Merge pull request #250778 from NixOS/staging-next

staging-next 2023-08-22
2023-08-27 20:22:51 +03:00 · 2023-08-27 20:22:51 +03:00 · f900e733c1
commit f900e733c1
parent 6ddd81bf11 a7533453d9
303 changed files with 2787 additions and 1164 deletions
--- a/doc/hooks/waf.section.md
+++ b/doc/hooks/waf.section.md
@ -1,3 +1,50 @@
 # wafHook {#wafhook}

-Overrides the configure, build, and install phases. This will run the “waf” script used by many projects. If `wafPath` (default `./waf`) doesn’t exist, it will copy the version of waf available in Nixpkgs. `wafFlags` can be used to pass flags to the waf script.
+[Waf](https://waf.io) is a Python-based software building system.
+
+In Nixpkgs, `wafHook` overrides the default configure, build, and install phases.
+
+## Variables controlling wafHook {#variablesControllingWafHook}
+
+### `wafPath` {#wafPath}
+
+Location of the `waf` tool. It defaults to `./waf`, to honor software projects that include it directly inside their source trees.
+
+If `wafPath` doesn't exist, then `wafHook` will copy the `waf` provided from Nixpkgs to it.
+
+### `wafConfigureFlags` {#wafConfigureFlags}
+
+Controls the flags passed to waf tool during configure phase.
+
+### `wafFlags` {#wafFlags}
+
+Controls the flags passed to waf tool during build and install phases.
+
+### `dontAddWafCrossFlags` {#dontAddWafCrossFlags}
+
+When set to `true`, don't add cross compilation flags during configure phase.
+
+### `dontUseWafConfigure` {#dontUseWafConfigure}
+
+When set to true, don't use the predefined `wafConfigurePhase`.
+
+### `dontUseWafBuild` {#dontUseWafBuild}
+
+When set to true, don't use the predefined `wafBuildPhase`.
+
+### `dontUseWafInstall` {#dontUseWafInstall}
+
+When set to true, don't use the predefined `wafInstallPhase`.
+
+### Variables honored by wafHook {#variablesHonoredByWafHook}
+
+The following variables commonly used by `stdenv.mkDerivation` are also honored by `wafHook`.
+
+- `prefixKey`
+- `configureTargets`
+- `enableParallelBuilding`
+- `enableParallelInstalling`
+- `buildFlags`
+- `buildTargets`
+- `installFlags`
+- `installTargets`
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -207,6 +207,8 @@ The module update takes care of the new config syntax and the data itself (user

 - `services.prometheus.exporters` has a new exporter to monitor electrical power consumption based on PowercapRAPL sensor called [Scaphandre](https://github.com/hubblo-org/scaphandre), see [#239803](https://github.com/NixOS/nixpkgs/pull/239803) for more details.

+- The MariaDB C client library was upgraded from 3.2.x to 3.3.x. It is recomended to review the [upstream release notes](https://mariadb.com/kb/en/mariadb-connector-c-33-release-notes/).
+
 - The module `services.calibre-server` has new options to configure the `host`, `port`, `auth.enable`, `auth.mode` and `auth.userDb` path, see [#216497](https://github.com/NixOS/nixpkgs/pull/216497/) for more details.

 - `services.prometheus.exporters` has a new [exporter](https://github.com/hipages/php-fpm_exporter) to monitor PHP-FPM processes, see [#240394](https://github.com/NixOS/nixpkgs/pull/240394) for more details.
--- a/pkgs/applications/audio/losslessaudiochecker/default.nix
+++ b/pkgs/applications/audio/losslessaudiochecker/default.nix
@ -11,7 +11,7 @@ stdenv.mkDerivation {

  nativeBuildInputs = [ autoPatchelfHook ];

-  setSourceRoot = "sourceRoot=$PWD";
+  sourceRoot = ".";

  dontBuild = true;

--- a/pkgs/applications/audio/sony-headphones-client/default.nix
+++ b/pkgs/applications/audio/sony-headphones-client/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake pkg-config copyDesktopItems ];
  buildInputs = [ bluez dbus glew glfw imgui ];

-  sourceRoot = "./${src.name}/Client";
+  sourceRoot = "${src.name}/Client";

  cmakeFlags = [ "-Wno-dev" ];

--- a/pkgs/applications/editors/howl/default.nix
+++ b/pkgs/applications/editors/howl/default.nix
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    sha256 = "1qc58l3rkr37cj6vhf8c7bnwbz93nscyraz7jxqwjq6k4gj0cjw3";
  };

-  sourceRoot = "./howl-${version}/src";
+  sourceRoot = "howl-${version}/src";

  # The Makefile uses "/usr/local" if not explicitly overridden
  installFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/applications/editors/molsketch/default.nix
+++ b/pkgs/applications/editors/molsketch/default.nix
@ -3,11 +3,11 @@
 , fetchurl
 , cmake
 , pkg-config
+, qttools
 , wrapQtAppsHook
 , hicolor-icon-theme
 , openbabel
 , desktop-file-utils
-, qttranslations
 }:

 mkDerivation rec {
@ -37,12 +37,11 @@ mkDerivation rec {
    mv $out/lib/molsketch/* $out/lib
  '';

-  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
+  nativeBuildInputs = [ cmake pkg-config qttools wrapQtAppsHook ];
  buildInputs = [
    hicolor-icon-theme
    openbabel
    desktop-file-utils
-    qttranslations
  ];

  meta = with lib; {
--- a/pkgs/applications/emulators/pcsx2/default.nix
+++ b/pkgs/applications/emulators/pcsx2/default.nix
@ -18,7 +18,6 @@
 , qtbase
 , qtsvg
 , qttools
-, qttranslations
 , qtwayland
 , rapidyaml
 , SDL2
@ -83,7 +82,6 @@ llvmPackages_16.stdenv.mkDerivation rec {
    qtbase
    qtsvg
    qttools
-    qttranslations
    qtwayland
    rapidyaml
    SDL2
--- a/pkgs/applications/emulators/yuzu/generic.nix
+++ b/pkgs/applications/emulators/yuzu/generic.nix
@ -110,7 +110,7 @@ in stdenv.mkDerivation {
  # This changes `ir/opt` to `ir/var/empty` in `externals/dynarmic/src/dynarmic/CMakeLists.txt`
  # making the build fail, as that path does not exist
  dontFixCmake = true;
-  patches = [./vulkan_version.patch];
+
  cmakeFlags = [
    # actually has a noticeable performance impact
    "-DYUZU_ENABLE_LTO=ON"
--- a/pkgs/applications/emulators/yuzu/vulkan_version.patch
+++ b/pkgs/applications/emulators/yuzu/vulkan_version.patch
@ -1,13 +0,0 @@
-Yuzu requires a version of Vulkan that has not yet been released as a stable Vulkan SDK. In case this patch fails, check which version Yuzu is currently using and verify that it still works with the version shipped in Nixpkgs.
-
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -314,7 +314,7 @@
- find_package(zstd 1.5 REQUIRED)
- 
- if (NOT YUZU_USE_EXTERNAL_VULKAN_HEADERS)
-    find_package(Vulkan 1.3.256 REQUIRED)
-+    find_package(Vulkan 1.3.250 REQUIRED)
- endif()
- 
- if (ENABLE_LIBUSB)
--- a/pkgs/applications/gis/openorienteering-mapper/default.nix
+++ b/pkgs/applications/gis/openorienteering-mapper/default.nix
@ -14,8 +14,6 @@
 , qtlocation
 , qtsensors
 , qttools
-, qttranslations
-, substituteAll
 , zlib
 }:

@ -31,11 +29,6 @@ mkDerivation rec {
  };

  patches = [
-    # https://github.com/NixOS/nixpkgs/issues/86054
-    (substituteAll {
-      src = ./fix-qttranslations-path.diff;
-      inherit qttranslations;
-    })
    # https://github.com/OpenOrienteering/mapper/pull/1907
    (fetchpatch {
      url = "https://github.com/OpenOrienteering/mapper/commit/bc52aa567e90a58d6963b44d5ae1909f3f841508.patch";
--- a/pkgs/applications/gis/openorienteering-mapper/fix-qttranslations-path.diff
+++ b/pkgs/applications/gis/openorienteering-mapper/fix-qttranslations-path.diff
@ -1,13 +0,0 @@
-diff --git i/src/util/translation_util.cpp w/src/util/translation_util.cpp
-index da03d216..c1f12751 100644
--- i/src/util/translation_util.cpp
-+++ w/src/util/translation_util.cpp
-@@ -103,7 +103,7 @@ TranslationUtil::TranslationUtil(const QString& code, QString translation_file)
- 	}
- 	
- 	QString translation_name = QLatin1String("qt_") + language.code;
-	if (!qt_translator.load(translation_name, QLibraryInfo::location(QLibraryInfo::TranslationsPath)))
-+	if (!qt_translator.load(translation_name, QLatin1String("@qttranslations@/translations")))
- 		load(qt_translator, translation_name);
- 	
- 	load(app_translator, translation_file);
--- a/pkgs/applications/gis/qmapshack/default.nix
+++ b/pkgs/applications/gis/qmapshack/default.nix
@ -1,5 +1,5 @@
-{ lib, stdenv, fetchFromGitHub, cmake, substituteAll, wrapQtAppsHook
-, qtscript, qttranslations, qtwebengine, gdal, proj, routino, quazip }:
+{ lib, stdenv, fetchFromGitHub, cmake, wrapQtAppsHook
+, qtscript, qtwebengine, gdal, proj, routino, quazip }:

 stdenv.mkDerivation rec {
  pname = "qmapshack";
@ -12,14 +12,6 @@ stdenv.mkDerivation rec {
    hash = "sha256-qG/fiR2J5wQZaR+xvBGjdp3L7viqki2ktkzBUf6fZi8=";
  };

-  patches = [
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    (substituteAll {
-      src = ./fix-qttranslations-path.patch;
-      inherit qttranslations;
-    })
-  ];
-
  nativeBuildInputs = [ cmake wrapQtAppsHook ];

  buildInputs = [ qtscript qtwebengine gdal proj routino quazip ];
--- a/pkgs/applications/gis/qmapshack/fix-qttranslations-path.patch
+++ b/pkgs/applications/gis/qmapshack/fix-qttranslations-path.patch
@ -1,74 +0,0 @@
-diff --git i/src/qmapshack/setup/CAppSetupLinux.cpp w/src/qmapshack/setup/CAppSetupLinux.cpp
-index 7581ef32..26eba3c8 100644
--- i/src/qmapshack/setup/CAppSetupLinux.cpp
-+++ w/src/qmapshack/setup/CAppSetupLinux.cpp
-@@ -30,7 +30,7 @@ void CAppSetupLinux::initQMapShack() {
-   prepareGdal("", "");
- 
-   // setup translators
-  QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
-+  QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
-   QString translationPath = QCoreApplication::applicationDirPath();
-   translationPath.replace(QRegExp("bin$"), "share/qmapshack/translations");
-   prepareTranslator(resourceDir, "qt_");
-diff --git i/src/qmapshack/setup/CAppSetupMac.cpp w/src/qmapshack/setup/CAppSetupMac.cpp
-index 37602802..ae4a5a23 100644
--- i/src/qmapshack/setup/CAppSetupMac.cpp
-+++ w/src/qmapshack/setup/CAppSetupMac.cpp
-@@ -56,7 +56,7 @@ void CAppSetupMac::initQMapShack() {
- 
-   // setup translators
-   QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
-  prepareTranslator(translationPath, "qt_");
-+  prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
-   prepareTranslator(translationPath, "qmapshack_");
- 
-   // load and apply style sheet
-diff --git i/src/qmaptool/setup/CAppSetupLinux.cpp w/src/qmaptool/setup/CAppSetupLinux.cpp
-index b703e7bb..637d653e 100644
--- i/src/qmaptool/setup/CAppSetupLinux.cpp
-+++ w/src/qmaptool/setup/CAppSetupLinux.cpp
-@@ -29,7 +29,7 @@ void CAppSetupLinux::initQMapTool() {
-   prepareGdal("", "");
- 
-   // setup translators
-  QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
-+  QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
-   QString translationPath = QCoreApplication::applicationDirPath();
-   translationPath.replace(QRegExp("bin$"), "share/qmaptool/translations");
-   prepareTranslator(resourceDir, "qt_");
-diff --git i/src/qmaptool/setup/CAppSetupMac.cpp w/src/qmaptool/setup/CAppSetupMac.cpp
-index dd68b9c1..84351cf4 100644
--- i/src/qmaptool/setup/CAppSetupMac.cpp
-+++ w/src/qmaptool/setup/CAppSetupMac.cpp
-@@ -57,7 +57,7 @@ void CAppSetupMac::initQMapTool() {
- 
-   // setup translators
-   QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
-  prepareTranslator(translationPath, "qt_");
-+  prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
-   prepareTranslator(translationPath, "qmaptool_");
- 
-   migrateDirContent(defaultCachePath());
-diff --git i/src/qmt_rgb2pct/main.cpp w/src/qmt_rgb2pct/main.cpp
-index 589d3d52..5f7c12f8 100644
--- i/src/qmt_rgb2pct/main.cpp
-+++ w/src/qmt_rgb2pct/main.cpp
-@@ -47,7 +47,7 @@ static void prepareTranslator(QString translationPath, QString translationPrefix
- static void loadTranslations() {
- #if defined(Q_OS_LINUX) || defined(Q_OS_FREEBSD) || defined(__FreeBSD_kernel__) || defined(__GNU__) || \
-     defined(Q_OS_CYGWIN)
-  QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
-+  QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
-   QString translationPath = QCoreApplication::applicationDirPath();
-   translationPath.replace(QRegExp("bin$"), "share/" APP_STR "/translations");
-   prepareTranslator(resourceDir, "qt_");
-@@ -58,7 +58,7 @@ static void loadTranslations() {
-   // os x
-   static QString relTranslationDir = "Resources/translations";  // app
-   QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
-  prepareTranslator(translationPath, "qt_");
-+  prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
-   prepareTranslator(translationPath, APP_STR "_");
- #endif
- 
--- a/pkgs/applications/misc/ausweisapp2/default.nix
+++ b/pkgs/applications/misc/ausweisapp2/default.nix
@ -14,6 +14,12 @@ mkDerivation rec {

  nativeBuildInputs = [ cmake pkg-config ];

+  # The build scripts copy the entire translations directory from Qt
+  # which ends up being read-only because it's in the store.
+  preBuild = ''
+    chmod +w resources/translations
+  '';
+
  buildInputs = [ qtsvg qttools qtwebsockets qtquickcontrols2 qtgraphicaleffects pcsclite ];

  meta = with lib; {
--- a/pkgs/applications/misc/birdtray/default.nix
+++ b/pkgs/applications/misc/birdtray/default.nix
@ -7,7 +7,6 @@
  , qtbase
  , qttools
  , qtx11extras
-  , qttranslations
 }:

 mkDerivation rec {
@ -21,21 +20,11 @@ mkDerivation rec {
    sha256 = "1469ng6zk0qx0qfsihrnlz1j9i1wk0hx4vqdaplz9mdpyxvmlryk";
  };

-  patches = [
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    ./fix-qttranslations-path.diff
-  ];
-
  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [
    qtbase qttools qtx11extras
  ];

-  postPatch = ''
-    substituteInPlace src/birdtrayapp.cpp \
-      --subst-var-by qttranslations ${qttranslations}
-  '';
-
  # Wayland support is broken.
  # https://github.com/gyunaev/birdtray/issues/113#issuecomment-621742315
  qtWrapperArgs = [ "--set QT_QPA_PLATFORM xcb" ];
--- a/pkgs/applications/misc/birdtray/fix-qttranslations-path.diff
+++ b/pkgs/applications/misc/birdtray/fix-qttranslations-path.diff
@ -1,13 +0,0 @@
-diff --git a/src/birdtrayapp.cpp b/src/birdtrayapp.cpp
-index 847b4d3..3a3709a 100644
--- a/src/birdtrayapp.cpp
-+++ b/src/birdtrayapp.cpp
-@@ -130,7 +130,7 @@ bool BirdtrayApp::loadTranslations() {
-             [](QString path) { return path.append("/translations"); });
-     QLocale locale = QLocale::system();
-     bool success = loadTranslation(
-            qtTranslator, locale, "qt", {QLibraryInfo::location(QLibraryInfo::TranslationsPath)});
-+            qtTranslator, locale, "qt", {QLatin1String("@qttranslations@/translations")});
-     success &= loadTranslation(dynamicTranslator, locale, "dynamic", locations);
-     success &= loadTranslation(mainTranslator, locale, "main", locations);
-     return success;
--- a/pkgs/applications/misc/crow-translate/default.nix
+++ b/pkgs/applications/misc/crow-translate/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchzip
-, substituteAll
 , cmake
 , extra-cmake-modules
 , qttools
@ -10,7 +9,6 @@
 , tesseract4
 , qtmultimedia
 , qtx11extras
-, qttranslations
 , wrapQtAppsHook
 , gst_all_1
 , testers
@ -26,14 +24,6 @@ stdenv.mkDerivation rec {
    hash = "sha256-PvfruCqmTBFLWLeIL9NV6+H2AifXcY97ImHzD1zEs28=";
  };

-  patches = [
-    (substituteAll {
-      # See https://github.com/NixOS/nixpkgs/issues/86054
-      src = ./fix-qttranslations-path.patch;
-      inherit qttranslations;
-    })
-  ];
-
  postPatch = ''
    substituteInPlace data/io.crow_translate.CrowTranslate.desktop \
      --replace "Exec=qdbus" "Exec=${lib.getBin qttools}/bin/qdbus"
--- a/pkgs/applications/misc/crow-translate/fix-qttranslations-path.patch
+++ b/pkgs/applications/misc/crow-translate/fix-qttranslations-path.patch
@ -1,13 +0,0 @@
-diff --git i/src/settings/appsettings.cpp w/src/settings/appsettings.cpp
-index 32cabfb..aab92ea 100644
--- i/src/settings/appsettings.cpp
-+++ w/src/settings/appsettings.cpp
-@@ -79,7 +79,7 @@ void AppSettings::applyLocale(const QLocale &locale)
-     const QLocale newLocale = locale == defaultLocale() ? QLocale::system() : locale;
-     QLocale::setDefault(newLocale);
-     s_appTranslator.load(newLocale, QStringLiteral(PROJECT_NAME), QStringLiteral("_"), QStandardPaths::locate(QStandardPaths::AppDataLocation, i18nDir, QStandardPaths::LocateDirectory));
-    s_qtTranslator.load(newLocale, QStringLiteral("qt"), QStringLiteral("_"), QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    s_qtTranslator.load(newLocale, QStringLiteral("qt"), QStringLiteral("_"), QLatin1String("@qttranslations@/translations"));
- }
- 
- QLocale AppSettings::defaultLocale()
--- a/pkgs/applications/misc/edgetx/default.nix
+++ b/pkgs/applications/misc/edgetx/default.nix
@ -1,6 +1,6 @@
 { lib, mkDerivation, fetchFromGitHub
 , cmake, gcc-arm-embedded, python3Packages
-, qtbase, qtmultimedia, qttranslations, SDL, gtest
+, qtbase, qtmultimedia, qttools, SDL, gtest
 , dfu-util
 }:

@ -16,9 +16,9 @@ mkDerivation rec {
    sha256 = "sha256-bKMAyONy1Udd+2nDVEMrtIsnfqrNuBVMWU7nCqvZ+3E=";
  };

-  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow ];
+  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow qttools ];

-  buildInputs = [ qtbase qtmultimedia qttranslations SDL ];
+  buildInputs = [ qtbase qtmultimedia SDL ];

  postPatch = ''
    sed -i companion/src/burnconfigdialog.cpp \
@ -27,7 +27,6 @@ mkDerivation rec {

  cmakeFlags = [
    "-DGTEST_ROOT=${gtest.src}/googletest"
-    "-DQT_TRANSLATIONS_DIR=${qttranslations}/translations"
    "-DDFU_UTIL_PATH=${dfu-util}/bin/dfu-util"
    # file RPATH_CHANGE could not write new RPATH
    "-DCMAKE_SKIP_BUILD_RPATH=ON"
--- a/pkgs/applications/misc/etesync-dav/default.nix
+++ b/pkgs/applications/misc/etesync-dav/default.nix
@ -16,6 +16,17 @@ let
          inherit version;
          hash = "sha256-4RIMIoyi9VO0cN9KX6knq2YlhGdSYGmYGz6wqRkCaH0=";
        };
+
+        patches = [
+          # Pulling in this patch lets us continue running tests without any
+          # other changes using setuptools >= 67.5.0.
+          (fetchpatch {
+            name = "remove-deprecated-pkg-resources.patch";
+            url = "https://github.com/pallets/flask/commit/751d85f3de3f726446bb12e4ddfae885a6645ba1.patch";
+            hash = "sha256-T4vKSSe3P0xtb2/iQjm0RH2Bwk1ZHWiPoX1Ycr63EqU=";
+            includes = [ "src/flask/cli.py" ];
+          })
+        ];
      });
      flask-wtf = super.flask-wtf.overridePythonAttrs (old: rec {
        version = "0.15.1";
--- a/pkgs/applications/misc/gpsbabel/default.nix
+++ b/pkgs/applications/misc/gpsbabel/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, pkg-config, which
-, qtbase, qmake, qttools, qttranslations, wrapQtAppsHook
+, qmake, qttools, wrapQtAppsHook
 , libusb1, shapelib, zlib
 , withGUI ? false, qtserialport
 , withMapPreview ? (!stdenv.isDarwin), qtwebengine
@ -21,11 +21,6 @@ stdenv.mkDerivation rec {

  postPatch = ''
    patchShebangs testo
-  '' + lib.optionalString withGUI ''
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    substituteInPlace gui/mainwindow.cc \
-      --replace 'QLibraryInfo::location(QLibraryInfo::TranslationsPath)' \
-                'QLatin1String("${qttranslations}/translations")'
  '' + lib.optionalString withDoc ''
    substituteInPlace gbversion.h.qmake.in \
      --replace /usr/share/doc $doc/share/doc
--- a/pkgs/applications/misc/gpxlab/default.nix
+++ b/pkgs/applications/misc/gpxlab/default.nix
@ -1,5 +1,5 @@
-{ stdenv, mkDerivation, lib, fetchFromGitHub, substituteAll
-, qmake, qttools, qttranslations
+{ stdenv, mkDerivation, lib, fetchFromGitHub
+, qmake, qttools
 }:

 mkDerivation rec {
@ -13,12 +13,6 @@ mkDerivation rec {
    sha256 = "080vnwcciqblfrbfyz9gjhl2lqw1hkdpbgr5qfrlyglkd4ynjd84";
  };

-  patches = (substituteAll {
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.patch;
-    inherit qttranslations;
-  });
-
  nativeBuildInputs = [ qmake qttools ];

  preConfigure = ''
--- a/pkgs/applications/misc/gpxlab/fix-qttranslations-path.patch
+++ b/pkgs/applications/misc/gpxlab/fix-qttranslations-path.patch
@ -1,17 +0,0 @@
-diff --git i/GPXLab/main.cpp w/GPXLab/main.cpp
-index b12d2dd..58d37c5 100644
--- i/GPXLab/main.cpp
-+++ w/GPXLab/main.cpp
-@@ -19,10 +19,10 @@ int main(int argc, char *argv[])
-     app.installTranslator(&gpxlab);
- 
-     QTranslator qt;
-#if defined(Q_OS_WIN32) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN32)
-     qt.load(QLocale::system(), "qt", "_", TRANSLATIONS_DIR);
- #else
-    qt.load(QLocale::system(), "qt", "_", QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    qt.load(QLocale::system(), "qt", "_", QLatin1String("@qttranslations@/translations"));
- #endif
-     app.installTranslator(&qt);
- 
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@ -3,10 +3,8 @@
 , fetchFromGitHub
 , qmake
 , nix-update-script
-, substituteAll
 , qtbase
 , qttools
-, qttranslations
 , qtlocation ? null # qt5 only
 , qtpositioning ? null # qt6 only
 , qtpbfimageplugin
@ -31,12 +29,6 @@ stdenv.mkDerivation rec {
    hash = "sha256-Zf2eyDx5QK69W6HNz/IGGHkX2qCDnxYsU8KLCgU9teY=";
  };

-  patches = (substituteAll {
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.diff;
-    inherit qttranslations;
-  });
-
  buildInputs = [ qtpbfimageplugin qtserialport ]
    ++ (if isQt6 then [
    qtbase
--- a/pkgs/applications/misc/gpxsee/fix-qttranslations-path.diff
+++ b/pkgs/applications/misc/gpxsee/fix-qttranslations-path.diff
@ -1,18 +0,0 @@
-diff --git i/src/GUI/app.cpp w/src/GUI/app.cpp
-index 37e9d3f..d4a065c 100644
--- i/src/GUI/app.cpp
-+++ w/src/GUI/app.cpp
-@@ -35,11 +35,10 @@ App::App(int &argc, char **argv) : QApplication(argc, argv)
- 		installTranslator(gpxsee);
- 
- 	QTranslator *qt = new QTranslator(this);
-#if defined(Q_OS_WIN32) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN32)
- 	if (qt->load(QLocale::system(), "qt", "_", ProgramPaths::translationsDir()))
- #else // Q_OS_WIN32 || Q_OS_MAC
-	if (qt->load(QLocale::system(), "qt", "_", QLibraryInfo::location(
-	  QLibraryInfo::TranslationsPath)))
-+	if (qt->load(QLocale::system(), "qt", "_", QLatin1String("@qttranslations@/translations")))
- #endif // Q_OS_WIN32 || Q_OS_MAC
- 		installTranslator(qt);
- 
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ libmediainfo wxGTK32 desktop-file-utils libSM imagemagick ]
    ++ lib.optionals stdenv.isDarwin [ Cocoa ];

-  sourceRoot = "./MediaInfo/Project/GNU/GUI/";
+  sourceRoot = "MediaInfo/Project/GNU/GUI";

  enableParallelBuilding = true;

--- a/pkgs/applications/misc/mediainfo/default.nix
+++ b/pkgs/applications/misc/mediainfo/default.nix
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ autoreconfHook pkg-config ];
  buildInputs = [ libzen libmediainfo zlib ];

-  sourceRoot = "./MediaInfo/Project/GNU/CLI/";
+  sourceRoot = "MediaInfo/Project/GNU/CLI";

  configureFlags = [ "--with-libmediainfo=${libmediainfo}" ];

--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@ -5,7 +5,6 @@
 , qmake
 , qttools
 , wrapQtAppsHook
-, qttranslations
 , gdal
 , proj
 , qtsvg
@ -48,7 +47,6 @@ stdenv.mkDerivation rec {
  '';

  qmakeFlags = [
-    "TRANSDIR_SYSTEM=${qttranslations}/translations"
    "USEWEBENGINE=1"
  ] ++ lib.optional withGeoimage "GEOIMAGE=1"
    ++ lib.optional withGpsdlib "GPSDLIB=1"
--- a/pkgs/applications/misc/mupdf/0001-Use-command-v-in-favor-of-which.patch
+++ b/pkgs/applications/misc/mupdf/0001-Use-command-v-in-favor-of-which.patch
@ -1,25 +1,13 @@
-From b2935ed7e2962d73f3b493c38c0bb1e8659c0a60 Mon Sep 17 00:00:00 2001
-From: toonn <toonn@toonn.io>
-Date: Tue, 8 Mar 2022 23:59:19 +0100
-Subject: [PATCH 1/2] Use command -v in favor of which
+Use command -v in favor of which

---
- Makerules | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Makerules b/Makerules
-index 0fdaecb..6d52cca 100644
 --- a/Makerules
 +++ b/Makerules
-@@ -145,7 +145,7 @@ else ifeq ($(OS),MACOS)
-   LD = xcrun ld
-   RANLIB = xcrun ranlib
- 
-  ifeq (, $(shell which pkg-config))
-+  ifeq (, $(shell command -v pkg-config))
+@@ -170,7 +170,7 @@
+   ifneq ($(ARCHFLAGS),)
+     $(warning "MacOS with ARCHFLAGS set. Assuming we are building for arm64, and setting HAVE_LIBCRYPTO to no.")
+     HAVE_LIBCRYPTO := no
+-  else ifeq (, $(shell which pkg-config))
+  else ifeq (, $(shell command -v pkg-config))
     $(warning "No pkg-config found, install it for proper integration of libcrypto")
   else
     HAVE_LIBCRYPTO := $(shell pkg-config --exists 'libcrypto >= 1.1.0' && echo yes)
-- 
-2.17.2 (Apple Git-113)
-
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@ -27,6 +27,7 @@
 , freeglut
 , libGLU
 , xcbuild
+, gitUpdater

 # for passthru.tests
 , cups-filters
@ -52,12 +53,12 @@ let

 in
 stdenv.mkDerivation rec {
-  version = "1.22.1";
+  version = "1.23.0";
  pname = "mupdf";

  src = fetchurl {
    url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "sha256-1i88DkVuu8QucfWkfw+M0SzsK/Co1yt541+jWmU4slo=";
+    sha256 = "sha256-3kFAaS5pMULDEeAwrBVuOO4XXXq2wb4QxcmuljhGFk4=";
  };

  patches = [ ./0001-Use-command-v-in-favor-of-which.patch
@ -151,14 +152,22 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  passthru.tests = {
-    inherit cups-filters zathura;
-    inherit (python3.pkgs) pikepdf pymupdf;
+  passthru = {
+    tests = {
+      inherit cups-filters zathura;
+      inherit (python3.pkgs) pikepdf pymupdf;
+    };
+
+    updateScript = gitUpdater {
+      url = "https://git.ghostscript.com/mupdf.git";
+      ignoredVersions = ".rc.*";
+    };
  };

  meta = with lib; {
    homepage = "https://mupdf.com";
    description = "Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C";
+    changelog = "https://git.ghostscript.com/?p=mupdf.git;a=blob_plain;f=CHANGES;hb=${version}";
    license = licenses.agpl3Plus;
    maintainers = with maintainers; [ vrthra fpletz ];
    platforms = platforms.unix;
--- a/pkgs/applications/misc/opentx/default.nix
+++ b/pkgs/applications/misc/opentx/default.nix
@ -1,6 +1,6 @@
 { lib, mkDerivation, fetchFromGitHub
 , cmake, gcc-arm-embedded, python3Packages
-, qtbase, qtmultimedia, qttranslations, SDL, gtest
+, qtbase, qtmultimedia, qttools, SDL, gtest
 , dfu-util, avrdude
 }:

@ -15,9 +15,9 @@ mkDerivation rec {
    sha256 = "sha256-F3zykJhKuIpLQSTjn7mcdjEmgRAlwCZpkTaKQR9ve3g=";
  };

-  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow ];
+  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow qttools ];

-  buildInputs = [ qtbase qtmultimedia qttranslations SDL ];
+  buildInputs = [ qtbase qtmultimedia SDL ];

  postPatch = ''
    sed -i companion/src/burnconfigdialog.cpp \
@ -27,7 +27,6 @@ mkDerivation rec {

  cmakeFlags = [
    "-DGTEST_ROOT=${gtest.src}/googletest"
-    "-DQT_TRANSLATIONS_DIR=${qttranslations}/translations"
    # XXX I would prefer to include these here, though we will need to file a bug upstream to get that changed.
    #"-DDFU_UTIL_PATH=${dfu-util}/bin/dfu-util"
    #"-DAVRDUDE_PATH=${avrdude}/bin/avrdude"
--- a/pkgs/applications/misc/ubpm/default.nix
+++ b/pkgs/applications/misc/ubpm/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitea, qmake, qttools, qtbase, qtserialport
-, qtconnectivity, qtcharts, qttranslations, wrapQtAppsHook }:
+, qtconnectivity, qtcharts, wrapQtAppsHook }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "ubpm";
@ -15,7 +15,6 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    substituteInPlace sources/mainapp/mainapp.pro \
-      --replace '$$[QT_INSTALL_TRANSLATIONS]' '${qttranslations}/translations' \
      --replace 'INSTALLDIR = /tmp/ubpm.AppDir' "INSTALLDIR = $out" \
      --replace '/usr/bin' '/bin' \
      --replace 'INSTALLS += target translations themes devices help lin' 'INSTALLS += target translations themes devices help'
@ -40,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
  # *.so plugins are being wrapped automatically which breaks them
  dontWrapQtApps = true;

-  buildInputs = [ qtbase qtserialport qtconnectivity qtcharts qttranslations ];
+  buildInputs = [ qtbase qtserialport qtconnectivity qtcharts ];

  meta = with lib; {
    homepage = "https://codeberg.org/LazyT/ubpm";
--- a/pkgs/applications/misc/valentina/default.nix
+++ b/pkgs/applications/misc/valentina/default.nix
@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitLab, substituteAll, installShellFiles
+{ lib, stdenv, fetchFromGitLab, installShellFiles
 , qmake, qttools
-, qtsvg, qttranslations, qtxmlpatterns
+, qtsvg, qtxmlpatterns
 , wrapQtAppsHook
 }:

@ -15,12 +15,6 @@ stdenv.mkDerivation rec {
    hash = "sha256-N9fC2tCP4TVNncatHaz5W5Mp3jOmAcEWYCl30+0myaE=";
  };

-  patches = (substituteAll {
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.patch;
-    inherit qttranslations;
-  });
-
  postPatch = ''
    substituteInPlace src/app/translations.pri \
      --replace '$$[QT_INSTALL_BINS]/$$LRELEASE' '${lib.getDev qttools}/bin/lrelease'
--- a/pkgs/applications/misc/valentina/fix-qttranslations-path.patch
+++ b/pkgs/applications/misc/valentina/fix-qttranslations-path.patch
@ -1,37 +0,0 @@
-diff --git i/src/libs/vmisc/vabstractapplication.cpp w/src/libs/vmisc/vabstractapplication.cpp
-index b64817bab..5f9aa3518 100644
--- i/src/libs/vmisc/vabstractapplication.cpp
-+++ w/src/libs/vmisc/vabstractapplication.cpp
-@@ -221,26 +221,26 @@ void VAbstractApplication::LoadTranslation(const QString &locale)
-     ClearTranslation();
- 
-     qtTranslator = new QTranslator(this);
-#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN)
-     qtTranslator->load("qt_" + locale, translationsPath(locale));
- #else
-    qtTranslator->load("qt_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    qtTranslator->load("qt_" + locale, QLatin1String("@qttranslations@/translations"));
- #endif
-     installTranslator(qtTranslator);
- 
-     qtxmlTranslator = new QTranslator(this);
-#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN)
-     qtxmlTranslator->load("qtxmlpatterns_" + locale, translationsPath(locale));
- #else
-    qtxmlTranslator->load("qtxmlpatterns_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    qtxmlTranslator->load("qtxmlpatterns_" + locale, QLatin1String("@qttranslations@/translations"));
- #endif
-     installTranslator(qtxmlTranslator);
- 
-     qtBaseTranslator = new QTranslator(this);
-#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
-+#if defined(Q_OS_WIN)
-     qtBaseTranslator->load("qtbase_" + locale, translationsPath(locale));
- #else
-    qtBaseTranslator->load("qtbase_" + locale, QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+    qtBaseTranslator->load("qtbase_" + locale, QLatin1String("@qttranslations@/translations"));
- #endif
-     installTranslator(qtBaseTranslator);
- 
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@ -12,7 +12,7 @@
 , mkDerivation
 , qtgraphicaleffects
 , qtquickcontrols2
-, qttranslations
+, qttools
 }:

 # How to update Linphone? (The Qt desktop app)
@ -73,11 +73,11 @@ mkDerivation rec {
    minizip-ng
    qtgraphicaleffects
    qtquickcontrols2
-    qttranslations
  ];

  nativeBuildInputs = [
    cmake
+    qttools
  ];

  cmakeFlags = [
--- a/pkgs/applications/networking/instant-messengers/qtox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qtox/default.nix
@ -12,7 +12,6 @@
 , qtbase
 , qtsvg
 , qttools
-, qttranslations
 , ffmpeg
 , filter-audio
 , libexif
@ -44,7 +43,6 @@ mkDerivation rec {
    libXScrnSaver
    qtbase
    qtsvg
-    qttranslations
    ffmpeg
    filter-audio
    libexif
--- a/pkgs/applications/networking/mailreaders/trojita/default.nix
+++ b/pkgs/applications/networking/mailreaders/trojita/default.nix
@ -16,8 +16,6 @@
 , qtkeychain
 , qttools
 , qtwebkit
-, qttranslations
-, substituteAll
 , withI18n ? false
 }:

@ -39,12 +37,6 @@ in mkDerivation rec {
    sha256 = "sha256-15G9YjT3qBKbeOKfb/IgXOO+DaJaTULP9NJn/MFYZS8=";
  };

-  patches = (substituteAll {
-    # See https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.patch;
-    inherit qttranslations;
-  });
-
  buildInputs = [
    akonadi-contacts
    gpgme
--- a/pkgs/applications/networking/mailreaders/trojita/fix-qttranslations-path.patch
+++ b/pkgs/applications/networking/mailreaders/trojita/fix-qttranslations-path.patch
@ -1,13 +0,0 @@
-diff --git i/src/Gui/main.cpp w/src/Gui/main.cpp
-index 851db4f1..e997f46e 100644
--- i/src/Gui/main.cpp
-+++ w/src/Gui/main.cpp
-@@ -52,7 +52,7 @@ int main(int argc, char **argv)
- 
-     QTranslator qtTranslator;
-     qtTranslator.load(QLatin1String("qt_") + QLocale::system().name(),
-                      QLibraryInfo::location(QLibraryInfo::TranslationsPath));
-+                      QLatin1String("@qttranslations@/translations"));
-     app.installTranslator(&qtTranslator);
- 
-     QLatin1String localeSuffix("/locale");
--- a/pkgs/applications/office/PageEdit/default.nix
+++ b/pkgs/applications/office/PageEdit/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, qtsvg, qtwebengine, qttranslations, wrapQtAppsHook }:
+{ lib, stdenv, fetchFromGitHub, cmake, qtsvg, qtwebengine, wrapQtAppsHook, qttools }:

 stdenv.mkDerivation rec {
  pname = "pageedit";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    hash = "sha256-naoflFANeMwabbdrNL3+ndvEXYT4Yqf+Mo77HcCexHE=";
  };

-  nativeBuildInputs = [ cmake qttranslations wrapQtAppsHook ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook qttools ];
  propagatedBuildInputs = [ qtsvg qtwebengine ];
  cmakeFlags = [ "-DINSTALL_BUNDLED_DICTS=0" ];

--- a/pkgs/applications/radio/rscw/default.nix
+++ b/pkgs/applications/radio/rscw/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
    sha256 = "1hxwxmqc5jinr14ya1idigqigc8qhy1vimzcwy2vmwdjay2sqik2";
  };

-  setSourceRoot = "sourceRoot=`pwd`";
+  sourceRoot = ".";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ gtk2 fftw ];
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -11,13 +11,13 @@
 , qtpositioning
 , qtmultimedia
 , qtserialport
-, qttranslations
 , qtwayland
 , qtwebengine
 , calcmysky
 , qxlsx
 , indilib
 , libnova
+, qttools
 }:

 stdenv.mkDerivation rec {
@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
    perl
    wrapGAppsHook
    wrapQtAppsHook
+    qttools
  ];

  buildInputs = [
@ -60,7 +61,6 @@ stdenv.mkDerivation rec {
    qtpositioning
    qtmultimedia
    qtserialport
-    qttranslations
    qtwebengine
    calcmysky
    qxlsx
--- a/pkgs/applications/science/biology/sratoolkit/default.nix
+++ b/pkgs/applications/science/biology/sratoolkit/default.nix
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    stdenv.cc.cc.lib
  ];

-  sourceRoot = "./sratoolkit.${version}-ubuntu64/bin";
+  sourceRoot = "sratoolkit.${version}-ubuntu64/bin";

  installPhase = ''
    find -L . -executable -type f -! -name "*remote-fuser*" -exec install -m755 -D {} $out/bin/{} \;
--- a/pkgs/applications/science/electronics/flatcam/default.nix
+++ b/pkgs/applications/science/electronics/flatcam/default.nix
@ -13,13 +13,16 @@ let
    packageOverrides = self: super: {
      shapely = super.shapely.overridePythonAttrs (old: rec {
        version = "1.8.4";
+
        src = fetchPypi {
          pname = "Shapely";
          inherit version;
          hash = "sha256-oZXlHKr6IYKR8suqP+9p/TNTyT7EtlsqRyLEz0DDGYw=";
        };
+
        # Environment variable used in shapely/_buildcfg.py
        GEOS_LIBRARY_PATH = "${geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
+
        patches = [
          # Patch to search form GOES .so/.dylib files in a Nix-aware way
          (substituteAll {
@ -28,6 +31,11 @@ let
            libc = lib.optionalString (!stdenv.isDarwin) "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";
          })
        ];
+
+        postPatch = ''
+          substituteInPlace pyproject.toml \
+            --replace 'setuptools<64' 'setuptools'
+        '';
      });
    };
  };
--- a/pkgs/applications/science/electronics/xyce/default.nix
+++ b/pkgs/applications/science/electronics/xyce/default.nix
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {

  srcs = [ xyce_src regression_src ];

-  sourceRoot = "./${xyce_src.name}";
+  sourceRoot = xyce_src.name;

  preConfigure = "./bootstrap";

--- a/pkgs/applications/science/logic/ekrhyper/default.nix
+++ b/pkgs/applications/science/logic/ekrhyper/default.nix
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {

  strictDeps = true;
  nativeBuildInputs = [ ocaml perl ];
-  setSourceRoot = "export sourceRoot=$(echo */ekrh/src/)";
+  setSourceRoot = "export sourceRoot=$(echo */ekrh/src)";
  preInstall = "export INSTALLDIR=$out";
  postInstall = ''for i in "$out/casc"/*; do ln -s "$i" "$out/bin/ekrh-casc-$(basename $i)"; done '';

--- a/pkgs/applications/science/misc/golly/default.nix
+++ b/pkgs/applications/science/misc/golly/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
  ];

  setSourceRoot = ''
-    sourceRoot=$(echo */gui-wx/)
+    sourceRoot=$(echo */gui-wx)
  '';

  postPatch = ''
--- a/pkgs/applications/video/davinci-resolve/default.nix
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@ -109,9 +109,7 @@ let
      '';

      # The unpack phase won't generate a directory
-      setSourceRoot = ''
-        sourceRoot=$PWD
-      '';
+      sourceRoot = ".";

      installPhase = ''
        runHook preInstall
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@ -1,4 +1,5 @@
-declare -a hardeningCFlags=()
+declare -a hardeningCFlagsAfter=()
+declare -a hardeningCFlagsBefore=()

 declare -A hardeningEnableMap=()

@ -48,15 +49,19 @@ for flag in "${!hardeningEnableMap[@]}"; do
    fortify | fortify3)
      # Use -U_FORTIFY_SOURCE to avoid warnings on toolchains that explicitly
      # set -D_FORTIFY_SOURCE=0 (like 'clang -fsanitize=address').
-      hardeningCFlags+=('-O2' '-U_FORTIFY_SOURCE')
+      hardeningCFlagsBefore+=('-O2' '-U_FORTIFY_SOURCE')
+      # Unset any _FORTIFY_SOURCE values the command-line may have set before
+      # enforcing our own value, avoiding (potentially fatal) redefinition
+      # warnings
+      hardeningCFlagsAfter+=('-U_FORTIFY_SOURCE')
      case $flag in
        fortify)
          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
-          hardeningCFlags+=('-D_FORTIFY_SOURCE=2')
+          hardeningCFlagsAfter+=('-D_FORTIFY_SOURCE=2')
        ;;
        fortify3)
          if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify3 >&2; fi
-          hardeningCFlags+=('-D_FORTIFY_SOURCE=3')
+          hardeningCFlagsAfter+=('-D_FORTIFY_SOURCE=3')
        ;;
        *)
          # Ignore unsupported.
@ -65,20 +70,20 @@ for flag in "${!hardeningEnableMap[@]}"; do
      ;;
    stackprotector)
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
-      hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
+      hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
      ;;
    pie)
      # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
-      hardeningCFlags=('-fPIE' "${hardeningCFlags[@]}")
+      hardeningCFlagsBefore=('-fPIE' "${hardeningCFlagsBefore[@]}")
      if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
        if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
-        hardeningCFlags=('-pie' "${hardeningCFlags[@]}")
+        hardeningCFlagsBefore=('-pie' "${hardeningCFlagsBefore[@]}")
      fi
      ;;
    pic)
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
-      hardeningCFlags+=('-fPIC')
+      hardeningCFlagsBefore+=('-fPIC')
      ;;
    strictoverflow)
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
@ -89,14 +94,14 @@ for flag in "${!hardeningEnableMap[@]}"; do
        #
        # See: https://github.com/llvm/llvm-project/blob/llvmorg-16.0.6/clang/lib/Driver/ToolChains/Clang.cpp#L6315
        #
-        hardeningCFlags+=('-fwrapv')
+        hardeningCFlagsBefore+=('-fwrapv')
      else
-        hardeningCFlags+=('-fno-strict-overflow')
+        hardeningCFlagsBefore+=('-fno-strict-overflow')
      fi
      ;;
    format)
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
-      hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
+      hardeningCFlagsBefore+=('-Wformat' '-Wformat-security' '-Werror=format-security')
      ;;
    *)
      # Ignore unsupported. Checked in Nix that at least *some*
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@ -171,8 +171,8 @@ fi
 source @out@/nix-support/add-hardening.sh

 # Add the flags for the C compiler proper.
-extraAfter=($NIX_CFLAGS_COMPILE_@suffixSalt@)
-extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
+extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_COMPILE_@suffixSalt@)
+extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)

 if [ "$dontLink" != 1 ]; then

--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@ -70,9 +70,12 @@ static void init()

 }

-static const char * rewrite(const char * path, char * buf)
+static const char * rewrite(const char * volatile path, char * buf)
 {
+    // Marking the path volatile is needed so the the following check isn't
+    // optimized away by the compiler.
    if (path == NULL) return path;
+
    for (int n = 0; n < nrRedirects; ++n) {
        int len = strlen(from[n]);
        if (strncmp(path, from[n], len) != 0) continue;
--- a/pkgs/build-support/libredirect/test.c
+++ b/pkgs/build-support/libredirect/test.c
@ -45,6 +45,17 @@ void test_subprocess(void) {
    assert(system(SUBTEST) == 0);
 }

+void test_stat_with_null_path(void) {
+    // This checks whether the compiler optimizes away the null pointer check
+    // on the path passed to stat(). If that's the case, the following code
+    // should segfault.
+    struct stat buf;
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wnonnull"
+    stat(NULL, &buf);
+#pragma GCC diagnostic pop
+}
+
 void assert_mktemp_path(
    const char * orig_prefix,
    const char * orig_suffix,
@ -147,6 +158,7 @@ int main(int argc, char *argv[])

    test_spawn();
    test_system();
+    test_stat_with_null_path();

    // Only run subprocess if no arguments are given
    // as the subprocess will be called without argument
--- a/pkgs/data/fonts/maple-font/default.nix
+++ b/pkgs/data/fonts/maple-font/default.nix
@ -5,10 +5,9 @@
 }:

 let
-  maple-font = { pname, sha256, desc }: stdenv.mkDerivation
-    rec{
-
-      inherit pname desc;
+  maple-font = { pname, sha256, desc }:
+    stdenv.mkDerivation rec{
+      inherit pname;
      version = "6.4";
      src = fetchurl {
        url = "https://github.com/subframe7536/Maple-font/releases/download/v${version}/${pname}.zip";
@ -17,7 +16,7 @@ let

      # Work around the "unpacker appears to have produced no directories"
      # case that happens when the archive doesn't have a subdirectory.
-      setSourceRoot = "sourceRoot=`pwd`";
+      sourceRoot = ".";
      nativeBuildInputs = [ unzip ];
      installPhase = ''
        find . -name '*.ttf'    -exec install -Dt $out/share/fonts/truetype {} \;
--- a/pkgs/data/fonts/roboto-mono/default.nix
+++ b/pkgs/data/fonts/roboto-mono/default.nix
@ -51,7 +51,7 @@ stdenv.mkDerivation {
    })
  ];

-  sourceRoot = "./";
+  sourceRoot = ".";

  unpackCmd = ''
    ttfName=$(basename $(stripHash $curSrc))
--- a/pkgs/data/fonts/rubik/default.nix
+++ b/pkgs/data/fonts/rubik/default.nix
@ -66,7 +66,7 @@ stdenv.mkDerivation {
    })
  ];

-  sourceRoot = "./";
+  sourceRoot = ".";

  unpackCmd = ''
    ttfName=$(basename $(stripHash $curSrc))
--- a/pkgs/data/misc/unicode-character-database/default.nix
+++ b/pkgs/data/misc/unicode-character-database/default.nix
@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
    unzip
  ];

-  setSourceRoot = ''
-    sourceRoot=$PWD
-  '';
+  sourceRoot = ".";

  installPhase = ''
    runHook preInstall
--- a/pkgs/data/misc/unihan-database/default.nix
+++ b/pkgs/data/misc/unihan-database/default.nix
@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
    unzip
  ];

-  setSourceRoot = ''
-    sourceRoot=$PWD
-  '';
+  sourceRoot = ".";

  installPhase = ''
    runHook preInstall
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
  ];

  # go to the source directory after unpacking the sources
-  setSourceRoot = "export sourceRoot=rox-filer-${version}/ROX-Filer/";
+  sourceRoot = "rox-filer-${version}/ROX-Filer";

  # account for 'setSourceRoot' offset
  patchFlags = [ "-p2" ];
--- a/pkgs/development/compilers/flutter/engine-artifacts/default.nix
+++ b/pkgs/development/compilers/flutter/engine-artifacts/default.nix
@ -191,7 +191,7 @@ let
            hash = (if artifactDirectory == null then hashes else hashes.${artifactDirectory}).${archive};
          });

-      setSourceRoot = if overrideUnpackCmd then "sourceRoot=`pwd`" else null;
+      sourceRoot = if overrideUnpackCmd then "." else null;
      unpackCmd = if overrideUnpackCmd then "unzip -o $src -d $out" else null;

      installPhase =
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , bison
 , cmake
 , jq
@ -10,24 +9,15 @@
 }:
 stdenv.mkDerivation rec {
  pname = "glslang";
-  version = "12.2.0";
+  version = "12.3.1";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "glslang";
    rev = version;
-    hash = "sha256-2i6DZA42b0s1ul6VDhjPi9lpSYvsRD8r9yiRoRfVoW0=";
+    hash = "sha256-NP5ph598YSPbpzJJUR2r+EkqFmuItxgvOSDgDaN+Swg=";
  };

-  patches = [
-    # Fix build on Darwin
-    # FIXME: remove for next release
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/glslang/commit/6a7ec4be7b8a22ab16cea0f294b5973dbcdd637a.diff";
-      hash = "sha256-O1N62X6LZNRNHHz90TLJDbt6pDr28EI6IKMbMXcKBj8=";
-    })
-  ];
-
  # These get set at all-packages, keep onto them for child drvs
  passthru = {
    spirv-tools = spirv-tools;
@ -48,8 +38,11 @@ stdenv.mkDerivation rec {

  # Fix the paths in .pc, even though it's unclear if these .pc are really useful.
  postFixup = ''
-    substituteInPlace "$out"/lib/pkgconfig/SPIRV-Tools{,-shared}.pc \
+    substituteInPlace $out/lib/pkgconfig/*.pc \
      --replace '=''${prefix}//' '=/'
+
+    # add a symlink for backwards compatibility
+    ln -s $out/bin/glslang $out/bin/glslangValidator
  '';

  meta = with lib; {
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@ -1,7 +1,8 @@
 self: dontUse: with self;

 let
-  pythonInterpreter = python.pythonForBuild.interpreter;
+  inherit (python) pythonForBuild;
+  pythonInterpreter = pythonForBuild.interpreter;
  pythonSitePackages = python.sitePackages;
  pythonCheckInterpreter = python.interpreter;
  setuppy = ../run_setup.py;
@ -66,11 +67,9 @@ in {
    makePythonHook {
      name = "pypa-build-hook.sh";
      propagatedBuildInputs = [ build wheel ];
-      substitutions = {
-        inherit pythonInterpreter;
-      };
-    } ./pypa-build-hook.sh) {};
-
+    } ./pypa-build-hook.sh) {
+      inherit (pythonForBuild.pkgs) build;
+    };

  pipInstallHook = callPackage ({ makePythonHook, pip }:
    makePythonHook {
@ -81,6 +80,17 @@ in {
      };
    } ./pip-install-hook.sh) {};

+  pypaInstallHook = callPackage ({ makePythonHook, installer }:
+    makePythonHook {
+      name = "pypa-install-hook";
+      propagatedBuildInputs = [ installer ];
+      substitutions = {
+        inherit pythonInterpreter pythonSitePackages;
+      };
+    } ./pypa-install-hook.sh) {
+      inherit (pythonForBuild.pkgs) installer;
+    };
+
  pytestCheckHook = callPackage ({ makePythonHook, pytest }:
    makePythonHook {
      name = "pytest-check-hook";
@ -134,9 +144,8 @@ in {
  pythonRelaxDepsHook = callPackage ({ makePythonHook, wheel }:
    makePythonHook {
      name = "python-relax-deps-hook";
-      propagatedBuildInputs = [ wheel ];
      substitutions = {
-        inherit pythonInterpreter;
+        inherit pythonInterpreter pythonSitePackages wheel;
      };
    } ./python-relax-deps-hook.sh) {};

--- a/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
@ -6,7 +6,7 @@ pypaBuildPhase() {
    runHook preBuild

    echo "Creating a wheel..."
-    @pythonInterpreter@ -m build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
+    pyproject-build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
    echo "Finished creating a wheel..."

    runHook postBuild
--- a/pkgs/development/interpreters/python/hooks/pypa-install-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pypa-install-hook.sh
@ -0,0 +1,26 @@
+# Setup hook for PyPA installer.
+echo "Sourcing pypa-install-hook"
+
+pypaInstallPhase() {
+    echo "Executing pypaInstallPhase"
+    runHook preInstall
+
+    pushd dist > /dev/null
+
+    for wheel in *.whl; do
+        @pythonInterpreter@ -m installer --prefix "$out" "$wheel"
+        echo "Successfully installed $wheel"
+    done
+
+    popd > /dev/null
+
+    export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
+
+    runHook postInstall
+    echo "Finished executing pypaInstallPhase"
+}
+
+if [ -z "${dontUsePypaInstall-}" ] && [ -z "${installPhase-}" ]; then
+    echo "Using pypaInstallPhase"
+    installPhase=pypaInstallPhase
+fi
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@ -78,24 +78,27 @@ pythonRelaxDepsHook() {
    pushd dist

    # See https://peps.python.org/pep-0491/#escaping-and-unicode
-    local -r pkg_name="${pname//[^[:alnum:].]/_}-$version"
+    local -r pkg_name="${pname//[^[:alnum:].]/_}"
    local -r unpack_dir="unpacked"
-    local -r metadata_file="$unpack_dir/$pkg_name/$pkg_name.dist-info/METADATA"
+    local -r metadata_file="$unpack_dir/$pkg_name*/$pkg_name*.dist-info/METADATA"

    # We generally shouldn't have multiple wheel files, but let's be safer here
    for wheel in "$pkg_name"*".whl"; do
-        @pythonInterpreter@ -m wheel unpack --dest "$unpack_dir" "$wheel"
+        PYTHONPATH="@wheel@/@pythonSitePackages@:$PYTHONPATH" \
+            @pythonInterpreter@ -m wheel unpack --dest "$unpack_dir" "$wheel"
        rm -rf "$wheel"

-        _pythonRelaxDeps "$metadata_file"
-        _pythonRemoveDeps "$metadata_file"
+        # Using no quotes on purpose since we need to expand the glob from `$metadata_file`
+        _pythonRelaxDeps $metadata_file
+        _pythonRemoveDeps $metadata_file

        if (( "${NIX_DEBUG:-0}" >= 1 )); then
            echo "pythonRelaxDepsHook: resulting METADATA for '$wheel':"
-            cat "$unpack_dir/$pkg_name/$pkg_name.dist-info/METADATA"
+            cat $metadata_file
        fi

-        @pythonInterpreter@ -m wheel pack "$unpack_dir/$pkg_name"
+        PYTHONPATH="@wheel@/@pythonSitePackages@:$PYTHONPATH" \
+            @pythonInterpreter@ -m wheel pack "$unpack_dir/$pkg_name"*
    done

    # Remove the folder since it will otherwise be in the dist output.
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@ -12,8 +12,8 @@
 , update-python-libraries
 , setuptools
 , flitBuildHook
-, pipBuildHook
-, pipInstallHook
+, pypaBuildHook
+, pypaInstallHook
 , pythonCatchConflictsHook
 , pythonImportsCheckHook
 , pythonNamespacesHook
@ -161,6 +161,20 @@ let

    in inputs: builtins.map (checkDrv) inputs;

+  isBootstrapInstallPackage = builtins.elem (attrs.pname or null) [
+    "flit-core" "installer"
+  ];
+
+  isBootstrapPackage = isBootstrapInstallPackage || builtins.elem (attrs.pname or null) ([
+    "build" "packaging" "pyproject-hooks" "wheel"
+  ] ++ lib.optionals (python.pythonOlder "3.11") [
+    "tomli"
+  ]);
+
+  isSetuptoolsDependency = builtins.elem (attrs.pname or null) [
+    "setuptools" "wheel"
+  ];
+
  # Keep extra attributes from `attrs`, e.g., `patchPhase', etc.
  self = toPythonModule (stdenv.mkDerivation ((builtins.removeAttrs attrs [
    "disabled" "checkPhase" "checkInputs" "nativeCheckInputs" "doCheck" "doInstallCheck" "dontWrapPythonPrograms" "catchConflicts" "format"
@ -174,7 +188,15 @@ let
      wrapPython
      ensureNewerSourcesForZipFilesHook  # move to wheel installer (pip) or builder (setuptools, flit, ...)?
      pythonRemoveTestsDirHook
-    ] ++ lib.optionals catchConflicts [
+    ] ++ lib.optionals (catchConflicts && !isBootstrapPackage && !isSetuptoolsDependency) [
+      #
+      # 1. When building a package that is also part of the bootstrap chain, we
+      #    must ignore conflicts after installation, because there will be one with
+      #    the package in the bootstrap.
+      #
+      # 2. When a package is a dependency of setuptools, we must ignore conflicts
+      #    because the hook that checks for conflicts uses setuptools.
+      #
      pythonCatchConflictsHook
    ] ++ lib.optionals removeBinBytecode [
      pythonRemoveBinBytecodeHook
@ -184,15 +206,26 @@ let
      setuptoolsBuildHook
    ] ++ lib.optionals (format == "flit") [
      flitBuildHook
-    ] ++ lib.optionals (format == "pyproject") [
-      pipBuildHook
-    ] ++ lib.optionals (format == "wheel") [
+    ] ++ lib.optionals (format == "pyproject") [(
+      if isBootstrapPackage then
+        pypaBuildHook.override {
+          inherit (python.pythonForBuild.pkgs.bootstrap) build;
+          wheel = null;
+        }
+      else
+        pypaBuildHook
+    )] ++ lib.optionals (format == "wheel") [
      wheelUnpackHook
    ] ++ lib.optionals (format == "egg") [
      eggUnpackHook eggBuildHook eggInstallHook
-    ] ++ lib.optionals (!(format == "other") || dontUsePipInstall) [
-      pipInstallHook
-    ] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+    ] ++ lib.optionals (format != "other") [(
+      if isBootstrapInstallPackage then
+        pypaInstallHook.override {
+          inherit (python.pythonForBuild.pkgs.bootstrap) installer;
+        }
+      else
+        pypaInstallHook
+    )] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
      # This is a test, however, it should be ran independent of the checkPhase and checkInputs
      pythonImportsCheckHook
    ] ++ lib.optionals (python.pythonAtLeast "3.3") [
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@ -32,12 +32,17 @@ let
      }
      else result;

-  buildPythonPackage = makeOverridablePythonPackage (lib.makeOverridable (callPackage ./mk-python-derivation.nix {
+  mkPythonDerivation = if python.isPy3k then
+    ./mk-python-derivation.nix
+  else
+    ./python2/mk-python-derivation.nix;
+
+  buildPythonPackage = makeOverridablePythonPackage (lib.makeOverridable (callPackage mkPythonDerivation {
    inherit namePrefix;     # We want Python libraries to be named like e.g. "python3.6-${name}"
    inherit toPythonModule; # Libraries provide modules
  }));

-  buildPythonApplication = makeOverridablePythonPackage (lib.makeOverridable (callPackage ./mk-python-derivation.nix {
+  buildPythonApplication = makeOverridablePythonPackage (lib.makeOverridable (callPackage mkPythonDerivation {
    namePrefix = "";        # Python applications should not have any prefix
    toPythonModule = x: x;  # Application does not provide modules.
  }));
--- a/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
@ -0,0 +1,252 @@
+# Generic builder only used for EOL and deprecated Python 2.
+
+{ lib
+, config
+, python
+, wrapPython
+, unzip
+, ensureNewerSourcesForZipFilesHook
+# Whether the derivation provides a Python module or not.
+, toPythonModule
+, namePrefix
+, update-python-libraries
+, setuptools
+, pipBuildHook
+, pipInstallHook
+, pythonCatchConflictsHook
+, pythonImportsCheckHook
+, pythonOutputDistHook
+, pythonRemoveBinBytecodeHook
+, pythonRemoveTestsDirHook
+, setuptoolsBuildHook
+, setuptoolsCheckHook
+, wheelUnpackHook
+, eggUnpackHook
+, eggBuildHook
+, eggInstallHook
+}:
+
+{ name ? "${attrs.pname}-${attrs.version}"
+
+# Build-time dependencies for the package
+, nativeBuildInputs ? []
+
+# Run-time dependencies for the package
+, buildInputs ? []
+
+# Dependencies needed for running the checkPhase.
+# These are added to buildInputs when doCheck = true.
+, checkInputs ? []
+, nativeCheckInputs ? []
+
+# propagate build dependencies so in case we have A -> B -> C,
+# C can import package A propagated by B
+, propagatedBuildInputs ? []
+
+# DEPRECATED: use propagatedBuildInputs
+, pythonPath ? []
+
+# Enabled to detect some (native)BuildInputs mistakes
+, strictDeps ? true
+
+, outputs ? [ "out" ]
+
+# used to disable derivation, useful for specific python versions
+, disabled ? false
+
+# Raise an error if two packages are installed with the same name
+# TODO: For cross we probably need a different PYTHONPATH, or not
+# add the runtime deps until after buildPhase.
+, catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform)
+
+# Additional arguments to pass to the makeWrapper function, which wraps
+# generated binaries.
+, makeWrapperArgs ? []
+
+# Skip wrapping of python programs altogether
+, dontWrapPythonPrograms ? false
+
+# Don't use Pip to install a wheel
+# Note this is actually a variable for the pipInstallPhase in pip's setupHook.
+# It's included here to prevent an infinite recursion.
+, dontUsePipInstall ? false
+
+# Skip setting the PYTHONNOUSERSITE environment variable in wrapped programs
+, permitUserSite ? false
+
+# Remove bytecode from bin folder.
+# When a Python script has the extension `.py`, bytecode is generated
+# Typically, executables in bin have no extension, so no bytecode is generated.
+# However, some packages do provide executables with extensions, and thus bytecode is generated.
+, removeBinBytecode ? true
+
+# Several package formats are supported.
+# "setuptools" : Install a common setuptools/distutils based package. This builds a wheel.
+# "wheel" : Install from a pre-compiled wheel.
+# "pyproject": Install a package using a ``pyproject.toml`` file (PEP517). This builds a wheel.
+# "egg": Install a package from an egg.
+# "other" : Provide your own buildPhase and installPhase.
+, format ? "setuptools"
+
+, meta ? {}
+
+, passthru ? {}
+
+, doCheck ? config.doCheckByDefault or false
+
+, disabledTestPaths ? []
+
+, ... } @ attrs:
+
+assert lib.assertMsg (format != "flit") "flit is not a supported Python 2 format";
+
+let
+  inherit (python) stdenv;
+
+  withDistOutput = lib.elem format ["pyproject" "setuptools" "flit" "wheel"];
+
+  name_ = name;
+
+  validatePythonMatches = attrName: let
+    isPythonModule = drv:
+      # all pythonModules have the pythonModule attribute
+      (drv ? "pythonModule")
+      # Some pythonModules are turned in to a pythonApplication by setting the field to false
+      && (!builtins.isBool drv.pythonModule);
+    isMismatchedPython = drv: drv.pythonModule != python;
+
+    optionalLocation = let
+        pos = builtins.unsafeGetAttrPos (if attrs ? "pname" then "pname" else "name") attrs;
+      in lib.optionalString (pos != null) " at ${pos.file}:${toString pos.line}:${toString pos.column}";
+
+    leftPadName = name: against: let
+        len = lib.max (lib.stringLength name) (lib.stringLength against);
+      in lib.strings.fixedWidthString len " " name;
+
+    throwMismatch = drv: let
+      myName = "'${namePrefix}${name}'";
+      theirName = "'${drv.name}'";
+    in throw ''
+      Python version mismatch in ${myName}:
+
+      The Python derivation ${myName} depends on a Python derivation
+      named ${theirName}, but the two derivations use different versions
+      of Python:
+
+          ${leftPadName myName theirName} uses ${python}
+          ${leftPadName theirName myName} uses ${toString drv.pythonModule}
+
+      Possible solutions:
+
+        * If ${theirName} is a Python library, change the reference to ${theirName}
+          in the ${attrName} of ${myName} to use a ${theirName} built from the same
+          version of Python
+
+        * If ${theirName} is used as a tool during the build, move the reference to
+          ${theirName} in ${myName} from ${attrName} to nativeBuildInputs
+
+        * If ${theirName} provides executables that are called at run time, pass its
+          bin path to makeWrapperArgs:
+
+              makeWrapperArgs = [ "--prefix PATH : ''${lib.makeBinPath [ ${lib.getName drv } ] }" ];
+
+      ${optionalLocation}
+    '';
+
+    checkDrv = drv:
+      if (isPythonModule drv) && (isMismatchedPython drv)
+      then throwMismatch drv
+      else drv;
+
+    in inputs: builtins.map (checkDrv) inputs;
+
+  # Keep extra attributes from `attrs`, e.g., `patchPhase', etc.
+  self = toPythonModule (stdenv.mkDerivation ((builtins.removeAttrs attrs [
+    "disabled" "checkPhase" "checkInputs" "nativeCheckInputs" "doCheck" "doInstallCheck" "dontWrapPythonPrograms" "catchConflicts" "format"
+    "disabledTestPaths" "outputs"
+  ]) // {
+
+    name = namePrefix + name_;
+
+    nativeBuildInputs = [
+      python
+      wrapPython
+      ensureNewerSourcesForZipFilesHook  # move to wheel installer (pip) or builder (setuptools, flit, ...)?
+      pythonRemoveTestsDirHook
+    ] ++ lib.optionals catchConflicts [
+      pythonCatchConflictsHook
+    ] ++ lib.optionals removeBinBytecode [
+      pythonRemoveBinBytecodeHook
+    ] ++ lib.optionals (lib.hasSuffix "zip" (attrs.src.name or "")) [
+      unzip
+    ] ++ lib.optionals (format == "setuptools") [
+      setuptoolsBuildHook
+    ] ++ lib.optionals (format == "pyproject") [(
+      pipBuildHook
+    )] ++ lib.optionals (format == "wheel") [
+      wheelUnpackHook
+    ] ++ lib.optionals (format == "egg") [
+      eggUnpackHook eggBuildHook eggInstallHook
+    ] ++ lib.optionals (format != "other") [(
+      pipInstallHook
+    )] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+      # This is a test, however, it should be ran independent of the checkPhase and checkInputs
+      pythonImportsCheckHook
+    ] ++ lib.optionals withDistOutput [
+      pythonOutputDistHook
+    ] ++ nativeBuildInputs;
+
+    buildInputs = validatePythonMatches "buildInputs" (buildInputs ++ pythonPath);
+
+    propagatedBuildInputs = validatePythonMatches "propagatedBuildInputs" (propagatedBuildInputs ++ [
+      # we propagate python even for packages transformed with 'toPythonApplication'
+      # this pollutes the PATH but avoids rebuilds
+      # see https://github.com/NixOS/nixpkgs/issues/170887 for more context
+      python
+    ]);
+
+    inherit strictDeps;
+
+    LANG = "${if python.stdenv.isDarwin then "en_US" else "C"}.UTF-8";
+
+    # Python packages don't have a checkPhase, only an installCheckPhase
+    doCheck = false;
+    doInstallCheck = attrs.doCheck or true;
+    nativeInstallCheckInputs = [
+    ] ++ lib.optionals (format == "setuptools") [
+      # Longer-term we should get rid of this and require
+      # users of this function to set the `installCheckPhase` or
+      # pass in a hook that sets it.
+      setuptoolsCheckHook
+    ] ++ nativeCheckInputs;
+    installCheckInputs = checkInputs;
+
+    postFixup = lib.optionalString (!dontWrapPythonPrograms) ''
+      wrapPythonPrograms
+    '' + attrs.postFixup or "";
+
+    # Python packages built through cross-compilation are always for the host platform.
+    disallowedReferences = lib.optionals (python.stdenv.hostPlatform != python.stdenv.buildPlatform) [ python.pythonForBuild ];
+
+    outputs = outputs ++ lib.optional withDistOutput "dist";
+
+    meta = {
+      # default to python's platforms
+      platforms = python.meta.platforms;
+      isBuildPythonPackage = python.meta.platforms;
+    } // meta;
+  } // lib.optionalAttrs (attrs?checkPhase) {
+    # If given use the specified checkPhase, otherwise use the setup hook.
+    # Longer-term we should get rid of `checkPhase` and use `installCheckPhase`.
+    installCheckPhase = attrs.checkPhase;
+  } //  lib.optionalAttrs (disabledTestPaths != []) {
+      disabledTestPaths = lib.escapeShellArgs disabledTestPaths;
+  }));
+
+  passthru.updateScript = let
+      filename = builtins.head (lib.splitString ":" self.meta.position);
+    in attrs.passthru.updateScript or [ update-python-libraries filename ];
+in lib.extendDerivation
+  (disabled -> throw "${name} not supported for interpreter ${python.executable}")
+  passthru
+  self
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "rubygems";
-  version = "3.4.18";
+  version = "3.4.19";

  src = fetchurl {
    url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-+yHTJWedZNCkkRMIRT103QMTFJODlbJ2PwVbTghEo0M=";
+    hash = "sha256-+ZYpS9UOB16qCjhrKwFGBn43t3KNOv/QIrLKIPAywWs=";
  };

  patches = [
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@ -1,4 +1,5 @@
-{ lib, stdenv, callPackage, makeSetupHook
+{ lib, stdenv, callPackage, makeSetupHook, runCommand
+, tzdata

 # Version specific stuff
 , release, version, src
@ -7,7 +8,7 @@

 let
  baseInterp =
-    stdenv.mkDerivation {
+    stdenv.mkDerivation rec {
      pname = "tcl";
      inherit version src;

@ -15,6 +16,14 @@ let

      setOutputFlags = false;

+      postPatch = ''
+        substituteInPlace library/clock.tcl \
+          --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo" \
+          --replace "/usr/share/lib/zoneinfo" "" \
+          --replace "/usr/lib/zoneinfo" "" \
+          --replace "/usr/local/etc/zoneinfo" ""
+      '';
+
      preConfigure = ''
        cd unix
      '';
@ -55,6 +64,12 @@ let
          name = "tcl-package-hook";
          propagatedBuildInputs = [ buildPackages.makeWrapper ];
        } ./tcl-package-hook.sh) {};
+        # verify that Tcl's clock library can access tzdata
+        tests.tzdata = runCommand "${pname}-test-tzdata" {} ''
+          ${baseInterp}/bin/tclsh <(echo "set t [clock scan {2004-10-30 05:00:00} \
+                                        -format {%Y-%m-%d %H:%M:%S} \
+                                        -timezone :America/New_York]") > $out
+        '';
      };
    };

--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@ -55,11 +55,11 @@

 stdenv.mkDerivation rec {
  pname = "SDL2";
-  version = "2.28.1";
+  version = "2.28.2";

  src = fetchurl {
    url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SXfOulwAVNvmwvEUZBrO1DzjvytB6mS2o3LWuhKcsV0=";
+    hash = "sha256-ZLEQL6Igk1FbAu8z3Yc53uG6V+nbumoJKUK4u+0aHF4=";
  };
  dontDisableStatic = if withStatic then 1 else 0;
  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/avahi/default.nix
+++ b/pkgs/development/libraries/avahi/default.nix
@ -36,14 +36,21 @@ stdenv.mkDerivation rec {
  patches = [
    # CVE-2021-36217 / CVE-2021-3502
    (fetchpatch {
+      name = "CVE-2021-3502.patch";
      url = "https://github.com/lathiat/avahi/commit/9d31939e55280a733d930b15ac9e4dda4497680c.patch";
      sha256 = "sha256-BXWmrLWUvDxKPoIPRFBpMS3T4gijRw0J+rndp6iDybU=";
    })
    # CVE-2021-3468
    (fetchpatch {
+      name = "CVE-2021-3468.patch";
      url = "https://github.com/lathiat/avahi/commit/447affe29991ee99c6b9732fc5f2c1048a611d3b.patch";
      sha256 = "sha256-qWaCU1ZkCg2PmijNto7t8E3pYRN/36/9FrG8okd6Gu8=";
    })
+    (fetchpatch {
+      name = "CVE-2023-1981.patch";
+      url = "https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f.patch";
+      sha256 = "sha256-BEYFGCnQngp+OpiKIY/oaKygX7isAnxJpUPCUvg+efc=";
+    })
  ];

  depsBuildBuild = [
--- a/pkgs/development/libraries/dab_lib/default.nix
+++ b/pkgs/development/libraries/dab_lib/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-KSkOg0a5iq+13kClQqj+TaEP/PsLUrm8bMmiJEAZ+C4=";
  };

-  sourceRoot = "${finalAttrs.src.name}/library/";
+  sourceRoot = "${finalAttrs.src.name}/library";

  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [ faad2 fftwFloat zlib ];
--- a/pkgs/development/libraries/fdk-aac/default.nix
+++ b/pkgs/development/libraries/fdk-aac/default.nix
@ -15,6 +15,8 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "dev" ];

+  enableParallelBuilding = true;
+
  configureFlags = lib.optional exampleSupport "--enable-example";

  meta = with lib; {
--- a/pkgs/development/libraries/gettext/0001-msginit-Do-not-use-POT-Creation-Date.patch
+++ b/pkgs/development/libraries/gettext/0001-msginit-Do-not-use-POT-Creation-Date.patch
@ -0,0 +1,32 @@
+From 1e000ca711886055176a2f90197a383d09de0e67 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miguel=20=C3=81ngel=20Arruga=20Vivas?=
+ <rosen644835@gmail.com>
+Date: Fri, 18 Dec 2020 14:19:36 +0100
+Subject: [PATCH] msginit: Do not use POT-Creation-Date.
+
+* gettext-tools/src/msginit.c (po_revision_date): Do not use
+POT-Creation-Date when the file is automatically generated.
+---
+ gettext-tools/src/msginit.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/gettext-tools/src/msginit.c b/gettext-tools/src/msginit.c
+index 8ca9a3b77..06e0e7195 100644
+--- a/gettext-tools/src/msginit.c
+++ b/gettext-tools/src/msginit.c
+@@ -1075,9 +1075,9 @@ static const char *
+ po_revision_date (const char *header)
+ {
+   if (no_translator)
+-    /* Because the PO file is automatically generated, we use the
+-       POT-Creation-Date, not the current time.  */
+-    return get_field (header, "POT-Creation-Date");
+    /* Because the PO file is automatically generated, we don't
+       generate PO-Revision-Date field.  */
+    return NULL;
+   else
+     {
+       /* Assume the translator will modify the PO file now.  */
+-- 
+2.29.2
+
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@ -17,6 +17,9 @@ stdenv.mkDerivation rec {
  };
  patches = [
    ./absolute-paths.diff
+    # fix reproducibile output, in particular in the grub2 build
+    # https://savannah.gnu.org/bugs/index.php?59658
+    ./0001-msginit-Do-not-use-POT-Creation-Date.patch
  ] ++ lib.optional stdenv.hostPlatform.isWindows (fetchpatch {
    url = "https://aur.archlinux.org/cgit/aur.git/plain/gettext_formatstring-ruby.patch?h=mingw-w64-gettext&id=e8b577ee3d399518d005e33613f23363a7df07ee";
    name = "gettext_formatstring-ruby.patch";
--- a/pkgs/development/libraries/glog/default.nix
+++ b/pkgs/development/libraries/glog/default.nix
@ -19,24 +19,50 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DBUILD_SHARED_LIBS=ON"
+    # glog's custom FindUnwind.cmake module detects LLVM's unwind in case
+    # stdenv.cc is clang. But the module doesn't get installed, causing
+    # consumers of the CMake config file to fail at the configuration step.
+    # Explicitly disabling unwind support sidesteps the issue.
+    "-DWITH_UNWIND=OFF"
  ];

-  # TODO: Re-enable Darwin tests once we're on a release that has https://github.com/google/glog/issues/709#issuecomment-960381653 fixed
-  doCheck = !stdenv.isDarwin;
+  doCheck = true;
+
  # There are some non-thread safe tests that can fail
  enableParallelChecking = false;
  nativeCheckInputs = [ perl ];

-  GTEST_FILTER =
+  env.GTEST_FILTER =
    let
      filteredTests = lib.optionals stdenv.hostPlatform.isMusl [
        "Symbolize.SymbolizeStackConsumption"
        "Symbolize.SymbolizeWithDemanglingStackConsumption"
      ] ++ lib.optionals stdenv.hostPlatform.isStatic [
        "LogBacktraceAt.DoesBacktraceAtRightLineWhenEnabled"
+      ] ++ lib.optionals stdenv.cc.isClang [
+        # Clang optimizes an expected allocation away.
+        # See https://github.com/google/glog/issues/937
+        "DeathNoAllocNewHook.logging"
+      ] ++ lib.optionals stdenv.isDarwin [
+        "LogBacktraceAt.DoesBacktraceAtRightLineWhenEnabled"
      ];
    in
-    lib.optionalString doCheck "-${builtins.concatStringsSep ":" filteredTests}";
+    "-${builtins.concatStringsSep ":" filteredTests}";
+
+  checkPhase =
+    let
+      excludedTests = lib.optionals stdenv.isDarwin [
+        "mock-log"
+      ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+        "logging"   # works around segfaults on aarch64-darwin for now
+      ];
+      excludedTestsRegex = lib.optionalString (excludedTests != [ ]) "(${lib.concatStringsSep "|" excludedTests})";
+    in
+    ''
+      runHook preCheck
+      ctest -E "${excludedTestsRegex}" --output-on-failure
+      runHook postCheck
+    '';

  meta = with lib; {
    homepage = "https://github.com/google/glog";
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@ -23,9 +23,29 @@ in stdenv.mkDerivation {
  pname = "gnu-config";
  version = "2023-07-31";

-  buildCommand = ''
-    install -Dm755 ${configGuess} $out/config.guess
-    install -Dm755 ${configSub} $out/config.sub
+  unpackPhase = ''
+    runHook preUnpack
+    cp ${configGuess} ./config.guess
+    cp ${configSub} ./config.sub
+    chmod +w ./config.sub ./config.guess
+    runHook postUnpack
+  '';
+
+  # If this isn't set, `pkgs.gnu-config.overrideAttrs( _: { patches
+  # = ...; })` will behave very counterintuitively: the (unpatched)
+  # gnu-config from the updateAutotoolsGnuConfigScriptsHook stdenv's
+  # defaultNativeBuildInputs will "update" the patched gnu-config by
+  # reverting the patch!
+  dontUpdateAutotoolsGnuConfigScripts = true;
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 ./config.guess $out/config.guess
+    install -Dm755 ./config.sub $out/config.sub
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/java/mockobjects/default.nix
+++ b/pkgs/development/libraries/java/mockobjects/default.nix
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
  };

  # Work around the "unpacker appears to have produced no directories"
-  setSourceRoot = "sourceRoot=`pwd`";
+  sourceRoot = ".";

  installPhase = ''
    runHook preInstall
--- a/pkgs/development/libraries/kdb/default.nix
+++ b/pkgs/development/libraries/kdb/default.nix
@ -4,12 +4,12 @@
 , fetchpatch
 , extra-cmake-modules
 , qtbase
-, qttranslations
 , kcoreaddons
 , python3
 , sqlite
 , postgresql
 , libmysqlclient
+, qttools
 }:

 mkDerivation rec {
@ -34,9 +34,9 @@ mkDerivation rec {
    })
  ];

-  nativeBuildInputs = [ extra-cmake-modules ];
+  nativeBuildInputs = [ extra-cmake-modules qttools ];

-  buildInputs = [ qttranslations kcoreaddons python3 sqlite postgresql libmysqlclient ];
+  buildInputs = [ kcoreaddons python3 sqlite postgresql libmysqlclient ];

  propagatedBuildInputs = [ qtbase ];

--- a/pkgs/development/libraries/kde-frameworks/kirigami2.nix
+++ b/pkgs/development/libraries/kde-frameworks/kirigami2.nix
@ -1,8 +1,8 @@
-{ mkDerivation, extra-cmake-modules, qtbase, qtquickcontrols2, qttranslations, qtgraphicaleffects }:
+{ mkDerivation, extra-cmake-modules, qtbase, qtquickcontrols2, qtgraphicaleffects, qttools }:

 mkDerivation {
  pname = "kirigami2";
-  nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ qtbase qtquickcontrols2 qttranslations qtgraphicaleffects ];
+  nativeBuildInputs = [ extra-cmake-modules qttools ];
+  buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects ];
  outputs = [ "out" "dev" ];
 }
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@ -30,7 +30,7 @@ let
  autoreconfHook = buildPackages.autoreconfHook269;
 in
 assert xarSupport -> libxml2 != null;
-(stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libarchive";
  version = "3.6.2";

@ -43,6 +43,16 @@ assert xarSupport -> libxml2 != null;

  outputs = [ "out" "lib" "dev" ];

+  patches = [
+    # fixes static linking; upstream in releases after 3.6.2
+    # https://github.com/libarchive/libarchive/pull/1825 merged upstream
+    (assert finalAttrs.version == "3.6.2"; fetchpatch {
+      name = "001-only-add-iconv-to-pc-file-if-needed.patch";
+      url = "https://github.com/libarchive/libarchive/commit/1f35c466aaa9444335a1b854b0b7223b0d2346c2.patch";
+      hash = "sha256-lb+zwWSH6/MLUIROvu9I/hUjSbb2jOWO755WC/r+lbY=";
+    })
+  ];
+
  postPatch = let
    skipTestPaths = [
      # test won't work in nix sandbox
@ -119,16 +129,4 @@ assert xarSupport -> libxml2 != null;
  passthru.tests = {
    inherit cmake nix samba;
  };
-})).overrideAttrs(previousAttrs:
-  assert previousAttrs.version == "3.6.2";
-  lib.optionalAttrs stdenv.hostPlatform.isStatic {
-    patches = [
-      # fixes static linking; upstream in releases after 3.6.2
-      # https://github.com/libarchive/libarchive/pull/1825 merged upstream
-      (fetchpatch {
-        name = "001-only-add-iconv-to-pc-file-if-needed.patch";
-        url = "https://github.com/libarchive/libarchive/commit/1f35c466aaa9444335a1b854b0b7223b0d2346c2.patch";
-        hash = "sha256-lb+zwWSH6/MLUIROvu9I/hUjSbb2jOWO755WC/r+lbY=";
-      })
-    ];
-  })
+})
--- a/pkgs/development/libraries/liblc3/default.nix
+++ b/pkgs/development/libraries/liblc3/default.nix
@ -7,7 +7,7 @@

 let
  name = "liblc3";
-  version = "1.0.3";
+  version = "1.0.4";
 in
 stdenv.mkDerivation {
  pname = name;
@ -17,7 +17,7 @@ stdenv.mkDerivation {
    owner = "google";
    repo = "liblc3";
    rev = "v${version}";
-    sha256 = "sha256-PEnK12FWAtxOMR3WyuxOQTgF+lD9S5YX+oKuWRbFfXM=";
+    sha256 = "sha256-nQJgF/cWoCx5TkX4xOaLB9SzvhVXPY29bLh7UwPMWEE=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@ -1,4 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, lcms2, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
+, lcms2
+, pkg-config
+
+# for passthru.tests
+, deepin
+, freeimage
+, hdrmerge
+, imagemagick
+, python3
+}:

 stdenv.mkDerivation rec {
  pname = "libraw";
@ -11,6 +25,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-K9mULf6V/TCl5Vu4iuIdSGF9HzQlgNQLRFHIpNbmAlY";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-1729.patch";
+      url = "https://github.com/LibRaw/LibRaw/commit/9ab70f6dca19229cb5caad7cc31af4e7501bac93.patch";
+      hash = "sha256-OAyqphxvtSM15NI77HwtGTmTmP9YNu3xhZ6D1CceJ7I=";
+    })
+  ];
+
  outputs = [ "out" "lib" "dev" "doc" ];

  propagatedBuildInputs = [ lcms2 ];
@ -19,6 +41,12 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  passthru.tests = {
+    inherit imagemagick hdrmerge freeimage;
+    inherit (deepin) deepin-image-viewer;
+    inherit (python3.pkgs) rawkit;
+  };
+
  meta = with lib; {
    description = "Library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others)";
    homepage = "https://www.libraw.org/";
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "libsndfile";
-  version = "1.2.0";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    hash = "sha256-zd0HDUzVYLyFjhIudBJQaKJUtYMjZeQRLALSkyD9tXU=";
+    hash = "sha256-MOOX/O0UaoeMaQPW9PvvE0izVp+6IoE5VbtTx0RvMkI=";
  };

  nativeBuildInputs = [ autoreconfHook autogen pkg-config python3 ];
--- a/pkgs/development/libraries/liburing/default.nix
+++ b/pkgs/development/libraries/liburing/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit }:
+{ lib, stdenv, fetchgit, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "liburing";
@ -10,6 +10,16 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-vbe9uh9AqXyPkzwD6zHoHH3JMeAJEl2FSGzny1T7diM=";
  };

+  patches = [
+    # Pull upstream fix for parallel build failures:
+    #   https://github.com/axboe/liburing/pull/891
+    (fetchpatch {
+      name = "parallel.patch";
+      url = "https://github.com/axboe/liburing/commit/c34dca74854cb6e7f2b09affa2a4ab0145e62371.patch";
+      hash = "sha256-RZSgHdQy5d7mXtMvkMyr+/kMhp1w+S5v9cqk5NSii5o=";
+    })
+  ];
+
  separateDebugInfo = true;
  enableParallelBuilding = true;
  # Upstream's configure script is not autoconf generated, but a hand written one.
--- a/pkgs/development/libraries/libzen/default.nix
+++ b/pkgs/development/libraries/libzen/default.nix
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ autoreconfHook ];
  configureFlags = [ "--enable-shared" ];

-  sourceRoot = "./ZenLib/Project/GNU/Library/";
+  sourceRoot = "ZenLib/Project/GNU/Library";

  preConfigure = "sh autogen.sh";

--- a/pkgs/development/libraries/liquidfun/default.nix
+++ b/pkgs/development/libraries/liquidfun/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake ];
  buildInputs = [ libGLU libGL libX11 libXi ];

-  sourceRoot = "liquidfun/Box2D/";
+  sourceRoot = "liquidfun/Box2D";

  preConfigurePhases = "preConfigure";

--- a/pkgs/development/libraries/mesa-glu/default.nix
+++ b/pkgs/development/libraries/mesa-glu/default.nix
@ -19,6 +19,8 @@ stdenv.mkDerivation (finalAttrs: {

  outputs = [ "out" "dev" ];

+  enableParallelBuilding = true;
+
  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;

  meta = {
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
  postPatch = ''
    patchShebangs nss

-    for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
+    for f in nss/coreconf/config.gypi nss/build.sh; do
      substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
    done

--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@ -132,6 +132,7 @@ stdenv.mkDerivation rec {
  cmakeDir = "../cmake";

  cmakeFlags = [
+    "-DABSL_ENABLE_INSTALL=ON"
    "-DCMAKE_BUILD_TYPE=RELEASE"
    "-DFETCHCONTENT_FULLY_DISCONNECTED=ON"
    "-DFETCHCONTENT_QUIET=OFF"
@ -143,6 +144,7 @@ stdenv.mkDerivation rec {
    "-DFETCHCONTENT_SOURCE_DIR_MP11=${mp11}"
    "-DFETCHCONTENT_SOURCE_DIR_ONNX=${python3Packages.onnx.src}"
    "-DFETCHCONTENT_SOURCE_DIR_PYTORCH_CPUINFO=${pytorch_cpuinfo}"
+    "-DFETCHCONTENT_SOURCE_DIR_RE2=${re2.src}"
    "-DFETCHCONTENT_SOURCE_DIR_SAFEINT=${safeint}"
    "-DFETCHCONTENT_TRY_FIND_PACKAGE_MODE=ALWAYS"
    "-Donnxruntime_BUILD_SHARED_LIB=ON"
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -75,7 +75,7 @@ let

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.77";
+    version = "0.3.78";

    outputs = [
      "out"
@ -93,7 +93,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-dRAo/GzWvXKVCGLM12YyTQmgXHEYn3QbOyaZKmlqTYY=";
+      sha256 = "sha256-tiVuab8kugp9ZOKL/m8uZQps/pcrVihwB3rRf6SGuzc=";
    };

    patches = [
@ -221,7 +221,7 @@ let
      moveToOutput "bin/pw-jack" "$jack"
    '';

-    passthru.tests = nixosTests.installed-tests.pipewire;
+    passthru.tests.installed-tests = nixosTests.installed-tests.pipewire;

    meta = with lib; {
      description = "Server and user space API to deal with multimedia pipelines";
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@ -46,6 +46,7 @@ let
      ./qtbase.patch.d/0009-qtbase-qtpluginpath.patch
      ./qtbase.patch.d/0010-qtbase-assert.patch
      ./qtbase.patch.d/0011-fix-header_module.patch
+      ./qtbase.patch.d/9999-backport-dbus-crash.patch
    ];
    qtdeclarative = [
      ./qtdeclarative.patch
@ -333,7 +334,17 @@ let
      } ../hooks/wrap-qt-apps-hook.sh;
    };

-in makeScopeWithSplicing' {
-  otherSplices = generateSplicesForMkScope "qt5";
-  f = addPackages;
-}
+  baseScope = makeScopeWithSplicing' {
+    otherSplices = generateSplicesForMkScope "qt5";
+    f = addPackages;
+  };
+
+  bootstrapScope = baseScope.overrideScope(final: prev: {
+    qtbase = prev.qtbase.override { qttranslations = null; };
+    qtdeclarative = null;
+  });
+
+  finalScope = baseScope.overrideScope(final: prev: {
+    qttranslations = bootstrapScope.qttranslations;
+  });
+in finalScope
--- a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch
@ -0,0 +1,79 @@
+commit eb0c6846a5d05d686f0686f0f1ddddcad762ad26 (HEAD -> kde/5.15)
+Author: K900 <me@0upti.me>
+Date:   Mon Aug 14 22:44:02 2023 +0300
+
+    QLibraryPrivate: Actually merge load hints
+
+    Or old and new load hints in mergeLoadHints() instead of just storing
+    new ones. Andjust QLibraryPrivate::setLoadHints() to handle objects
+    with no file name differently and just set load hints directly.
+
+    Mention that load hints are merged once the file name is set
+    in the documentation for QLibrary::setLoadHints().
+
+    Add a regression test into tst_qfactoryloader.
+
+    Update and extend tst_QPluginLoader::loadHints() to take into account
+    load hints merging.
+
+    Fixes: QTBUG-114480
+    Change-Id: I3b9afaec7acde1f5ff992d913f8d7217392c7e00
+    Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
+    Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
+
+diff --git a/src/corelib/plugin/qlibrary.cpp b/src/corelib/plugin/qlibrary.cpp
+index 5d2f024267..45b5a3fe27 100644
+--- a/src/corelib/plugin/qlibrary.cpp
+++ b/src/corelib/plugin/qlibrary.cpp
+@@ -526,7 +526,7 @@ void QLibraryPrivate::mergeLoadHints(QLibrary::LoadHints lh)
+     if (pHnd.loadRelaxed())
+         return;
+
+-    loadHintsInt.storeRelaxed(lh);
+    loadHintsInt.fetchAndOrRelaxed(lh);
+ }
+
+ QFunctionPointer QLibraryPrivate::resolve(const char *symbol)
+@@ -538,6 +538,13 @@ QFunctionPointer QLibraryPrivate::resolve(const char *symbol)
+
+ void QLibraryPrivate::setLoadHints(QLibrary::LoadHints lh)
+ {
+    // Set the load hints directly for a dummy if this object is not associated
+    // with a file. Such object is not shared between multiple instances.
+    if (fileName.isEmpty()) {
+        loadHintsInt.storeRelaxed(lh);
+        return;
+    }
+
+     // this locks a global mutex
+     QMutexLocker lock(&qt_library_mutex);
+     mergeLoadHints(lh);
+@@ -1166,6 +1173,10 @@ QString QLibrary::errorString() const
+     lazy symbol resolution, and will not export external symbols for resolution
+     in other dynamically-loaded libraries.
+
+    \note Hints can only be cleared when this object is not associated with a
+    file. Hints can only be added once the file name is set (\a hints will
+    be or'ed with the old hints).
+
+     \note Setting this property after the library has been loaded has no effect
+     and loadHints() will not reflect those changes.
+
+diff --git a/src/corelib/plugin/qpluginloader.cpp b/src/corelib/plugin/qpluginloader.cpp
+index 0a63b93762..ceee5d6385 100644
+--- a/src/corelib/plugin/qpluginloader.cpp
+++ b/src/corelib/plugin/qpluginloader.cpp
+@@ -414,10 +414,11 @@ QString QPluginLoader::errorString() const
+ void QPluginLoader::setLoadHints(QLibrary::LoadHints loadHints)
+ {
+     if (!d) {
+-        d = QLibraryPrivate::findOrCreate(QString());   // ugly, but we need a d-ptr
+        d = QLibraryPrivate::findOrCreate({}, {}, loadHints); // ugly, but we need a d-ptr
+         d->errorString.clear();
+    } else {
+        d->setLoadHints(loadHints);
+     }
+-    d->setLoadHints(loadHints);
+ }
+
+ QLibrary::LoadHints QPluginLoader::loadHints() const
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@ -15,6 +15,7 @@
  # optional dependencies
 , cups ? null, postgresql ? null
 , withGtk3 ? false, dconf, gtk3
+, qttranslations ? null

  # options
 , libGLSupported ? !stdenv.isDarwin
@ -310,6 +311,8 @@ stdenv.mkDerivation (finalAttrs: {
    ] ++ lib.optionals (mysqlSupport) [
      "-L" "${libmysqlclient}/lib"
      "-I" "${libmysqlclient}/include"
+    ] ++ lib.optional (qttranslations != null) [
+      "-translationdir" "${qttranslations}/translations"
    ]
  );

--- a/pkgs/development/libraries/qt-5/modules/qttools.nix
+++ b/pkgs/development/libraries/qt-5/modules/qttools.nix
@ -36,7 +36,7 @@ qtModule {
    "bin/macdeployqt"
  ];

-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin ''-DNIXPKGS_QMLIMPORTSCANNER="${qtdeclarative.dev}/bin/qmlimportscanner"'';
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.isDarwin && qtdeclarative != null) ''-DNIXPKGS_QMLIMPORTSCANNER="${qtdeclarative.dev}/bin/qmlimportscanner"'';

  setupHook = ../hooks/qttools-setup-hook.sh;
 }
--- a/pkgs/development/libraries/qt-5/modules/qttranslations.nix
+++ b/pkgs/development/libraries/qt-5/modules/qttranslations.nix
@ -2,5 +2,6 @@

 qtModule {
  pname = "qttranslations";
-  qtInputs = [ qttools ];
+  nativeBuildInputs = [ qttools ];
+  outputs = [ "out" ];
 }
--- a/pkgs/development/libraries/qt-5/qtModule.nix
+++ b/pkgs/development/libraries/qt-5/qtModule.nix
@ -17,7 +17,7 @@ mkDerivation (args // {
  patches = (args.patches or []) ++ (patches.${pname} or []);

  nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ perl self.qmake ];
-  propagatedBuildInputs = args.qtInputs ++ (args.propagatedBuildInputs or []);
+  propagatedBuildInputs = (args.qtInputs or []) ++ (args.propagatedBuildInputs or []);

  outputs = args.outputs or [ "out" "dev" ];
  setOutputFlags = args.setOutputFlags or false;
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@ -48,6 +48,7 @@ let
          ./patches/0005-qtbase-deal-with-a-font-face-at-index-0-as-Regular-f.patch
          ./patches/0006-qtbase-qt-cmake-always-use-cmake-from-path.patch
          ./patches/0007-qtbase-find-qt-tools-in-QTTOOLSPATH.patch
+          ./patches/0008-qtbase-allow-translations-outside-prefix.patch
          ./patches/0008-qtbase-find-qmlimportscanner-in-macdeployqt-via-environment.patch
          ./patches/0009-qtbase-check-in-the-QML-folder-of-this-library-does-actuall.patch
          ./patches/0010-qtbase-pass-to-qmlimportscanner-the-QML2_IMPORT_PATH.patch
@ -171,6 +172,14 @@ let

  # TODO(@Artturin): convert to makeScopeWithSplicing'
  # simple example of how to do that in 5568a4d25ca406809530420996d57e0876ca1a01
-  self = lib.makeScope newScope addPackages;
-in
-self
+  baseScope = lib.makeScope newScope addPackages;
+
+  bootstrapScope = baseScope.overrideScope'(final: prev: {
+    qtbase = prev.qtbase.override { qttranslations = null; };
+    qtdeclarative = null;
+  });
+
+  finalScope = baseScope.overrideScope'(final: prev: {
+    qttranslations = bootstrapScope.qttranslations;
+  });
+in finalScope
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@ -93,6 +93,7 @@
 , libGL
 , debug ? false
 , developerBuild ? false
+, qttranslations ? null
 }:

 let
@ -233,7 +234,7 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals stdenv.isDarwin [
    # error: 'path' is unavailable: introduced in macOS 10.15
    "-DQT_FEATURE_cxx17_filesystem=OFF"
-  ];
+  ] ++ lib.optional (qttranslations != null) "-DINSTALL_TRANSLATIONSDIR=${qttranslations}/translations";

  NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [
    # Undefined symbols for architecture arm64: "___gss_c_nt_hostbased_service_oid_desc"
--- a/pkgs/development/libraries/qt-6/modules/qttranslations.nix
+++ b/pkgs/development/libraries/qt-6/modules/qttranslations.nix
@ -4,5 +4,6 @@

 qtModule {
  pname = "qttranslations";
-  qtInputs = [ qttools ];
+  nativeBuildInputs = [ qttools ];
+  outputs = [ "out" ];
 }
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@ -14,8 +14,6 @@
 , python3
 , which
 , nodejs
-, qtbase
-, perl
 , xorg
 , libXcursor
 , libXScrnSaver
@ -51,8 +49,6 @@
 , systemd
 , pipewire
 , gn
-, runCommand
-, writeScriptBin
 , ffmpeg_4
 , lib
 , stdenv
@ -60,10 +56,8 @@
 , libxml2
 , libxslt
 , lcms2
-, re2
 , libkrb5
 , mesa
-, xkeyboard_config
 , enableProprietaryCodecs ? true
  # darwin
 , llvmPackages_14
@ -135,7 +129,11 @@ qtModule {
    # environment variable, since NixOS relies on it working.
    # See https://github.com/NixOS/nixpkgs/issues/226484 for more context.
    ../patches/qtwebengine-xkb-includes.patch
+
    ../patches/qtwebengine-link-pulseaudio.patch
+
+    # Override locales install path so they go to QtWebEngine's $out
+    ../patches/qtwebengine-locales-path.patch
  ];

  postPatch = ''
@ -225,7 +223,6 @@ qtModule {
    libxml2
    libxslt
    lcms2
-    re2

    libevent
    ffmpeg_4
--- a/Show More
+++ b/Show More