5c323.patch";
-      sha256 = "05mxsd2pz3xrvywdqyxkwdvxx8hjfxzcgl51897avz4v2j89pyq8";
-    })
-    ./py_sitepackage_dir.patch
     ./py_pybind11_no_external_download.patch
   ];
 
-  postPatch = ''
-    # https://github.com/IntelRealSense/librealsense/issues/11092
-    # insert a "#include <iostream" at beginning of file
-    sed '1i\#include <iostream>' -i wrappers/python/pyrs_device.cpp
-  '';
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/development/libraries/librealsense/py_pybind11_no_external_download.patch b/pkgs/development/libraries/librealsense/py_pybind11_no_external_download.patch
index 2b48edb62e37..c91945fa1523 100644
--- a/pkgs/development/libraries/librealsense/py_pybind11_no_external_download.patch
+++ b/pkgs/development/libraries/librealsense/py_pybind11_no_external_download.patch
@@ -1,39 +1,15 @@
-From 01e51b9c90ba51b2d0ca797dde676812cf3db415 Mon Sep 17 00:00:00 2001
-From: "Robert T. McGibbon" <rmcgibbo@gmail.com>
-Date: Mon, 10 May 2021 17:26:04 -0400
-Subject: [PATCH 1/1] V1
-
----
- wrappers/python/CMakeLists.txt | 15 +--------------
- 1 file changed, 1 insertion(+), 14 deletions(-)
-
-diff --git a/wrappers/python/CMakeLists.txt b/wrappers/python/CMakeLists.txt
-index aa83e4c77..4ec92ccfa 100644
---- a/wrappers/python/CMakeLists.txt
-+++ b/wrappers/python/CMakeLists.txt
-@@ -8,21 +8,8 @@ if (NOT BUILD_PYTHON_BINDINGS)
- endif()
+diff --git a/CMake/global_config.cmake b/CMake/global_config.cmake
+index 350f7a268..2cf125c67 100644
+--- a/CMake/global_config.cmake
++++ b/CMake/global_config.cmake
+@@ -69,7 +69,8 @@ macro(global_set_flags)
  
- set(DEPENDENCIES realsense2)
--# In order for the external project clone to occur during cmake configure step(rather than during compilation, as would normally happen),
--# we copy the external project declaration to the build folder and then execute it
--configure_file(${CMAKE_SOURCE_DIR}/third-party/pybind11/CMakeLists.txt ${CMAKE_BINARY_DIR}/external-projects/pybind11/CMakeLists.txt)
--execute_process(COMMAND "${CMAKE_COMMAND}" -G "${CMAKE_GENERATOR}" .
--    WORKING_DIRECTORY "${CMAKE_BINARY_DIR}/external-projects/pybind11"
--)
--execute_process(COMMAND "${CMAKE_COMMAND}" --build .
--    WORKING_DIRECTORY "${CMAKE_BINARY_DIR}/external-projects/pybind11"
--)
+     if(BUILD_PYTHON_BINDINGS)
+         include(libusb_config)
+-        include(CMake/external_pybind11.cmake)
++        find_package(pybind11 REQUIRED)
++        set(PYTHON_INSTALL_DIR "${XXNIX_PYTHON_SITEPACKAGES}/pyrealsense2" CACHE PATH "Installation directory for Python bindings")
+     endif()
  
--# Add pybind11 makefile
--add_subdirectory("${CMAKE_BINARY_DIR}/third-party/pybind11"
--                 "${CMAKE_BINARY_DIR}/third-party/pybind11"
--                 EXCLUDE_FROM_ALL
--)
-+find_package(pybind11 REQUIRED)
- 
- set(PYBIND11_CPP_STANDARD -std=c++11)
- # Force Pybind11 not to share pyrealsense2 resources with other pybind modules.
--- 
-2.29.3
+     if(CHECK_FOR_UPDATES)
 
diff --git a/pkgs/development/libraries/librealsense/py_sitepackage_dir.patch b/pkgs/development/libraries/librealsense/py_sitepackage_dir.patch
deleted file mode 100644
index 99b567a429ed..000000000000
--- a/pkgs/development/libraries/librealsense/py_sitepackage_dir.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/wrappers/python/CMakeLists.txt
-+++ b/wrappers/python/CMakeLists.txt
-@@ -10,11 +10,11 @@
- if (CMAKE_VERSION VERSION_LESS 3.12)
-   find_package(PythonInterp REQUIRED)
-   find_package(PythonLibs REQUIRED)
--  set(PYTHON_INSTALL_DIR "${CMAKE_INSTALL_LIBDIR}/python${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}/pyrealsense2" CACHE PATH "Installation directory for Python bindings")
-+  set(PYTHON_INSTALL_DIR "${XXNIX_PYTHON_SITEPACKAGES}/pyrealsense2" CACHE PATH "Installation directory for Python bindings")
-   set(CMAKECONFIG_PY_INSTALL_DIR "${CMAKE_INSTALL_LIBDIR}/cmake/pyrealsense2")
- else()
-   find_package(Python REQUIRED COMPONENTS Interpreter Development)
--  set(PYTHON_INSTALL_DIR "${Python_SITEARCH}/pyrealsense2" CACHE PATH "Installation directory for Python bindings")
-+  set(PYTHON_INSTALL_DIR "${XXNIX_PYTHON_SITEPACKAGES}/pyrealsense2" CACHE PATH "Installation directory for Python bindings")
-   set(CMAKECONFIG_PY_INSTALL_DIR "${CMAKE_INSTALL_LIBDIR}/cmake/pyrealsense2")
- endif()

From 6a3c46ee385cbeef4a6df5933a9248d5bc51c51b Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Sat, 25 Nov 2023 09:12:25 -0500
Subject: [PATCH 18/89] emscripten: add willcohen to maintainers

---
 pkgs/development/compilers/emscripten/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 39c7d58aac85..01fa67520593 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -131,7 +131,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/emscripten-core/emscripten";
     description = "An LLVM-to-JavaScript Compiler";
     platforms = platforms.all;
-    maintainers = with maintainers; [ qknight matthewbauer raitobezarius ];
+    maintainers = with maintainers; [ qknight matthewbauer raitobezarius willcohen ];
     license = licenses.ncsa;
   };
 }

From a4daad0caa880988d181f9af214699fd4f2f3dad Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Mon, 11 Dec 2023 11:10:22 -0500
Subject: [PATCH 19/89] llvmPackages_17.lld: backport table-base patch

Starting with emscripten-3.1.46, this flag to LLVM is needed.

This is a backport of
https://github.com/llvm/llvm-project/commit/93adcb770b99351b18553089c164fe3ef2119699.patch,
with additional review at https://reviews.llvm.org/D158892 and
emscripten-core/emscripten#20097.
---
 .../llvm/17/lld/add-table-base.patch          | 190 ++++++++++++++++++
 .../compilers/llvm/17/lld/default.nix         |   1 +
 2 files changed, 191 insertions(+)
 create mode 100644 pkgs/development/compilers/llvm/17/lld/add-table-base.patch

diff --git a/pkgs/development/compilers/llvm/17/lld/add-table-base.patch b/pkgs/development/compilers/llvm/17/lld/add-table-base.patch
new file mode 100644
index 000000000000..15fc903a5e3f
--- /dev/null
+++ b/pkgs/development/compilers/llvm/17/lld/add-table-base.patch
@@ -0,0 +1,190 @@
+From 93adcb770b99351b18553089c164fe3ef2119699 Mon Sep 17 00:00:00 2001
+From: Sam Clegg <sbc@chromium.org>
+Date: Fri, 25 Aug 2023 13:56:16 -0700
+Subject: [PATCH] [lld][WebAssembly] Add `--table-base` setting
+
+This is similar to `--global-base` but determines where to place the
+table segments rather than that data segments.
+
+See https://github.com/emscripten-core/emscripten/issues/20097
+
+Differential Revision: https://reviews.llvm.org/D158892
+---
+ test/wasm/table-base.s | 72 ++++++++++++++++++++++++++++++++++++++
+ wasm/Driver.cpp        | 19 ++++++++--
+ wasm/Options.td        |  5 ++-
+ wasm/Writer.cpp        |  8 -----
+ 4 files changed, 93 insertions(+), 11 deletions(-)
+ create mode 100644 test/wasm/table-base.s
+
+diff --git a/test/wasm/table-base.s b/test/wasm/table-base.s
+new file mode 100644
+index 000000000000000..56fff414fd31d96
+--- /dev/null
++++ b/test/wasm/table-base.s
+@@ -0,0 +1,72 @@
++# RUN: llvm-mc -filetype=obj -triple=wasm32-unknown-unknown %s -o %t.o
++
++# RUN: wasm-ld --export=__table_base -o %t.wasm %t.o
++# RUN: obj2yaml %t.wasm | FileCheck %s  -check-prefix=CHECK-DEFAULT
++
++# RUN: wasm-ld --table-base=100 --export=__table_base -o %t.wasm %t.o
++# RUN: obj2yaml %t.wasm | FileCheck %s  -check-prefix=CHECK-100
++
++.globl _start
++_start:
++  .functype _start () -> ()
++  i32.const _start
++  drop
++  end_function
++
++# CHECK-DEFAULT:       - Type:            TABLE
++# CHECK-DEFAULT-NEXT:    Tables:
++# CHECK-DEFAULT-NEXT:      - Index:           0
++# CHECK-DEFAULT-NEXT:        ElemType:        FUNCREF
++# CHECK-DEFAULT-NEXT:        Limits:
++# CHECK-DEFAULT-NEXT:          Flags:           [ HAS_MAX ]
++# CHECK-DEFAULT-NEXT:          Minimum:         0x2
++# CHECK-DEFAULT-NEXT:          Maximum:         0x2
++
++# CHECK-DEFAULT:       - Type:            GLOBAL
++# CHECK-DEFAULT-NEXT:    Globals:
++# CHECK-DEFAULT-NEXT:      - Index:           0
++# CHECK-DEFAULT-NEXT:        Type:            I32
++# CHECK-DEFAULT-NEXT:        Mutable:         true
++# CHECK-DEFAULT-NEXT:        InitExpr:
++# CHECK-DEFAULT-NEXT:          Opcode:          I32_CONST
++# CHECK-DEFAULT-NEXT:          Value:           66560
++# CHECK-DEFAULT-NEXT:      - Index:           1
++# CHECK-DEFAULT-NEXT:        Type:            I32
++# CHECK-DEFAULT-NEXT:        Mutable:         false
++# CHECK-DEFAULT-NEXT:        InitExpr:
++# CHECK-DEFAULT-NEXT:          Opcode:          I32_CONST
++# CHECK-DEFAULT-NEXT:          Value:           1
++
++# CHECK-DEFAULT:       - Type:            EXPORT
++# CHECK-DEFAULT:           - Name:            __table_base
++# CHECK-DEFAULT-NEXT:        Kind:            GLOBAL
++# CHECK-DEFAULT-NEXT:        Index:           1
++
++# CHECK-100:       - Type:            TABLE
++# CHECK-100-NEXT:    Tables:
++# CHECK-100-NEXT:      - Index:           0
++# CHECK-100-NEXT:        ElemType:        FUNCREF
++# CHECK-100-NEXT:        Limits:
++# CHECK-100-NEXT:          Flags:           [ HAS_MAX ]
++# CHECK-100-NEXT:          Minimum:         0x65
++# CHECK-100-NEXT:          Maximum:         0x65
++
++# CHECK-100:       - Type:            GLOBAL
++# CHECK-100-NEXT:    Globals:
++# CHECK-100-NEXT:      - Index:           0
++# CHECK-100-NEXT:        Type:            I32
++# CHECK-100-NEXT:        Mutable:         true
++# CHECK-100-NEXT:        InitExpr:
++# CHECK-100-NEXT:          Opcode:          I32_CONST
++# CHECK-100-NEXT:          Value:           66560
++# CHECK-100-NEXT:      - Index:           1
++# CHECK-100-NEXT:        Type:            I32
++# CHECK-100-NEXT:        Mutable:         false
++# CHECK-100-NEXT:        InitExpr:
++# CHECK-100-NEXT:          Opcode:          I32_CONST
++# CHECK-100-NEXT:          Value:           100
++
++# CHECK-100:       - Type:            EXPORT
++# CHECK-100:           - Name:            __table_base
++# CHECK-100-NEXT:        Kind:            GLOBAL
++# CHECK-100-NEXT:        Index:           1
+diff --git a/wasm/Driver.cpp b/wasm/Driver.cpp
+index 84304881f5ca34e..c2f5f0185781f36 100644
+--- a/wasm/Driver.cpp
++++ b/wasm/Driver.cpp
+@@ -502,6 +502,7 @@ static void readConfigs(opt::InputArgList &args) {
+ 
+   config->initialMemory = args::getInteger(args, OPT_initial_memory, 0);
+   config->globalBase = args::getInteger(args, OPT_global_base, 0);
++  config->tableBase = args::getInteger(args, OPT_table_base, 0);
+   config->maxMemory = args::getInteger(args, OPT_max_memory, 0);
+   config->zStackSize =
+       args::getZOptionValue(args, OPT_z, "stack-size", WasmPageSize);
+@@ -573,6 +574,17 @@ static void setConfigs() {
+     if (config->exportTable)
+       error("-shared/-pie is incompatible with --export-table");
+     config->importTable = true;
++  } else {
++    // Default table base.  Defaults to 1, reserving 0 for the NULL function
++    // pointer.
++    if (!config->tableBase)
++      config->tableBase = 1;
++    // The default offset for static/global data, for when --global-base is
++    // not specified on the command line.  The precise value of 1024 is
++    // somewhat arbitrary, and pre-dates wasm-ld (Its the value that
++    // emscripten used prior to wasm-ld).
++    if (!config->globalBase && !config->relocatable && !config->stackFirst)
++      config->globalBase = 1024;
+   }
+ 
+   if (config->relocatable) {
+@@ -666,8 +678,11 @@ static void checkOptions(opt::InputArgList &args) {
+     warn("-Bsymbolic is only meaningful when combined with -shared");
+   }
+ 
+-  if (config->globalBase && config->isPic) {
+-    error("--global-base may not be used with -shared/-pie");
++  if (config->isPic) {
++    if (config->globalBase)
++      error("--global-base may not be used with -shared/-pie");
++    if (config->tableBase)
++      error("--table-base may not be used with -shared/-pie");
+   }
+ }
+ 
+diff --git a/wasm/Options.td b/wasm/Options.td
+index 50417d2928e0a34..bb764396bf4df14 100644
+--- a/wasm/Options.td
++++ b/wasm/Options.td
+@@ -191,7 +191,7 @@ def growable_table: FF<"growable-table">,
+   HelpText<"Remove maximum size from function table, allowing table to grow">;
+ 
+ def global_base: JJ<"global-base=">,
+-  HelpText<"Where to start to place global data">;
++  HelpText<"Memory offset at which to place global data (Defaults to 1024)">;
+ 
+ def import_memory: FF<"import-memory">,
+   HelpText<"Import the module's memory from the default module of \"env\" with the name \"memory\".">;
+@@ -224,6 +224,9 @@ def no_entry: FF<"no-entry">,
+ def stack_first: FF<"stack-first">,
+   HelpText<"Place stack at start of linear memory rather than after data">;
+ 
++def table_base: JJ<"table-base=">,
++  HelpText<"Table offset at which to place address taken functions (Defaults to 1)">;
++
+ defm whole_archive: B<"whole-archive",
+     "Force load of all members in a static library",
+     "Do not force load of all members in a static library (default)">;
+diff --git a/wasm/Writer.cpp b/wasm/Writer.cpp
+index f25d358dc5bae6f..0576bf2907e49c4 100644
+--- a/wasm/Writer.cpp
++++ b/wasm/Writer.cpp
+@@ -358,13 +358,6 @@ void Writer::layoutMemory() {
+       memoryPtr = config->globalBase;
+     }
+   } else {
+-    if (!config->globalBase && !config->relocatable && !config->isPic) {
+-      // The default offset for static/global data, for when --global-base is
+-      // not specified on the command line.  The precise value of 1024 is
+-      // somewhat arbitrary, and pre-dates wasm-ld (Its the value that
+-      // emscripten used prior to wasm-ld).
+-      config->globalBase = 1024;
+-    }
+     memoryPtr = config->globalBase;
+   }
+ 
+@@ -1685,7 +1678,6 @@ void Writer::run() {
+   // For PIC code the table base is assigned dynamically by the loader.
+   // For non-PIC, we start at 1 so that accessing table index 0 always traps.
+   if (!config->isPic) {
+-    config->tableBase = 1;
+     if (WasmSym::definedTableBase)
+       WasmSym::definedTableBase->setVA(config->tableBase);
+     if (WasmSym::definedTableBase32)
diff --git a/pkgs/development/compilers/llvm/17/lld/default.nix b/pkgs/development/compilers/llvm/17/lld/default.nix
index cc18aee76a44..84943e8effce 100644
--- a/pkgs/development/compilers/llvm/17/lld/default.nix
+++ b/pkgs/development/compilers/llvm/17/lld/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gnu-install-dirs.patch
+    ./add-table-base.patch
   ];
 
   nativeBuildInputs = [ cmake ninja ];

From c4a686bcb7952c76e1c0b7d0e4f5317b7db2814d Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Sat, 25 Nov 2023 09:11:57 -0500
Subject: [PATCH 20/89] emscripten: 3.1.47 -> 3.1.50

---
 ...-emulate-clang-sysroot-include-logic.patch | 32 ++++++++-----------
 .../compilers/emscripten/default.nix          | 15 ++++++---
 pkgs/top-level/all-packages.nix               |  2 +-
 3 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
index 6a57e423bd72..4171906d5e36 100644
--- a/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
+++ b/pkgs/development/compilers/emscripten/0001-emulate-clang-sysroot-include-logic.patch
@@ -1,4 +1,4 @@
-From 4bbbb640934aa653bcfec0335798b77a8935b815 Mon Sep 17 00:00:00 2001
+From 86fc9ce2b381748813b372f7e86909be6f955cbd Mon Sep 17 00:00:00 2001
 From: Yureka <yuka@yuka.dev>
 Date: Sat, 7 Aug 2021 09:16:46 +0200
 Subject: [PATCH] emulate clang 'sysroot + /include' logic
@@ -16,27 +16,23 @@ in the include search order, right after the resource root.
 Hence usage of -idirafter. Clang also documents an -isystem-after flag
 but it doesn't appear to work
 ---
- emcc.py | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
+ emcc.py | 3 +++
+ 1 file changed, 3 insertions(+)
 
 diff --git a/emcc.py b/emcc.py
-index ba8d1b556..7d89644c5 100755
+index 279f6d4d9..26e20e2cc 100644
 --- a/emcc.py
 +++ b/emcc.py
-@@ -883,7 +883,12 @@ def parse_s_args(args):
+@@ -400,6 +400,9 @@ def get_cflags(user_args, is_cxx):
+   # We add these to the user's flags (newargs), but not when building .s or .S assembly files
+   cflags = get_clang_flags(user_args)
+   cflags.append('--sysroot=' + cache.get_sysroot(absolute=True))
++  cflags.append('-resource-dir=@resourceDir@')
++  cflags.append('-idirafter' + cache.get_sysroot(absolute=True) + os.path.join('/include'))
++  cflags.append('-iwithsysroot' + os.path.join('/include','c++','v1'))
  
- 
- def emsdk_cflags(user_args):
--  cflags = ['--sysroot=' + cache.get_sysroot(absolute=True)]
-+  cflags = [
-+    '--sysroot=' + cache.get_sysroot(absolute=True),
-+    '-resource-dir=@resourceDir@',
-+    '-idirafter' + cache.get_sysroot(absolute=True) + os.path.join('/include'),
-+    '-iwithsysroot' + os.path.join('/include','c++','v1')
-+  ]
- 
-   def array_contains_any_of(hay, needles):
-     for n in needles:
+   if settings.EMSCRIPTEN_TRACING:
+     cflags.append('-D__EMSCRIPTEN_TRACING__=1')
 -- 
-2.40.0
+2.42.0
 
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 01fa67520593..1f8d2f55da34 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "emscripten";
-  version = "3.1.47";
+  version = "3.1.50";
 
   llvmEnv = symlinkJoin {
     name = "emscripten-llvm-${version}";
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "emscripten-core";
     repo = "emscripten";
-    hash = "sha256-cRNkQ+7vUqJLNlf5dieeDcyT1jlBUeVxO8avoUvOPHI=";
+    hash = "sha256-iFZF+DxGaq279QPPugoLhYmoXmyLPkmn1x4rBCkdW+I=";
     rev = version;
   };
 
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./0001-emulate-clang-sysroot-include-logic.patch;
-      resourceDir = "${llvmEnv}/lib/clang/16/";
+      resourceDir = "${llvmEnv}/lib/clang/17/";
     })
   ];
 
@@ -51,6 +51,9 @@ stdenv.mkDerivation rec {
 
     patchShebangs .
 
+    # emscripten 3.1.50 requires LLVM tip-of-tree instead of LLVM 17
+    sed -i -e "s/EXPECTED_LLVM_VERSION = 18/EXPECTED_LLVM_VERSION = 17.0/g" tools/shared.py
+
     # fixes cmake support
     sed -i -e "s/print \('emcc (Emscript.*\)/sys.stderr.write(\1); sys.stderr.flush()/g" emcc.py
 
@@ -106,7 +109,11 @@ stdenv.mkDerivation rec {
         # TODO: get library cache to build with both enabled and function exported
         $out/bin/emcc $LTO $BIND test.c
         $out/bin/emcc $LTO $BIND -s RELOCATABLE test.c
-        $out/bin/emcc $LTO $BIND -s USE_PTHREADS test.c
+        # starting with emscripten 3.1.48+,
+        # to use pthreads, _emscripten_check_mailbox must be exported
+        # (see https://github.com/emscripten-core/emscripten/pull/20604)
+        # TODO: get library cache to build with pthreads at all
+        # $out/bin/emcc $LTO $BIND -s USE_PTHREADS test.c
       done
     done
     popd
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2363df0fd2f0..b0c0ded400c9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7943,7 +7943,7 @@ with pkgs;
   easeprobe = callPackage ../tools/misc/easeprobe { };
 
   emscripten = callPackage ../development/compilers/emscripten {
-    llvmPackages = llvmPackages_16;
+    llvmPackages = llvmPackages_17;
   };
 
   emscriptenPackages = recurseIntoAttrs (callPackage ./emscripten-packages.nix { });

From 0286e3119e3c2035b8c1a4a0d61f2e1cf6e6f98f Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Tue, 12 Dec 2023 16:42:45 +1300
Subject: [PATCH 21/89] lib.getExe: Make more efficient

---
 lib/meta.nix | 34 +++++++++++++++-------------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/lib/meta.nix b/lib/meta.nix
index 1a43016d27c4..5d5f71d6c3cb 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -4,8 +4,8 @@
 { lib }:
 
 let
-  inherit (lib) matchAttrs any all;
-  inherit (builtins) isString;
+  inherit (lib) matchAttrs any all isDerivation getBin assertMsg;
+  inherit (builtins) isString match typeOf;
 
 in
 rec {
@@ -154,16 +154,12 @@ rec {
        getExe pkgs.mustache-go
        => "/nix/store/am9ml4f4ywvivxnkiaqwr0hyxka1xjsf-mustache-go-1.3.0/bin/mustache"
   */
-  getExe = x:
-    let
-      y = x.meta.mainProgram or (
-        # This could be turned into an error when 23.05 is at end of life
-        lib.warn "getExe: Package ${lib.strings.escapeNixIdentifier x.meta.name or x.pname or x.name} does not have the meta.mainProgram attribute. We'll assume that the main program has the same name for now, but this behavior is deprecated, because it leads to surprising errors when the assumption does not hold. If the package has a main program, please set `meta.mainProgram` in its definition to make this warning go away. Otherwise, if the package does not have a main program, or if you don't control its definition, use getExe' to specify the name to the program, such as lib.getExe' foo \"bar\"."
-          lib.getName
-          x
-      );
-    in
-    getExe' x y;
+  getExe = x: getExe' x (x.meta.mainProgram or (
+    # This could be turned into an error when 23.05 is at end of life
+    lib.warn "getExe: Package ${lib.strings.escapeNixIdentifier x.meta.name or x.pname or x.name} does not have the meta.mainProgram attribute. We'll assume that the main program has the same name for now, but this behavior is deprecated, because it leads to surprising errors when the assumption does not hold. If the package has a main program, please set `meta.mainProgram` in its definition to make this warning go away. Otherwise, if the package does not have a main program, or if you don't control its definition, use getExe' to specify the name to the program, such as lib.getExe' foo \"bar\"."
+    lib.getName
+    x
+  ));
 
   /* Get the path of a program of a derivation.
 
@@ -175,11 +171,11 @@ rec {
        => "/nix/store/5rs48jamq7k6sal98ymj9l4k2bnwq515-imagemagick-7.1.1-15/bin/convert"
   */
   getExe' = x: y:
-    assert lib.assertMsg (lib.isDerivation x)
-      "lib.meta.getExe': The first argument is of type ${builtins.typeOf x}, but it should be a derivation instead.";
-    assert lib.assertMsg (lib.isString y)
-     "lib.meta.getExe': The second argument is of type ${builtins.typeOf y}, but it should be a string instead.";
-    assert lib.assertMsg (builtins.length (lib.splitString "/" y) == 1)
-     "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
-    "${lib.getBin x}/bin/${y}";
+    assert assertMsg (isDerivation x)
+      "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
+    assert assertMsg (isString y)
+      "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
+    assert assertMsg (match ".*\/.*" y == null)
+      "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
+    "${getBin x}/bin/${y}";
 }

From a52660a52dbfb35e28210be6986180192b661735 Mon Sep 17 00:00:00 2001
From: Bouke van der Bijl <i@bou.ke>
Date: Tue, 12 Dec 2023 14:43:04 +0100
Subject: [PATCH 22/89] Install preset into $out/share

---
 pkgs/development/libraries/librealsense/default.nix |  1 +
 .../libraries/librealsense/install-presets.patch    | 13 +++++++++++++
 2 files changed, 14 insertions(+)
 create mode 100644 pkgs/development/libraries/librealsense/install-presets.patch

diff --git a/pkgs/development/libraries/librealsense/default.nix b/pkgs/development/libraries/librealsense/default.nix
index 4c7b54d965a9..9a127fcd92ad 100644
--- a/pkgs/development/libraries/librealsense/default.nix
+++ b/pkgs/development/libraries/librealsense/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./py_pybind11_no_external_download.patch
+    ./install-presets.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/librealsense/install-presets.patch b/pkgs/development/libraries/librealsense/install-presets.patch
new file mode 100644
index 000000000000..347aa4345323
--- /dev/null
+++ b/pkgs/development/libraries/librealsense/install-presets.patch
@@ -0,0 +1,13 @@
+diff --git a/tools/realsense-viewer/CMakeLists.txt b/tools/realsense-viewer/CMakeLists.txt
+index 44be6278f..1a4531dff 100644
+--- a/tools/realsense-viewer/CMakeLists.txt
++++ b/tools/realsense-viewer/CMakeLists.txt
+@@ -253,7 +253,7 @@ install(
+ )
+ #https://cmake.org/cmake/help/latest/command/install.html
+ install(DIRECTORY presets/
+-    DESTINATION $ENV{HOME}/Documents/librealsense2/presets
++    DESTINATION $ENV{out}/share/librealsense2/presets
+     FILES_MATCHING PATTERN "*.preset"
+ )
+ endif()

From 4db7046b7f8accc66c81ec9f454cb8695532a31f Mon Sep 17 00:00:00 2001
From: nicoo <nicoo@mur.at>
Date: Sat, 11 Nov 2023 22:27:22 +0000
Subject: [PATCH 23/89] mpvScripts.buildLua: Strip `pname` when inferring
 `scriptName`

---
 pkgs/applications/video/mpv/scripts/buildLua.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/video/mpv/scripts/buildLua.nix b/pkgs/applications/video/mpv/scripts/buildLua.nix
index 4c1e1957c097..c7f510253f94 100644
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@@ -20,11 +20,17 @@ lib.makeOverridable (args: stdenvNoCC.mkDerivation (extendedBy
   , extraScripts ? []
   , ... }@args:
   let
+    strippedName = with builtins;
+      let groups = match "mpv[-_](.*)" pname; in
+      if groups != null
+      then head groups
+      else pname
+    ;
     # either passthru.scriptName, inferred from scriptPath, or from pname
     scriptName = (args.passthru or {}).scriptName or (
       if args ? scriptPath
       then fileName args.scriptPath
-      else "${pname}.lua"
+      else "${strippedName}.lua"
     );
     scriptPath = args.scriptPath or "./${scriptName}";
   in {

From 6b2a19c707ee8c575616a605c355de4d1f781b22 Mon Sep 17 00:00:00 2001
From: nicoo <nicoo@mur.at>
Date: Sat, 11 Nov 2023 22:30:59 +0000
Subject: [PATCH 24/89] mpvScripts.mpv-playlistmanager: Simplify after
 `buildLua` change

---
 pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
index 8ec05a3cf691..c164bae1495d 100644
--- a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
@@ -17,8 +17,6 @@ buildLua rec {
       'youtube_dl_executable = "${lib.getBin yt-dlp}/bin/yt-dlp"',
   '';
 
-  scriptPath = "playlistmanager.lua";
-
   meta = with lib; {
     description = "Mpv lua script to create and manage playlists";
     homepage = "https://github.com/jonniek/mpv-playlistmanager";

From 5c3a58bbcf5799bac071367022788d63fc531141 Mon Sep 17 00:00:00 2001
From: nicoo <nicoo@mur.at>
Date: Sat, 11 Nov 2023 22:31:00 +0000
Subject: [PATCH 25/89] mpvScripts.quality-menu: Simplify after `buildLua`
 change

---
 pkgs/applications/video/mpv/scripts/quality-menu.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/applications/video/mpv/scripts/quality-menu.nix b/pkgs/applications/video/mpv/scripts/quality-menu.nix
index e4d82d17ca39..8b9aadaccbc7 100644
--- a/pkgs/applications/video/mpv/scripts/quality-menu.nix
+++ b/pkgs/applications/video/mpv/scripts/quality-menu.nix
@@ -15,7 +15,6 @@ buildLua rec {
     hash = "sha256-yrcTxqpLnOI1Tq3khhflO3wzhyeTPuvKifyH5/P57Ns=";
   };
 
-  scriptPath = "quality-menu.lua";
   extraScripts = lib.optional oscSupport "quality-menu-osc.lua";
 
   meta = with lib; {

From ffc274f6989a13bf6a32ec041938f5358c1bd5b8 Mon Sep 17 00:00:00 2001
From: nicoo <nicoo@mur.at>
Date: Wed, 29 Nov 2023 11:04:50 +0000
Subject: [PATCH 26/89] mpvScripts.thumbfast: Simplify after `buildLua` change

---
 pkgs/applications/video/mpv/scripts/thumbfast.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/applications/video/mpv/scripts/thumbfast.nix b/pkgs/applications/video/mpv/scripts/thumbfast.nix
index 4899f556e8b2..3ddb701f6d1d 100644
--- a/pkgs/applications/video/mpv/scripts/thumbfast.nix
+++ b/pkgs/applications/video/mpv/scripts/thumbfast.nix
@@ -11,8 +11,6 @@ buildLua {
     hash = "sha256-5u5WBvWOEydJrnr/vilEgW4+fxkxM6wNjb9Fyyxx/1c=";
   };
 
-  scriptPath = "thumbfast.lua";
-
   passthru.extraWrapperArgs = [
     "--prefix" "PATH" ":" "${lib.getBin mpv-unwrapped}/bin"
   ];

From 21f12bea73af3fd95e48c160a9b54f60335b6993 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:49:09 -0600
Subject: [PATCH 27/89] linux/hardened/patches/6.4: remove

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index d8f8bb2fa73f..4560e1f5b54b 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -59,16 +59,6 @@
         "sha256": "1kk4d7ph6pvgdrdmaklg15wf58nw9n7yqgkag7jdvqinzh99sb5d",
         "version": "6.1.61"
     },
-    "6.4": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-6.4.16-hardened1.patch",
-            "sha256": "10lydnnhhq9ynng1gfaqh1mncsb0dmr27zzcbygs1xigy2bl70n9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.16-hardened1/linux-hardened-6.4.16-hardened1.patch"
-        },
-        "sha256": "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln",
-        "version": "6.4.16"
-    },
     "6.5": {
         "patch": {
             "extra": "-hardened1",

From 8f05af0d5f8039a55acc212f4370b0d57927976c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:50:44 -0600
Subject: [PATCH 28/89] linux/hardened/patches/4.14: 4.14.328-hardened1 ->
 4.14.332-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 4560e1f5b54b..f9d8d35ae970 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,12 +2,12 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.328-hardened1.patch",
-            "sha256": "1qq2l4nwhxgl4drx6isc1ly892kffjq4hqb4zadqs6sxvsdm7x57",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.328-hardened1/linux-hardened-4.14.328-hardened1.patch"
+            "name": "linux-hardened-4.14.332-hardened1.patch",
+            "sha256": "1nda3z8hkyfw53dzk1v5zwpzhm75gizsixfmrh8ylaghhk5s8yw3",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.332-hardened1/linux-hardened-4.14.332-hardened1.patch"
         },
-        "sha256": "1igcpvnhwwrczfdsafmszvi0456k7f6j4cgpfw6v6afw09p95d8x",
-        "version": "4.14.328"
+        "sha256": "1f4q0acbp917myjmgiy4haxp78yak5h1rj5g937r6mkykwb6nb14",
+        "version": "4.14.332"
     },
     "4.19": {
         "patch": {

From d825dc121428862a5be47aeda4fe6d724e4465b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:50:51 -0600
Subject: [PATCH 29/89] linux/hardened/patches/4.19: 4.19.297-hardened1 ->
 4.19.301-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index f9d8d35ae970..4998b2d3e696 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -12,12 +12,12 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.297-hardened1.patch",
-            "sha256": "1qj09bynl7ml880xpc2956jn0b1gmm77yf3jc45v3jq3610jhna4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.297-hardened1/linux-hardened-4.19.297-hardened1.patch"
+            "name": "linux-hardened-4.19.301-hardened1.patch",
+            "sha256": "0arlwp0g4anqlnivyc8y6rq9mhq1ivmy4i0d8kqvwpc2b3wcc525",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.301-hardened1/linux-hardened-4.19.301-hardened1.patch"
         },
-        "sha256": "0c9xxqgv2i36hrr06dwz7f3idc04xpv0a5pxg08xdh03cnyf12cx",
-        "version": "4.19.297"
+        "sha256": "1fr05fl8fyyjgsqj8fppd5v378d7sazvpqlq4sl875851fd9nmb2",
+        "version": "4.19.301"
     },
     "5.10": {
         "patch": {

From a22e51dc96ee7539cab3fefc2bd33c6070a5e5c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:50:59 -0600
Subject: [PATCH 30/89] linux/hardened/patches/5.10: 5.10.199-hardened1 ->
 5.10.203-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 4998b2d3e696..5cf876c17abe 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -22,12 +22,12 @@
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.199-hardened1.patch",
-            "sha256": "10vwd5wygfnxpbz15bq56pjygba3vqqal0d7xry2bch4p444pp5f",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.199-hardened1/linux-hardened-5.10.199-hardened1.patch"
+            "name": "linux-hardened-5.10.203-hardened1.patch",
+            "sha256": "19inx95ynyzhh2h9xdg2yw4yfa5nfcw2dh2a7vw4mf0bqdv2iqvc",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.203-hardened1/linux-hardened-5.10.203-hardened1.patch"
         },
-        "sha256": "1h944syk7n6c4j1djlx19n77alzwbxcdza77c9ykicgfynhpgsm0",
-        "version": "5.10.199"
+        "sha256": "0xr8p7kfr1v3s41fv55ph0l8d9s2p146dl2fh3r2y09lrvwwxssn",
+        "version": "5.10.203"
     },
     "5.15": {
         "patch": {

From 4175f2aa26318593b6f53e3204eaf8cd35b6065a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:51:02 -0600
Subject: [PATCH 31/89] linux/hardened/patches/5.15: 5.15.137-hardened1 ->
 5.15.142-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 5cf876c17abe..acf6983c4f78 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -32,12 +32,12 @@
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.137-hardened1.patch",
-            "sha256": "19gs1w380qgvazwjwhxypizpfx71faa7hsji0x5cgyw6vxhi6l1b",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.137-hardened1/linux-hardened-5.15.137-hardened1.patch"
+            "name": "linux-hardened-5.15.142-hardened1.patch",
+            "sha256": "0x4bsf638rrdrp9b389i6nlprwsfc25qpld50yfcjinqhiykd269",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.142-hardened1/linux-hardened-5.15.142-hardened1.patch"
         },
-        "sha256": "1xxjbxldrhmnh2q6rykpxyfbj8xqgl82q30n8sfavrzr14bb4jcp",
-        "version": "5.15.137"
+        "sha256": "0xjn16b02f8d6c0m8vrbmk85kdyfy8m46s80rnkb0nnwfx9cjxld",
+        "version": "5.15.142"
     },
     "5.4": {
         "patch": {

From 5670b0753255b4ff45eb0ef396b96ebfea55b7eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:51:06 -0600
Subject: [PATCH 32/89] linux/hardened/patches/5.4: 5.4.259-hardened1 ->
 5.4.263-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index acf6983c4f78..d80a0e18db5f 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -42,12 +42,12 @@
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.259-hardened1.patch",
-            "sha256": "1w8ipflgisd127gmx6wyz8p5qfi8cfd2a5j2xgibspkf45nzfwi8",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.259-hardened1/linux-hardened-5.4.259-hardened1.patch"
+            "name": "linux-hardened-5.4.263-hardened1.patch",
+            "sha256": "1v59qzjp9v78y7fkj884a77pjsk4ggplkfh1fq2blj04g7v1zhgv",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.263-hardened1/linux-hardened-5.4.263-hardened1.patch"
         },
-        "sha256": "195v4fidavzm637glj6580006mrcaygnbj4za874imb62bxf9rpz",
-        "version": "5.4.259"
+        "sha256": "1y1mfwjsilrx8x8jnjlyh8r9zlygjjqdf7pay92jv2qijjddpl2h",
+        "version": "5.4.263"
     },
     "6.1": {
         "patch": {

From a8e0e9d48be8d9dcfcdf9d7a4996ad366fbbbc7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:51:12 -0600
Subject: [PATCH 33/89] linux/hardened/patches/6.1: 6.1.61-hardened1 ->
 6.1.67-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index d80a0e18db5f..ad404f0917f7 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -52,12 +52,12 @@
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.61-hardened1.patch",
-            "sha256": "0d9zhh32dx1q828q50kmznmsa6yinppbklhgg8ix7b7k23857ha6",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.61-hardened1/linux-hardened-6.1.61-hardened1.patch"
+            "name": "linux-hardened-6.1.67-hardened1.patch",
+            "sha256": "0jcn2k79l90dys4nrwqha89jv9d1ffghhvlqk9vibfs7y3zrlpbr",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.67-hardened1/linux-hardened-6.1.67-hardened1.patch"
         },
-        "sha256": "1kk4d7ph6pvgdrdmaklg15wf58nw9n7yqgkag7jdvqinzh99sb5d",
-        "version": "6.1.61"
+        "sha256": "11cjqll3b7iq3mblwyzjrd5ph8avgk23f4mw4shm8j6ai5rdndvm",
+        "version": "6.1.67"
     },
     "6.5": {
         "patch": {

From ae686ad0d665d071f6db493ebed99fac6f251dcc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:51:16 -0600
Subject: [PATCH 34/89] linux/hardened/patches/6.5: 6.5.10-hardened1 ->
 6.5.13-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index ad404f0917f7..3c7edf581a9c 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -62,11 +62,11 @@
     "6.5": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.5.10-hardened1.patch",
-            "sha256": "0p2lj7ryiizr1sxvm2kgds3l8sg9fns35y2fcyqq61lg7ymzj1fi",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.10-hardened1/linux-hardened-6.5.10-hardened1.patch"
+            "name": "linux-hardened-6.5.13-hardened1.patch",
+            "sha256": "1fj6yaq2gdjlj2h19vkm13jrx0yiczj6pvric1kq1r6cprqrkkki",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.13-hardened1/linux-hardened-6.5.13-hardened1.patch"
         },
-        "sha256": "12sswml8jvabv6bqx35lg3jj6gq8jjk365rghjngdy5d0j34jpx1",
-        "version": "6.5.10"
+        "sha256": "1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq",
+        "version": "6.5.13"
     }
 }

From 70ac3dc8fed36a771f2e0eaa3d0f1547a5e0420f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Tue, 12 Dec 2023 15:51:26 -0600
Subject: [PATCH 35/89] linux/hardened/patches/6.6: init at 6.6.6-hardened1

---
 pkgs/os-specific/linux/kernel/hardened/patches.json | 10 ++++++++++
 pkgs/top-level/all-packages.nix                     |  2 ++
 pkgs/top-level/linux-kernels.nix                    |  2 ++
 3 files changed, 14 insertions(+)

diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 3c7edf581a9c..cc410ae8b8af 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -68,5 +68,15 @@
         },
         "sha256": "1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq",
         "version": "6.5.13"
+    },
+    "6.6": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-6.6.6-hardened1.patch",
+            "sha256": "0jhhixayka13rb0cd0qbsqpb7awayjdbn8qyx7wya1y83cgyn2ly",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.6-hardened1/linux-hardened-6.6.6-hardened1.patch"
+        },
+        "sha256": "1j14n8b012pv3r7i9p762jyabzn2nv1ranxyw5lk3c9lg68hmxzb",
+        "version": "6.6.6"
     }
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2ab5d6b1af40..d37a9105b4de 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28178,6 +28178,8 @@ with pkgs;
   linux_6_1_hardened = linuxKernel.kernels.linux_6_1_hardened;
   linuxPackages_6_5_hardened = linuxKernel.packages.linux_6_5_hardened;
   linux_6_5_hardened = linuxKernel.kernels.linux_6_5_hardened;
+  linuxPackages_6_6_hardened = linuxKernel.packages.linux_6_6_hardened;
+  linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;
 
   # GNU Linux-libre kernels
   linuxPackages-libre = linuxKernel.packages.linux_libre;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index efd25b37fa60..860291466017 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -255,6 +255,7 @@ in {
     linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
     linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };
     linux_6_5_hardened = hardenedKernelFor kernels.linux_6_5 { };
+    linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };
 
   } // lib.optionalAttrs config.allowAliases {
     linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11";
@@ -627,6 +628,7 @@ in {
     linux_5_15_hardened = recurseIntoAttrs (packagesFor kernels.linux_5_15_hardened);
     linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);
     linux_6_5_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_5_hardened);
+    linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);
 
     linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
     linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);

From f910a7194ffbf2833820715d18f5e19b7791d763 Mon Sep 17 00:00:00 2001
From: kashw2 <supra4keanu@hotmail.com>
Date: Wed, 13 Dec 2023 08:48:55 +1000
Subject: [PATCH 36/89] bearer: 1.32.0 -> 1.33.0

---
 pkgs/development/tools/bearer/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index a073c2b2b248..e1f56a56fbc6 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.32.0";
+  version = "1.33.0";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fqc/+eYrUcFHgC+st0LogLLIW/jRyp0M5VwxMBWkPKY=";
+    hash = "sha256-sdtZOj3jksXDVVYi+Uy/zXgZoqlhGlPKjokXNErBe9k=";
   };
 
-  vendorHash = "sha256-QDtjB1h7mNBEpTwoQfex3c6oba/kztKlgQpbmNHvoz0=";
+  vendorHash = "sha256-u3pqG74o8xRxxepS5u3lTo4rPgbFABDC/dLWD1JAyxA=";
 
   subPackages = [
     "cmd/bearer"

From dffac4a1a4434cc708230e1b22edd8ba1dfd1d22 Mon Sep 17 00:00:00 2001
From: Sophie Tauchert <sophie@999eagle.moe>
Date: Wed, 13 Dec 2023 10:09:57 +0100
Subject: [PATCH 37/89] linuxKernel.kernels.linux_zen: 6.6.4-zen1 -> 6.6.6-zen1

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 4a1bd7543b1b..6aea1e63c524 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,9 +4,9 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.6.4"; #zen
+    version = "6.6.6"; #zen
     suffix = "zen1"; #zen
-    sha256 = "1zks4fpbw788aaw9rysdpfhmqzr8l5y6afq92md1gizyyl1rjhq1"; #zen
+    sha256 = "13lxj1841mykfmbd8pwshr8jjxpxw1d8dyzkzq4ks6nviivnqfsn"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx

From f6d681d974eab8e1143bcb852b081685868626cd Mon Sep 17 00:00:00 2001
From: Sophie Tauchert <sophie@999eagle.moe>
Date: Wed, 13 Dec 2023 10:10:21 +0100
Subject: [PATCH 38/89] linuxKernel.kernels.linux_lqx: 6.6.4-lqx1 -> 6.6.6-lqx1

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 6aea1e63c524..55d32587766c 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -11,9 +11,9 @@ let
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.6.4"; #lqx
+    version = "6.6.6"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "049pga9bc5pbnwki5vmnz9pdx0p5r7sssb66b4580h9x9skzi9m2"; #lqx
+    sha256 = "0p3ilsikd0v2k6d40n5s3smipww817yw2y47ayi1xj8m44rlp8gg"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {

From 115db55209616941a6afdc20e7a3f27398580e13 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Dec 2023 10:37:51 +0000
Subject: [PATCH 39/89] buildah-unwrapped: 1.32.2 -> 1.33.2

---
 pkgs/development/tools/buildah/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index a6761a7350c7..81d00d6304e0 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.32.2";
+  version = "1.33.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    hash = "sha256-Av4wrJ+anVu1pTSFTpaseBhj+7ECsRoKb1bATrUKYuo=";
+    hash = "sha256-jkUEGaECBNidKreoyezWw7LN38uHqyYo40dOwfuuuI4=";
   };
 
   outputs = [ "out" "man" ];

From 1ac728d5e3206cd7a0227933bf2ca70107bdcd75 Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 18:59:07 +0800
Subject: [PATCH 40/89] sbclPackages.cl-colors2_0_5_4: update src url

---
 pkgs/development/lisp-modules/packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 90e36dc882cd..8a9d36ce4baf 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -224,8 +224,8 @@ let
     version = "0.5.4";
 
     src = pkgs.fetchgit {
-      url = "https://notabug.org/cage/cl-colors2";
-      rev = "refs/tags/v0.5.4";
+      url = "https://codeberg.org/cage/cl-colors2";
+      rev = "v0.5.4";
       sha256 = "sha256-JbT1BKjaXDwdlzHLPjX1eg0RMIOT86R17SPgbe2h+tA=";
     };
   };

From 39530d74567253e0c025e8fc5a215995d5b86c93 Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 19:03:38 +0800
Subject: [PATCH 41/89] sbclPackages.history-tree: 0.1.1 -> 0.1.2

---
 pkgs/development/lisp-modules/packages.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 8a9d36ce4baf..4b8cbd1998e7 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -356,18 +356,17 @@ let
 
   history-tree = build-asdf-system rec {
     pname = "history-tree";
-    version = "0.1.1";
+    version = "0.1.2";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "history-tree";
       rev = version;
-      hash = "sha256-lOORalyTybdut/If+dBXS4PlZt2AnZrEI/qjQWS03pk=";
+      hash = "sha256-wpVONvShNnvrPOlbNoX/t9sYiwxnIKnnJaJyALEyeNg=";
     };
     lispLibs = with self; [
       alexandria
       cl-custom-hash-table
       local-time
-      nasdf
       nclasses
       trivial-package-local-nicknames
     ];

From 755b07776a3c23ab9b002c1b92ac2e06e0e8e920 Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 19:05:02 +0800
Subject: [PATCH 42/89] sbclPackages.nclasses: 0.6.0 -> 0.6.1

---
 pkgs/development/lisp-modules/packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 4b8cbd1998e7..b078e70545be 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -294,16 +294,16 @@ let
 
   };
 
-  nclasses = build-asdf-system {
+  nclasses = build-asdf-system rec {
     pname = "nclasses";
-    version = "0.6.0";
+    version = "0.6.1";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nclasses";
-      rev = "0.6.0";
-      sha256 = "sha256-JupP+TIxavUoyOPnp57FqpEjWfgKspdFoSRnV2rk5U4=";
+      rev = version;
+      sha256 = "sha256-foXmaLxMYMFieB2Yd2iPsU4EX5kLXq7kyElqGZ47OgI=";
     };
-    lispLibs = [ self.nasdf super.moptilities ];
+    lispLibs = [ super.moptilities ];
   };
 
   nfiles = build-asdf-system {

From 195e46267a05c098de0b3fbfdb00ebe98734d95b Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 19:06:02 +0800
Subject: [PATCH 43/89] sbclPackages.nfiles: 20230705-git -> 1.1.4

---
 pkgs/development/lisp-modules/packages.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index b078e70545be..c87ce861aa15 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -306,17 +306,16 @@ let
     lispLibs = [ super.moptilities ];
   };
 
-  nfiles = build-asdf-system {
+  nfiles = build-asdf-system rec {
     pname = "nfiles";
-    version = "20230705-git";
+    version = "1.1.4";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nfiles";
-      rev = "3626e8d512a84efc12479ceb3969d194511757f7";
-      sha256 = "sha256-MoJdbTOVfw2rJk4cf/rEnR55BxdXkoqqu9Txd/R9OYQ=";
+      rev = version;
+      sha256 = "sha256-4rhpBErQgZHcwZRblxgiYaUmKalvllSbJjnRteDVH6k=";
     };
     lispLibs = [
-      self.nasdf
       self.nclasses
       super.quri
       super.alexandria

From 5aa52578d484f47c808f31607876f0fd6ec90e31 Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 19:07:22 +0800
Subject: [PATCH 44/89] sbclPackages.nhooks: 1.2.1 -> 1.2.2

---
 pkgs/development/lisp-modules/packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index c87ce861aa15..224093fab085 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -327,14 +327,14 @@ let
     ];
   };
 
-  nhooks = build-asdf-system {
+  nhooks = build-asdf-system rec {
     pname = "nhooks";
-    version = "1.2.1";
+    version = "1.2.2";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nhooks";
-      rev = "1.2.1";
-      hash = "sha256-D61QHxHTceIu5mCGKf3hy53niQMfs0idEYQK1ZYn1YM=";
+      rev = version;
+      hash = "sha256-6A3fsemsv2KbTmdGMQeL9iHFUBHc4kK6CRNVyc91LdU=";
     };
     lispLibs = with self; [ bordeaux-threads closer-mop serapeum ];
   };

From 89591aebbd1da7ce58b36ae7b0e5da2dbdbae35e Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 19:08:11 +0800
Subject: [PATCH 45/89] sbclPackages.njson: 1.1.0 -> 1.2.2

---
 pkgs/development/lisp-modules/packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 224093fab085..f53ffb86c258 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -267,16 +267,16 @@ let
     };
   };
 
-  njson = build-asdf-system {
+  njson = build-asdf-system rec {
     pname = "njson";
-    version = "1.1.0";
+    version = "1.2.2";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "njson";
-      rev = "1.1.0";
-      sha256 = "sha256-hVo5++QCns7Mv3zATpAP3EVz1pbj+jbQmzSLqs6hqQo=";
+      rev = version;
+      sha256 = "sha256-kw5DD0GJp/TeCiYATBY8GL8UKqYS6Q4j0a0eQsdcZRc=";
     };
-    lispLibs = [ self.nasdf super.cl-json super.com_dot_inuoe_dot_jzon];
+    lispLibs = [ super.cl-json super.com_dot_inuoe_dot_jzon];
     systems = [ "njson" "njson/cl-json" "njson/jzon"];
   };
 

From 1f664005cbad931261bbbec3e920c2aa6c37e35c Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 19:16:08 +0800
Subject: [PATCH 46/89] sbclPackages.prompter: 0.1.0 -> 0.1.1

---
 pkgs/development/lisp-modules/packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index f53ffb86c258..3cd374a5d72b 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -230,15 +230,15 @@ let
     };
   };
 
-  prompter = build-asdf-system {
+  prompter = build-asdf-system rec {
     pname = "prompter";
-    version = "0.1.0";
+    version = "0.1.1";
 
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "prompter";
-      rev = "0.1.0";
-      sha256 = "sha256-Duv7L2lMjr3VXsoujQDOMNHCbdUDX4RWoncVm9LDCZE=";
+      rev = version;
+      sha256 = "sha256-A9gIUBj0oUDFGR5aqHz+tdNR6t03LPMrx0n9qM3ACwE=";
     };
 
     lispLibs = [

From cb5f05ece443faace5740c39d4a10f5510160311 Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 19:16:48 +0800
Subject: [PATCH 47/89] sbclPackages.nsymbols: 0.3.1 -> 0.3.2

---
 pkgs/development/lisp-modules/packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 3cd374a5d72b..0733e68dedd0 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -280,14 +280,14 @@ let
     systems = [ "njson" "njson/cl-json" "njson/jzon"];
   };
 
-  nsymbols = build-asdf-system {
+  nsymbols = build-asdf-system rec {
     pname = "nsymbols";
-    version = "0.3.1";
+    version = "0.3.2";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nsymbols";
-      rev = "0.3.1";
-      sha256 = "sha256-KcrE06bG5Khp5/807wb/TbPG3nWTlNWHrDpmK6bm7ZM=";
+      rev = version;
+      sha256 = "sha256-psk29WEA7Hxgp29oUniBNvI+lyZfMkdpa5A7okc6kKs=";
     };
     lispLibs = [ super.closer-mop ];
     systems = [ "nsymbols" "nsymbols/star" ];

From 9ac7126460157d0735e7ebbff88107a022cac95f Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 19:17:29 +0800
Subject: [PATCH 48/89] sbclPackages.nkeymaps: 1.1.0 -> 1.1.1

---
 pkgs/development/lisp-modules/packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 0733e68dedd0..a2eb19dfb81a 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -341,12 +341,12 @@ let
 
   nkeymaps = build-asdf-system rec {
     pname = "nkeymaps";
-    version = "1.1.0";
+    version = "1.1.1";
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nkeymaps";
       rev = version;
-      hash = "sha256-ewMu2IgEzCYY72vG91IA7l8X78Ph6jpQvbKeOFZdAyM=";
+      hash = "sha256-/t85Yh4EvnSyIM6xeDBLmfVz3wddmavInXzeYafNMJ0=";
     };
     lispLibs = with self; [ alexandria fset trivial-package-local-nicknames
                             str ];

From 1d876084fc87aeadc1f987675dd4595961661037 Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 18:57:49 +0800
Subject: [PATCH 49/89] nyxt: 3.9.0 -> 3.10.0

---
 pkgs/development/lisp-modules/packages.nix | 40 +++++++++++++++++-----
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index a2eb19dfb81a..9bfce63178b5 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -373,7 +373,7 @@ let
 
   nyxt-gtk = build-asdf-system {
     pname = "nyxt";
-    version = "3.9.0";
+    version = "3.10.0";
 
     lispLibs = (with super; [
       alexandria
@@ -411,7 +411,6 @@ let
       plump
       clss
       spinneret
-      slynk
       trivia
       trivial-features
       trivial-garbage
@@ -427,8 +426,8 @@ let
         src = pkgs.fetchFromGitHub {
           owner = "snmsts";
           repo = "trivial-clipboard";
-          rev = "6ddf8d5dff8f5c2102af7cd1a1751cbe6408377b";
-          sha256 = "sha256-n15IuTkqAAh2c1OfNbZfCAQJbH//QXeH0Bl1/5OpFRM=";
+          rev = "f7b2c96fea00ca06a83f20b00b7b1971e76e03e7";
+          sha256 = "sha256-U6Y9BiM2P1t9P8fdX8WIRQPRWl2v2ZQuKdP1IUqvOAk=";
         };}))
       (cl-gobject-introspection.overrideAttrs (final: prev: {
         src = pkgs.fetchFromGitHub {
@@ -445,26 +444,45 @@ let
           sha256 = "sha256-t/B9CvQTekEEsM/ZEp47Mn6NeZaTYFsTdRqclfX9BNg=";
         };
       }))
+      (slynk.overrideAttrs (final: prev: {
+        src = pkgs.fetchFromGitHub {
+          owner = "joaotavora";
+          repo = "sly";
+          rev = "9c43bf65b967e12cef1996f1af5f0671d8aecbf4";
+          hash = "sha256-YlHZ/7VwvHe2PBPRshN+Gr3WuGK9MpkOJprP6QXI3pY=";
+        };
+        systems = [ "slynk" "slynk/arglists" "slynk/fancy-inspector"
+                    "slynk/package-fu" "slynk/mrepl" "slynk/trace-dialog"
+                    "slynk/profiler" "slynk/stickers" "slynk/indentation"
+                    "slynk/retro" ];
+      }))
     ]) ++ (with self; [
       history-tree
       nhooks
       nkeymaps
-      nasdf
       prompter
       cl-colors2_0_5_4
       njson
       nsymbols
       nclasses
       nfiles
-      swank
       cl-containers
+      (swank.overrideAttrs (final: prev: {
+        src = pkgs.fetchFromGitHub {
+          owner = "slime";
+          repo = "slime";
+          rev = "735258a26bb97e85d25f39e4bef83c1f80c12f5d";
+          hash = "sha256-vMMer6qLJDKTwNE3unsOQezujISqFtn2AYl8cxsJvrc=";
+        };
+        systems = [ "swank" "swank/exts" ];
+      }))
     ]);
 
     src = pkgs.fetchFromGitHub {
       owner = "atlas-engineer";
       repo = "nyxt";
-      rev = "3.9.0";
-      sha256 = "sha256-bZoAE0FErgXPylOzh6AfMq3befms9dHms8+slbYdctk=";
+      rev = "3.10.0";
+      sha256 = "sha256-yEa5Lx1egkg9Jh3EQfvaBQicm31uxIq/3s2NOQUC4uc=";
     };
 
     nativeBuildInputs = [ pkgs.makeWrapper ];
@@ -484,8 +502,14 @@ let
     # see: https://gitlab.common-lisp.net/asdf/asdf/-/blob/master/doc/asdf.texinfo#L2582
     patches = [ ./patches/nyxt-remove-build-operation.patch ];
 
+    NASDF_USE_LOGICAL_PATHS = true;
+
     buildScript = pkgs.writeText "build-nyxt.lisp" ''
       (load "${super.alexandria.asdfFasl}/asdf.${super.alexandria.faslExt}")
+      (require :uiop)
+      (let ((pwd (uiop:ensure-directory-pathname (uiop/os:getcwd))))
+        (asdf:load-asd (uiop:merge-pathnames* "libraries/nasdf/nasdf.asd" pwd))
+        (asdf:load-asd (uiop:merge-pathnames* "nyxt.asd" pwd)))
       ;; There's a weird error while copy/pasting in Nyxt that manifests with sb-ext:save-lisp-and-die, so we use asdf:operare :program-op instead
       (asdf:operate :program-op :nyxt/gi-gtk-application)
     '';

From f8e60526f47b0bf296f351188f461ff0b665eb8e Mon Sep 17 00:00:00 2001
From: Vonfry <mail@vonfry.name>
Date: Tue, 12 Dec 2023 22:24:31 +0800
Subject: [PATCH 50/89] sbclPackages.nasdf: deprecate

---
 pkgs/development/lisp-modules/packages.nix | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 9bfce63178b5..afb2d834579a 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -256,17 +256,6 @@ let
 
   };
 
-  nasdf = build-asdf-system {
-    pname = "nasdf";
-    version = "20230911-git";
-    src = pkgs.fetchFromGitHub {
-      owner = "atlas-engineer";
-      repo = "ntemplate";
-      rev = "ab7a018f3a67a999c72710644b10b4545130c139";
-      sha256 = "sha256-fXGh0h6CXLoBgK1jRxkSNyQVAY1gvi4iyHQBuzueR5Y=";
-    };
-  };
-
   njson = build-asdf-system rec {
     pname = "njson";
     version = "1.2.2";

From ba3aa62c3f77bc2ab9314cd4f1732d41cf308c35 Mon Sep 17 00:00:00 2001
From: Michael Adler <therisen06@gmail.com>
Date: Wed, 13 Dec 2023 14:28:16 +0100
Subject: [PATCH 51/89] opensc: 0.23.0 -> 0.24.0

---
 pkgs/tools/security/opensc/default.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 9b5b6fba8b24..856921edbf18 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -8,23 +8,15 @@
 
 stdenv.mkDerivation rec {
   pname = "opensc";
-  version = "0.23.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "OpenSC";
     repo = "OpenSC";
     rev = version;
-    sha256 = "sha256-Yo8dwk7+d6q+hi7DmJ0GJM6/pmiDOiyEm/tEBSbCU8k=";
+    sha256 = "sha256-1mm0b4AAtX0AgjShpU1FR6e7pUkea5TOJdIGkNQgjuE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-2977.patch";
-      url = "https://github.com/OpenSC/OpenSC/commit/81944d1529202bd28359bede57c0a15deb65ba8a.patch";
-      hash = "sha256-rCeYYKPtv3pii5zgDP5x9Kl2r98p3uxyBSCYlPJZR/s=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [
     zlib readline openssl libassuan

From 85bcd8c3918ecba20b7e9a87769f50b07a00b13a Mon Sep 17 00:00:00 2001
From: Connor Baker <connor.baker@tweag.io>
Date: Wed, 13 Dec 2023 02:32:57 +0000
Subject: [PATCH 52/89] cudaPackages: add missing newline to manifest builder

---
 pkgs/development/cuda-modules/generic-builders/manifest.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/cuda-modules/generic-builders/manifest.nix b/pkgs/development/cuda-modules/generic-builders/manifest.nix
index 95140ca651cd..71c914c8c8f2 100644
--- a/pkgs/development/cuda-modules/generic-builders/manifest.nix
+++ b/pkgs/development/cuda-modules/generic-builders/manifest.nix
@@ -189,6 +189,9 @@ backendStdenv.mkDerivation (
       ''
       # Move the outputs into their respective outputs.
       + strings.concatMapStringsSep "\n" mkMoveToOutputCommand (builtins.tail finalAttrs.outputs)
+      # Add a newline to the end of the installPhase, so that the post-install hook doesn't
+      # get concatenated with the last moveToOutput command.
+      + "\n"
       # Post-install hook
       + ''
         runHook postInstall

From 634efac01469a3a0e0f712dacb5b4c2987ff975d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20Fern=C3=A1ndez=20L=C3=B3pez?=
 <ereslibre@ereslibre.es>
Date: Sun, 10 Dec 2023 22:51:56 +0100
Subject: [PATCH 53/89] wamr: fix darwin build

---
 pkgs/development/interpreters/wamr/default.nix | 4 +---
 pkgs/top-level/all-packages.nix                | 2 +-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/interpreters/wamr/default.nix b/pkgs/development/interpreters/wamr/default.nix
index 9396f3361afa..f7761d5037f9 100644
--- a/pkgs/development/interpreters/wamr/default.nix
+++ b/pkgs/development/interpreters/wamr/default.nix
@@ -31,8 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.asl20;
     mainProgram = "iwasm";
     maintainers = with maintainers; [ ereslibre ];
-    # TODO (ereslibre): this derivation should be improved to support
-    # more platforms.
-    broken = !stdenv.isLinux;
+    platforms = platforms.unix;
   };
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4f3ef401937f..8c7e28375af9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -41394,7 +41394,7 @@ with pkgs;
 
   wacomtablet = libsForQt5.callPackage ../tools/misc/wacomtablet { };
 
-  wamr = callPackage ../development/interpreters/wamr { };
+  wamr = darwin.apple_sdk_11_0.callPackage ../development/interpreters/wamr { };
 
   wasmer = callPackage ../development/interpreters/wasmer {
     llvmPackages = llvmPackages_14;

From be0a6b0dd6b72667a930a8e26bf4ae9e99b311a5 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Tue, 12 Dec 2023 22:17:06 +0100
Subject: [PATCH 54/89] nixos/restic: append PATH in wrappers instead of
 overwriting

fixes "mount"
---
 nixos/modules/services/backup/restic.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index e3eb504e0adf..b222dd952d15 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -384,10 +384,11 @@ in
       ${lib.optionalString (backup.environmentFile != null) "source ${backup.environmentFile}"}
       # set same environment variables as the systemd service
       ${lib.pipe config.systemd.services."restic-backups-${name}".environment [
-        (lib.filterAttrs (_: v: v != null))
+        (lib.filterAttrs (n: v: v != null && n != "PATH"))
         (lib.mapAttrsToList (n: v: "${n}=${v}"))
         (lib.concatStringsSep "\n")
       ]}
+      PATH=${config.systemd.services."restic-backups-${name}".environment.PATH}:$PATH
 
       exec ${resticCmd} $@
     '') (lib.filterAttrs (_: v: v.createWrapper) config.services.restic.backups);

From a92e6068b4988fb77ee71a3da83ead4330029ff8 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Wed, 13 Dec 2023 11:52:44 +0000
Subject: [PATCH 55/89] buildGraalvm: use
 NATIVE_IMAGE_DEPRECATED_BUILDER_SANITATION instead of CC wrapper

Instead of using a hacky CC wrapper to re-inject the environment
variables needed to build, we set the
NATIVE_IMAGE_DEPRECATED_BUILDER_SANITATION=true that is in 21.0.0
release changelog:
https://github.com/oracle/graal/blob/489611a304ec808cdcb1e07e9a9799e6240fd2e1/substratevm/CHANGELOG.md?plain=1#L48

This is deprecated behavior for now, and will be removed in future, but
this will allow us more time until we figure a proper solution.

See:
- https://github.com/oracle/graal/issues/7502
- https://github.com/oracle/graal/issues/7981
- https://github.com/oracle/graal/pull/6095
---
 .../community-edition/buildGraalvm.nix        | 25 +++++++------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
index 7d62411f5740..858d7443ff62 100644
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@@ -63,22 +63,7 @@ let
     mkdir -p $out/bin
     ln -s ${lib.getDev musl}/bin/musl-gcc $out/bin/${stdenv.hostPlatform.system}-musl-gcc
   '');
-  # GraalVM 23.0.0+ (i.e.: JDK 21.0.0+) clean-up the environment inside darwin
-  # So we need to re-added some env vars to make everything work correctly again
-  darwin-cc = (runCommandCC "darwin-cc"
-    {
-      nativeBuildInputs = [ makeWrapper ];
-      buildInputs = [ darwin.apple_sdk.frameworks.Foundation zlib ];
-    } ''
-    makeWrapper ${stdenv.cc}/bin/cc $out/bin/cc \
-      --prefix NIX_CFLAGS_COMPILE_${stdenv.cc.suffixSalt} : "$NIX_CFLAGS_COMPILE" \
-      --prefix NIX_LDFLAGS_${stdenv.cc.suffixSalt} : "$NIX_LDFLAGS"
-  '');
-  binPath = lib.makeBinPath (
-    lib.optionals stdenv.isDarwin [ darwin-cc ]
-    ++ lib.optionals useMusl [ musl-gcc ]
-    ++ [ stdenv.cc ]
-  );
+  binPath = lib.makeBinPath (lib.optionals useMusl [ musl-gcc ] ++ [ stdenv.cc ]);
 
   runtimeLibraryPath = lib.makeLibraryPath
     ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
@@ -180,6 +165,14 @@ let
       echo "Testing GraalVM"
       $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
 
+      # Workaround GraalVM issue where the builder does not have access to the
+      # environment variables since 21.0.0
+      # Only needed for native-image tests
+      # https://github.com/oracle/graal/pull/6095
+      # https://github.com/oracle/graal/pull/6095
+      # https://github.com/oracle/graal/issues/7502
+      export NATIVE_IMAGE_DEPRECATED_BUILDER_SANITATION="true";
+
       echo "Ahead-Of-Time compilation"
       $out/bin/native-image -H:+UnlockExperimentalVMOptions -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
       ./helloworld | fgrep 'Hello World'

From ed5b0bccf54ea17f66aa5836c5f7bb8680b0e2c1 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Wed, 13 Dec 2023 12:00:58 +0000
Subject: [PATCH 56/89] buildGraalvmNativeImage: set
 NATIVE_IMAGE_DEPRECATED_BUILDER_SANITATION

---
 pkgs/build-support/build-graalvm-native-image/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/build-support/build-graalvm-native-image/default.nix b/pkgs/build-support/build-graalvm-native-image/default.nix
index e5fe1abe1d11..0612db2ad79b 100644
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@@ -49,6 +49,13 @@ stdenv.mkDerivation ({
 
   nativeImageBuildArgs = nativeImageBuildArgs ++ extraNativeImageBuildArgs ++ [ graalvmXmx ];
 
+  # Workaround GraalVM issue where the builder does not have access to the
+  # environment variables since 21.0.0
+  # https://github.com/oracle/graal/pull/6095
+  # https://github.com/oracle/graal/pull/6095
+  # https://github.com/oracle/graal/issues/7502
+  env.NATIVE_IMAGE_DEPRECATED_BUILDER_SANITATION = "true";
+
   buildPhase = args.buildPhase or ''
     runHook preBuild
 

From d4b7b154072635827dcd473131273e1a8bc54097 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Wed, 13 Dec 2023 04:33:31 +0100
Subject: [PATCH 57/89] lib.path.hasStorePathPrefix: init

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 lib/path/default.nix    | 81 +++++++++++++++++++++++++++++++++++++++++
 lib/path/tests/unit.nix | 30 ++++++++++++++-
 2 files changed, 110 insertions(+), 1 deletion(-)

diff --git a/lib/path/default.nix b/lib/path/default.nix
index ab8a9e2202e9..e6b385c0aee0 100644
--- a/lib/path/default.nix
+++ b/lib/path/default.nix
@@ -9,6 +9,7 @@ let
     split
     match
     typeOf
+    storeDir
     ;
 
   inherit (lib.lists)
@@ -24,6 +25,8 @@ let
     drop
     ;
 
+  listHasPrefix = lib.lists.hasPrefix;
+
   inherit (lib.strings)
     concatStringsSep
     substring
@@ -120,6 +123,28 @@ let
         else recurse ([ (baseNameOf base) ] ++ components) (dirOf base);
     in recurse [];
 
+  # The components of the store directory, typically [ "nix" "store" ]
+  storeDirComponents = splitRelPath ("./" + storeDir);
+  # The number of store directory components, typically 2
+  storeDirLength = length storeDirComponents;
+
+  # Type: [ String ] -> Bool
+  #
+  # Whether path components have a store path as a prefix, according to
+  # https://nixos.org/manual/nix/stable/store/store-path.html#store-path.
+  componentsHaveStorePathPrefix = components:
+    # path starts with the store directory (typically /nix/store)
+    listHasPrefix storeDirComponents components
+    # is not the store directory itself, meaning there's at least one extra component
+    && storeDirComponents != components
+    # and the first component after the store directory has the expected format.
+    # NOTE: We could change the hash regex to be [0-9a-df-np-sv-z],
+    # because these are the actual ASCII characters used by Nix's base32 implementation,
+    # but this is not fully specified, so let's tie this too much to the currently implemented concept of store paths.
+    # Similar reasoning applies to the validity of the name part.
+    # We care more about discerning store path-ness on realistic values. Making it airtight would be fragile and slow.
+    && match ".{32}-.+" (elemAt components storeDirLength) != null;
+
 in /* No rec! Add dependencies on this file at the top. */ {
 
   /*
@@ -321,6 +346,62 @@ in /* No rec! Add dependencies on this file at the top. */ {
       subpath = joinRelPath deconstructed.components;
     };
 
+  /*
+    Whether a [path](https://nixos.org/manual/nix/stable/language/values.html#type-path)
+    has a [store path](https://nixos.org/manual/nix/stable/store/store-path.html#store-path)
+    as a prefix.
+
+    :::{.note}
+    As with all functions of this `lib.path` library, it does not work on paths in strings,
+    which is how you'd typically get store paths.
+
+    Instead, this function only handles path values themselves,
+    which occur when Nix files in the store use relative path expressions.
+    :::
+
+    Type:
+      hasStorePathPrefix :: Path -> Bool
+
+    Example:
+      # Subpaths of derivation outputs have a store path as a prefix
+      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo/bar/baz
+      => true
+
+      # The store directory itself is not a store path
+      hasStorePathPrefix /nix/store
+      => false
+
+      # Derivation outputs are store paths themselves
+      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo
+      => true
+
+      # Paths outside the Nix store don't have a store path prefix
+      hasStorePathPrefix /home/user
+      => false
+
+      # Not all paths under the Nix store are store paths
+      hasStorePathPrefix /nix/store/.links/10gg8k3rmbw8p7gszarbk7qyd9jwxhcfq9i6s5i0qikx8alkk4hq
+      => false
+
+      # Store derivations are also store paths themselves
+      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo.drv
+      => true
+  */
+  hasStorePathPrefix = path:
+    let
+      deconstructed = deconstructPath path;
+    in
+    assert assertMsg
+      (isPath path)
+      "lib.path.hasStorePathPrefix: Argument is of type ${typeOf path}, but a path was expected";
+    assert assertMsg
+      # This function likely breaks or needs adjustment if used with other filesystem roots, if they ever get implemented.
+      # Let's try to error nicely in such a case, though it's unclear how an implementation would work even and whether this could be detected.
+      # See also https://github.com/NixOS/nix/pull/6530#discussion_r1422843117
+      (deconstructed.root == /. && toString deconstructed.root == "/")
+      "lib.path.hasStorePathPrefix: Argument has a filesystem root (${toString deconstructed.root}) that's not /, which is currently not supported.";
+    componentsHaveStorePathPrefix deconstructed.components;
+
   /*
     Whether a value is a valid subpath string.
 
diff --git a/lib/path/tests/unit.nix b/lib/path/tests/unit.nix
index bad6560f13a9..9b0a0b2714aa 100644
--- a/lib/path/tests/unit.nix
+++ b/lib/path/tests/unit.nix
@@ -3,7 +3,10 @@
 { libpath }:
 let
   lib = import libpath;
-  inherit (lib.path) hasPrefix removePrefix append splitRoot subpath;
+  inherit (lib.path) hasPrefix removePrefix append splitRoot hasStorePathPrefix subpath;
+
+  # This is not allowed generally, but we're in the tests here, so we'll allow ourselves.
+  storeDirPath = /. + builtins.storeDir;
 
   cases = lib.runTests {
     # Test examples from the lib.path.append documentation
@@ -91,6 +94,31 @@ let
       expected = false;
     };
 
+    testHasStorePathPrefixExample1 = {
+      expr = hasStorePathPrefix (storeDirPath + "/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo/bar/baz");
+      expected = true;
+    };
+    testHasStorePathPrefixExample2 = {
+      expr = hasStorePathPrefix storeDirPath;
+      expected = false;
+    };
+    testHasStorePathPrefixExample3 = {
+      expr = hasStorePathPrefix (storeDirPath + "/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo");
+      expected = true;
+    };
+    testHasStorePathPrefixExample4 = {
+      expr = hasStorePathPrefix /home/user;
+      expected = false;
+    };
+    testHasStorePathPrefixExample5 = {
+      expr = hasStorePathPrefix (storeDirPath + "/.links/10gg8k3rmbw8p7gszarbk7qyd9jwxhcfq9i6s5i0qikx8alkk4hq");
+      expected = false;
+    };
+    testHasStorePathPrefixExample6 = {
+      expr = hasStorePathPrefix (storeDirPath + "/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo.drv");
+      expected = true;
+    };
+
     # Test examples from the lib.path.subpath.isValid documentation
     testSubpathIsValidExample1 = {
       expr = subpath.isValid null;

From f622b970ed500d0238596591f5fc936204e221a0 Mon Sep 17 00:00:00 2001
From: BlankParticle <blankparticle@gmail.com>
Date: Wed, 13 Dec 2023 21:52:08 +0530
Subject: [PATCH 58/89] spotify: 1.2.25.1011.g0348b2ea -> 1.2.26.1187.g36b715a1

---
 pkgs/applications/audio/spotify/linux.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/audio/spotify/linux.nix b/pkgs/applications/audio/spotify/linux.nix
index a5aec13504b1..a73c00a8fb9d 100644
--- a/pkgs/applications/audio/spotify/linux.nix
+++ b/pkgs/applications/audio/spotify/linux.nix
@@ -14,14 +14,14 @@ let
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.2.25.1011.g0348b2ea";
+  version = "1.2.26.1187.g36b715a1";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "73";
+  rev = "74";
 
   deps = [
     alsa-lib
@@ -87,7 +87,7 @@ stdenv.mkDerivation {
   # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    hash = "sha512-93A+0YfP2/HnQOhSMw3UZ374bpS5ccQqb7a+e4RPSKvyT54wcI6hpmRn8CVo02oLo0yI2hho3Bu3ggsJLVgzbw==";
+    hash = "sha512-Muurn4ih54oVTvLGuRfTPCgGSRImE8O0S5k7gZ4Utgrz3TKgVrthY9AXldP8v+qLcfIrrYwixJy2WGuur9E0jg==";
   };
 
   nativeBuildInputs = [ wrapGAppsHook makeShellWrapper squashfsTools ];

From 1b44690b1650fd7483e80450f7cc8964b7e8e671 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Dec 2023 17:00:18 +0000
Subject: [PATCH 59/89] cf-vault: 0.0.16 -> 0.0.17

---
 pkgs/tools/admin/cf-vault/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/admin/cf-vault/default.nix b/pkgs/tools/admin/cf-vault/default.nix
index 3dd693b13d59..13d3ea13d9f4 100644
--- a/pkgs/tools/admin/cf-vault/default.nix
+++ b/pkgs/tools/admin/cf-vault/default.nix
@@ -1,16 +1,16 @@
 {buildGoModule, fetchFromGitHub, lib}:
 buildGoModule rec {
   pname = "cf-vault";
-  version = "0.0.16";
+  version = "0.0.17";
 
   src = fetchFromGitHub {
     owner = "jacobbednarz";
     repo = pname;
     rev = version;
-    sha256 = "sha256-puuP7L8KJ3MvlWz5tOeov8HZad+Lvo64DqTbaKPfg6o=";
+    sha256 = "sha256-wSTbg+dQrTbfL4M4XdwZXS04mjIFtD0RY1vK0CUHkso=";
   };
 
-  vendorHash = "sha256-cnv3vustgougdfU9RlyP4O3e7kx9nNzzJm1Q2d+sCDo=";
+  vendorHash = "sha256-b9Ni4H2sk2gU+0zLOBg0P4ssqSJYTHnAvnmMHXha5us=";
 
   meta = with lib; {
     description = ''

From f609de15385b9687cd83dd8fba51381cd942b815 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 13 Dec 2023 18:15:24 +0100
Subject: [PATCH 60/89] exploitdb: 2023-12-12 -> 2023-12-13

Diff: https://gitlab.com/exploit-database/exploitdb/-/compare/refs/tags/2023-12-12...2023-12-13
---
 pkgs/tools/security/exploitdb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 123c5ba74c32..6572b0561fad 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-12-12";
+  version = "2023-12-13";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-OHx9UV5IhNt9/jKUKAzAUILdjxpQgOe5BQdXz3k38RE=";
+    hash = "sha256-DnGHtEF31MN82IrCPcH5HlRdcu6A5XACkOTT3ytzrig=";
   };
 
   nativeBuildInputs = [

From 7382d4d83491e5f6885b78da2fada509605b2932 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 13 Dec 2023 18:16:49 +0100
Subject: [PATCH 61/89] checkov: 3.1.34 -> 3.1.38

Diff: https://github.com/bridgecrewio/checkov/compare/refs/tags/3.1.34...3.1.38

Changelog: https://github.com/bridgecrewio/checkov/releases/tag/3.1.38
---
 pkgs/development/tools/analysis/checkov/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 22157b26baea..482b0f092bb8 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.1.34";
+  version = "3.1.38";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-F0zXvxxnfiCoEzhDL5v82OImqOX3y5umyRy5PbVCls0=";
+    hash = "sha256-03tukEuNaQP3YNv66FuDKzeTPcPfPY4PT6ZWRLFDu6c=";
   };
 
   patches = [

From cde08ea694d553d7459e8838ac2e76cbf5b6686e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 13 Dec 2023 18:17:49 +0100
Subject: [PATCH 62/89] python311Packages.can: 4.3.0 -> 4.3.1

Diff: https://github.com/hardbyte/python-can/compare/refs/tags/v4.3.0...v4.3.1

Changelog: https://github.com/hardbyte/python-can/releases/tag/v4.3.1
---
 pkgs/development/python-modules/can/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/can/default.nix b/pkgs/development/python-modules/can/default.nix
index 4688c6507495..28c401b667fe 100644
--- a/pkgs/development/python-modules/can/default.nix
+++ b/pkgs/development/python-modules/can/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "can";
-  version = "4.3.0";
+  version = "4.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "hardbyte";
     repo = "python-can";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JsYAh5Z6RIX6aWpSuW+VIzJRPf5MfNbBGg36v3CQiLU=";
+    hash = "sha256-t2zt54nPOYcEE0RPb4fbW7sN4HzFXlDIHvHudstBwrM=";
   };
 
   postPatch = ''

From 3022db61f2935f6329ee7caf423c08e820fc33c1 Mon Sep 17 00:00:00 2001
From: root <root@8fc1a5414af4>
Date: Wed, 13 Dec 2023 17:20:24 +0000
Subject: [PATCH 63/89] vimPlugins: update on 2023-12-13

---
 .../editors/vim/plugins/generated.nix         | 50 ++++++++++++-------
 1 file changed, 31 insertions(+), 19 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index c6d5e250ddb8..b61868d64a25 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -33,8 +33,8 @@ final: prev:
     src = fetchFromGitHub {
       owner = "jackMort";
       repo = "ChatGPT.nvim";
-      rev = "fc0a13f803653051801cfcf7acfd600ce44454a9";
-      sha256 = "0csinl0z5jy0wnrl2rbg04kbblwb4kzsx0s6hd4n9iq9iz2k51z8";
+      rev = "f189c51d03316b4ab02766c5fed6f876f5d57cbb";
+      sha256 = "1h6fggfqifx47vhd3n0c4vldrx5lqbizkijm14nkj55224sq5i61";
     };
     meta.homepage = "https://github.com/jackMort/ChatGPT.nvim/";
   };
@@ -1171,12 +1171,12 @@ final: prev:
 
   bufferline-nvim = buildVimPlugin {
     pname = "bufferline.nvim";
-    version = "2023-12-08";
+    version = "2023-12-13";
     src = fetchFromGitHub {
       owner = "akinsho";
       repo = "bufferline.nvim";
-      rev = "ac788fbc493839c1e76daa8d119934b715fdb90e";
-      sha256 = "0zy8z80s32hqa6jsffh9wygb77dnp7zhsp2zqgbl63lpyy0ffrvc";
+      rev = "e48ce1805697e4bb97bc171c081e849a65859244";
+      sha256 = "06af2lvydw7c2yswin968vdh2f06s5xmwx6pip45c4am8q68a2y6";
     };
     meta.homepage = "https://github.com/akinsho/bufferline.nvim/";
   };
@@ -3382,6 +3382,18 @@ final: prev:
     meta.homepage = "https://github.com/bogado/file-line/";
   };
 
+  fileline-nvim = buildVimPlugin {
+    pname = "fileline.nvim";
+    version = "2023-08-30";
+    src = fetchFromGitHub {
+      owner = "lewis6991";
+      repo = "fileline.nvim";
+      rev = "64fc4b24f559467ff7fdbf4b3d9eaf4724f331e4";
+      sha256 = "0q68mz6kd3zbf2blwz84q39wn2kq9svl8516p5vyn9jpn70rnmgv";
+    };
+    meta.homepage = "https://github.com/lewis6991/fileline.nvim/";
+  };
+
   firenvim = buildVimPlugin {
     pname = "firenvim";
     version = "2023-08-18";
@@ -7763,12 +7775,12 @@ final: prev:
 
   nvim-web-devicons = buildVimPlugin {
     pname = "nvim-web-devicons";
-    version = "2023-12-08";
+    version = "2023-12-13";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-web-devicons";
-      rev = "8b2e5ef9eb8a717221bd96cb8422686d65a09ed5";
-      sha256 = "0s7vhlr71f3n8in2dnpqj1p1jgncn0mdl1y6a7ksl8yx2vrxqdyl";
+      rev = "a1425903ab52a0a0460622519e827f224e5b4fee";
+      sha256 = "11ag1v91b6pbrvrrmw4dvi9r46zrni9pgg1a5ndli5w5wdy7sf67";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-web-devicons/";
   };
@@ -8535,11 +8547,11 @@ final: prev:
 
   rainbow-delimiters-nvim = buildVimPlugin {
     pname = "rainbow-delimiters.nvim";
-    version = "2023-12-12";
+    version = "2023-12-13";
     src = fetchgit {
       url = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
-      rev = "cc1783ca5f1f9bfed18bfc051bb88e0e4faaf17a";
-      sha256 = "174fx4ijyjczqb2lg6s1i3g4m4mvph02s7wfdk2jf0png7dg2mq4";
+      rev = "0b4c1ab6724062f3582746c6a5a8c0636bf7ed81";
+      sha256 = "0xz7m7xr6v467hglncdqc6jayh7qj4fyh3f7sgv8yyxlm8bf8prd";
     };
     meta.homepage = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
   };
@@ -8954,12 +8966,12 @@ final: prev:
 
   sg-nvim = buildVimPlugin {
     pname = "sg.nvim";
-    version = "2023-11-15";
+    version = "2023-12-13";
     src = fetchFromGitHub {
       owner = "sourcegraph";
       repo = "sg.nvim";
-      rev = "41378567217097a3d78b624c9f11d29436381e99";
-      sha256 = "0dwh7zb8l83d8l63ps6qc5am7r95bnyavz5r8qpxnzgzdic2r5nv";
+      rev = "9eeb00c758a394cccd2828720b0eaadce6f1ad51";
+      sha256 = "085vpy7vrmzcx5143gcxsgan99g6g9p05rljs0pkrw5kn7fw6szb";
     };
     meta.homepage = "https://github.com/sourcegraph/sg.nvim/";
   };
@@ -10466,8 +10478,8 @@ final: prev:
     src = fetchFromGitHub {
       owner = "unisonweb";
       repo = "unison";
-      rev = "37ca00c65e9ba2f5adfe87780efda8071d894fae";
-      sha256 = "07prqlwjlxix80ji537giam6w70699rgn5xslig5ivrmsldr42s7";
+      rev = "a91e3c32060862ea2ba1ebdedd3d3eaa636edcdd";
+      sha256 = "15wm2jx6vrrx8f00g7p0w3jzqgpg6c0jbzj2n7h6vl93s7d65207";
     };
     meta.homepage = "https://github.com/unisonweb/unison/";
   };
@@ -12912,12 +12924,12 @@ final: prev:
 
   vim-just = buildVimPlugin {
     pname = "vim-just";
-    version = "2023-12-12";
+    version = "2023-12-13";
     src = fetchFromGitHub {
       owner = "NoahTheDuke";
       repo = "vim-just";
-      rev = "a9761618b04ee1bf22005661cc8f598398d7b8d9";
-      sha256 = "0hyqqk87fijraknkwwx9wzlvb6lpmn0wzrfzfb3j7as7rzbrb8gp";
+      rev = "db122b74305993402150e18fad9568a5a0b542e8";
+      sha256 = "0d1m1nda6r8wpbywl27xg3dwjfxnxy1vwiq9pp3m77d9blcnwgwf";
     };
     meta.homepage = "https://github.com/NoahTheDuke/vim-just/";
   };

From 806f68c893bf84819732b511088dbf32aa976fd7 Mon Sep 17 00:00:00 2001
From: root <root@8fc1a5414af4>
Date: Wed, 13 Dec 2023 17:36:57 +0000
Subject: [PATCH 64/89] vimPlugins: resolve github repository redirects

---
 pkgs/applications/editors/vim/plugins/generated.nix    | 6 +++---
 pkgs/applications/editors/vim/plugins/vim-plugin-names | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index b61868d64a25..f3461dcc00b5 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -4836,12 +4836,12 @@ final: prev:
 
   lean-nvim = buildVimPlugin {
     pname = "lean.nvim";
-    version = "2023-12-10";
+    version = "2023-12-13";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "1bfcbea057c7daa81427c07440145a065339474a";
-      sha256 = "0y5cdk8p0dkqx44h7kzs9f7j4jjmqcg7d029wj00m6wvb81618f3";
+      rev = "a5daac8ebccb93af25ace2a2041b503f18ff3dcb";
+      sha256 = "1a2qgmpg2j49v5pz8j4bfa5n8q8kiyixfz3jxhh41jkw7myxcqwh";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 7f9a677b583c..3faba6d29582 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -281,6 +281,7 @@ https://github.com/lambdalisue/fern.vim/,,
 https://github.com/wincent/ferret/,,
 https://github.com/j-hui/fidget.nvim/,,
 https://github.com/bogado/file-line/,,
+https://github.com/lewis6991/fileline.nvim/,,
 https://github.com/glacambre/firenvim/,HEAD,
 https://github.com/andviro/flake8-vim/,,
 https://github.com/folke/flash.nvim/,HEAD,

From a7aa95db53ad43533805bf0971b6c77fa7e87c01 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 13 Dec 2023 18:38:41 +0100
Subject: [PATCH 65/89] lib/attrsets: Document and link Nix language operators

---
 lib/attrsets.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 9b4a8684f9b7..99b686918453 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -14,6 +14,14 @@ rec {
 
   /* Return an attribute from nested attribute sets.
 
+     Nix has an [attribute selection operator `. or`](https://nixos.org/manual/nix/stable/language/operators#attribute-selection) which is sufficient for such queries, as long as the number of attributes is static. For example:
+
+     ```nix
+     (x.a.b or 6) == attrByPath ["a" "b"] 6 x
+     # and
+     (x.${f p}."example.com" or 6) == attrByPath [ (f p) "example.com" ] 6 x
+     ```
+
      Example:
        x = { a = { b = 3; }; }
        # ["a" "b"] is equivalent to x.a.b
@@ -51,6 +59,14 @@ rec {
 
   /* Return if an attribute from nested attribute set exists.
 
+     Nix has a [has attribute operator `?`](https://nixos.org/manual/nix/stable/language/operators#has-attribute), which is sufficient for such queries, as long as the number of attributes is static. For example:
+
+     ```nix
+     (x?a.b) == hasAttryByPath ["a" "b"] x
+     # and
+     (x?${f p}."example.com") == hasAttryByPath [ (f p) "example.com" ] x
+     ```
+
      **Laws**:
       1.  ```nix
           hasAttrByPath [] x == true
@@ -177,6 +193,14 @@ rec {
   /* Like `attrByPath`, but without a default value. If it doesn't find the
      path it will throw an error.
 
+     Nix has an [attribute selection operator](https://nixos.org/manual/nix/stable/language/operators#attribute-selection) which is sufficient for such queries, as long as the number of attributes is static. For example:
+
+    ```nix
+     x.a.b == getAttrByPath ["a" "b"] x
+     # and
+     x.${f p}."example.com" == getAttrByPath [ (f p) "example.com" ] x
+     ```
+
      Example:
        x = { a = { b = 3; }; }
        getAttrFromPath ["a" "b"] x

From fccb48062fb09cb52837d2e7e4ee008c74011798 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 12 Dec 2023 22:23:04 +0000
Subject: [PATCH 66/89] darwin/make-bootstrap-tools.nix: set
 -headerpad_max_install_names for coreutils

Without the change bootstrapTools build fails as:
https://cache.nixos.org/log/g5wyq9xqshan6m3kl21bjn1z88hx48rh-stdenv-bootstrap-tools.drv

    error: install_name_tool: changing install names or rpaths can't be redone for: /nix/store/0hxg356h7lnl2hck23wrdpbib3cckx41-stdenv-bootstrap-tools/bin/tac (for architecture x86_64) because larger updated load commands do not fit (the program must be relinked, and you may need to use -headerpad or -headerpad_max_install_names)
---
 pkgs/stdenv/darwin/make-bootstrap-tools.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index 1324c78c5fd6..384567739d0e 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -32,11 +32,16 @@ let cross = if crossSystem != null
 in with import pkgspath ({ inherit localSystem overlays; } // cross // custom-bootstrap);
 
 rec {
-  coreutils_ = coreutils.override (args: {
+  coreutils_ = (coreutils.override (args: {
     # We want coreutils without ACL support.
     aclSupport = false;
     # Cannot use a single binary build, or it gets dynamically linked against gmp.
     singleBinary = false;
+  })).overrideAttrs (oa: {
+    # Increase header size to be able to inject extra RPATHs. Otherwise
+    # x86_64-darwin build fails as:
+    #    https://cache.nixos.org/log/g5wyq9xqshan6m3kl21bjn1z88hx48rh-stdenv-bootstrap-tools.drv
+    NIX_LDFLAGS = (oa.NIX_LDFLAGS or "") + " -headerpad_max_install_names";
   });
 
   cctools_ = darwin.cctools;

From 57deeeb161da110fe3050c80fb3935aadaf70760 Mon Sep 17 00:00:00 2001
From: Matt Polzin <mpolzin@workwithopal.com>
Date: Wed, 13 Dec 2023 12:35:10 -0600
Subject: [PATCH 67/89] vimPlugins: update sg-nvim-rust cargo hash to fix
 plugin builds

---
 pkgs/applications/editors/vim/plugins/overrides.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index f034ac4bae1c..e519f4e5268d 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1007,7 +1007,7 @@ self: super: {
         pname = "sg-nvim-rust";
         inherit (old) version src;
 
-        cargoHash = "sha256-ITrjY15Haz8hEztWym4q8YW2h0R8/kOYPaIYJu87sN4=";
+        cargoHash = "sha256-XaCBFAq/T17fz4Zn1OtG9Or3p4UwxXYKr+PTkl+Ho3k=";
 
         nativeBuildInputs = [ pkg-config ];
 

From 9d97cf879ca8f98460526929d1acb0a3c65b262c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Dec 2023 10:48:21 +0000
Subject: [PATCH 68/89] buildkite-agent-metrics: 5.8.0 -> 5.9.2

---
 pkgs/servers/monitoring/buildkite-agent-metrics/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/monitoring/buildkite-agent-metrics/default.nix b/pkgs/servers/monitoring/buildkite-agent-metrics/default.nix
index 10bf273497dd..67a1218d1bd1 100644
--- a/pkgs/servers/monitoring/buildkite-agent-metrics/default.nix
+++ b/pkgs/servers/monitoring/buildkite-agent-metrics/default.nix
@@ -4,7 +4,7 @@
 }:
 buildGoModule rec {
   pname = "buildkite-agent-metrics";
-  version = "5.8.0";
+  version = "5.9.2";
 
   outputs = [ "out" "lambda" ];
 
@@ -12,10 +12,10 @@ buildGoModule rec {
     owner = "buildkite";
     repo = "buildkite-agent-metrics";
     rev = "v${version}";
-    hash = "sha256-QPtjKjUGKlqgklZ0wUOJ1lXuXHhWVC83cEJ4QVtgdl4=";
+    hash = "sha256-JYpsQUIKTlQz1VUmPfTzvgh++0p3NAoa105mvGoqgt8=";
   };
 
-  vendorHash = "sha256-KgTzaF8dFD4VwcuSqmOy2CSfLuA0rjFwtCqGNYHFFlc=";
+  vendorHash = "sha256-2EbZLLaddR7oWXb9H9E35foevp6gMbWfoymDf2lQuto=";
 
   postInstall = ''
     mkdir -p $lambda/bin

From d07f761378be07e6ded8c0adb3fe3cfcb39592ab Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 13 Dec 2023 20:44:41 +0100
Subject: [PATCH 69/89] python311Packages.bellows: 0.37.1 -> 0.37.3

https://github.com/zigpy/bellows/releases/tag/0.37.2
https://github.com/zigpy/bellows/releases/tag/0.37.3
---
 pkgs/development/python-modules/bellows/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 03ebff7aea5f..112c50ca038c 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.37.1";
+  version = "0.37.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-JkaCM9XOdGZE9/C2BUV3g9QL5+k/HlVYd4WsAMS2mgk=";
+    hash = "sha256-WVVOJrQWWC4tuREjSs8bOA0J9Y/y2BLE2s3YysSaBt8=";
   };
 
   postPatch = ''

From 64e61c5b097478df1f8f8303ea9f7959621d51b1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 13 Dec 2023 20:45:06 +0100
Subject: [PATCH 70/89] python311Packages.zigpy: 0.60.0 -> 0.60.1

https://github.com/zigpy/zigpy/releases/tag/0.60.1
---
 pkgs/development/python-modules/zigpy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index 80934e280d40..1185f63e1903 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "0.60.0";
+  version = "0.60.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zigpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-1i92YyOIoWSMDHgfnXiXQuvDnmEPlSHwoSLmmsoTkDU=";
+    hash = "sha256-Ejf/Z9mgyO8y99rmuPPVOleyHWgYzxq3AO3TB8jkmtY=";
   };
 
   postPatch = ''

From 1cc0a8332b3f7928aeda329ba354f294f1d928c2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 13 Dec 2023 20:50:41 +0100
Subject: [PATCH 71/89] python311Packages.zigpy-xbee: 0.20.0 -> 0.20.1

https://github.com/zigpy/zigpy-xbee/releases/tag/0.20.1
---
 pkgs/development/python-modules/zigpy-xbee/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zigpy-xbee/default.nix b/pkgs/development/python-modules/zigpy-xbee/default.nix
index d40e2b17b6cc..848f253243cf 100644
--- a/pkgs/development/python-modules/zigpy-xbee/default.nix
+++ b/pkgs/development/python-modules/zigpy-xbee/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-xbee";
-  version = "0.20.0";
+  version = "0.20.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zigpy-xbee";
     rev = "refs/tags/${version}";
-    hash = "sha256-Ja9U/X9YblS6uUD7MX3t2tItG9AMiNF7OFgvIotdvQs=";
+    hash = "sha256-H0rs4EOzz2Nx5YuwqTZp2FGF1z2phBgSIyraKHHx4RA=";
   };
 
   postPatch = ''

From 1ef6715530f6dc39ddc5ec41fa6bce5cb53e859b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 13 Dec 2023 20:51:20 +0100
Subject: [PATCH 72/89] python311Packages.zigpy-deconz: 0.22.0 -> 0.22.2

https://github.com/zigpy/zigpy-deconz/releases/tag/0.22.2
---
 pkgs/development/python-modules/zigpy-deconz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zigpy-deconz/default.nix b/pkgs/development/python-modules/zigpy-deconz/default.nix
index b5ed6bbd11d0..99cdb83515cf 100644
--- a/pkgs/development/python-modules/zigpy-deconz/default.nix
+++ b/pkgs/development/python-modules/zigpy-deconz/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy-deconz";
-  version = "0.22.0";
+  version = "0.22.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-pdWWI+yZh0uf2TzVbyJFIrxM2zfmaPG/PGZWaNNrZ6M=";
+    hash = "sha256-gkIo56SGqthLq2Ycjl/MqKLJvTxhkm8reUmwVhphxhg=";
   };
 
   postPatch = ''

From 68f4b58fbc5e45973e0bb57ee4fb1e9aa117e8cc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 3 Dec 2023 00:01:55 +0100
Subject: [PATCH 73/89] python311Packages.plugwise: 0.35.1 -> 0.35.3

https://github.com/plugwise/python-plugwise/releases/tag/v0.35.3
---
 pkgs/development/python-modules/plugwise/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 14e77c816b88..9888ef279f47 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.35.1";
+  version = "0.35.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eHJQXLiuWmJo/Eo4B8gEo44rwpPA7ASjxKSmdu6Tv9M=";
+    hash = "sha256-DCG1sKpUUV2/2mVJ2ltCkzCxQxAkDtxzNX6uMSpJhi4=";
   };
 
   propagatedBuildInputs = [

From d375c67fb6f1bf65333b61b9f03a6367d48e2052 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 13 Dec 2023 20:53:12 +0100
Subject: [PATCH 74/89] python311Packages.pyhiveapi: 0.5.15 -> 0.5.16

https://github.com/Pyhass/Pyhiveapi/compare/refs/tags/v0.5.15...v0.5.16
---
 pkgs/development/python-modules/pyhiveapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyhiveapi/default.nix b/pkgs/development/python-modules/pyhiveapi/default.nix
index ec6d51191966..989b1d115d8d 100644
--- a/pkgs/development/python-modules/pyhiveapi/default.nix
+++ b/pkgs/development/python-modules/pyhiveapi/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyhiveapi";
-  version = "0.5.15";
+  version = "0.5.16";
 
   format = "pyproject";
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "Pyhass";
     repo = "Pyhiveapi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tR2PCR1qGn4KnqAjEpcRTcVlMEpKCwn5RAm99AXBSnk=";
+    hash = "sha256-gPou5KGLFEFP29qSpRg+6sCiXOwfoF1gyhBVERYJ1LI=";
   };
 
   postPatch = ''

From 9ec56a870ebed35c3bfd4f208d8e3dbf1aa78d30 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 13 Dec 2023 20:45:40 +0100
Subject: [PATCH 75/89] home-assistant: 2023.12.1 -> 2023.12.2

https://github.com/home-assistant/core/releases/tag/2023.12.2
---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 pkgs/servers/home-assistant/default.nix            | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index f22263d55c0f..b7b7d702cc79 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.12.1";
+  version = "2023.12.2";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 3d76446d3406..55a368af3bb6 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -311,7 +311,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.12.1";
+  hassVersion = "2023.12.2";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -329,13 +329,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-S9o1xhhqiSRan1BXnN0AndFPfLL0KqqH42WKOi3Yl+g=";
+    hash = "sha256-uP4aX8Fo4GopvzpZGKFw99rXxudEgsKfhdeMHhXv47s=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-e9OtUsluYlNBVmQ8u71dF0Q+wDdV8mvmYFdN8syl5rI=";
+    hash = "sha256-1KMTn/iuey/Cug1gq4+54J+ZJTqcU+sW5Zw5tS+DwcQ=";
   };
 
   nativeBuildInputs = with python.pkgs; [

From 9effc00b6b42e77581e1fd71ba2c5cad50a73383 Mon Sep 17 00:00:00 2001
From: Lily Foster <lily@lily.flowers>
Date: Wed, 13 Dec 2023 15:04:12 -0500
Subject: [PATCH 76/89] zigbee2mqtt: pin to nodejs_18 for now

---
 pkgs/servers/zigbee2mqtt/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/zigbee2mqtt/default.nix b/pkgs/servers/zigbee2mqtt/default.nix
index 6b655c63cd86..a215b7d771b8 100644
--- a/pkgs/servers/zigbee2mqtt/default.nix
+++ b/pkgs/servers/zigbee2mqtt/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildNpmPackage
 , fetchFromGitHub
-, python3
+, nodejs_18
 , nixosTests
 , nix-update-script
 }:
@@ -19,9 +19,7 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-MXTKZNERxryt7L42dHxKx7XfXByNQ67oU+4FKTd0u4U=";
 
-  nativeBuildInputs = [
-    python3
-  ];
+  nodejs = nodejs_18;
 
   passthru.tests.zigbee2mqtt = nixosTests.zigbee2mqtt;
   passthru.updateScript = nix-update-script { };

From 18ee0842a5df7adc1ac40dac25e6a74a12103af2 Mon Sep 17 00:00:00 2001
From: Mihai Fufezan <fufexan@protonmail.com>
Date: Tue, 5 Dec 2023 21:37:56 +0200
Subject: [PATCH 77/89] hyprland: 0.32.3 -> 0.33.1

---
 .../hyprwm/hyprland/default.nix               | 11 ++--
 .../hyprwm/hyprland/wlroots.nix               | 54 ++-----------------
 2 files changed, 11 insertions(+), 54 deletions(-)

diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
index 402b35847446..ad8079be63c3 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@@ -28,7 +28,6 @@
 , xcbutilwm
 , xwayland
 , debug ? false
-, enableNvidiaPatches ? false
 , enableXWayland ? true
 , legacyRenderer ? false
 , withSystemd ? true
@@ -36,18 +35,20 @@
   # deprecated flags
 , nvidiaPatches ? false
 , hidpiXWayland ? false
+, enableNvidiaPatches ? false
 }:
-assert lib.assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been renamed `enableNvidiaPatches`";
+assert lib.assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been removed.";
+assert lib.assertMsg (!enableNvidiaPatches) "The option `enableNvidiaPatches` has been removed.";
 assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.32.3";
+  version = "0.33.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8PP26+ybmScq5WpFd2JPqUDzG2VggYOvD6/rzY9/CJ4=";
+    hash = "sha256-p7el5oQZPy9l1zyIrlHu6nA4BAu59eLoSqBjhkw2jaw=";
   };
 
   patches = [
@@ -99,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
       wayland-protocols
       pango
       pciutils
-      (wlroots.override { inherit enableNvidiaPatches; })
+      wlroots
     ]
     ++ lib.optionals stdenv.hostPlatform.isMusl [ libexecinfo ]
     ++ lib.optionals enableXWayland [ libxcb xcbutilwm xwayland ]
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
index 8191582dfb3a..a77526abb508 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
@@ -1,39 +1,9 @@
 { fetchFromGitLab
-, hyprland
 , wlroots
-, lib
 , libdisplay-info
 , libliftoff
 , hwdata
-, enableNvidiaPatches ? false
 }:
-let
-  libdisplay-info-new = libdisplay-info.overrideAttrs (old: {
-    version = "0.1.1+date=2023-03-02";
-    src = fetchFromGitLab {
-      domain = "gitlab.freedesktop.org";
-      owner = "emersion";
-      repo = old.pname;
-      rev = "147d6611a64a6ab04611b923e30efacaca6fc678";
-      sha256 = "sha256-/q79o13Zvu7x02SBGu0W5yQznQ+p7ltZ9L6cMW5t/o4=";
-    };
-  });
-
-  libliftoff-new = libliftoff.overrideAttrs (old: {
-    version = "0.5.0-dev";
-    src = fetchFromGitLab {
-      domain = "gitlab.freedesktop.org";
-      owner = "emersion";
-      repo = old.pname;
-      rev = "d98ae243280074b0ba44bff92215ae8d785658c0";
-      sha256 = "sha256-DjwlS8rXE7srs7A8+tHqXyUsFGtucYSeq6X0T/pVOc8=";
-    };
-
-    NIX_CFLAGS_COMPILE = toString [
-      "-Wno-error=sign-conversion"
-    ];
-  });
-in
 wlroots.overrideAttrs
   (old: {
     version = "0.17.0-dev";
@@ -42,29 +12,15 @@ wlroots.overrideAttrs
       domain = "gitlab.freedesktop.org";
       owner = "wlroots";
       repo = "wlroots";
-      rev = "5de9e1a99d6642c2d09d589aa37ff0a8945dcee1";
-      hash = "sha256-HXu98PyBMKEWLqiTb8viuLDznud/SdkdJsx5A5CWx7I=";
+      rev = "5d639394f3e83b01596dcd166a44a9a1a2583350";
+      hash = "sha256-7kvyoA91etzVEl9mkA/EJfB6z/PltxX7Xc4gcr7/xlo=";
     };
 
-    pname =
-      old.pname
-      + "-hyprland"
-      + lib.optionalString enableNvidiaPatches "-nvidia";
-
-    patches =
-      (old.patches or [ ])
-      ++ (lib.optionals enableNvidiaPatches [
-        "${hyprland.src}/nix/patches/wlroots-nvidia.patch"
-      ]);
-
-    # don't need old.postPatch for hwdata's path in wlroots 0.16
-    postPatch = lib.optionalString enableNvidiaPatches ''
-      substituteInPlace render/gles2/renderer.c --replace "glFlush();" "glFinish();"
-    '';
+    pname = "${old.pname}-hyprland";
 
     buildInputs = old.buildInputs ++ [
       hwdata
-      libdisplay-info-new
-      libliftoff-new
+      libdisplay-info
+      libliftoff
     ];
   })

From 79ddf33f84364fa3b857ac3d06ecce91d8429ba5 Mon Sep 17 00:00:00 2001
From: Mihai Fufezan <fufexan@protonmail.com>
Date: Tue, 5 Dec 2023 21:39:49 +0200
Subject: [PATCH 78/89] nixos/hyprland: remove enableNvidiaPatches option

Hyprland now works on Nvidia without patching.
---
 nixos/modules/programs/hyprland.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/programs/hyprland.nix b/nixos/modules/programs/hyprland.nix
index 166c6cbc5c18..9061ce5da83a 100644
--- a/nixos/modules/programs/hyprland.nix
+++ b/nixos/modules/programs/hyprland.nix
@@ -30,7 +30,6 @@ in
       readOnly = true;
       default = cfg.package.override {
         enableXWayland = cfg.xwayland.enable;
-        enableNvidiaPatches = cfg.enableNvidiaPatches;
       };
       defaultText = literalExpression
         "`programs.hyprland.package` with applied configuration";
@@ -42,8 +41,6 @@ in
     portalPackage = mkPackageOption pkgs "xdg-desktop-portal-hyprland" { };
 
     xwayland.enable = mkEnableOption (mdDoc "XWayland") // { default = true; };
-
-    enableNvidiaPatches = mkEnableOption (mdDoc "patching wlroots for better Nvidia support");
   };
 
   config = mkIf cfg.enable {
@@ -73,9 +70,13 @@ in
       [ "programs" "hyprland" "xwayland" "hidpi" ]
       "XWayland patches are deprecated. Refer to https://wiki.hyprland.org/Configuring/XWayland"
     )
-    (mkRenamedOptionModule
-      [ "programs" "hyprland" "nvidiaPatches" ]
+    (mkRemovedOptionModule
       [ "programs" "hyprland" "enableNvidiaPatches" ]
+      "Nvidia patches are no longer needed"
+    )
+    (mkRemovedOptionModule
+      [ "programs" "hyprland" "nvidiaPatches" ]
+      "Nvidia patches are no longer needed"
     )
   ];
 }

From c73fdc2fdc20093f2fff38100c1e36256058726e Mon Sep 17 00:00:00 2001
From: jopejoe1 <johannes@joens.email>
Date: Wed, 6 Dec 2023 19:17:41 +0100
Subject: [PATCH 79/89] python311Packages.nototools: move out of noto-fonts
 folder

---
 .../python-modules/nototools/default.nix}                       | 0
 pkgs/top-level/python-packages.nix                              | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename pkgs/{data/fonts/noto-fonts/tools.nix => development/python-modules/nototools/default.nix} (100%)

diff --git a/pkgs/data/fonts/noto-fonts/tools.nix b/pkgs/development/python-modules/nototools/default.nix
similarity index 100%
rename from pkgs/data/fonts/noto-fonts/tools.nix
rename to pkgs/development/python-modules/nototools/default.nix
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7cf03fc84e9e..e9f44f729a9e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8374,7 +8374,7 @@ self: super: with self; {
     inherit (pkgs) notmuch;
   };
 
-  nototools = callPackage ../data/fonts/noto-fonts/tools.nix { };
+  nototools = callPackage ../development/python-modules/nototools { };
 
   notus-scanner = callPackage ../development/python-modules/notus-scanner { };
 

From 546c660ff673bb4e95af205fcbdade43a6e9abbe Mon Sep 17 00:00:00 2001
From: jopejoe1 <johannes@joens.email>
Date: Wed, 6 Dec 2023 19:26:04 +0100
Subject: [PATCH 80/89] noto-fonts-emoji-blob-bin: move out of noto-fonts file

---
 .../no/noto-fonts-emoji-blob-bin/package.nix  | 30 +++++++++++++++++
 pkgs/data/fonts/noto-fonts/default.nix        | 32 -------------------
 pkgs/top-level/all-packages.nix               |  1 -
 3 files changed, 30 insertions(+), 33 deletions(-)
 create mode 100644 pkgs/by-name/no/noto-fonts-emoji-blob-bin/package.nix

diff --git a/pkgs/by-name/no/noto-fonts-emoji-blob-bin/package.nix b/pkgs/by-name/no/noto-fonts-emoji-blob-bin/package.nix
new file mode 100644
index 000000000000..311505c3ae48
--- /dev/null
+++ b/pkgs/by-name/no/noto-fonts-emoji-blob-bin/package.nix
@@ -0,0 +1,30 @@
+ { lib
+, stdenvNoCC
+, fetchurl
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "noto-fonts-emoji-blob-bin";
+  version = "15.0";
+
+  src = fetchurl {
+    url = "https://github.com/C1710/blobmoji/releases/download/v${version}/Blobmoji.ttf";
+    hash = "sha256-3MPWZ1A2ups171dNIiFTJ3C1vZiGy6I8ZF70aUfrePk=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm 444 $src $out/share/fonts/blobmoji/Blobmoji.ttf
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Noto Emoji with extended Blob support";
+    homepage = "https://github.com/C1710/blobmoji";
+    license = with lib.licenses; [ ofl asl20 ];
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ rileyinman jk ];
+  };
+}
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index b5a5d26b5122..c947ff886cf7 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -270,36 +270,4 @@ rec {
         sourceProvenance = [ sourceTypes.binaryBytecode ];
       };
     };
-
-  noto-fonts-emoji-blob-bin =
-    let
-      pname = "noto-fonts-emoji-blob-bin";
-      version = "15.0";
-    in
-    stdenvNoCC.mkDerivation {
-      inherit pname version;
-
-      src = fetchurl {
-        url = "https://github.com/C1710/blobmoji/releases/download/v${version}/Blobmoji.ttf";
-        hash = "sha256-3MPWZ1A2ups171dNIiFTJ3C1vZiGy6I8ZF70aUfrePk=";
-      };
-
-      dontUnpack = true;
-
-      installPhase = ''
-        runHook preInstall
-
-        install -Dm 444 $src $out/share/fonts/blobmoji/Blobmoji.ttf
-
-        runHook postInstall
-      '';
-
-      meta = with lib; {
-        description = "Noto Emoji with extended Blob support";
-        homepage = "https://github.com/C1710/blobmoji";
-        license = with licenses; [ ofl asl20 ];
-        platforms = platforms.all;
-        maintainers = with maintainers; [ rileyinman jk ];
-      };
-    };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 124da72781f2..e727de6e4e95 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29754,7 +29754,6 @@ with pkgs;
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif
     noto-fonts-color-emoji
-    noto-fonts-emoji-blob-bin
     noto-fonts-monochrome-emoji
     ;
 

From c34ac183ca5b34670d421ab504b6412c15a0ac9a Mon Sep 17 00:00:00 2001
From: jopejoe1 <johannes@joens.email>
Date: Wed, 6 Dec 2023 19:37:56 +0100
Subject: [PATCH 81/89] noto-fonts-monochrome-emoji: move out of noto-fonts
 file

---
 .../noto-emoji.hashes.json                    |  0
 .../noto-emoji.json                           |  0
 .../noto-emoji.py                             |  0
 .../noto-fonts-monochrome-emoji/package.nix   | 53 +++++++++++++++++++
 pkgs/data/fonts/noto-fonts/default.nix        | 46 ----------------
 pkgs/top-level/all-packages.nix               |  1 -
 6 files changed, 53 insertions(+), 47 deletions(-)
 rename pkgs/{data/fonts/noto-fonts => by-name/no/noto-fonts-monochrome-emoji}/noto-emoji.hashes.json (100%)
 rename pkgs/{data/fonts/noto-fonts => by-name/no/noto-fonts-monochrome-emoji}/noto-emoji.json (100%)
 rename pkgs/{data/fonts/noto-fonts => by-name/no/noto-fonts-monochrome-emoji}/noto-emoji.py (100%)
 create mode 100644 pkgs/by-name/no/noto-fonts-monochrome-emoji/package.nix

diff --git a/pkgs/data/fonts/noto-fonts/noto-emoji.hashes.json b/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.hashes.json
similarity index 100%
rename from pkgs/data/fonts/noto-fonts/noto-emoji.hashes.json
rename to pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.hashes.json
diff --git a/pkgs/data/fonts/noto-fonts/noto-emoji.json b/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.json
similarity index 100%
rename from pkgs/data/fonts/noto-fonts/noto-emoji.json
rename to pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.json
diff --git a/pkgs/data/fonts/noto-fonts/noto-emoji.py b/pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.py
similarity index 100%
rename from pkgs/data/fonts/noto-fonts/noto-emoji.py
rename to pkgs/by-name/no/noto-fonts-monochrome-emoji/noto-emoji.py
diff --git a/pkgs/by-name/no/noto-fonts-monochrome-emoji/package.nix b/pkgs/by-name/no/noto-fonts-monochrome-emoji/package.nix
new file mode 100644
index 000000000000..08f78b613efc
--- /dev/null
+++ b/pkgs/by-name/no/noto-fonts-monochrome-emoji/package.nix
@@ -0,0 +1,53 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+}:
+
+# Metadata fetched from
+#  https://www.googleapis.com/webfonts/v1/webfonts?key=${GOOGLE_FONTS_TOKEN}&family=Noto+Emoji
+let
+  metadata = with builtins; head (fromJSON (readFile ./noto-emoji.json)).items;
+  urlHashes = with builtins; fromJSON (readFile ./noto-emoji.hashes.json);
+in
+stdenvNoCC.mkDerivation {
+  pname = "noto-fonts-monochrome-emoji";
+  version = "${lib.removePrefix "v" metadata.version}.${metadata.lastModified}";
+  preferLocalBuild = true;
+
+  dontUnpack = true;
+  srcs =
+    let
+      weightNames = {
+        "300" = "Light";
+        regular = "Regular";
+        "500" = "Medium";
+        "600" = "SemiBold";
+        "700" = "Bold";
+      };
+    in
+    lib.mapAttrsToList
+      (variant: url: fetchurl {
+        name = "NotoEmoji-${weightNames.${variant}}.ttf";
+        hash = urlHashes.${url};
+        inherit url;
+      })
+      metadata.files;
+
+  installPhase = ''
+    runHook preInstall
+    for src in $srcs; do
+      install -D $src $out/share/fonts/noto/$(stripHash $src)
+    done
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Monochrome emoji font";
+    homepage = "https://fonts.google.com/noto/specimen/Noto+Emoji";
+    license = [ lib.licenses.ofl ];
+    maintainers = [ lib.maintainers.nicoo ];
+
+    platforms = lib.platforms.all;
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+  };
+}
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index c947ff886cf7..59ce84dedf3a 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -224,50 +224,4 @@ rec {
         maintainers = with maintainers; [ mathnerd314 sternenseemann ];
       };
     };
-
-  noto-fonts-monochrome-emoji =
-    # Metadata fetched from
-    #  https://www.googleapis.com/webfonts/v1/webfonts?key=${GOOGLE_FONTS_TOKEN}&family=Noto+Emoji
-    let metadata = with builtins; head (fromJSON (readFile ./noto-emoji.json)).items;
-        urlHashes = with builtins; fromJSON (readFile ./noto-emoji.hashes.json);
-
-    in
-    stdenvNoCC.mkDerivation {
-      pname = "noto-fonts-monochrome-emoji";
-      version = "${lib.removePrefix "v" metadata.version}.${metadata.lastModified}";
-      preferLocalBuild = true;
-
-      dontUnpack = true;
-      srcs = let
-        weightNames = {
-          "300"   = "Light";
-          regular = "Regular";
-          "500"   = "Medium";
-          "600"   = "SemiBold";
-          "700"   = "Bold";
-        };
-      in lib.mapAttrsToList
-        (variant: url: fetchurl { name = "NotoEmoji-${weightNames.${variant}}.ttf";
-                                  hash = urlHashes.${url};
-                                  inherit url; } )
-        metadata.files;
-
-      installPhase = ''
-        runHook preInstall
-        for src in $srcs; do
-          install -D $src $out/share/fonts/noto/$(stripHash $src)
-        done
-        runHook postInstall
-      '';
-
-      meta = with lib; {
-        description = "Monochrome emoji font";
-        homepage = "https://fonts.google.com/noto/specimen/Noto+Emoji";
-        license = [ licenses.ofl ];
-        maintainers = [ maintainers.nicoo ];
-
-        platforms = platforms.all;
-        sourceProvenance = [ sourceTypes.binaryBytecode ];
-      };
-    };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e727de6e4e95..aea5ce5e828e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29754,7 +29754,6 @@ with pkgs;
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif
     noto-fonts-color-emoji
-    noto-fonts-monochrome-emoji
     ;
 
   nuclear = callPackage ../applications/audio/nuclear { };

From 9fbcecc83f7fdc806874d80aef8859d661d4bac4 Mon Sep 17 00:00:00 2001
From: jopejoe1 <johannes@joens.email>
Date: Wed, 6 Dec 2023 19:42:41 +0100
Subject: [PATCH 82/89] noto-fonts-color-emoji: move out of noto-fonts file

---
 .../no/noto-fonts-color-emoji/package.nix     | 69 +++++++++++++++++++
 pkgs/data/fonts/noto-fonts/default.nix        | 61 ----------------
 pkgs/top-level/all-packages.nix               |  1 -
 3 files changed, 69 insertions(+), 62 deletions(-)
 create mode 100644 pkgs/by-name/no/noto-fonts-color-emoji/package.nix

diff --git a/pkgs/by-name/no/noto-fonts-color-emoji/package.nix b/pkgs/by-name/no/noto-fonts-color-emoji/package.nix
new file mode 100644
index 000000000000..37f56db62df1
--- /dev/null
+++ b/pkgs/by-name/no/noto-fonts-color-emoji/package.nix
@@ -0,0 +1,69 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, buildPackages
+, pkg-config
+, cairo
+, imagemagick
+, zopfli
+, pngquant
+, which
+}:
+
+let
+  emojiPythonEnv =
+    buildPackages.python3.withPackages (p: with p; [ fonttools nototools ]);
+in
+stdenvNoCC.mkDerivation rec {
+  pname = "noto-fonts-color-emoji";
+  version = "2.042";
+
+  src = fetchFromGitHub {
+    owner = "googlefonts";
+    repo = "noto-emoji";
+    rev = "v${version}";
+    hash = "sha256-otJQMXrBIPrxD1vCdgcrZ2h1a9XAMbqEBFumjz1XJ54=";
+  };
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+    pkg-config
+    cairo
+  ];
+
+  nativeBuildInputs = [
+    imagemagick
+    zopfli
+    pngquant
+    which
+    emojiPythonEnv
+  ];
+
+  postPatch = ''
+    patchShebangs *.py
+    patchShebangs third_party/color_emoji/*.py
+    # remove check for virtualenv, since we handle
+    # python requirements using python.withPackages
+    sed -i '/ifndef VIRTUAL_ENV/,+2d' Makefile
+    # Make the build verbose so it won't get culled by Hydra thinking that
+    # it somehow got stuck doing nothing.
+    sed -i 's;\t@;\t;' Makefile
+  '';
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/fonts/noto
+    cp NotoColorEmoji.ttf $out/share/fonts/noto
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Color emoji font";
+    homepage = "https://github.com/googlefonts/noto-emoji";
+    license = with lib.licenses; [ ofl asl20 ];
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ mathnerd314 sternenseemann ];
+  };
+}
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index 59ce84dedf3a..caf3134387b4 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -163,65 +163,4 @@ rec {
     version = "2.002";
     sha256 = "sha256-GLjpTAiHfygj1J4AdUVDJh8kykkFOglq+h4kyat5W9s=";
   };
-
-  noto-fonts-color-emoji =
-    let
-      version = "2.042";
-      emojiPythonEnv =
-        buildPackages.python3.withPackages (p: with p; [ fonttools nototools ]);
-    in
-    stdenvNoCC.mkDerivation {
-      pname = "noto-fonts-emoji";
-      inherit version;
-
-      src = fetchFromGitHub {
-        owner = "googlefonts";
-        repo = "noto-emoji";
-        rev = "v${version}";
-        hash = "sha256-otJQMXrBIPrxD1vCdgcrZ2h1a9XAMbqEBFumjz1XJ54=";
-      };
-
-      depsBuildBuild = [
-        buildPackages.stdenv.cc
-        pkg-config
-        cairo
-      ];
-
-      nativeBuildInputs = [
-        imagemagick
-        zopfli
-        pngquant
-        which
-        emojiPythonEnv
-      ];
-
-      postPatch = ''
-        patchShebangs *.py
-        patchShebangs third_party/color_emoji/*.py
-        # remove check for virtualenv, since we handle
-        # python requirements using python.withPackages
-        sed -i '/ifndef VIRTUAL_ENV/,+2d' Makefile
-
-        # Make the build verbose so it won't get culled by Hydra thinking that
-        # it somehow got stuck doing nothing.
-        sed -i 's;\t@;\t;' Makefile
-      '';
-
-      enableParallelBuilding = true;
-
-      installPhase = ''
-        runHook preInstall
-        mkdir -p $out/share/fonts/noto
-        cp NotoColorEmoji.ttf $out/share/fonts/noto
-        runHook postInstall
-      '';
-
-      meta = with lib; {
-        description = "Color emoji font";
-        homepage = "https://github.com/googlefonts/noto-emoji";
-        license = with licenses; [ ofl asl20 ];
-        platforms = platforms.all;
-        maintainers = with maintainers; [ mathnerd314 sternenseemann ];
-      };
-    };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index aea5ce5e828e..b753f9e67f07 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29753,7 +29753,6 @@ with pkgs;
     noto-fonts-lgc-plus
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif
-    noto-fonts-color-emoji
     ;
 
   nuclear = callPackage ../applications/audio/nuclear { };

From 73aa85d1152f4143269245f0c2929a679c1028f2 Mon Sep 17 00:00:00 2001
From: jopejoe1 <johannes@joens.email>
Date: Wed, 6 Dec 2023 19:46:12 +0100
Subject: [PATCH 83/89] noto-fonts: move out of noto-fonts file

---
 pkgs/by-name/no/noto-fonts/package.nix | 73 +++++++++++++++++++
 pkgs/data/fonts/noto-fonts/default.nix | 97 --------------------------
 pkgs/top-level/all-packages.nix        | 20 +++++-
 3 files changed, 90 insertions(+), 100 deletions(-)
 create mode 100644 pkgs/by-name/no/noto-fonts/package.nix

diff --git a/pkgs/by-name/no/noto-fonts/package.nix b/pkgs/by-name/no/noto-fonts/package.nix
new file mode 100644
index 000000000000..4f8606095e02
--- /dev/null
+++ b/pkgs/by-name/no/noto-fonts/package.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gitUpdater
+, variants ? [ ]
+, suffix ? ""
+, longDescription ? ''
+    When text is rendered by a computer, sometimes characters are
+    displayed as “tofu”. They are little boxes to indicate your device
+    doesn’t have a font to display the text.
+    Google has been developing a font family called Noto, which aims to
+    support all languages with a harmonious look and feel. Noto is
+    Google’s answer to tofu. The name noto is to convey the idea that
+    Google’s goal is to see “no more tofu”.  Noto has multiple styles and
+    weights, and freely available to all.
+  ''
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "noto-fonts${suffix}";
+  version = "23.11.1";
+
+  src = fetchFromGitHub {
+    owner = "notofonts";
+    repo = "notofonts.github.io";
+    rev = "noto-monthly-release-${version}";
+    hash = "sha256-qBHLCOfVBOn9CV194S4cYw9nhHyAe2AUBJHQMvyEfW8=";
+  };
+
+  _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
+
+  installPhase = ''
+    # We check availability in order of variable -> otf -> ttf
+    # unhinted -- the hinted versions use autohint
+    # maintaining maximum coverage.
+    #
+    # We have a mix of otf and ttf fonts
+    local out_font=$out/share/fonts/noto
+  '' + (if _variants == [ ] then ''
+    for folder in $(ls -d fonts/*/); do
+      if [[ -d "$folder"unhinted/variable-ttf ]]; then
+        install -m444 -Dt $out_font "$folder"unhinted/variable-ttf/*.ttf
+      elif [[ -d "$folder"unhinted/otf ]]; then
+        install -m444 -Dt $out_font "$folder"unhinted/otf/*.otf
+      else
+        install -m444 -Dt $out_font "$folder"unhinted/ttf/*.ttf
+      fi
+    done
+  '' else ''
+    for variant in $_variants; do
+      if [[ -d fonts/"$variant"/unhinted/variable-ttf ]]; then
+        install -m444 -Dt $out_font fonts/"$variant"/unhinted/variable-ttf/*.ttf
+      elif [[ -d fonts/"$variant"/unhinted/otf ]]; then
+        install -m444 -Dt $out_font fonts/"$variant"/unhinted/otf/*.otf
+      else
+        install -m444 -Dt $out_font fonts/"$variant"/unhinted/ttf/*.ttf
+      fi
+    done
+  '');
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "noto-monthly-release-";
+  };
+
+  meta = {
+    description = "Beautiful and free fonts for many languages";
+    homepage = "https://www.google.com/get/noto/";
+    inherit longDescription;
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ mathnerd314 emily jopejoe1 ];
+  };
+}
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index caf3134387b4..ff926279d69f 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -14,81 +14,7 @@
 , buildPackages
 , variants ? [ ]
 }:
-let
-  notoLongDescription = ''
-    When text is rendered by a computer, sometimes characters are
-    displayed as “tofu”. They are little boxes to indicate your device
-    doesn’t have a font to display the text.
-
-    Google has been developing a font family called Noto, which aims to
-    support all languages with a harmonious look and feel. Noto is
-    Google’s answer to tofu. The name noto is to convey the idea that
-    Google’s goal is to see “no more tofu”.  Noto has multiple styles and
-    weights, and freely available to all.
-  '';
-in
 rec {
-  mkNoto =
-    { pname
-    , variants ? [ ]
-    , longDescription ? notoLongDescription
-    }:
-    stdenvNoCC.mkDerivation rec {
-      inherit pname;
-      version = "23.11.1";
-
-      src = fetchFromGitHub {
-        owner = "notofonts";
-        repo = "notofonts.github.io";
-        rev = "noto-monthly-release-${version}";
-        hash = "sha256-qBHLCOfVBOn9CV194S4cYw9nhHyAe2AUBJHQMvyEfW8=";
-      };
-
-      _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
-
-      installPhase = ''
-        # We check availability in order of variable -> otf -> ttf
-        # unhinted -- the hinted versions use autohint
-        # maintaining maximum coverage.
-        #
-        # We have a mix of otf and ttf fonts
-        local out_font=$out/share/fonts/noto
-      '' + (if _variants == [ ] then ''
-        for folder in $(ls -d fonts/*/); do
-          if [[ -d "$folder"unhinted/variable-ttf ]]; then
-            install -m444 -Dt $out_font "$folder"unhinted/variable-ttf/*.ttf
-          elif [[ -d "$folder"unhinted/otf ]]; then
-            install -m444 -Dt $out_font "$folder"unhinted/otf/*.otf
-          else
-            install -m444 -Dt $out_font "$folder"unhinted/ttf/*.ttf
-          fi
-        done
-      '' else ''
-        for variant in $_variants; do
-          if [[ -d fonts/"$variant"/unhinted/variable-ttf ]]; then
-            install -m444 -Dt $out_font fonts/"$variant"/unhinted/variable-ttf/*.ttf
-          elif [[ -d fonts/"$variant"/unhinted/otf ]]; then
-            install -m444 -Dt $out_font fonts/"$variant"/unhinted/otf/*.otf
-          else
-            install -m444 -Dt $out_font fonts/"$variant"/unhinted/ttf/*.ttf
-          fi
-        done
-      '');
-
-      passthru.updateScript = gitUpdater {
-        rev-prefix = "noto-monthly-release-";
-      };
-
-      meta = with lib; {
-        description = "Beautiful and free fonts for many languages";
-        homepage = "https://www.google.com/get/noto/";
-        inherit longDescription;
-        license = licenses.ofl;
-        platforms = platforms.all;
-        maintainers = with maintainers; [ mathnerd314 emily jopejoe1 ];
-      };
-    };
-
   mkNotoCJK = { typeface, version, sha256 }:
     stdenvNoCC.mkDerivation {
       pname = "noto-fonts-cjk-${lib.toLower typeface}";
@@ -129,29 +55,6 @@ rec {
       };
     };
 
-  noto-fonts = mkNoto {
-    pname = "noto-fonts";
-  };
-
-  noto-fonts-lgc-plus = mkNoto {
-    pname = "noto-fonts-lgc-plus";
-    variants = [
-      "Noto Sans"
-      "Noto Serif"
-      "Noto Sans Mono"
-      "Noto Music"
-      "Noto Sans Symbols"
-      "Noto Sans Symbols 2"
-      "Noto Sans Math"
-    ];
-    longDescription = ''
-      This package provides the Noto Fonts, but only for latin, greek
-      and cyrillic scripts, as well as some extra fonts. To create a
-      custom Noto package with custom variants, see the `mkNoto`
-      helper function.
-    '';
-  };
-
   noto-fonts-cjk-sans = mkNotoCJK {
     typeface = "Sans";
     version = "2.004";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b753f9e67f07..6c3b48fc561e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29748,13 +29748,27 @@ with pkgs;
   nordzy-icon-theme = callPackage ../data/icons/nordzy-icon-theme { };
 
   inherit (callPackages ../data/fonts/noto-fonts {})
-    mkNoto
-    noto-fonts
-    noto-fonts-lgc-plus
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif
     ;
 
+  noto-fonts-lgc-plus = callPackage ../by-name/no/noto-fonts/package.nix {
+    suffix = "-lgc-plus";
+    variants = [
+      "Noto Sans"
+      "Noto Serif"
+      "Noto Sans Mono"
+      "Noto Music"
+      "Noto Sans Symbols"
+      "Noto Sans Symbols 2"
+      "Noto Sans Math"
+    ];
+    longDescription = ''
+      This package provides the Noto Fonts, but only for latin, greek
+      and cyrillic scripts, as well as some extra fonts.
+    '';
+  };
+
   nuclear = callPackage ../applications/audio/nuclear { };
 
   nuclei = callPackage ../tools/security/nuclei { };

From b81aeb09ae5ce9a2572b1ee2a9982e81add1a1bc Mon Sep 17 00:00:00 2001
From: jopejoe1 <johannes@joens.email>
Date: Wed, 6 Dec 2023 19:49:45 +0100
Subject: [PATCH 84/89] noto-fonts-cjk-sans: move out of noto-fonts file

---
 .../no/noto-fonts-cjk-sans/package.nix        | 49 +++++++++++++++++++
 pkgs/data/fonts/noto-fonts/default.nix        |  6 ---
 pkgs/top-level/all-packages.nix               |  1 -
 3 files changed, 49 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/by-name/no/noto-fonts-cjk-sans/package.nix

diff --git a/pkgs/by-name/no/noto-fonts-cjk-sans/package.nix b/pkgs/by-name/no/noto-fonts-cjk-sans/package.nix
new file mode 100644
index 000000000000..5c7ab7684b62
--- /dev/null
+++ b/pkgs/by-name/no/noto-fonts-cjk-sans/package.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, nixosTests
+, gitUpdater
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "noto-fonts-cjk-sans";
+  version = "2.004";
+
+  src = fetchFromGitHub {
+    owner = "notofonts";
+    repo = "noto-cjk";
+    rev = "Sans${version}";
+    hash = "sha256-IgalJkiOAVjNxKaPAQWfb5hKeqclliR4qVXCq63FGWY=";
+    sparseCheckout = [ "Sans/Variable/OTC" ];
+  };
+
+  installPhase = ''
+    install -m444 -Dt $out/share/fonts/opentype/noto-cjk Sans/Variable/OTC/*.otf.ttc
+  '';
+
+  passthru.tests.noto-fonts = nixosTests.noto-fonts;
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "Sans";
+  };
+
+  meta = {
+    description = "Beautiful and free fonts for CJK languages";
+    homepage = "https://www.google.com/get/noto/help/cjk/";
+    longDescription = ''
+      Noto Sans CJK is a sans typeface designed as
+      an intermediate style between the modern and traditional. It is
+      intended to be a multi-purpose digital font for user interface
+      designs, digital content, reading on laptops, mobile devices, and
+      electronic books. Noto Sans CJK comprehensively covers
+      Simplified Chinese, Traditional Chinese, Japanese, and Korean in a
+      unified font family. It supports regional variants of ideographic
+      characters for each of the four languages. In addition, it supports
+      Japanese kana, vertical forms, and variant characters (itaiji); it
+      supports Korean hangeul — both contemporary and archaic.
+    '';
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ mathnerd314 emily ];
+  };
+}
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index ff926279d69f..ebf4970de30b 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -55,12 +55,6 @@ rec {
       };
     };
 
-  noto-fonts-cjk-sans = mkNotoCJK {
-    typeface = "Sans";
-    version = "2.004";
-    sha256 = "sha256-IgalJkiOAVjNxKaPAQWfb5hKeqclliR4qVXCq63FGWY=";
-  };
-
   noto-fonts-cjk-serif = mkNotoCJK {
     typeface = "Serif";
     version = "2.002";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6c3b48fc561e..e6a20fd916fd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29748,7 +29748,6 @@ with pkgs;
   nordzy-icon-theme = callPackage ../data/icons/nordzy-icon-theme { };
 
   inherit (callPackages ../data/fonts/noto-fonts {})
-    noto-fonts-cjk-sans
     noto-fonts-cjk-serif
     ;
 

From e9b49cdba86d8532856987ec846d16a16ecf44b2 Mon Sep 17 00:00:00 2001
From: jopejoe1 <johannes@joens.email>
Date: Wed, 6 Dec 2023 19:51:42 +0100
Subject: [PATCH 85/89] noto-fonts-cjk-serif: move out of noto-fonts file

---
 .../no/noto-fonts-cjk-serif/package.nix       | 49 +++++++++++++++
 pkgs/data/fonts/noto-fonts/default.nix        | 63 -------------------
 pkgs/top-level/all-packages.nix               |  4 --
 3 files changed, 49 insertions(+), 67 deletions(-)
 create mode 100644 pkgs/by-name/no/noto-fonts-cjk-serif/package.nix
 delete mode 100644 pkgs/data/fonts/noto-fonts/default.nix

diff --git a/pkgs/by-name/no/noto-fonts-cjk-serif/package.nix b/pkgs/by-name/no/noto-fonts-cjk-serif/package.nix
new file mode 100644
index 000000000000..d9fddcc684c4
--- /dev/null
+++ b/pkgs/by-name/no/noto-fonts-cjk-serif/package.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, nixosTests
+, gitUpdater
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "noto-fonts-cjk-serif";
+  version = "2.002";
+
+  src = fetchFromGitHub {
+    owner = "notofonts";
+    repo = "noto-cjk";
+    rev = "Serif${version}";
+    hash = "sha256-GLjpTAiHfygj1J4AdUVDJh8kykkFOglq+h4kyat5W9s=";
+    sparseCheckout = [ "Serif/Variable/OTC" ];
+  };
+
+  installPhase = ''
+    install -m444 -Dt $out/share/fonts/opentype/noto-cjk Serif/Variable/OTC/*.otf.ttc
+  '';
+
+  passthru.tests.noto-fonts = nixosTests.noto-fonts;
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "Serif";
+  };
+
+  meta = with lib; {
+    description = "Beautiful and free fonts for CJK languages";
+    homepage = "https://www.google.com/get/noto/help/cjk/";
+    longDescription = ''
+      Noto Serif CJK is a serif typeface designed as
+      an intermediate style between the modern and traditional. It is
+      intended to be a multi-purpose digital font for user interface
+      designs, digital content, reading on laptops, mobile devices, and
+      electronic books. Noto Serif CJK comprehensively covers
+      Simplified Chinese, Traditional Chinese, Japanese, and Korean in a
+      unified font family. It supports regional variants of ideographic
+      characters for each of the four languages. In addition, it supports
+      Japanese kana, vertical forms, and variant characters (itaiji); it
+      supports Korean hangeul — both contemporary and archaic.
+    '';
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ mathnerd314 emily ];
+  };
+}
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
deleted file mode 100644
index ebf4970de30b..000000000000
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{ stdenv
-, stdenvNoCC
-, lib
-, gitUpdater
-, fetchFromGitHub
-, fetchurl
-, cairo
-, nixosTests
-, pkg-config
-, pngquant
-, which
-, imagemagick
-, zopfli
-, buildPackages
-, variants ? [ ]
-}:
-rec {
-  mkNotoCJK = { typeface, version, sha256 }:
-    stdenvNoCC.mkDerivation {
-      pname = "noto-fonts-cjk-${lib.toLower typeface}";
-      inherit version;
-
-      src = fetchFromGitHub {
-        owner = "googlefonts";
-        repo = "noto-cjk";
-        rev = "${typeface}${version}";
-        inherit sha256;
-        sparseCheckout = [ "${typeface}/Variable/OTC" ];
-      };
-
-      installPhase = ''
-        install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/Variable/OTC/*.otf.ttc
-      '';
-
-      passthru.tests.noto-fonts = nixosTests.noto-fonts;
-
-      meta = with lib; {
-        description = "Beautiful and free fonts for CJK languages";
-        homepage = "https://www.google.com/get/noto/help/cjk/";
-        longDescription = ''
-          Noto ${typeface} CJK is a ${lib.toLower typeface} typeface designed as
-          an intermediate style between the modern and traditional. It is
-          intended to be a multi-purpose digital font for user interface
-          designs, digital content, reading on laptops, mobile devices, and
-          electronic books. Noto ${typeface} CJK comprehensively covers
-          Simplified Chinese, Traditional Chinese, Japanese, and Korean in a
-          unified font family. It supports regional variants of ideographic
-          characters for each of the four languages. In addition, it supports
-          Japanese kana, vertical forms, and variant characters (itaiji); it
-          supports Korean hangeul — both contemporary and archaic.
-        '';
-        license = licenses.ofl;
-        platforms = platforms.all;
-        maintainers = with maintainers; [ mathnerd314 emily ];
-      };
-    };
-
-  noto-fonts-cjk-serif = mkNotoCJK {
-    typeface = "Serif";
-    version = "2.002";
-    sha256 = "sha256-GLjpTAiHfygj1J4AdUVDJh8kykkFOglq+h4kyat5W9s=";
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e6a20fd916fd..a664e60613ef 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29747,10 +29747,6 @@ with pkgs;
 
   nordzy-icon-theme = callPackage ../data/icons/nordzy-icon-theme { };
 
-  inherit (callPackages ../data/fonts/noto-fonts {})
-    noto-fonts-cjk-serif
-    ;
-
   noto-fonts-lgc-plus = callPackage ../by-name/no/noto-fonts/package.nix {
     suffix = "-lgc-plus";
     variants = [

From dc92ffa69cd5278bc68b3469b48d350db8355cfa Mon Sep 17 00:00:00 2001
From: Cole Mickens <cole.mickens@gmail.com>
Date: Tue, 28 Nov 2023 18:16:53 -0600
Subject: [PATCH 86/89] process-compose: 0.69.0 -> 0.77.4

---
 pkgs/applications/misc/process-compose/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
index 25ff9aed3b74..a7c37aeb964b 100644
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "0.69.0";
+  version = "0.77.4";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YVNcr8oYEOsy0KLOsPdWTZcXYTqyz4RYG9MCEngLn7c=";
+    hash = "sha256-uouF43SokBD+LCMqSDWJ3pj2LznfJYJoUkoTQ1TyYyI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -43,7 +43,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  vendorHash = "sha256-lU21nRfIi4/eobnHhX/fCWnWtoiQBiWvTUOjBL0I4X4=";
+  vendorHash = "sha256-0On/Rg8c9g45qbLuwhP/ZIGosu0X1uzXfAoddgTCDkg=";
 
   doCheck = false;
 

From ca53524eb16c08389557faae45ce1c8b4ab38b0a Mon Sep 17 00:00:00 2001
From: mangoiv <mail@mangoiv.com>
Date: Wed, 13 Dec 2023 23:17:49 +0100
Subject: [PATCH 87/89] haskell.packagse.ghc96.cborg-json remove unnecessary
 jailbreak

cborg-json 0.2.5.0 was jailbroken on ghc9.6.x due to invalid bounds,
this has been fixed upstream
---
 pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
index 803e34163f9d..7fce340d5c56 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
@@ -119,7 +119,6 @@ self: super: {
   # Forbids base >= 4.18, fix proposed: https://github.com/sjakobi/newtype-generics/pull/25
   newtype-generics = jailbreakForCurrentVersion super.newtype-generics "0.6.2";
 
-  cborg-json = jailbreakForCurrentVersion super.cborg-json "0.2.5.0";
   serialise = jailbreakForCurrentVersion super.serialise "0.2.6.0";
 
   #

From 49ebc3878e9ec7848d77d75450f8c78233aa898a Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Wed, 13 Dec 2023 14:50:03 -0800
Subject: [PATCH 88/89] nixos/nebula: tests: revert wait_for_unit

---
 nixos/tests/nebula.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/nixos/tests/nebula.nix b/nixos/tests/nebula.nix
index 1bece2200f23..89b91d89fcb3 100644
--- a/nixos/tests/nebula.nix
+++ b/nixos/tests/nebula.nix
@@ -144,7 +144,6 @@ in
 
     restartAndCheckNebula = name: ip: ''
       ${name}.systemctl("restart nebula@smoke.service")
-      ${name}.wait_for_unit("nebula@smoke.service")
       ${name}.succeed("ping -c5 ${ip}")
     '';
 
@@ -180,8 +179,6 @@ in
       ${nodeB}.succeed("iptables -I INPUT -s " + node_a + " -j DROP")
       ${nodeA}.systemctl("restart nebula@smoke.service")
       ${nodeB}.systemctl("restart nebula@smoke.service")
-      ${nodeA}.wait_for_unit("nebula@smoke.service")
-      ${nodeB}.wait_for_unit("nebula@smoke.service")
     '';
     allowTrafficBetween = nodeA: nodeB: ''
       node_a = ${getPublicIp nodeA}
@@ -190,8 +187,6 @@ in
       ${nodeB}.succeed("iptables -D INPUT -s " + node_a + " -j DROP")
       ${nodeA}.systemctl("restart nebula@smoke.service")
       ${nodeB}.systemctl("restart nebula@smoke.service")
-      ${nodeA}.wait_for_unit("nebula@smoke.service")
-      ${nodeB}.wait_for_unit("nebula@smoke.service")
     '';
   in ''
     # Create the certificate and sign the lighthouse's keys.

From 18a19d8dd2f92d2220296023f11246d16aa4ad8c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Dec 2023 13:21:40 +0000
Subject: [PATCH 89/89] cargo-mobile2: 0.7.0 -> 0.9.0

---
 pkgs/development/tools/rust/cargo-mobile2/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-mobile2/default.nix b/pkgs/development/tools/rust/cargo-mobile2/default.nix
index 3564862e19fc..b29c7bb64fb1 100644
--- a/pkgs/development/tools/rust/cargo-mobile2/default.nix
+++ b/pkgs/development/tools/rust/cargo-mobile2/default.nix
@@ -12,7 +12,7 @@
 let
   inherit (darwin.apple_sdk.frameworks) CoreServices;
   pname = "cargo-mobile2";
-  version = "0.7.0";
+  version = "0.9.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -20,14 +20,14 @@ rustPlatform.buildRustPackage {
     owner = "tauri-apps";
     repo = pname;
     rev = "cargo-mobile2-v${version}";
-    hash = "sha256-aJPiPhDbu7Nwnd65kPMxeULrcjdSu0EF34ma3n/NTYI=";
+    hash = "sha256-zLArfCUgBWx/xrcjvyhQbSxjH0JKI3JhoDVRX2/kBnQ=";
   };
 
   # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
   # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
   # sourceRoot = "${src.name}/tooling/cli";
 
-  cargoHash = "sha256-Inc+PWJO+PM99YYwQEG1J0/17RkLauraFVzO2CO15rQ=";
+  cargoHash = "sha256-13iCSd2BQ4fEeXSOfDBVgnzFSl1fUAPrbZZJ3qx7oHc=";
 
   preBuild = ''
     mkdir -p $out/share/