Merge branch 'master' into haskell-updates

f1f9ae6a3b causes everything to rebuild
2023-02-13 15:44:13 +01:00 · 2023-02-13 15:44:13 +01:00 · dc2feb983f
commit dc2feb983f
parent 75cdc109f0 f1f9ae6a3b
403 changed files with 4578 additions and 4414 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -16490,7 +16490,7 @@
    name = "zimbatm";
  };
  Zimmi48 = {
-    email = "theo.zimmermann@univ-paris-diderot.fr";
+    email = "theo.zimmermann@telecom-paris.fr";
    github = "Zimmi48";
    githubId = 1108325;
    name = "Théo Zimmermann";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -312,6 +312,19 @@ with lib.maintainers; {
    enableFeatureFreezePing = true;
  };

+  graalvm-ce = {
+    members = [
+      bandresen
+      hlolli
+      glittershark
+      babariviere
+      ericdallo
+      thiagokokada
+    ];
+    scope = "Maintain GraalVM Community Edition packages.";
+    shortName = "GraalVM-CE";
+  };
+
  haskell = {
    members = [
      cdepillabout
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -99,6 +99,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Calling `makeSetupHook` without passing a `name` argument is deprecated.

+- The `cosmoc` package has been removed. The upstream scripts in `cosmocc` should be used instead.
+
 - Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually.

 - The [services.wordpress.sites.&lt;name&gt;.plugins](#opt-services.wordpress.sites._name_.plugins) and [services.wordpress.sites.&lt;name&gt;.themes](#opt-services.wordpress.sites._name_.themes) options have been converted from sets to attribute sets to allow for consumers to specify explicit install paths via attribute name.
--- a/nixos/modules/services/matrix/appservice-discord.nix
+++ b/nixos/modules/services/matrix/appservice-discord.nix
@ -5,7 +5,6 @@ with lib;
 let
  dataDir = "/var/lib/matrix-appservice-discord";
  registrationFile = "${dataDir}/discord-registration.yaml";
-  appDir = "${pkgs.matrix-appservice-discord}/${pkgs.matrix-appservice-discord.passthru.nodeAppDir}";
  cfg = config.services.matrix-appservice-discord;
  opt = options.services.matrix-appservice-discord;
  # TODO: switch to configGen.json once RFC42 is implemented
@ -16,6 +15,15 @@ in {
    services.matrix-appservice-discord = {
      enable = mkEnableOption (lib.mdDoc "a bridge between Matrix and Discord");

+      package = mkOption {
+        type = types.package;
+        default = pkgs.matrix-appservice-discord;
+        defaultText = literalExpression "pkgs.matrix-appservice-discord";
+        description = lib.mdDoc ''
+          Which package of matrix-appservice-discord to use.
+        '';
+      };
+
      settings = mkOption rec {
        # TODO: switch to types.config.json as prescribed by RFC42 once it's implemented
        type = types.attrs;
@ -114,7 +122,7 @@ in {

      preStart = ''
        if [ ! -f '${registrationFile}' ]; then
-          ${pkgs.matrix-appservice-discord}/bin/matrix-appservice-discord \
+          ${cfg.package}/bin/matrix-appservice-discord \
            --generate-registration \
            --url=${escapeShellArg cfg.url} \
            ${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \
@ -135,13 +143,13 @@ in {

        DynamicUser = true;
        PrivateTmp = true;
-        WorkingDirectory = appDir;
+        WorkingDirectory = "${cfg.package}/${cfg.package.passthru.nodeAppDir}";
        StateDirectory = baseNameOf dataDir;
        UMask = "0027";
        EnvironmentFile = cfg.environmentFile;

        ExecStart = ''
-          ${pkgs.matrix-appservice-discord}/bin/matrix-appservice-discord \
+          ${cfg.package}/bin/matrix-appservice-discord \
            --file='${registrationFile}' \
            --config='${settingsFile}' \
            --port='${toString cfg.port}'
--- a/nixos/tests/systemd-cryptenroll.nix
+++ b/nixos/tests/systemd-cryptenroll.nix
@ -2,7 +2,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
  name = "systemd-cryptenroll";
  meta = with pkgs.lib.maintainers; {
    maintainers = [ ymatsiuk ];
-    broken = true; # times out after two hours, details -> https://github.com/NixOS/nixpkgs/issues/167994
  };

  nodes.machine = { pkgs, lib, ... }: {
--- a/pkgs/applications/audio/aether-lv2/default.nix
+++ b/pkgs/applications/audio/aether-lv2/default.nix
@ -18,6 +18,12 @@ stdenv.mkDerivation rec {
    lv2 libX11 libGL libGLU mesa
  ];

+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+    "-Wno-error=stringop-overflow"
+  ];
+
  installPhase = ''
    mkdir -p $out/lib/lv2
    cp -r aether.lv2 $out/lib/lv2
--- a/pkgs/applications/audio/bespokesynth/default.nix
+++ b/pkgs/applications/audio/bespokesynth/default.nix
@ -66,6 +66,10 @@ stdenv.mkDerivation rec {
    fetchSubmodules = true;
  };

+  postPatch = ''
+    sed '1i#include <memory>' -i Source/TitleBar.h # gcc12
+  '';
+
  cmakeBuildType = "Release";

  cmakeFlags = lib.optionals enableVST2 [ "-DBESPOKE_VST2_SDK_LOCATION=${vst-sdk}/VST2_SDK" ];
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
    sha256 = "17x4hylgq4dn9qycsdacfxy64f5cv57n2qgkvsdp524gnqzw4az3";
  };

+  outputs = [ "out" "doc" ];
+
  enableParallelBuilding = true;

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@ -63,6 +63,12 @@ stdenv.mkDerivation rec {
    "-DWARNINGS_ARE_ERRORS=ON"
  ];

+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or aarch64 (old gcc)
+    "-Wno-error=mismatched-new-delete"
+    "-Wno-error=use-after-free"
+  ];
+
  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
    # Normal CMake install phase on Darwin only installs the binary, the user is expected to use CPack to build a
    # bundle. That adds alot of overhead for not much benefit (CPack is currently abit broken, and needs impure access
--- a/pkgs/applications/audio/jack-rack/default.nix
+++ b/pkgs/applications/audio/jack-rack/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
  };
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ libjack2 ladspaH gtk2 alsa-lib libxml2 lrdf ];
-  NIX_LDFLAGS = "-ldl -lm -lpthread";
+  NIX_LDFLAGS = "-lm -lpthread";

  meta = {
    description = ''An effects "rack" for the JACK low latency audio API'';
--- a/pkgs/applications/audio/jamin/default.nix
+++ b/pkgs/applications/audio/jamin/default.nix
@ -21,8 +21,6 @@ stdenv.mkDerivation rec {
  #       `l_notebook1'; jamin-callbacks.o:/build/jamin-0.95.0/src/hdeq.h:64: first defined here
  NIX_CFLAGS_COMPILE = "-fcommon";

-  NIX_LDFLAGS = "-ldl";
-
  postInstall = ''
    wrapProgram $out/bin/jamin --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa
  '';
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -4,19 +4,21 @@
 , ladspaH, php, libXrandr }:

 stdenv.mkDerivation rec {
-        pname = "lsp-plugins";
-        version = "1.2.5";
+  pname = "lsp-plugins";
+  version = "1.2.5";

-        src = fetchurl {
-                url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-                sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
-        };
+  src = fetchurl {
+    url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
+    sha256 = "sha256-YYrt+FbpY7iEui0aw4Ce94BW1SHDk0OH8gFSzkW2fkw=";
+  };

-        nativeBuildInputs = [ pkg-config php makeWrapper ];
-        buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];
+  outputs = [ "out" "dev" "doc" ];

-        makeFlags = [
-                "PREFIX=${placeholder "out"}"
+  nativeBuildInputs = [ pkg-config php makeWrapper ];
+  buildInputs = [ jack2 libsndfile libGLU libGL lv2 cairo ladspaH libXrandr ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
  ];

  NIX_CFLAGS_COMPILE = "-DLSP_NO_EXPERIMENTAL";
--- a/pkgs/applications/audio/mimic/default.nix
+++ b/pkgs/applications/audio/mimic/default.nix
@ -38,6 +38,11 @@ stdenv.mkDerivation rec {
    pcre2
  ] ++ lib.optional pulseaudioSupport libpulseaudio;

+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=free-nonheap-object"
+  ];
+
  postInstall = ''
    wrapProgram $out/bin/mimic \
      --run "export ALSA_PLUGIN_DIR=${alsa-plugins}/lib/alsa-lib"
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "mpg123";
-  version = "1.29.3";
+  version = "1.31.2";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-ljiF2Mx3Ji8ot3GHx9GJ4yGV5kJE3iUwt5jd8yGD6Ec=";
+    sha256 = "sha256-sX8ikF4x9DtrQB399qce0Ru30Fb2jbRJ1wufmug5x94=";
  };

  outputs = [ "out" ] ++ lib.optionals withConplay [ "conplay" ];
--- a/pkgs/applications/audio/odin2/default.nix
+++ b/pkgs/applications/audio/odin2/default.nix
@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-N96Nb7G6hqfh8DyMtHbttl/fRZUkS8f2KfPSqeMAhHY=";
  };

+  postPatch = ''
+    sed '1i#include <utility>' -i \
+      libs/JUCELV2/modules/juce_gui_basics/windows/juce_ComponentPeer.h # gcc12
+  '';
+
  nativeBuildInputs = [
    cmake
    pkg-config
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, openssl, libogg, libopus }:
+{ lib, stdenv, fetchurl, pkg-config, openssl, libogg, libopus, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "opusfile";
@ -12,7 +12,14 @@ stdenv.mkDerivation rec {
  buildInputs = [ openssl libogg ];
  propagatedBuildInputs = [ libopus ];
  outputs = [ "out" "dev" ];
-  patches = [ ./include-multistream.patch ]
+  patches = [
+    ./include-multistream.patch
+    (fetchpatch {
+      name = "CVE-2022-47021.patch";
+      url = "https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5.patch";
+      sha256 = "sha256-XThI/ys5caB+OncFVfxm5IsvQPy1MbLQKwIlYjPvTJQ=";
+    })
+  ]
    # fixes problem with openssl 1.1 dependency
    # see https://github.com/xiph/opusfile/issues/13
    ++ lib.optionals stdenv.hostPlatform.isWindows [ ./disable-cert-store.patch ];
--- a/pkgs/applications/audio/stochas/default.nix
+++ b/pkgs/applications/audio/stochas/default.nix
@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
    fetchSubmodules = true;
  };

+  postPatch = ''
+    sed '1i#include <utility>' -i \
+      lib/JUCE/modules/juce_gui_basics/windows/juce_ComponentPeer.h # gcc12
+  '';
+
  nativeBuildInputs = [ cmake pkg-config ];

  buildInputs = [
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation (rec {
  pname = "ed";
-  version = "1.18";
+  version = "1.19";

  src = fetchurl {
    url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    sha256 = "sha256-rKjvrZgAxYdySiC5eqj8R+a1pH34Fgb+q6gxsHRGK08=";
+    hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
  };

  nativeBuildInputs = [ lzip ];
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@ -80,13 +80,13 @@ in stdenv.mkDerivation rec {
    moveToOutput share/vim "$out"
  '';

+  # Prevent tclPackageHook from auto-wrapping all binaries, we only
+  # need to wrap poke-gui
+  dontWrapTclBinaries = true;
+
  postFixup = lib.optionalString guiSupport ''
    wrapProgram "$out/bin/poke-gui" \
      --prefix TCLLIBPATH ' ' "$TCLLIBPATH"
-
-    # Prevent tclPackageHook from auto-wrapping all binaries, we only
-    # need to wrap poke-gui
-    unset TCLLIBPATH
  '';

  passthru = {
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@ -1,126 +1,190 @@
-{ stdenv
-, lib
-, fetchpatch
-, pkg-config
-, cmake
-, bluez
-, ffmpeg
-, libao
-, gtk3
-, glib
-, libGLU
-, libGL
-, gettext
-, libpthreadstubs
-, libXrandr
-, libXext
-, readline
-, openal
-, libXdmcp
-, portaudio
+{ lib
+, stdenv
 , fetchFromGitHub
-, libusb1
-, libevdev
-, wxGTK30
-, soundtouch
-, miniupnpc
-, mbedtls_2
+, cmake
+, pkg-config
+, wrapQtAppsHook
+, alsa-lib
+, bluez
+, bzip2
+, cubeb
 , curl
-, lzo
+, enet
+, ffmpeg
+, fmt_8
+, hidapi
+, libevdev
+, libGL
+, libiconv
+, libpulseaudio
+, libspng
+, libusb1
+, libXdmcp
+, libXext
+, libXrandr
+, mbedtls_2
+, mgba
+, miniupnpc
+, minizip-ng
+, openal
+, pugixml
+, qtbase
 , sfml
-, libpulseaudio ? null
+, soundtouch
+, udev
+, vulkan-loader
+, xxHash
+, xz
+
+  # Used in passthru
+, common-updater-scripts
+, dolphin-emu
+, jq
+, testers
+, writeShellScript
+
+  # Darwin-only dependencies
+, CoreBluetooth
+, ForceFeedback
+, IOKit
+, moltenvk
+, OpenGL
+, VideoToolbox
 }:

 stdenv.mkDerivation rec {
  pname = "dolphin-emu";
-  version = "5.0";
+  version = "5.0-18498";

  src = fetchFromGitHub {
    owner = "dolphin-emu";
    repo = "dolphin";
-    rev = version;
-    sha256 = "07mlfnh0hwvk6xarcg315x7z2j0qbg9g7cm040df9c8psiahc3g6";
+    rev = "46b99671d9158e0ca840c1d8ef249db0f321ced7";
+    sha256 = "sha256-K+OF8o8I1XDLQQcsWC8p8jUuWeb+RoHlBG3cEZ1aWIU=";
+    fetchSubmodules = true;
  };

-  patches = [
-    # Fix FTBFS with glibc 2.26
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/02_glibc-2.26.patch";
-      name = "02_glibc-2.26.patch";
-      sha256 = "sha256-LBXT3rf5klwmX9YQXt4/iv06GghsWZprNhLGYlKiDqk=";
-    })
-    # Fix FTBFS with GCC 8
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/03_gcc8.patch";
-      name = "03_gcc8.patch";
-      sha256 = "sha256-uWP6zMjoHYbX6K+oPSQdBn2xWQpvNyhZabMkhtYrSbU=";
-    })
-    # Fix FTBFS with SoundTouch 2.1.2
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/05_soundtouch-2.1.2.patch";
-      name = "05_soundtouch-2.1.2.patch";
-      sha256 = "sha256-Y7CNM6GQC9GRhlOBLZlxkIpj1CFhIwA5L8lGXur/bwY=";
-    })
-    # Use GTK+3 wxWidgets backend
-    (fetchpatch {
-      url = "https://salsa.debian.org/games-team/dolphin-emu/raw/8c952b1fcd46259e9d8cce836df433e0a8b88f8c/debian/patches/06_gtk3.patch";
-      name = "06_gtk3.patch";
-      sha256 = "sha256-pu5Q0+8kNwmpf2DoXCXHFqxF0EGTnFXJipkBz1Vh2cs=";
-    })
-  ];
-
-  cmakeFlags = [
-    "-DENABLE_LTO=True"
-  ];
-
  nativeBuildInputs = [
-    pkg-config
    cmake
+    pkg-config
+    wrapQtAppsHook
  ];

  buildInputs = [
-    bluez
-    ffmpeg
-    libao
-    libGLU
-    libGL
-    gtk3
-    glib
-    gettext
-    libpthreadstubs
-    libXrandr
-    libXext
-    readline
-    openal
-    libevdev
-    libXdmcp
-    portaudio
-    libpulseaudio
-    libevdev
-    libXdmcp
-    portaudio
-    libusb1
-    libpulseaudio
-    wxGTK30
-    soundtouch
-    miniupnpc
-    mbedtls_2
+    bzip2
+    cubeb
    curl
-    lzo
+    enet
+    ffmpeg
+    fmt_8
+    hidapi
+    libGL
+    libiconv
+    libpulseaudio
+    libspng
+    libusb1
+    libXdmcp
+    mbedtls_2
+    miniupnpc
+    minizip-ng
+    openal
+    pugixml
+    qtbase
    sfml
+    soundtouch
+    xxHash
+    xz
+  ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    bluez
+    libevdev
+    libXext
+    libXrandr
+    mgba # Derivation doesn't support Darwin
+    udev
+    vulkan-loader
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreBluetooth
+    ForceFeedback
+    IOKit
+    moltenvk
+    OpenGL
+    VideoToolbox
  ];

+  cmakeFlags = [
+    "-DDISTRIBUTOR=NixOS"
+    "-DUSE_SHARED_ENET=ON"
+    "-DDOLPHIN_WC_REVISION=${src.rev}"
+    "-DDOLPHIN_WC_DESCRIBE=${version}"
+    "-DDOLPHIN_WC_BRANCH=master"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
+    "-DUSE_BUNDLED_MOLTENVK=OFF"
+    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
+    "-DSKIP_POSTPROCESS_BUNDLE=ON"
+    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
+    # Note: The updater isn't available on linux, so we dont need to disable it there.
+    "-DENABLE_AUTOUPDATE=OFF"
+  ];
+
+  qtWrapperArgs = lib.optionals stdenv.isLinux [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+    # https://bugs.dolphin-emu.org/issues/11807
+    # The .desktop file should already set this, but Dolphin may be launched in other ways
+    "--set QT_QPA_PLATFORM xcb"
+  ];
+
+  # https://github.com/NixOS/nixpkgs/issues/201254
+  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
+
+  # Use nix-provided libraries instead of submodules
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace CMakeLists.txt \
+      --replace "if(NOT APPLE)" "if(true)" \
+      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
+  '';
+
  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
    install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Only gets installed automatically if the standalone executable is used
+    mkdir -p $out/Applications
+    cp -r ./Binaries/Dolphin.app $out/Applications
+    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
  '';

+  passthru = {
+    tests.version = testers.testVersion {
+      package = dolphin-emu;
+      command = "dolphin-emu-nogui --version";
+    };
+
+    updateScript = writeShellScript "dolphin-update-script" ''
+      set -eou pipefail
+      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
+
+      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
+      version="$(jq -r '.shortrev' <<< "$json")"
+      rev="$(jq -r '.hash' <<< "$json")"
+      update-source-version dolphin-emu "$version" --rev="$rev"
+    '';
+  };
+
  meta = with lib; {
-    homepage = "https://dolphin-emu.org/";
+    homepage = "https://dolphin-emu.org";
    description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
+    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
+    branch = "master";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ MP2E ashkitten ];
-    # x86_32 is an unsupported platform.
-    # Enable generic build if you really want a JIT-less binary.
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      MP2E
+      ashkitten
+      xfix
+      ivar
+    ];
+    # Requires both LLVM and SDK bump
+    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
 }
--- a/pkgs/applications/emulators/dolphin-emu/master.nix
+++ b/pkgs/applications/emulators/dolphin-emu/master.nix
@ -1,196 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, cmake
-, wrapQtAppsHook
-, qtbase
-, bluez
-, ffmpeg
-, libGL
-, libXrandr
-, libusb1
-, libXdmcp
-, libXext
-, openal
-, udev
-, libevdev
-, cubeb
-, curl
-, alsa-lib
-, miniupnpc
-, enet
-, mbedtls_2
-, soundtouch
-, sfml
-, minizip-ng
-, xz
-, hidapi
-, fmt_8
-, vulkan-loader
-, libpulseaudio
-, bzip2
-, libiconv
-, pugixml
-, xxHash
-
-  # Used in passthru
-, testers
-, dolphin-emu-beta
-, writeShellScript
-, common-updater-scripts
-, jq
-
-  # Darwin-only dependencies
-, CoreBluetooth
-, ForceFeedback
-, IOKit
-, VideoToolbox
-, OpenGL
-, libpng
-, moltenvk
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dolphin-emu";
-  version = "5.0-17995";
-
-  src = fetchFromGitHub {
-    owner = "dolphin-emu";
-    repo = "dolphin";
-    rev = "8bad821019721b9b72701b495da95656ace5fea5";
-    sha256 = "sha256-uxHzn+tXRBr11OPpZ4ELBw7DTJH4mnqUBOeyPlXNAh8=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # On x86_64-darwin CMake reportedly does not work without this in some cases.
-    # See https://github.com/NixOS/nixpkgs/pull/190373#issuecomment-1241310765
-    ./minizip-external-missing-include.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    cubeb
-    curl
-    ffmpeg
-    pugixml
-    xxHash
-    libGL
-    libpulseaudio
-    openal
-    libusb1
-    libiconv
-    libpng
-    libXdmcp
-    hidapi
-    miniupnpc
-    enet
-    mbedtls_2
-    soundtouch
-    sfml
-    minizip-ng
-    xz
-    qtbase
-    fmt_8
-    bzip2
-  ] ++ lib.optionals stdenv.isLinux [
-    libXrandr
-    libXext
-    bluez
-    udev
-    libevdev
-    alsa-lib
-    vulkan-loader
-  ] ++ lib.optionals stdenv.isDarwin [
-    CoreBluetooth
-    OpenGL
-    ForceFeedback
-    IOKit
-    VideoToolbox
-    moltenvk
-  ];
-
-  cmakeFlags = [
-    "-DDISTRIBUTOR=NixOS"
-    "-DUSE_SHARED_ENET=ON"
-    "-DDOLPHIN_WC_REVISION=${src.rev}"
-    "-DDOLPHIN_WC_DESCRIBE=${version}"
-    "-DDOLPHIN_WC_BRANCH=master"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
-    "-DUSE_BUNDLED_MOLTENVK=OFF"
-    # Bundles the application folder into a standalone executable, so we cannot devendor libraries
-    "-DSKIP_POSTPROCESS_BUNDLE=ON"
-    # Needs xcode so compilation fails with it enabled. We would want the version to be fixed anyways.
-    # Note: The updater isn't available on linux, so we dont need to disable it there.
-    "-DENABLE_AUTOUPDATE=OFF"
-  ];
-
-  qtWrapperArgs = lib.optionals stdenv.isLinux [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
-    # https://bugs.dolphin-emu.org/issues/11807
-    # The .desktop file should already set this, but Dolphin may be launched in other ways
-    "--set QT_QPA_PLATFORM xcb"
-    # https://bugs.dolphin-emu.org/issues/12913
-    "--set QT_XCB_NO_XI2 1"
-  ];
-
-  # https://github.com/NixOS/nixpkgs/issues/201254
-  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
-
-  # Use nix-provided libraries instead of submodules
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace CMakeLists.txt \
-      --replace "if(NOT APPLE)" "if(true)" \
-      --replace "if(LIBUSB_FOUND AND NOT APPLE)" "if(LIBUSB_FOUND)"
-  '';
-
-  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
-    install -D $src/Data/51-usb-device.rules $out/etc/udev/rules.d/51-usb-device.rules
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Only gets installed automatically if the standalone executable is used
-    mkdir -p $out/Applications
-    cp -r ./Binaries/Dolphin.app $out/Applications
-    ln -s $out/Applications/Dolphin.app/Contents/MacOS/Dolphin $out/bin
-  '';
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = dolphin-emu-beta;
-      command = "dolphin-emu-nogui --version";
-    };
-
-    updateScript = writeShellScript "dolphin-update-script" ''
-      set -eou pipefail
-      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
-
-      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
-      version="$(jq -r '.shortrev' <<< "$json")"
-      rev="$(jq -r '.hash' <<< "$json")"
-      update-source-version dolphin-emu-beta "$version" --rev="$rev"
-    '';
-  };
-
-  meta = with lib; {
-    homepage = "https://dolphin-emu.org";
-    description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
-    mainProgram = if stdenv.hostPlatform.isDarwin then "Dolphin" else "dolphin-emu";
-    branch = "master";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
-      MP2E
-      ashkitten
-      xfix
-      ivar
-    ];
-    # Requires both LLVM and SDK bump
-    broken = stdenv.isDarwin && stdenv.isx86_64;
-  };
-}
--- a/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
+++ b/pkgs/applications/emulators/dolphin-emu/minizip-external-missing-include.patch
@ -1,18 +0,0 @@
-commit 5e0cb8066fb1653399c54e93e42375295c2562bd
-Author: Ivar Scholten <ivar.scholten@protonmail.com>
-Date:   Fri Sep 9 14:27:55 2022 +0200
-
-    Externals/minizip: add missing include to CheckFunctionExists
-
-diff --git a/Externals/minizip/CMakeLists.txt b/Externals/minizip/CMakeLists.txt
-index c3d7c5512e..f59f8b295c 100644
--- a/Externals/minizip/CMakeLists.txt
-+++ b/Externals/minizip/CMakeLists.txt
-@@ -60,6 +60,7 @@ if (HAVE_INTTYPES_H)
-   target_compile_definitions(minizip PRIVATE HAVE_INTTYPES_H)
- endif()
-
-+include(CheckFunctionExists)
- check_function_exists(fseeko HAVE_FSEEKO)
- if (NOT HAVE_FSEEKO)
-   target_compile_definitions(minizip PRIVATE NO_FSEEKO)
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@ -117,6 +117,10 @@ stdenv.mkDerivation rec {
      --subst-var-by mamePath "$out/opt/mame"
  '';

+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=use-after-free"
+  ];
+
  desktopItems = [
    (makeDesktopItem {
      name = "MAME";
--- a/pkgs/applications/emulators/rpcs3/default.nix
+++ b/pkgs/applications/emulators/rpcs3/default.nix
@ -1,4 +1,4 @@
-{ gcc11Stdenv, lib, fetchFromGitHub, wrapQtAppsHook, cmake, pkg-config, git
+{ gcc12Stdenv, lib, fetchFromGitHub, wrapQtAppsHook, cmake, pkg-config, git
 , qtbase, qtquickcontrols, qtmultimedia, openal, glew, vulkan-headers, vulkan-loader, libpng
 , ffmpeg, libevdev, libusb1, zlib, curl, wolfssl, python3, pugixml, faudio, flatbuffers
 , sdl2Support ? true, SDL2
@ -21,7 +21,7 @@ let
    sha256 = "0c3g30rj1y8fbd2q4kwlpg1jdy02z4w5ryhj3yr9051pdnf4kndz";
  };
 in
-gcc11Stdenv.mkDerivation {
+gcc12Stdenv.mkDerivation {
  pname = "rpcs3";
  version = rpcs3Version;

--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -47,13 +47,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.0-61";
+  version = "7.1.0-62";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = finalAttrs.version;
-    hash = "sha256-g7WeqPpPd1gceU+s+vRDpb41IX1lzpiqh3cAYeFdUlg=";
+    hash = "sha256-K74BWxGTpkaE+KBrdOCVd+m/2MJP6YUkB2CFh/YEHyI=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@ -46,6 +46,11 @@ stdenv.mkDerivation rec {
    ++ lib.optionals stdenv.hostPlatform.isLinux [ libX11 libXrandr libXinerama libXcursor libXi libXext alsa-lib fontconfig libGLU ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ AVFoundation Carbon Cocoa CoreAudio Kernel OpenGL ];

+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=array-bounds"
+  ];
+
  installPhase = ''
    runHook preInstall

--- a/pkgs/applications/graphics/goxel/default.nix
+++ b/pkgs/applications/graphics/goxel/default.nix
@ -16,6 +16,12 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ scons pkg-config wrapGAppsHook ];
  buildInputs = [ glfw3 gtk3 libpng12 ];
+
+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=format-truncation"
+  ];
+
  NIX_LDFLAGS = "-lpthread";

  buildPhase = ''
--- a/pkgs/applications/graphics/hdrmerge/default.nix
+++ b/pkgs/applications/graphics/hdrmerge/default.nix
@ -46,6 +46,11 @@ mkDerivation rec {
      url = "https://github.com/mkroehnert/hdrmerge/commit/472b2dfe7d54856158aea3d5412a02d0bab1da4c.patch";
      sha256 = "0jc713ajr4w08pfbi6bva442prj878nxp1fpl9112i3xj34x9sdi";
    })
+    (fetchpatch {
+      name = "support-libraw-0.21.patch";
+      url = "https://github.com/jcelaya/hdrmerge/commit/779e566b3e2807280b78c79affda2cdfa64bde87.diff";
+      sha256 = "48sivCfJWEtGiBXTrO+SWTVlT9xyx92w2kkB8Wt/clk=";
+    })
  ];

  desktopItems = [
--- a/pkgs/applications/graphics/jpegoptim/default.nix
+++ b/pkgs/applications/graphics/jpegoptim/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, libjpeg }:

 stdenv.mkDerivation rec {
-  version = "1.5.1";
+  version = "1.5.2";
  pname = "jpegoptim";

  src = fetchFromGitHub {
    owner = "tjko";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-QPipwBk+BS/u3YxB8ACeFXQSuoW1aynEyG3tEMrhcaE=";
+    sha256 = "sha256-PROQvOqsis8we58OOZ/kuY+L/CoV7XfnY9wvrpsTJu8=";
  };

  # There are no checks, it seems.
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@ -1,7 +1,7 @@
 { callPackage, ... } @ args:

 callPackage ./generic.nix (args // {
-  version = "5.1.4";
+  version = "5.1.5";
  kde-channel = "stable";
-  sha256 = "sha256-wisCCGJZbrL92RHhsXnbvOewgb4RFFei6sr2rhzKLcs=";
+  sha256 = "1lx4x4affkbh47b7w5qvahkkr4db0vcw6h24nykak6gpy2z5wxqw";
 })
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@ -6,7 +6,7 @@
 }:

 let
-  version = "5.10.0";
+  version = "5.11.0";

  docFiles = [
    (fetchurl {
@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
    owner = "paraview";
    repo = "paraview";
    rev = "v${version}";
-    sha256 = "0ipx6zq44hpic7gvv0s2jvjncak6vlmrz5sp9ypc15b15bna0gs2";
+    sha256 = "sha256-WvkKGl5lG+apX6m4ULVZZVtDsSUjEVXe/seh95b+LmI=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@ -11,6 +11,12 @@ mkDerivation rec {
    sha256 = "sha256-xr7SYzQZiY4Bp8w1AxDX2TS/WRyrcln8JYGqTADq+ng=";
  };

+  # Needed with GCC 12
+  postPatch = ''
+    sed '1i#include <iterator>' -i src/lyxfind.cpp
+    sed '1i#include <cstring>'  -i src/insets/InsetListings.cpp
+  '';
+
  # LaTeX is used from $PATH, as people often want to have it with extra pkgs
  nativeBuildInputs = [ pkg-config makeWrapper ];
  buildInputs = [
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@ -140,13 +140,16 @@ in stdenv.mkDerivation rec {
    patchShebangs tools/get_wb_version.sh
  '';

-  NIX_CFLAGS_COMPILE = toString ([
+  NIX_CFLAGS_COMPILE = [
    # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
    "-Wno-error=deprecated-declarations"
  ] ++ lib.optionals stdenv.isAarch64 [
    # error: narrowing conversion of '-1' from 'int' to 'char'
    "-Wno-error=narrowing"
-  ]);
+  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but problematic with some old GCCs
+    "-Wno-error=maybe-uninitalized"
+  ];

  cmakeFlags = [
    "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
--- a/pkgs/applications/misc/regextester/default.nix
+++ b/pkgs/applications/misc/regextester/default.nix
@ -11,18 +11,19 @@
 , ninja
 , gobject-introspection
 , gsettings-desktop-schemas
+, desktop-file-utils
 , pantheon
 , wrapGAppsHook }:

 stdenv.mkDerivation rec {
  pname = "regextester";
-  version = "1.0.1";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "artemanufrij";
    repo = "regextester";
    rev = version;
-    sha256 = "1xwwv1hccni1mrbl58f7ly4qfq6738vn24bcbl2q346633cd7kx3";
+    hash = "sha256-5+gU8DeB99w2h/4vMal2eHkR0305dmRYiY6fsLZzlnc=";
  };

  nativeBuildInputs = [
@ -34,6 +35,7 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    wrapGAppsHook
+    desktop-file-utils
  ];

  buildInputs = [
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "23.1.2";
-  sha256 = "1c8l5zzy5pjilp1a84084g3dgdm0rxkx7hj7lqcn0iihfvhxc1xq";
-  vendorSha256 = "sha256-6dOX3SsKjpwC/dEUO2SnVna99lpav7kIEKrMUy4YfhA=";
+  version = "23.2.1";
+  sha256 = "0qjl6qxfg6bj22fwm2y01if5dqp2w79y45ibrg46r33pf6gbwjxj";
+  vendorSha256 = "sha256-YxWBjbE3aBFfCbQeSTfQv5QzP5n4IRHHqNrFwrJPQ7g=";
 }
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pluto";
-  version = "5.12.0";
+  version = "5.13.3";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "pluto";
    rev = "v${version}";
-    sha256 = "sha256-WE/XWNBy5p8PEQ11s8nmW+HoVEkQB9cKoj5ZS8Suvs8=";
+    sha256 = "sha256-6kbfsqhALf7LFl0GS4VAMTVDFKP+CaEr6IPfpTZ33Fo=";
  };

-  vendorHash = "sha256-F5Vh9wPd53bifLStk6wEwidPZvOjN87jn4RxJbSuW4o=";
+  vendorHash = "sha256-lXW1yHrGLwZdhfkMLeu7zm0w2HxXk1DW+QEY+rfGZpE=";

  ldflags = [
    "-w" "-s"
--- a/pkgs/applications/networking/instant-messengers/jami/client.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/client.nix
@ -9,7 +9,7 @@
 , python3
 , qttools # for translations
 , wrapQtAppsHook
-, ffmpeg-jami
+, ffmpeg_5
 , jami-daemon
 , libnotify
 , qt5compat
@ -43,7 +43,7 @@ stdenv.mkDerivation {
  ];

  buildInputs = [
-    ffmpeg-jami
+    ffmpeg_5
    jami-daemon
    libnotify
    networkmanager
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common
+++ b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_common
@ -1,156 +0,0 @@
--disable-everything
--enable-zlib
--enable-gpl
--enable-swscale
--enable-bsfs
--disable-filters
--disable-programs
--disable-postproc
--disable-protocols
--enable-protocol=crypto
--enable-protocol=file
--enable-protocol=rtp
--enable-protocol=srtp
--enable-protocol=tcp
--enable-protocol=udp
--enable-protocol=unix
--enable-protocol=pipe
--disable-demuxers
--disable-muxers
--enable-muxer=rtp
--enable-muxer=g722
--enable-muxer=g723_1
--enable-muxer=g726
--enable-muxer=g726le
--enable-muxer=h263
--enable-muxer=h264
--enable-muxer=hevc
--enable-muxer=matroska
--enable-muxer=webm
--enable-muxer=ogg
--enable-muxer=pcm_s16be
--enable-muxer=pcm_s16le
--enable-demuxer=rtp
--enable-demuxer=mjpeg
--enable-demuxer=mjpeg_2000
--enable-demuxer=mpegvideo
--enable-demuxer=gif
--enable-demuxer=image_jpeg_pipe
--enable-demuxer=image_png_pipe
--enable-demuxer=image_webp_pipe
--enable-demuxer=matroska
--enable-demuxer=m4v
--enable-demuxer=mp3
--enable-demuxer=ogg
--enable-demuxer=flac
--enable-demuxer=wav
--enable-demuxer=ac3
--enable-demuxer=g722
--enable-demuxer=g723_1
--enable-demuxer=g726
--enable-demuxer=g726le
--enable-demuxer=pcm_mulaw
--enable-demuxer=pcm_alaw
--enable-demuxer=pcm_s16be
--enable-demuxer=pcm_s16le
--enable-demuxer=h263
--enable-demuxer=h264
--enable-demuxer=hevc
--enable-parser=h263
--enable-parser=h264
--enable-parser=hevc
--enable-parser=mpeg4video
--enable-parser=vp8
--enable-parser=vp9
--enable-parser=opus
--enable-encoder=adpcm_g722
--enable-decoder=adpcm_g722
--enable-encoder=adpcm_g726
--enable-decoder=adpcm_g726
--enable-encoder=adpcm_g726le
--enable-decoder=adpcm_g726le
--enable-decoder=g729
--enable-encoder=g723_1
--enable-decoder=g723_1
--enable-encoder=rawvideo
--enable-decoder=rawvideo
--enable-encoder=libx264
--enable-decoder=h264
--enable-encoder=pcm_alaw
--enable-decoder=pcm_alaw
--enable-encoder=pcm_mulaw
--enable-decoder=pcm_mulaw
--enable-encoder=mpeg4
--enable-decoder=mpeg4
--enable-encoder=libvpx_vp8
--enable-decoder=vp8
--enable-decoder=vp9
--enable-encoder=h263
--enable-encoder=h263p
--enable-decoder=h263
--enable-encoder=mjpeg
--enable-decoder=mjpeg
--enable-decoder=mjpegb
--enable-libspeex
--enable-libopus
--enable-libvpx
--enable-libx264
--enable-encoder=libspeex
--enable-decoder=libspeex
--enable-encoder=libopus
--enable-decoder=libopus
--enable-decoder=flac
--enable-decoder=vorbis
--enable-decoder=aac
--enable-decoder=ac3
--enable-decoder=eac3
--enable-decoder=mp3
--enable-decoder=pcm_u24be
--enable-decoder=pcm_u24le
--enable-decoder=pcm_u32be
--enable-decoder=pcm_u32le
--enable-decoder=pcm_u8
--enable-decoder=pcm_f16le
--enable-decoder=pcm_f24le
--enable-decoder=pcm_f32be
--enable-decoder=pcm_f32le
--enable-decoder=pcm_f64be
--enable-decoder=pcm_f64le
--enable-decoder=pcm_s16be
--enable-decoder=pcm_s16be_planar
--enable-decoder=pcm_s16le
--enable-decoder=pcm_s16le_planar
--enable-decoder=pcm_s24be
--enable-decoder=pcm_s24le
--enable-decoder=pcm_s24le_planar
--enable-decoder=pcm_s32be
--enable-decoder=pcm_s32le
--enable-decoder=pcm_s32le_planar
--enable-decoder=pcm_s64be
--enable-decoder=pcm_s64le
--enable-decoder=pcm_s8
--enable-decoder=pcm_s8_planar
--enable-decoder=pcm_u16be
--enable-decoder=pcm_u16le
--enable-encoder=gif
--enable-decoder=gif
--enable-encoder=jpegls
--enable-decoder=jpegls
--enable-encoder=ljpeg
--enable-decoder=jpeg2000
--enable-encoder=png
--enable-decoder=png
--enable-encoder=bmp
--enable-decoder=bmp
--enable-encoder=tiff
--enable-decoder=tiff
--enable-filter=scale
--enable-filter=overlay
--enable-filter=amix
--enable-filter=amerge
--enable-filter=aresample
--enable-filter=format
--enable-filter=aformat
--enable-filter=fps
--enable-filter=transpose
--enable-filter=pad
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux
+++ b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_linux
@ -1,18 +0,0 @@
--enable-pic
--target-os=linux
--enable-indev=v4l2
--enable-indev=xcbgrab
--enable-vdpau
--enable-hwaccel=h264_vdpau
--enable-hwaccel=mpeg4_vdpau
--enable-vaapi
--enable-hwaccel=h264_vaapi
--enable-hwaccel=mpeg4_vaapi
--enable-hwaccel=h263_vaapi
--enable-hwaccel=vp8_vaapi
--enable-hwaccel=mjpeg_vaapi
--enable-hwaccel=hevc_vaapi
--enable-encoder=h264_vaapi
--enable-encoder=vp8_vaapi
--enable-encoder=mjpeg_vaapi
--enable-encoder=hevc_vaapi
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86
+++ b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_args_x86
@ -1,10 +0,0 @@
--enable-cuvid
--enable-ffnvcodec
--enable-nvdec
--enable-nvenc
--enable-hwaccel=h264_nvdec
--enable-hwaccel=hevc_nvdec
--enable-hwaccel=vp8_nvdec
--enable-hwaccel=mjpeg_nvdec
--enable-encoder=h264_nvenc
--enable-encoder=hevc_nvenc
--- a/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches
+++ b/pkgs/applications/networking/instant-messengers/jami/config/ffmpeg_patches
@ -1,7 +0,0 @@
-remove-mjpeg-log.patch
-change-RTCP-ratio.patch
-rtp_ext_abs_send_time.patch
-libopusdec-enable-FEC.patch
-libopusenc-reload-packet-loss-at-encode.patch
-ios-disable-b-frames.patch
-screen-sharing-x11-fix.patch
--- a/pkgs/applications/networking/instant-messengers/jami/daemon.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
@ -9,7 +9,7 @@
 , asio
 , dbus
 , dbus_cplusplus
-, ffmpeg-jami
+, ffmpeg_5
 , fmt
 , gmp
 , gnutls
@ -51,7 +51,7 @@ stdenv.mkDerivation {
    dbus
    dbus_cplusplus
    fmt
-    ffmpeg-jami
+    ffmpeg_5
    gmp
    gnutls
    http-parser
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@ -4,7 +4,6 @@
 , fetchFromGitHub
 , fetchzip
 , fetchpatch
-, ffmpeg_5
 , pjsip
 , opendht
 , jack
@ -41,31 +40,6 @@ let
  readLinesToList = with builtins; file: filter (s: isString s && stringLength s > 0) (split "\n" (readFile file));
 in
 rec {
-  ffmpeg-jami = (ffmpeg_5.override rec {
-    version = "5.0.1";
-    branch = version;
-    sha256 = "sha256-KN8z1AChwcGyDQepkZeAmjuI73ZfXwfcH/Bn+sZMWdY=";
-    doCheck = false;
-  }).overrideAttrs (old:
-    let
-      patch-src = src + "/daemon/contrib/src/ffmpeg/";
-    in
-    {
-      patches = old.patches ++ (map (x: patch-src + x) (readLinesToList ./config/ffmpeg_patches)) ++
-        # SDL2 recently changed their versioning
-        [
-          (fetchpatch {
-            url = "https://git.videolan.org/?p=ffmpeg.git;a=patch;h=e5163b1d34381a3319214a902ef1df923dd2eeba";
-            hash = "sha256-nLhP2+34cj5EgpnUrePZp60nYAxmbhZAEDfay4pBVk0=";
-          })
-        ];
-      configureFlags = old.configureFlags
-        ++ (readLinesToList ./config/ffmpeg_args_common)
-        ++ lib.optionals stdenv.isLinux (readLinesToList ./config/ffmpeg_args_linux)
-        ++ lib.optionals (stdenv.isx86_32 || stdenv.isx86_64) (readLinesToList ./config/ffmpeg_args_x86);
-      outputs = [ "out" "doc" ];
-    });
-
  pjsip-jami = pjsip.overrideAttrs (old:
    let
      patch-src = src + "/daemon/contrib/src/pjproject/";
@ -105,10 +79,10 @@ rec {
  };

  jami-daemon = callPackage ./daemon.nix {
-    inherit version src udev jack jami-meta ffmpeg-jami pjsip-jami opendht-jami;
+    inherit version src udev jack jami-meta pjsip-jami opendht-jami;
  };

  jami-client = qt6Packages.callPackage ./client.nix {
-    inherit version src ffmpeg-jami jami-meta;
+    inherit version src jami-meta;
  };
 }
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , pkg-config, cmake, ninja, yasm
 , libjpeg, openssl_1_1, libopus, ffmpeg, alsa-lib, libpulseaudio, protobuf
 , openh264, usrsctp, libevent, libvpx
@ -31,6 +31,14 @@ stdenv.mkDerivation {
    mesa libepoxy libglvnd
  ];

+  patches = [
+    # GCC 12 Fix
+    (fetchpatch {
+      url = "https://github.com/desktop-app/tg_owt/pull/101/commits/86d2bcd7afb8706663d29e30f65863de5a626142.patch";
+      hash = "sha256-iWS0mB8R0vqPU/0qf6Ax54UCAKYDVCPac2mi/VHbFm0=";
+    })
+  ];
+
  cmakeFlags = [
    # Building as a shared library isn't officially supported and may break at any time.
    "-DBUILD_SHARED_LIBS=OFF"
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@ -18,6 +18,8 @@
 , gssSupport   ? true
 , writeScript
 }:
+assert smimeSupport -> sslSupport;
+assert gpgmeSupport -> sslSupport;

 stdenv.mkDerivation rec {
  pname = "mutt";
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -4,13 +4,13 @@ let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
      pname = stname;
-      version = "1.23.0";
+      version = "1.23.1";

      src = fetchFromGitHub {
        owner = "syncthing";
        repo = "syncthing";
        rev = "v${version}";
-        hash = "sha256-Z4YVU45na4BgIbN/IlORpTCuf2EuSuOyppDRzswn3EI=";
+        hash = "sha256-Jbg56Nn+5ZjIv1KZrThkqWY+P13MglLE78E6jc0rbY0=";
      };

      vendorHash = "sha256-q63iaRxJRvPY0Np20O6JmdMEjSg/kxRneBfs8fRTwXk=";
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@ -80,6 +80,11 @@ stdenv.mkDerivation rec {
  # guile warning
  GUILE_AUTO_COMPILE="0";

+  NIX_CFLAGS_COMPILE = lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+    "-Wno-error=use-after-free"
+  ];
+
  # `make check` target does not define its prerequisites but expects them to
  # have already been built.  The list of targets below was built through trial
  # and error based on failing tests.
--- a/pkgs/applications/office/paperwork/paperwork-shell.nix
+++ b/pkgs/applications/office/paperwork/paperwork-shell.nix
@ -11,6 +11,7 @@
 , fabulous
 , getkey
 , psutil
+, shared-mime-info

 , pkgs
 }:
@ -39,6 +40,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    shared-mime-info
    openpaperwork-gtk
  ];

--- a/pkgs/applications/office/paperwork/src.nix
+++ b/pkgs/applications/office/paperwork/src.nix
@ -1,13 +1,13 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.1.1";
+  version = "2.1.2";
  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    repo = "paperwork";
    group = "World";
    owner = "OpenPaperwork";
    rev = version;
-    sha256 = "2M2eMP54F3RRDMBuAZ1gBiBoMmTRJaHTUwtTjj4ZU+4=";
+    sha256 = "/5k+zUtTE+Dr879xbHDCAYrqlEJLsbkcRSG3GbA/PCg=";
  };
  sample_documents = fetchFromGitLab {
    domain = "gitlab.gnome.org";
--- a/pkgs/applications/plasma-mobile/angelfish.nix
+++ b/pkgs/applications/plasma-mobile/angelfish.nix
@ -3,7 +3,7 @@
 , cmake
 , corrosion
 , extra-cmake-modules
-, gcc11
+, gcc12
 , kconfig
 , kcoreaddons
 , kdbusaddons
@ -46,7 +46,7 @@ mkDerivation rec {
    cmake
    corrosion
    extra-cmake-modules
-    gcc11 # doesn't build with GCC 9 from stdenv on aarch64
+    gcc12 # doesn't build with GCC 9 from stdenv on aarch64
  ] ++ (with rustPlatform; [
    cargoSetupHook
    rust.cargo
--- a/pkgs/applications/plasma-mobile/audiotube.nix
+++ b/pkgs/applications/plasma-mobile/audiotube.nix
@ -2,7 +2,7 @@
 , mkDerivation

 , extra-cmake-modules
-, gcc11
+, gcc12
 , wrapGAppsHook

 , gst_all_1
@ -22,7 +22,7 @@ mkDerivation rec {
  nativeBuildInputs = [
    extra-cmake-modules
    wrapGAppsHook
-    gcc11 # doesn't build with GCC 9 from stdenv on aarch64
+    gcc12 # doesn't build with GCC 9 from stdenv on aarch64
    python3Packages.wrapPython
    python3Packages.pybind11
  ];
--- a/pkgs/applications/plasma-mobile/neochat.nix
+++ b/pkgs/applications/plasma-mobile/neochat.nix
@ -1,4 +1,4 @@
-{ gcc11Stdenv
+{ gcc12Stdenv
 , lib
 , srcs

@ -31,7 +31,7 @@
 }:

 # Workaround for AArch64 not using GCC11 yet.
-gcc11Stdenv.mkDerivation rec {
+gcc12Stdenv.mkDerivation rec {
  pname = "neochat";
  inherit (srcs.neochat) version src;

--- a/pkgs/applications/plasma-mobile/spacebar.nix
+++ b/pkgs/applications/plasma-mobile/spacebar.nix
@ -1,6 +1,6 @@
 { lib
 , mkDerivation
-, gcc11Stdenv
+, gcc12Stdenv
 , srcs

 , cmake
@ -24,8 +24,8 @@
 , qtquickcontrols2
 }:

-# Workaround for AArch64 not using GCC11 yet.
-gcc11Stdenv.mkDerivation rec {
+# Workaround for AArch64 still using GCC9.
+gcc12Stdenv.mkDerivation rec {
  pname = "spacebar";
  inherit (srcs.spacebar) version src;

--- a/pkgs/applications/science/biology/octopus/default.nix
+++ b/pkgs/applications/science/biology/octopus/default.nix
@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-VaUr63v7mzhh4VBghH7a7qrqOYwl6vucmmKzTi9yAjY=";
  }) ];

+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=deprecated-declarations"
+  ];
+
  postInstall = ''
    mkdir $out/bin
    mv $out/octopus $out/bin
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@ -41,12 +41,12 @@ stdenv.mkDerivation rec {
  ];

  configureFlags = with lib; [
-    "--with-yaml-prefix=${libyaml}"
+    "--with-yaml-prefix=${lib.getDev libyaml}"
    "--with-blas=-lblas"
    "--with-lapack=-llapack"
-    "--with-fftw-prefix=${fftw.dev}"
-    "--with-gsl-prefix=${gsl}"
-    "--with-libxc-prefix=${libxc}"
+    "--with-fftw-prefix=${lib.getDev fftw}"
+    "--with-gsl-prefix=${lib.getDev gsl}"
+    "--with-libxc-prefix=${lib.getDev libxc}"
    "--enable-openmp"
  ] ++ optional enableFma "--enable-fma3"
    ++ optional enableFma4 "--enable-fma4"
--- a/pkgs/applications/science/logic/cbmc/default.nix
+++ b/pkgs/applications/science/logic/cbmc/default.nix
@ -60,9 +60,13 @@ stdenv.mkDerivation rec {
      --prefix PATH : "$out/share/cbmc" \
  '';

-  # fix "argument unused during compilation"
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
-    "-Wno-unused-command-line-argument";
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
+    # Needed with GCC 12 but breaks on darwin (with clang)
+    "-Wno-error=maybe-uninitialized"
+  ] ++ lib.optionals stdenv.cc.isClang [
+    # fix "argument unused during compilation"
+    "-Wno-unused-command-line-argument"
+  ];

  # TODO: add jbmc support
  cmakeFlags = [ "-DWITH_JBMC=OFF" "-Dsat_impl=cadical" "-Dcadical_INCLUDE_DIR=${cadical.dev}/include" ];
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@ -54,6 +54,12 @@ stdenv.mkDerivation rec {
    ] else [ "-DUSE_CUDA=OFF" ])
    ++ lib.optional (!cudnnSupport) "-DUSE_CUDNN=OFF";

+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
+  ];
+
  postPatch = ''
    substituteInPlace 3rdparty/mkldnn/tests/CMakeLists.txt \
      --replace "/bin/bash" "${bash}/bin/bash"
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -26,13 +26,13 @@

 buildPythonApplication rec {
  pname = "commitizen";
-  version = "2.41.0";
+  version = "2.42.0";

  src = fetchFromGitHub {
    owner = "commitizen-tools";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-dzAIRfUdyHSefDRDuPMsr8l2Dsiall2ZUDB6GufTbXE=";
+    hash = "sha256-13WEbF6in+zYZXWYqlYA98qJkKxjmcpQY9GuGS+DDtk=";
  };

  format = "pyproject";
--- a/pkgs/applications/version-management/fnc/default.nix
+++ b/pkgs/applications/version-management/fnc/default.nix
@ -13,6 +13,11 @@ stdenv.mkDerivation rec {

  makeFlags = [ "PREFIX=$(out)" ];

+  NIX_CFLAGS_COMPILE = [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+  ];
+
  preInstall = ''
    mkdir -p $out/bin
  '';
--- a/pkgs/applications/version-management/git-trim/default.nix
+++ b/pkgs/applications/version-management/git-trim/default.nix
@ -1,4 +1,14 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, openssl, libiconv, Security }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, libgit2
+, IOKit
+, CoreFoundation
+, fetchpatch
+}:

 rustPlatform.buildRustPackage rec {
  pname = "git-trim";
@ -11,11 +21,22 @@ rustPlatform.buildRustPackage rec {
    sha256 = "sha256-XAO3Qg5I2lYZVNx4+Z5jKHRIFdNwBJsUQwJXFb4CbvM=";
  };

-  cargoHash = "sha256-KCLMb8NXxjscrmKXkP/RbV+LsJqOG7zaClJGFiQ4o9k=";
+  cargoHash = "sha256-mS8kNkZs8jX99ryG4XkU+U/iWIIcmET2vOfG1YNNZFU=";
+
+  cargoPatches = [
+    # Update git2 https://github.com/foriequal0/git-trim/pull/202
+    (fetchpatch {
+      url = "https://github.com/foriequal0/git-trim/commit/4355cd1d6f605455087c4d7ad16bfb92ffee941f.patch";
+      sha256 = "sha256-C1pX4oe9ZCgvqYTBJeSjMdr0KFyjv2PNVMJDlwCAngY=";
+    })
+  ];
+
+  OPENSSL_NO_VENDOR = 1;

  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
+  buildInputs = [ openssl libgit2 ]
+    ++ lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];

  postInstall = ''
    install -Dm644 -t $out/share/man/man1/ docs/git-trim.1
--- a/pkgs/applications/version-management/sapling/Cargo.lock
+++ b/pkgs/applications/version-management/sapling/Cargo.lock
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@ -43,7 +43,7 @@ let
    owner = "facebook";
    repo = "sapling";
    rev = version;
-    hash = "sha256-zlvb+qn9SSBPZmlF8KwKTWyKj94FGOafSMRMNLsccOU";
+    hash = "sha256-WOvkw+vuU/9vWgxCx7ogawQWCr1O7E70uw/LhuLiSzE";
  };

  addonsSrc = "${src}/addons";
@ -51,7 +51,7 @@ let
  # Fetches the Yarn modules in Nix to to be used as an offline cache
  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${addonsSrc}/yarn.lock";
-    sha256 = "sha256-+29WAgSXVciHhLMN04yfKiWCpjM3Vo54nUdTP6owSLs";
+    sha256 = "sha256-haeVRO5JBStrO7fjI9WhC5xZwX0IlZR1wxh0Q+m/UQM";
  };

  # Builds the NodeJS server that runs with `sl web`
@ -100,12 +100,13 @@ python3Packages.buildPythonApplication {
  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "cloned-0.1.0" = "sha256-DYQTK722wgeDUJtOVXHLt42G6gpe6A62rET+JH+bPKU=";
+      "abomonation-0.7.3+smallvec1" = "sha256-AxEXR6GC8gHjycIPOfoViP7KceM29p2ZISIt4iwJzvM=";
+      "cloned-0.1.0" = "sha256-ZWO3/+O3Oc2Zg99seJ40CInrW1+3rFvL5HjIxhjDW5I=";
      "deltae-0.3.0" = "sha256-a9Skaqs+tVTw8x83jga+INBr+TdaMmo35Bf2wbfR6zs=";
-      "fb303_core-0.0.0" = "sha256-YEFNTYvtgp8nc/1O7AbdyxCD3Xx2xCjbS17fTTEsUL0=";
-      "fbthrift-0.0.1+unstable" = "sha256-mDoYhXOzQIDqP7XdmiBbmq5VmAKAgggTNH/kW2kHv4k=";
+      "fb303_core-0.0.0" = "sha256-LEib4QL5sMCUyQ9yGWnsOmO6hmlDaE80nfmrTC8elu0=";
+      "fbthrift-0.0.1+unstable" = "sha256-4SjdZzG6UP8OY7/Qy7ebdKOg1WdZ2USG6wJ7YhA/PxU=";
      "reqwest-0.11.11" = "sha256-uhc8XhkGW22XDNo0qreWdXeFF2cslOOZHfTRQ30IBcE=";
-      "serde_bser-0.3.1" = "sha256-/zn1NfXWytXvnalkgPsg9BdujVV97PGkXwmPtQGVeCc=";
+      "serde_bser-0.3.1" = "sha256-uW7qXEn0p7m6uo5r+rD3TDH/Lf1cBMWml0TbhysgDH8=";
    };
  };
  postPatch = ''
--- a/pkgs/applications/version-management/sapling/deps.json
+++ b/pkgs/applications/version-management/sapling/deps.json
@ -73,6 +73,6 @@
      "url": "https://files.pythonhosted.org/packages/4c/76/1e41fbb365ad20b6efab2e61b0f4751518444c953b390f9b2d36cf97eea0/Cython-0.29.32.tar.gz"
    }
  ],
-  "version": "0.2.20221222-152408-ha6a66d09",
-  "versionHash": "14601963598499040874"
+  "version": "0.2.20230124-180750-hf8cd450a",
+  "versionHash": "5465836048527734544"
 }
--- a/pkgs/applications/video/haruna/default.nix
+++ b/pkgs/applications/video/haruna/default.nix
@ -26,13 +26,13 @@

 mkDerivation rec {
  pname = "haruna";
-  version = "0.10.2";
+  version = "0.10.3";

  src = fetchFromGitLab {
    owner = "multimedia";
    repo = "haruna";
    rev = "v${version}";
-    hash = "sha256-hhHWxmr2EzW9QqfV1bpJCiWOWsmGJmvxvtQcuXlMTc4=";
+    hash = "sha256-kXafPUcWWvadGbcN4PAtXlFmfll/mSpwu2Sbh6Gxx4w=";
    domain = "invent.kde.org";
  };

--- a/pkgs/applications/window-managers/cardboard/default.nix
+++ b/pkgs/applications/window-managers/cardboard/default.nix
@ -99,6 +99,8 @@ stdenv.mkDerivation rec {
     cp -r ${expected-wrap} ${expected-wrap.name}
     cp -r ${wlroots-wrap} ${wlroots-wrap.name}
    )
+
+    sed '1i#include <functional>' -i cardboard/ViewAnimation.h # gcc12
  '';

  # "Inherited" from Nixpkgs expression for wlroots
@ -108,6 +110,8 @@ stdenv.mkDerivation rec {
    "-Dwlroots:libseat=disabled"
  ];

+  NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ]; # gcc12
+
  meta = with lib; {
    homepage = "https://gitlab.com/cardboardwm/cardboard";
    description = "A scrollable, tiling Wayland compositor inspired on PaperWM";
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, graalvm, glibcLocales }:
+{ lib, stdenv, graalvm-ce, glibcLocales }:

 { name ? "${args.pname}-${args.version}"
  # Final executable name
@ -19,7 +19,7 @@
  # XMX size of GraalVM during build
 , graalvmXmx ? "-J-Xmx6g"
  # The GraalVM derivation to use
-, graalvmDrv ? graalvm
+, graalvmDrv ? graalvm-ce
  # Locale to be used by GraalVM compiler
 , LC_ALL ? "en_US.UTF-8"
 , meta ? { }
@ -51,12 +51,14 @@ stdenv.mkDerivation (args // {

  disallowedReferences = [ graalvmDrv ];

+  passthru = { inherit graalvmDrv; };
+
  meta = {
    # default to graalvm's platforms
    platforms = graalvmDrv.meta.platforms;
    # default to executable name
    mainProgram = executable;
    # need to have native-image-installable-svm available
-    broken = !(builtins.elem "native-image-installable-svm" graalvmDrv.products);
+    broken = !(builtins.any (p: (p.product or "") == "native-image-installable-svm") graalvmDrv.products);
  } // meta;
 })
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -343,18 +343,11 @@ stdenv.mkDerivation {
    # compile, because it uses "#include_next <limits.h>" to find the
    # limits.h file in ../includes-fixed. To remedy the problem,
    # another -idirafter is necessary to add that directory again.
-    #
-    # We use --sysroot=/nix/store/does/not/exist to drop embedded default
-    # path to glibc headers gcc was built against. Without it -idirafter
-    # only appends to the list and outdated glibc headers end up being
-    # used. 'cc-cflags-before' is used to allow user's --sysroot= option
-    # to override our default.
    + optionalString (libc != null) (''
      touch "$out/nix-support/libc-cflags"
      touch "$out/nix-support/libc-ldflags"
      echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
    '' + optionalString (!(cc.langD or false)) ''
-      echo "--sysroot=/nix/store/does/not/exist" >> $out/nix-support/cc-cflags-before
      echo "-idirafter ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
    '' + optionalString (isGNU && (!(cc.langD or false))) ''
      for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@ -46,14 +46,14 @@ else stdenv.mkDerivation rec {
      -L${llvmPackages_13.clang.libc}/lib \
      -Wl,-install_name,$libName \
      -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
    '' else if stdenv.isDarwin then ''
    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
      -Wl,-install_name,$out/lib/$libName \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
    '' else ''
    $CC -Wall -std=c99 -O3 -fPIC libredirect.c \
-      -ldl -shared -o "$libName"
+      -shared -o "$libName"
    ''}

    if [ -n "$doInstallCheck" ]; then
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@ -201,6 +201,37 @@ WRAPPER(int, __xstat64)(int ver, const char * path, struct stat64 * st)
 WRAPPER_DEF(__xstat64)
 #endif

+#if defined(__linux__) && defined(STATX_TYPE)
+WRAPPER(int, statx)(int dirfd, const char * restrict pathname, int flags,
+    unsigned int mask, struct statx * restrict statxbuf)
+{
+    int (*statx_real) (int, const char * restrict, int,
+        unsigned int, struct statx * restrict) = LOOKUP_REAL(statx);
+    char buf[PATH_MAX];
+    return statx_real(dirfd, rewrite(pathname, buf), flags, mask, statxbuf);
+}
+WRAPPER_DEF(statx)
+#endif
+
+WRAPPER(int, fstatat)(int dirfd, const char * pathname, struct stat * statbuf, int flags)
+{
+    int (*fstatat_real) (int, const char *, struct stat *, int) = LOOKUP_REAL(fstatat);
+    char buf[PATH_MAX];
+    return fstatat_real(dirfd, rewrite(pathname, buf), statbuf, flags);
+}
+WRAPPER_DEF(fstatat);
+
+// In musl libc, fstatat64 is simply a macro for fstatat
+#if !defined(__APPLE__) && !defined(fstatat64)
+WRAPPER(int, fstatat64)(int dirfd, const char * pathname, struct stat64 * statbuf, int flags)
+{
+    int (*fstatat64_real) (int, const char *, struct stat64 *, int) = LOOKUP_REAL(fstatat64);
+    char buf[PATH_MAX];
+    return fstatat64_real(dirfd, rewrite(pathname, buf), statbuf, flags);
+}
+WRAPPER_DEF(fstatat64);
+#endif
+
 WRAPPER(int, stat)(const char * path, struct stat * st)
 {
    int (*__stat_real) (const char *, struct stat *) = LOOKUP_REAL(stat);
@ -209,6 +240,17 @@ WRAPPER(int, stat)(const char * path, struct stat * st)
 }
 WRAPPER_DEF(stat)

+// In musl libc, stat64 is simply a macro for stat
+#if !defined(__APPLE__) && !defined(stat64)
+WRAPPER(int, stat64)(const char * path, struct stat64 * st)
+{
+    int (*stat64_real) (const char *, struct stat64 *) = LOOKUP_REAL(stat64);
+    char buf[PATH_MAX];
+    return stat64_real(rewrite(path, buf), st);
+}
+WRAPPER_DEF(stat64)
+#endif
+
 WRAPPER(int, access)(const char * path, int mode)
 {
    int (*access_real) (const char *, int mode) = LOOKUP_REAL(access);
@ -346,6 +388,14 @@ WRAPPER(int, system)(const char *command)
 }
 WRAPPER_DEF(system)

+WRAPPER(int, chdir)(const char *path)
+{
+    int (*chdir_real) (const char *) = LOOKUP_REAL(chdir);
+    char buf[PATH_MAX];
+    return chdir_real(rewrite(path, buf));
+}
+WRAPPER_DEF(chdir);
+
 WRAPPER(int, mkdir)(const char *path, mode_t mode)
 {
    int (*mkdir_real) (const char *path, mode_t mode) = LOOKUP_REAL(mkdir);
--- a/pkgs/build-support/libredirect/test.c
+++ b/pkgs/build-support/libredirect/test.c
@ -63,6 +63,12 @@ int main(int argc, char *argv[])
    FILE *testfp;
    int testfd;
    struct stat testsb;
+#ifndef __APPLE__
+    struct stat64 testsb64;
+#endif
+#if defined(__linux__) && defined(STATX_TYPE)
+    struct statx testsbx;
+#endif
    char buf[PATH_MAX];

    testfp = fopen(TESTPATH, "r");
@ -76,6 +82,20 @@ int main(int argc, char *argv[])
    assert(access(TESTPATH, X_OK) == 0);

    assert(stat(TESTPATH, &testsb) != -1);
+#ifndef __APPLE__
+    assert(stat64(TESTPATH, &testsb64) != -1);
+#endif
+    assert(fstatat(123, TESTPATH, &testsb, 0) != -1);
+#ifndef __APPLE__
+    assert(fstatat64(123, TESTPATH, &testsb64, 0) != -1);
+#endif
+#if defined(__linux__) && defined(STATX_TYPE)
+    assert(statx(123, TESTPATH, 0, STATX_ALL, &testsbx) != -1);
+#endif
+
+    assert(getcwd(buf, PATH_MAX) != NULL);
+    assert(chdir(TESTDIR) == 0);
+    assert(chdir(buf) == 0);

    assert(mkdir(TESTDIR "/dir-mkdir", 0777) == 0);
    assert(unlink(TESTDIR "/dir-mkdir") == -1); // it's a directory!
--- a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@ -12,7 +12,7 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
    source @out@/nix-support/add-flags.sh
 fi

-set -- "$@" @addFlags@
+set -- @addFlags@ "$@"

 if (( ${#role_suffixes[@]} > 0 )); then
    # replace env var with nix-modified one
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@ -4,7 +4,6 @@
 , rust
 , stdenv
 , callPackage
-, cacert
 , cargoBuildHook
 , cargoCheckHook
 , cargoInstallHook
@ -124,7 +123,6 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
      inherit cargo cargo-auditable;
    })
  ] ++ [
-    cacert
    cargoBuildHook
    (if useNextest then cargoNextestHook else cargoCheckHook)
    cargoInstallHook
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@ -73,6 +73,9 @@ in stdenv.mkDerivation ({

    ${cargoUpdateHook}

+    # Override the `http.cainfo` option usually specified in `.cargo/config`.
+    export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
+
    cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG

    # Create an empty vendor directory when there is no dependency to vendor
--- a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@ -1,4 +1,6 @@
-postFixupHooks+=(_makeSymlinksRelative)
+# symlinks are often created in postFixup
+# don't use fixupOutputHooks, it is before postFixup
+postFixupHooks+=(_makeSymlinksRelativeInAllOutputs)

 # For every symlink in $output that refers to another file in $output
 # ensure that the symlink is relative. This removes references to the output
@ -26,3 +28,10 @@ _makeSymlinksRelative() {

    done < <(find $prefix -type l -print0)
 }
+
+_makeSymlinksRelativeInAllOutputs() {
+  local output
+  for output in $(getAllOutputNames); do
+    prefix="${!output}" _makeSymlinksRelative
+  done
+}
--- a/pkgs/data/fonts/freefont-ttf/default.nix
+++ b/pkgs/data/fonts/freefont-ttf/default.nix
@ -1,18 +1,22 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
  pname = "freefont-ttf";
  version = "20120503";

-  url = "mirror://gnu/freefont/freefont-ttf-${version}.zip";
+  src = fetchzip {
+    url = "mirror://gnu/freefont/freefont-ttf-${version}.zip";
+    hash = "sha256-K3kVHGcDTxQ7N7XqSdwRObriVkBoBYPKHbyYrYvm7VU=";
+  };
+
+  installPhase = ''
+    runHook preInstall

-  postFetch = ''
    mkdir -p $out/share/fonts/truetype
-    mv $out/*.ttf $out/share/fonts/truetype
-    find $out -maxdepth 1 ! -type d -exec rm {} +
-  '';
+    mv *.ttf $out/share/fonts/truetype

-  sha256 = "sha256-bdMZg/mHYc0N6HiR8uNl0CjeOwBou+OYj3LPkyEUHUA=";
+    runHook postInstall
+  '';

  meta = {
    description = "GNU Free UCS Outline Fonts";
@ -24,6 +28,6 @@ fetchzip rec {
    homepage = "https://www.gnu.org/software/freefont/";
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.all;
-    maintainers = [];
+    maintainers = [ ];
  };
 }
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "18.0.0";
+  version = "19.0.0";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "03f2rabj2w2l7jwqyl2awj42jhh0l3picqgyfcv3q067i34abfyn";
-  iosevka-aile = "0p1r5sysy6djfd1sx0pfxf42bv7ayqgk1nvil33jr925w96i2dp6";
-  iosevka-curly = "0r33wcgvh315avgkkic27qpf3bavrqwbig1kj4wm5rdr957ldk40";
-  iosevka-curly-slab = "0yd7grhnx7z27xmd3wr8x2xx2002hmfi1y3ndmqq1sc9gab5gcb7";
-  iosevka-etoile = "0jhd49vxxxaqi1rxfkmpc3v1q96ak1b5wyggchngqi3739pjgqy3";
-  iosevka-slab = "00wk15kj9b1nr3b0bmarx6gqx3jg8z1pm9qqf9x09s72b3ng8adm";
-  iosevka-ss01 = "1kp6zv8zyx50la7zrfz4fis68s41kplibagny61w5v3w36xpm3cs";
-  iosevka-ss02 = "1c0dl28a3wwa5g4793jyb4n4c8p5vjlyh1b8j2i5da31dqrqm9gj";
-  iosevka-ss03 = "0vs8x6l8gwqi47g1c5ainsk5fb2i6j4wv7mgdyw5j5l3blnba5yh";
-  iosevka-ss04 = "1caf4xqd1dywzbq06ip042rw88833yk9ws7y3vjvsp93g7a2r675";
-  iosevka-ss05 = "008aphj4w6ri3fgnydrxavvpm3bfywv4cym10fqi9xgd84jhm9m1";
-  iosevka-ss06 = "00dkagqiwzwzvv75zss82yx0gdcbmh9xvr8swhi5zk0y0bc3xk2y";
-  iosevka-ss07 = "1acnva081awp76xyspksq9jkvlyswh3q1jy9gnsc6kh4vyn17vjs";
-  iosevka-ss08 = "0lmkglcjlppvfd7k2pz57r476fa4c0q5l4gqzfy1mlklh0mc5hqb";
-  iosevka-ss09 = "04r2k2z54iszwfnif872p5br0dm4fvc5341cpbxv4almpzxjyqnr";
-  iosevka-ss10 = "1c6gs9g8dhywpd2ha7kx2l7g7bwj7i5a78645ipx8126f749y0y9";
-  iosevka-ss11 = "0286k56r12a2yjylxynvzd0idrcv4ykrmpkn3b5xv9f74qq6irmf";
-  iosevka-ss12 = "0ab4x5lh8spbg0djb092vcq1cnvjhazwkia8byq1q47iwiyh756l";
-  iosevka-ss13 = "0kva71mfkl9xzz8khjzgrj47zg2505rg0hv5hxflawxsqwi4iwvl";
-  iosevka-ss14 = "1gk7m3xh4v3jm6s5g2prd27w4p0r1blbxsxdy3b020bdwikxcaga";
-  iosevka-ss15 = "0frxjc3hhay8izsx4ywff4j39qxp9ljz6hvw0rjcya3vny515jq5";
-  iosevka-ss16 = "1g299yhn0kfc7vn8vbgwq4798w5lcl72j6hj91k90i1yq11lg13i";
-  iosevka-ss17 = "02z83x73bhpgf44kq0gw46bdnpqzr4vm37h78bh19vydzqaj8hg0";
-  iosevka-ss18 = "1b7vhhbspi98xzmk4hpiw08jmscm7f7nibqxhkfmppl6y0ymbm9d";
-  sgr-iosevka = "1n60dgprl2p22wwfhxpwy9v9xf6vyv3qwm2jdc0m9m0q9jwjashr";
-  sgr-iosevka-aile = "1k195vqv2wajhmyma43xgda3s2z86kl2gksgdrm95s9sx7ijns2s";
-  sgr-iosevka-curly = "15yq1fs7knp9gxgqjxslpmlx85c6kvpm31sf81llpf4k5f9dmlcp";
-  sgr-iosevka-curly-slab = "0fa68lm6iwlf2s5k8388dwgk015c55zg1wkhhhjmixwn7p8gifxz";
-  sgr-iosevka-etoile = "1ry1zc7cdx6g927d1752ipz39v4wsnfrnn8n9cfwamz8v458wld1";
-  sgr-iosevka-fixed = "173v09dx5pwsbh9jac5qxi7nk95dqyryg747hl58bchby6kmnc3k";
-  sgr-iosevka-fixed-curly = "11y8bj9vmdq48n370f1r4zsk72ci3cq7c9ff6y40hn5w40s8k379";
-  sgr-iosevka-fixed-curly-slab = "1a4gmz6sl67l23awkfl8f3xdr8hbb2mi1lsc0ain1wvvyx1bi56m";
-  sgr-iosevka-fixed-slab = "11xv18ykrfg2fdvbrlcx7k3qvp5yqbm278ks3gm0gbck1awvfckg";
-  sgr-iosevka-fixed-ss01 = "1yb96x53wjks537vs0gd7rss6piszs139k1kgb1swrpq7519awaz";
-  sgr-iosevka-fixed-ss02 = "10yy0yg2i9nm00lzpmrfbdh7jjcll37wql3fcsaxha57gcxf9nf0";
-  sgr-iosevka-fixed-ss03 = "1fpjfqlqq6lz3gya1q24nzy2xls6nxn567lhglj0ykjnh3prkll8";
-  sgr-iosevka-fixed-ss04 = "1kwa5mwd6ihsyj2y70hrrvgy41cs19i0f7nvl4khs3i69a1l58ag";
-  sgr-iosevka-fixed-ss05 = "08v8in8s8p2nayazq60w1kc1jpq48nwdwh6wbxv7ij7lfwii8xws";
-  sgr-iosevka-fixed-ss06 = "03jzylw99xa3b6hpy6bpwhyii6d9fggy9synfl54sn7smwqk08wr";
-  sgr-iosevka-fixed-ss07 = "13yzd6r51gka03fcl3bvx6d97b4m4px2cnsd724maqkqrcxkbxgb";
-  sgr-iosevka-fixed-ss08 = "1xghlj7drx9328jr1cb051nkwv47r5ykkyy6ydff1c4amc1xabsq";
-  sgr-iosevka-fixed-ss09 = "12l6lbz4m1lwyqqmv583777r9ymssy9x34rz72y3dch0mqhmjjzg";
-  sgr-iosevka-fixed-ss10 = "1flrh6a7m0dw7na30nhbxjld54517z77ff3s9fjrpmgyb9wz7i2j";
-  sgr-iosevka-fixed-ss11 = "1j4v4h6k505gkxyswcjf61kj9cfgkalxjg1arms9zb351p8rrkda";
-  sgr-iosevka-fixed-ss12 = "00qwnsxc08bm5cq3ljz2pjqsiw019ah4z0crqcwaysijicxmbckc";
-  sgr-iosevka-fixed-ss13 = "0jrw0amhfi28mc4i7a74qvgjamvymijlf3akskaw9qrmzvks8wn1";
-  sgr-iosevka-fixed-ss14 = "0rvh842zkxdrna9nh2ylsjs3q90sq39658l0mafi85b8z5asdwai";
-  sgr-iosevka-fixed-ss15 = "0j5yrr1biqfhgj6qg6359xg9rfv6qzqiqdqjgfjwbhijs6xfn8f1";
-  sgr-iosevka-fixed-ss16 = "06jrfhb257nmldnxxyc5rh869r5y62v2y034c0r9j7354s7gcq7a";
-  sgr-iosevka-fixed-ss17 = "0cgmsh0478963k1dgpkhy6j1b383gx2q09z3shr6j87knjjwqgp0";
-  sgr-iosevka-fixed-ss18 = "0r4nyd459aqgna7dyzvxnznclqihxdb888g949kdzhxykfchq53s";
-  sgr-iosevka-slab = "1bv8asz66hn80xvjxa7b0vgywha1bpmhd8q95cssc3085dprz1r6";
-  sgr-iosevka-ss01 = "0sv19w0adnddzarf8dlz0n73jzqnp0xfb2lgh4xcpjkhm66j3fhh";
-  sgr-iosevka-ss02 = "1ih10a666r77pvj57crdgyn7ll15giwxj0nis501r1fkp1bzkscn";
-  sgr-iosevka-ss03 = "180hkjzzgasf9a58vi0n0cishnbyjgbjmkh60awcpxwvh85qd4hf";
-  sgr-iosevka-ss04 = "1i4rpg9j967xaxg8h9dmachd3896f4jgwxa0mfjlizls2hfvnbsi";
-  sgr-iosevka-ss05 = "1ca2z4dincjk7jl16pa6d7dnnzq3w3il7fr2lphvrjvdrxbci615";
-  sgr-iosevka-ss06 = "08dj9dcq58grnp6lh16yvvzjqhzlm765v4ci1rys0wbjnp72xxda";
-  sgr-iosevka-ss07 = "13k6plhdgxhp5gjs8z98wb480hh5wy6p2zmc4xvhp88y93fy8kk7";
-  sgr-iosevka-ss08 = "1zfxamanq6a06fazn1jkaswh5g6iw22qnycg5dnxn4flk8nas1db";
-  sgr-iosevka-ss09 = "0qaxp4fsvl26il16h78y2l8013m49cbk2nzxcs1k9g5if11a49d3";
-  sgr-iosevka-ss10 = "1qvvm6rvhrbp83qjfb3dfsbam20f6aw52kg1i5ggfrqj35niv0hd";
-  sgr-iosevka-ss11 = "1v2b456qj8kyacm7308gsim5p25wnyg8qabyrfvdj00h81s31akl";
-  sgr-iosevka-ss12 = "1rsi6ir5vccar0n3ychisc40axiyhqj5yvcx450ppd33f3sd5rc7";
-  sgr-iosevka-ss13 = "12x4q5l1pdxi065zs913dqd7zb8qpi4bbgd43h3k5azsrwxwvixr";
-  sgr-iosevka-ss14 = "1snzdv23jqmbz25k9i2zl7px7yysk5hn74q1x251s07ghdx3nfdj";
-  sgr-iosevka-ss15 = "0hbmj6wij6cv9yh76npp4xrl7fdm8jjx03398anfcsa02gkvg8zz";
-  sgr-iosevka-ss16 = "0v6vhg0vp5ig6ngs96q5mxa2snfp08nk68a9772sm1ny61q3chrq";
-  sgr-iosevka-ss17 = "0268b85yhdfsbjyhi0vlxwrpwxa8h919np53s060z94094h6jd9x";
-  sgr-iosevka-ss18 = "13vnhh8181h36y6iz2p2x6rjgjv5w3d0gqbcdkwhgmvx7s03k122";
-  sgr-iosevka-term = "05c2sxb4aris90mhjxyfkw1b0ga0hplfas669076h7yjsimw647l";
-  sgr-iosevka-term-curly = "1j0b4fhcivkdgka9zyqf732hcxj8rchqxkwv2bwxib1a17fmwn6c";
-  sgr-iosevka-term-curly-slab = "0dvv2n3plfxm8z2xi1ihzn4rncyk1kz8xbgyprnb0lvqiyf18igy";
-  sgr-iosevka-term-slab = "0i7wrvq6c96q8v6zw9iym42b6sbm0vc04ysljghpblnnfymq5yv9";
-  sgr-iosevka-term-ss01 = "1n23qp50pr466blpn2h9dhjbn0wnbbxyzb0sz751bk8db41lpyqb";
-  sgr-iosevka-term-ss02 = "0ghvfhkdsfsjb8yjwvwlwhn66lmy8dx34126ccnvj0g77ww2nwa9";
-  sgr-iosevka-term-ss03 = "03hnmy9wijqwsc36cg5b3pxj7mb1cbyacii00pcvrpcns2w1ssbw";
-  sgr-iosevka-term-ss04 = "0fv9xhhii0h5ii4yxsdnywn45254494mgq1n5aajasq494cgxhp4";
-  sgr-iosevka-term-ss05 = "0qa4l77sjpxd9l4nb555bhgzm0f1c74w6014md2rpljjvyy2mzwg";
-  sgr-iosevka-term-ss06 = "05y7rmghvhmzw3spn7b3v6hmpcqg5p32flm437a1aljdr46sbxli";
-  sgr-iosevka-term-ss07 = "1lzqgpr1vchi4ricqp1v49nv62rl3anbdvzpvddby81wr5jcyd1y";
-  sgr-iosevka-term-ss08 = "1sxicv2gspc39fyja370dpiq12xd1bgndiw5r6cqfkkd8x8dgpdv";
-  sgr-iosevka-term-ss09 = "0ax9pgm3d171kksrqd2z8xpr68kdxkqg9h344an55gjk01q7dzay";
-  sgr-iosevka-term-ss10 = "1rgvadmvdldcaqa0r76kzmrck814qwksdqficaxcd7wk8bx64n81";
-  sgr-iosevka-term-ss11 = "02if14ff5kax4p1aa2wkbidhwlzgyxi7lxir2ildahwfkvkp971y";
-  sgr-iosevka-term-ss12 = "0sj8n12is4094nbj67wkk88953jp9235kvvr4230abql1g6s263r";
-  sgr-iosevka-term-ss13 = "006sdcj8qw247b63d647ykm8razyb0apsfd0cjmlikj9hdmyzrr2";
-  sgr-iosevka-term-ss14 = "0i7d3ldp9rj1f4kwdk8hkxq0s38df6i25qfx6hwfjj1c5bl3a843";
-  sgr-iosevka-term-ss15 = "15gjqz7zc6wwy1l61pgpnz7wwyyaij43dcrwcwyi6h10jhm8b3ia";
-  sgr-iosevka-term-ss16 = "1c1i1iyqzgh3pz4fzjp26d71lphmcgqbjp2s91yyqg3nfhwbzvyc";
-  sgr-iosevka-term-ss17 = "0kr58576vlx81nb2ia5z9226m6h0ybd5vzfj5li9b721l4q0rpky";
-  sgr-iosevka-term-ss18 = "1zjs40i4dmw2l45k8wydngl4g3a88nhbmmjwd5lsz8a40pq4bw15";
+  iosevka = "0m8z67daj1gwb3yiw8qw3n1nxp96xb11fvb5183bh02r7ncym0da";
+  iosevka-aile = "02jhyzk3bpsjng3b1jfffwvr2inhhjsm4jdahzj05j381fp717c4";
+  iosevka-curly = "1si2kzv7qhlpyaaa954vnjmfk1c5rjxjimvckinpkjz30cnvg1bl";
+  iosevka-curly-slab = "1ngk3r6kdqngksga3s3m615jkqrxdcplj8srvlb6642vcc38w6vh";
+  iosevka-etoile = "1yg38x8dk5nyyjyy71v5j4x2x701hmp8gjwvphf5scf6vn52lvxz";
+  iosevka-slab = "1bw6lyy8lg4vpalnrsrnkrm9dlyl6vm6faigy2y9bfvh7nxrd8qa";
+  iosevka-ss01 = "1p02d8mdqx6mbnycs9d2r0qwqsxjrlgbl7skf8y66dsmjn6xxd0y";
+  iosevka-ss02 = "0ds8ad38h7h8250hdm89v2imya6jdzgk1h5jgsf983ls1gqjikhc";
+  iosevka-ss03 = "1s6rc4qhlfgvr7g8ywmlmsl58hfrqx0w24ivx5zz4jr5zqj70j7l";
+  iosevka-ss04 = "1lc8kx0p8m8nm4ql6ylcw9g4iq0j65hv6x48273cclqqcmqdn4qj";
+  iosevka-ss05 = "1wx02ysbj0rpr623jp1jy64ywrj8rm3n2fqzq05f4qv996bij11k";
+  iosevka-ss06 = "1bf0qnpvbq94d42gvbzikfkk20d788cicsyk8kz1vsf5xbg37kla";
+  iosevka-ss07 = "1ybl5gfyz4dnarimamshf002p9k6148wbbrbarpswb85kab502hd";
+  iosevka-ss08 = "1llp8iryr5dixdarwls9iw8mmnhzhlr7q8fzq969p64ygk76rkn4";
+  iosevka-ss09 = "14b49k0zv49xybdwrbf0p1krrga3jjviwzy0alxrwn0zf7vlbnbi";
+  iosevka-ss10 = "1xs1dkq62pml17dii2lhsianhzr22059i17sw2b334wbszc00j7y";
+  iosevka-ss11 = "0mrjzmk74vlq69ih4gm2iza4qdzyznn42bk3jwlvpd67z5vq36ag";
+  iosevka-ss12 = "0z16a8wrydi0ch9zj0lcz6cxbvawkr0ck03bzdbb81waggk4fxin";
+  iosevka-ss13 = "1rv8n3vbhwqv7bks6v86v4w13fr4a015xpvprzfz76xp98hb9dmc";
+  iosevka-ss14 = "0m7kpvy8bknmrfsql9b24w7n15hybnkisjxzzmrxkf8a60jrydni";
+  iosevka-ss15 = "006jkgww0hdb0c1wgby0y5535xapjpk1w8vm51d3yyrp04pwr1r1";
+  iosevka-ss16 = "1mmc7cyyk64lcavb2gib64b64zcr7qcn0m3cmlwnr1zgm6nb3w64";
+  iosevka-ss17 = "0wanv1h8qg5jyx7w380h7jkbc22slg9566pzw7dv7dg1nw0h2v3k";
+  iosevka-ss18 = "1y1daxghw3jbfn785935906j76l0230yixdmwlrzyra2svyaql3w";
+  sgr-iosevka = "182nzxxrxfz8xc3w8g9bsr0can71671w4xplyvyi7b1v9f62g9f5";
+  sgr-iosevka-aile = "1arjiwx5qf8j6pzb8mpd1g46z0kn80341wvcmsnx42d97b2m64jx";
+  sgr-iosevka-curly = "1lyh0rh2pswbaxsqyxicyknhla4gm2h0jb2rg0wx9vib9h53lazn";
+  sgr-iosevka-curly-slab = "0h2j7dwcyd5v1acpwjsz9li5g4r1ssx715x5pj4gdvskq4calff4";
+  sgr-iosevka-etoile = "15ag0w6sv24rc91mxh4c89gq6jwnq37bxml6a41rvn54fy0h1jnd";
+  sgr-iosevka-fixed = "0935zbk5x0mk06al11nig74b2rv1x8zc3waxs8hvbri0ryzykzk4";
+  sgr-iosevka-fixed-curly = "1i8cqfwcdsaxdlh87kaya8bp33fwlyz984r757122qnqbywcfm30";
+  sgr-iosevka-fixed-curly-slab = "0ba77jxn8n5dssjpwj4iyvwxw3mxqizrvsz5jyv9a4f3gfvwi18k";
+  sgr-iosevka-fixed-slab = "0qfhc7pg30ashpx504lln4h2w36icrbgij7fga07z2a715qxmfq9";
+  sgr-iosevka-fixed-ss01 = "1597hn4vzh0r8j22k7866blj3kw2bhp70z7msfr2hbszpscwxwqg";
+  sgr-iosevka-fixed-ss02 = "1ygrsvamgp6f26zg5qysk6dn4fa1im02dzsrlpgpv3sl4gh0cv44";
+  sgr-iosevka-fixed-ss03 = "0936ggnzaavqn4d7fsmmf54bwp0v31sz0n1w15ky7c5bsqp9h8ja";
+  sgr-iosevka-fixed-ss04 = "1xjslygh3f5nv0k8fiby0cgg22wr0a9jh79fbzallx3zh4d60a2a";
+  sgr-iosevka-fixed-ss05 = "0vnm398zdvkzymhw41gljpf9jq52wq3vawiyw5xsdr75d4n63fpb";
+  sgr-iosevka-fixed-ss06 = "1pnk8ijb193h85sk702ar0m0wk03xz1xcnvx8iq4k52q3a3vdd40";
+  sgr-iosevka-fixed-ss07 = "0qfcf6r2gzc5zwjfrcq1hjp9c5s13fc34lwwmxkj8224d42543jn";
+  sgr-iosevka-fixed-ss08 = "1ram9wm14k2sncfqpak23vss3pyqbwd1ndhm1i4ib7bpq8skd3wi";
+  sgr-iosevka-fixed-ss09 = "0r8zy1fwih42clxm2rsjqks5rxgy1qxirz396r25gvwxng2503y4";
+  sgr-iosevka-fixed-ss10 = "1v44s7n1gwz7mcybjsi1amv6xc8z47k20miycngjcy1cccrds2da";
+  sgr-iosevka-fixed-ss11 = "1fdclqvzq45shpj97awc7636ymgrnfd69iaizwxy49y2krpa7dx9";
+  sgr-iosevka-fixed-ss12 = "07f7i0qh9z6hlgy0ak3myxmiy4rbrixcap52lhk8wwapbnf21r7l";
+  sgr-iosevka-fixed-ss13 = "07z3hfi5vynwl15dqfsldwjj5i9fldmm6i1nypm28cxbya3izj60";
+  sgr-iosevka-fixed-ss14 = "1r001yna7ydf24bkgygld2kh47pvsz1yr9s57ssvdql37q24wzf1";
+  sgr-iosevka-fixed-ss15 = "1757lzbp9payykcdywdbfilhgm1yij8gsnazc7bywpc4sv806vhz";
+  sgr-iosevka-fixed-ss16 = "18mr7wvz5q60kgz0h2k05ahd0krz3ng7wgg1amd3292cji61vxvw";
+  sgr-iosevka-fixed-ss17 = "1bykqwspssv1vbx2nns8dfckijqmd633g57glmlhjmxlavv5gxnw";
+  sgr-iosevka-fixed-ss18 = "034w2yv2ihybkz03zalcsixrmjs7as62v8jhk8xkyckqc3bk0kc7";
+  sgr-iosevka-slab = "04b1w9ij6dgy5gyvi7d47g9xadpb230mlgbdrk36fyhvfyw048y1";
+  sgr-iosevka-ss01 = "077d4dan7f41ydi64xv0z0784j5vcj98vmqagmy1c1xyr0p68dac";
+  sgr-iosevka-ss02 = "1hmy2cwnsb3f60yp66lznas78432518xkj2jmpqy8ad05d2zmmc8";
+  sgr-iosevka-ss03 = "1bs1hb6magmbc2zh4fzx7h6j6bdllbvv85fv5krs3b888w3fzjw1";
+  sgr-iosevka-ss04 = "1c3wb8nz0xz57crwn151b5sgzm320jkirsajyjf0srdaid1gkjkx";
+  sgr-iosevka-ss05 = "1dx33y8rk3nzgdfikz262javq4v3n76hvv5b7rx7kxlkxycpy8ya";
+  sgr-iosevka-ss06 = "1s54xx4w3zvbz2w7f5sl5vlqazwsm033jsq8ljrdh4c2l88mpcq3";
+  sgr-iosevka-ss07 = "03zfq3jib2df6dhj1pbmw8hq57i0fx98gkawxzk13sfgrzz1zv47";
+  sgr-iosevka-ss08 = "09k220gha919lv18bs6y2zlcjqa5j7jsq8mfqx8xddcwq1v9v094";
+  sgr-iosevka-ss09 = "0plvxhqwkr52sich4kwzqs3xq5s5x61hq7n423ar2zaskx007sjv";
+  sgr-iosevka-ss10 = "0c42h417sir120cp6fbnbhv3s1ys8pxky56v6f44h50w7p6qhlx1";
+  sgr-iosevka-ss11 = "03sp7z0s5sb9bnhxb9liainpiqmq1r0lpmigscl6wr1rpaxq2l7i";
+  sgr-iosevka-ss12 = "0y2xs0qv3b1k4s4my9c69j94ql2kwmqmm3f626vjj8rar8r0wab0";
+  sgr-iosevka-ss13 = "1pyv3i1972n5gxr16fl68gydjsxndh7kbba3d15bmkankahgll6c";
+  sgr-iosevka-ss14 = "1c7y8h8jv937wnlxkgdswb0ixa5v747z598pd0yhvwid3ksxb1px";
+  sgr-iosevka-ss15 = "08wzzkr0l0xz4l7qk9kbhvybr4favl0qz0cjr7raw0hibqkw17sp";
+  sgr-iosevka-ss16 = "0q63x71mq19gqqiaqbqsp0lvf3knhckx5d17caq6ipv5gs3xxmzr";
+  sgr-iosevka-ss17 = "04054qbvyfvp1aqs3likyh85kqyckkg2ac83s65lvkj3f46r50sg";
+  sgr-iosevka-ss18 = "1ckrfx3f4mncm1hbc2bcsbk97kkzsi524wfgvhz10jw1yk5yyd60";
+  sgr-iosevka-term = "1ygfsc86fihkxpwm2q3j2y3ibpb7lkrjwrld7dg9ymb83hah29xm";
+  sgr-iosevka-term-curly = "1qz8x2z23m5yvdpf0055a7xb5z77dabwbf3hkmh4r77rp1h6idv4";
+  sgr-iosevka-term-curly-slab = "011n7qpcx2abvp5i9z6picy5bcjvvfx7pjqy8m7sf02fdm14s2jl";
+  sgr-iosevka-term-slab = "1iwgcqnxbjf25k6bbx3iwcqy2ghwnnxvfinjp5slwr7bhjjjbl9y";
+  sgr-iosevka-term-ss01 = "09s813a8ywqpncmq0iqkjjnh1sb5zn267fzp2dz92cmw5929627s";
+  sgr-iosevka-term-ss02 = "1yyvnxdwi6caq6b6pgviad5l7b7znx4xkxdg1np23a7imr94vb1c";
+  sgr-iosevka-term-ss03 = "1hrdipmf54z2hrl7g8m8z17aq3lp5v66xy24f58qsm4c1pfab3i7";
+  sgr-iosevka-term-ss04 = "1h54glwrzblg61y4f1sxm78mci47wjry4h4gdrbpx96snf31ynbb";
+  sgr-iosevka-term-ss05 = "1xzzj36817nsw15s3a1f740d89gc4634dnczjjj6vrddli8ilann";
+  sgr-iosevka-term-ss06 = "0c07i831bmfz6y7jqaip6il4cvqzc51d0w17s2dnjrnj4x3ndgmx";
+  sgr-iosevka-term-ss07 = "0x9wzf0w4pzjmzzbmzj56nkhhz5834chvxqn9519fbq1md4pfl3b";
+  sgr-iosevka-term-ss08 = "1gf1l17d8hrf1aq4pq9ai05kan8m86z8s2d7masjkvg1zaw2lb4s";
+  sgr-iosevka-term-ss09 = "1nnhciib413ll2h7ps3vyghiayz9iwniwr7byyn9pdimm0j5vq07";
+  sgr-iosevka-term-ss10 = "0qvficwhpya5sy5myxsjjfmrn9z2d9lpzyi88l8dhz3dfvyr1yzs";
+  sgr-iosevka-term-ss11 = "0ml6swvyddhz2nvq14skfh1d9d98c3d6ir0qgf97pc0qxyqbcfp2";
+  sgr-iosevka-term-ss12 = "01nxs1m2iif6lswx22h58i45zxab0nbqpf0rzlp6v3wnb8ylpbi5";
+  sgr-iosevka-term-ss13 = "0zadj9fakpqmibnxz883hwbcgqfssjvsi6kcvzik5cnamlk2jz8c";
+  sgr-iosevka-term-ss14 = "1dwfm8lcbgf8rfw11i2alrv98f9332cqyk9zvzfrjrdp9camr7j0";
+  sgr-iosevka-term-ss15 = "0z7ad7vy2faq33kpbl1x2w6i3s4af8v8fzj05rdyadws35ra3idd";
+  sgr-iosevka-term-ss16 = "1fzzkmk7ppcbmg7s50nknc7nwavfpqsja12af8qidzba9z535w2g";
+  sgr-iosevka-term-ss17 = "1rcpfgf5blg3nbf6prw9h2ylc2ji8vl6cxqlck482kncz8ph9swk";
+  sgr-iosevka-term-ss18 = "1nksii5xyi97lsrf1hxl06m0pdlk8rnsbg1s81amkzz8fxlyhzlc";
 }
--- a/pkgs/data/icons/capitaine-cursors-themed/default.nix
+++ b/pkgs/data/icons/capitaine-cursors-themed/default.nix
@ -1,14 +1,22 @@
-{ lib, fetchzip }:
-fetchzip rec {
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
  pname = "capitaine-cursors-themed";
  version = "5";
-  stripRoot = false;
-  url = "https://github.com/sainnhe/capitaine-cursors/releases/download/r${version}/Linux.zip";
-  sha256 = "jQNAXuR/OtvohWziGYgb5Ni2/tEIGaY9HIyUUW793EY=";

-  postFetch = ''
+  src = fetchzip {
+    url = "https://github.com/sainnhe/capitaine-cursors/releases/download/r${version}/Linux.zip";
+    stripRoot = false;
+    hash = "sha256-ipPpmZKU/xLA45fdOvxVbtFDCUsCYIvzeps/DjhFkNg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/share/icons
    cp -r ./ $out/share/icons
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/data/misc/cldr-annotations/default.nix
+++ b/pkgs/data/misc/cldr-annotations/default.nix
@ -1,23 +1,24 @@
-{ lib, fetchzip }:
+{ lib, stdenvNoCC, fetchzip }:

-fetchzip rec {
+stdenvNoCC.mkDerivation rec {
  pname = "cldr-annotations";
  version = "42.0";

-  url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
+  src = fetchzip {
+    url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
+    stripRoot = false;
+    hash = "sha256-paRon3ecGXNp3ZDnN1DU9RVU2NDWTBiKjy0OP3vcPLE=";
+  };
+
+  installPhase = ''
+    runHook preInstall

-  stripRoot = false;
-  postFetch = ''
    mkdir -p $out/share/unicode/cldr/common
-    mv $out/common/annotations{,Derived} -t $out/share/unicode/cldr/common
+    mv common/annotations{,Derived} -t $out/share/unicode/cldr/common

-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+    runHook postInstall
  '';

-  hash = "sha256-9OOd69nBaDSt+ilL3PTGpcQgC60PnHqd8/CYa2LgeI0=";
-
  meta = with lib; {
    description = "Names and keywords for Unicode characters from the Common Locale Data Repository";
    homepage = "https://cldr.unicode.org";
--- a/pkgs/data/misc/papirus-folders/default.nix
+++ b/pkgs/data/misc/papirus-folders/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "papirus-folders";
-  version = "1.12.0";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "PapirusDevelopmentTeam";
    repo = "papirus-folders";
    rev = "v${version}";
-    sha256 = "sha256-ZZMEZCWO+qW76eqa+TgxWGVz69VkSCPcttLoCrH7ppY=";
+    sha256 = "sha256-Dus9f2m5Wj46Url7N3UYEvBAankppzGzdJHGPH3CT3g=";
  };

  buildInputs = [
--- a/pkgs/data/misc/publicsuffix-list/default.nix
+++ b/pkgs/data/misc/publicsuffix-list/default.nix
@ -1,20 +1,24 @@
-{ lib, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:

-let
+stdenvNoCC.mkDerivation {
  pname = "publicsuffix-list";
-  version = "2021-09-03";
-in fetchFromGitHub {
-  name = "${pname}-${version}";
-  owner = "publicsuffix";
-  repo = "list";
-  rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
-  sha256 = "sha256-Q8uIXM1CMu8dlWcVoL17M1XRGu3kG7Y7jpx0oHQh+2I=";
+  version = "unstable-2021-09-03";

-  postFetch = ''
-    install -Dm0444 $out/public_suffix_list.dat $out/tests/test_psl.txt -t $out/share/publicsuffix
-    shopt -s extglob dotglob
-    rm -rf $out/!(share)
-    shopt -u extglob dotglob
+  src = fetchFromGitHub {
+    owner = "publicsuffix";
+    repo = "list";
+    rev = "2533d032871e1ef1f410fc0754b848d4587c8021";
+    hash = "sha256-moibTN9KovABcg+ubKUgMXg4b8sMrTVo6Itmiati/Vk=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm0444 public_suffix_list.dat tests/test_psl.txt -t $out/share/publicsuffix
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/data/misc/unicode-emoji/default.nix
+++ b/pkgs/data/misc/unicode-emoji/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenvNoCC
 , fetchurl
 , symlinkJoin
 }:
@ -6,30 +7,40 @@
 let
  version = "15.0";

-  fetchData = { file, sha256 }: fetchurl {
-    url = "https://www.unicode.org/Public/emoji/${version}/${file}";
-    inherit sha256;
-    downloadToTemp = true;
-    recursiveHash = true;
-    postFetch = ''
+  fetchData = { suffix, hash }: stdenvNoCC.mkDerivation {
+    pname = "unicode-emoji-${suffix}";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://www.unicode.org/Public/emoji/${version}/emoji-${suffix}.txt";
+      inherit hash;
+    };
+
+    dontUnpack = true;
+
+    installPhase = ''
+      runHook preInstall
+
      installDir="$out/share/unicode/emoji"
      mkdir -p "$installDir"
-      mv "$downloadedFile" "$installDir/${file}"
+      cp "$src" "$installDir/emoji-${suffix}.txt"
+
+      runHook postInstall
    '';
  };

  srcs = {
    emoji-sequences = fetchData {
-      file = "emoji-sequences.txt";
-      sha256 = "sha256-vRpXHAcdY3arTnFwBH3WUW3DOh8B3L9+sRcecLHZ2lg=";
+      suffix = "sequences";
+      hash = "sha256-XCIi2KQy2JagMaaML1SwT79HsPzi5phT8euKPpRetW0=";
    };
    emoji-test = fetchData {
-      file = "emoji-test.txt";
-      sha256 = "sha256-3Rega6+ZJ5jXRhLFL/i/12V5IypEo5FaGG6Wf9Bj0UU=";
+      suffix = "test";
+      hash = "sha256-hEXyOsg4jglr4Z0CYuFPzv+Fb/Ugk/I1bciUhfGoU9s=";
    };
    emoji-zwj-sequences = fetchData {
-      file = "emoji-zwj-sequences.txt";
-      sha256 = "sha256-9AqrpyUCiBcR/fafa4VaH0pT5o1YzEZDVySsX4ja1u8=";
+      suffix = "zwj-sequences";
+      hash = "sha256-/jV/kRe3dGZ2Bjdl1YcTft+bJZA6eSvVSTW/CFZ5EYI=";
    };
  };
 in
--- a/pkgs/desktops/gnome/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome/apps/seahorse/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , lib
+, fetchpatch
 , fetchurl
 , vala
 , meson
@ -36,6 +37,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-Wx0b+6dPNlgifzyC4pbzMN0PzR70Y2tqIYIo/uXqgy0=";
  };

+  patches = [
+    (fetchpatch {
+      name = "gpg-2.4.patch";
+      url = "https://gitlab.gnome.org/GNOME/seahorse/-/commit/9260c74779be3d7a378db0671af862ffa3573d42.patch";
+      hash = "sha256-4QiFgH4jC1ucmA9fFozUQZ3Mat76SgpYkMpRz80RH64=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/desktops/gnome/core/gnome-contacts/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-contacts/default.nix
@ -26,11 +26,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-contacts";
-  version = "43.0";
+  version = "43.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "VbYd9+k/Cr4f+kZeGOPF3k9JqQ8mjqnRHtyGrwbQceE=";
+    sha256 = "Ug3IjJAce4/n4SoBOhQlz+2R8vhAhIWitJ+SxnWZACA=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/rox/rox-filer/default.nix
+++ b/pkgs/desktops/rox/rox-filer/default.nix
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
    wrapGAppsHook
  ];
  buildInputs = [ libxml2 gtk shared-mime-info libSM ];
-  NIX_LDFLAGS = "-ldl -lm";
+  NIX_LDFLAGS = "-lm";

  patches = [
    ./rox-filer-2.11-in-source-build.patch
--- a/pkgs/development/compilers/dmd/generic.nix
+++ b/pkgs/development/compilers/dmd/generic.nix
@ -151,13 +151,6 @@ stdenv.mkDerivation rec {
    git
  ];

-  # Workaround cc-wrapper's --sysroot= value for `staging-next`: it
-  # breaks library lookup via RUNPATH:
-  #   ld: warning: libm.so.6, needed by ./generated/linux/release/64/lib.so, not found (try using -rpath or -rpath-link)
-  #   ld: /build/druntime/generated/linux/release/64/libdruntime.so: undefined reference to `log10@GLIBC_2.2.5'
-  # TODO(trofi): remove the workaround once cc-wrapper is fixed.
-  NIX_CFLAGS_COMPILE = [ "--sysroot=/" ];
-
  buildInputs = [
    curl
    tzdata
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@ -222,7 +222,7 @@ stdenv.mkDerivation ({
  inherit (callFile ../common/dependencies.nix { })
    depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";

  preConfigure = (callFile ../common/pre-configure.nix { }) + ''
    ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
@ -235,7 +235,6 @@ stdenv.mkDerivation ({
  configureFlags = callFile ../common/configure-flags.nix { };

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@ -82,7 +82,10 @@ let majorVersion = "11";
      ++ optional (stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch

      # Obtain latest patch with ../update-mcfgthread-patches.sh
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch;
+      ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch
+
+      # openjdk build fails without this on -march=opteron; is upstream in gcc12
+      ++ [ ./gcc-issue-103910.patch ];

    /* Cross-gcc settings (build == host != target) */
    crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
@ -228,7 +231,7 @@ stdenv.mkDerivation ({
  inherit (callFile ../common/dependencies.nix { })
    depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";

  preConfigure = (callFile ../common/pre-configure.nix { }) + ''
    ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
@ -241,7 +244,6 @@ stdenv.mkDerivation ({
  configureFlags = callFile ../common/configure-flags.nix { };

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch
+++ b/pkgs/development/compilers/gcc/11/gcc-issue-103910.patch
@ -0,0 +1,41 @@
+From d243f4009d8071b734df16cd70f4c5d09a373769 Mon Sep 17 00:00:00 2001
+From: Andrew Pinski <apinski@marvell.com>
+Date: Wed, 5 Jan 2022 22:00:07 +0000
+Subject: [PATCH] Fix target/103910: missing GTY on x86_mfence causing PCH
+ usage to ICE
+
+With -O3 -march=opteron, a mfence builtin is added after the loop
+to say the nontemporal stores are no longer needed. This all good
+without precompiled headers as the function decl that is referneced
+by x86_mfence is referenced in another variable but with precompiled
+headers, x86_mfence is all messed up and the decl was GC'ed away.
+This fixes the problem by marking x86_mfence as GTY to save/restore
+during precompiled headers just like most other variables in
+the header file.
+
+Committed as obvious after a bootstrap/test on x86_64-linux-gnu.
+
+gcc/ChangeLog:
+
+	PR target/103910
+	* config/i386/i386.h (x86_mfence): Mark with GTY.
+---
+ gcc/config/i386/i386.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gcc/config/i386/i386.h b/gcc/config/i386/i386.h
+index f027608eefa..3ac0f698ae2 100644
+--- a/gcc/config/i386/i386.h
+++ b/gcc/config/i386/i386.h
+@@ -486,7 +486,7 @@ extern unsigned char ix86_prefetch_sse;
+ 
+ /* Fence to use after loop using storent.  */
+ 
+-extern tree x86_mfence;
+extern GTY(()) tree x86_mfence;
+ #define FENCE_FOLLOWING_MOVNT x86_mfence
+ 
+ /* Once GDB has been enhanced to deal with functions without frame
+-- 
+2.31.1
+
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@ -261,7 +261,7 @@ stdenv.mkDerivation ({

  inherit (callFile ../common/dependencies.nix { }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";


  preConfigure = (callFile ../common/pre-configure.nix { }) + ''
@ -275,7 +275,6 @@ stdenv.mkDerivation ({
  configureFlags = callFile ../common/configure-flags.nix { };

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@ -246,7 +246,6 @@ stdenv.mkDerivation ({
  configureFlags = callFile ../common/configure-flags.nix { };

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -266,7 +266,6 @@ stdenv.mkDerivation ({
  configureFlags = callFile ../common/configure-flags.nix { };

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -276,7 +276,7 @@ stdenv.mkDerivation ({
  inherit (callFile ../common/dependencies.nix { })
    depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";

  preConfigure = callFile ../common/pre-configure.nix { };

@ -287,7 +287,6 @@ stdenv.mkDerivation ({
  configureFlags = callFile ../common/configure-flags.nix { };

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@ -226,7 +226,7 @@ stdenv.mkDerivation ({
    depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";

  preConfigure = callFile ../common/pre-configure.nix { };

@ -240,7 +240,6 @@ stdenv.mkDerivation ({
  ;

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@ -207,7 +207,7 @@ stdenv.mkDerivation ({
  inherit (callFile ../common/dependencies.nix { })
    depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";

  preConfigure = callFile ../common/pre-configure.nix { };

@ -218,7 +218,6 @@ stdenv.mkDerivation ({
  configureFlags = callFile ../common/configure-flags.nix { };

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -221,7 +221,7 @@ stdenv.mkDerivation ({
  inherit (callFile ../common/dependencies.nix { })
    depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

-  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
+  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm";

  preConfigure = callFile ../common/pre-configure.nix { };

@ -232,7 +232,6 @@ stdenv.mkDerivation ({
  configureFlags = callFile ../common/configure-flags.nix { };

  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-  targetPlatformConfig = targetPlatform.config;

  buildFlags = optional
    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@ -203,17 +203,6 @@ preInstall() {
        ln -s lib "$out/${targetConfig}/lib32"
        ln -s lib "${!outputLib}/${targetConfig}/lib32"
    fi
-
-    # cc-wrappers uses --sysroot=/nix/store/does/not/exist as a way to
-    # drop default sysheaders search path. Unfortunately that switches
-    # clang++ into searching libraries in gcc in cross-compiler paths:
-    #   from ${!outputLib}/lib (native)
-    #   to ${!outputLib}/${targetPlatformConfig}/lib
-    # We create the symlink to make both native and cross paths
-    # available even if the toolchain is not the cross-compiler.
-    if [ ! -e ${!outputLib}/${targetPlatformConfig} ] ; then
-        ln -s . ${!outputLib}/${targetPlatformConfig}
-    fi
 }


--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , substituteAll
@ -87,6 +88,12 @@ stdenv.mkDerivation rec {
    })
    ./remove-tools-1.11.patch
    ./go_no_vendor_checks-1.16.patch
+
+    # runtime: support riscv64 SV57 mode
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
+      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
+    })
  ];

  GOOS = stdenv.targetPlatform.parsed.kernel.name;
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchurl
 , tzdata
 , substituteAll
@ -87,6 +88,12 @@ stdenv.mkDerivation rec {
    })
    ./remove-tools-1.11.patch
    ./go_no_vendor_checks-1.16.patch
+
+    # runtime: support riscv64 SV57 mode
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/1e3c19f3fee12e5e2b7802a54908a4d4d03960da.patch";
+      sha256 = "sha256-mk/9gXwQEcAkiRemF6GiNU0c0fhDR29/YcKgQR7ONTA=";
+    })
  ];

  GOOS = stdenv.targetPlatform.parsed.kernel.name;
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@ -0,0 +1,148 @@
+{ lib
+, stdenv
+, alsa-lib
+, autoPatchelfHook
+, cairo
+, cups
+, fontconfig
+, Foundation
+, glib
+, gtk3
+, gtkSupport ? stdenv.isLinux
+, makeWrapper
+, setJavaClassPath
+, unzip
+, xorg
+, zlib
+}:
+{ javaVersion
+, meta ? { }
+, products ? [ ]
+, ... } @ args:
+
+let
+  runtimeLibraryPath = lib.makeLibraryPath
+    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
+  mapProducts = key: default: (map (p: p.${key} or default) products);
+  concatProducts = key: lib.concatStringsSep "\n" (mapProducts key "");
+
+  graalvmXXX-ce = stdenv.mkDerivation (args // {
+    pname = "graalvm${javaVersion}-ce";
+
+    unpackPhase = ''
+      runHook preUnpack
+
+      mkdir -p "$out"
+
+      # The tarball on Linux has the following directory structure:
+      #
+      #   graalvm-ce-java11-20.3.0/*
+      #
+      # while on Darwin it looks like this:
+      #
+      #   graalvm-ce-java11-20.3.0/Contents/Home/*
+      #
+      # We therefor use --strip-components=1 vs 3 depending on the platform.
+      tar xf "$src" -C "$out" --strip-components=${
+        if stdenv.isLinux then "1" else "3"
+      }
+
+      # Sanity check
+      if [ ! -d "$out/bin" ]; then
+          echo "The `bin` is directory missing after extracting the graalvm"
+          echo "tarball, please compare the directory structure of the"
+          echo "tarball with what happens in the unpackPhase (in particular"
+          echo "with regards to the `--strip-components` flag)."
+          exit 1
+      fi
+
+      runHook postUnpack
+    '';
+
+    postUnpack = ''
+      for product in ${toString products}; do
+        cp -Rv $product/* $out
+      done
+    '';
+
+    dontStrip = true;
+
+    nativeBuildInputs = [ unzip makeWrapper ]
+      ++ lib.optional stdenv.isLinux autoPatchelfHook;
+
+    propagatedBuildInputs = [ setJavaClassPath zlib ]
+      ++ lib.optional stdenv.isDarwin Foundation;
+
+    buildInputs = lib.optionals stdenv.isLinux [
+      alsa-lib # libasound.so wanted by lib/libjsound.so
+      fontconfig
+      stdenv.cc.cc.lib # libstdc++.so.6
+      xorg.libX11
+      xorg.libXext
+      xorg.libXi
+      xorg.libXrender
+      xorg.libXtst
+    ];
+
+    preInstall = concatProducts "preInstall";
+    postInstall = ''
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -sf $out/include/linux/*_md.h $out/include/
+
+      # copy-paste openjdk's preFixup
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat > $out/nix-support/setup-hook << EOF
+        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '' + concatProducts "postInstall";
+
+    preFixup = lib.optionalString (stdenv.isLinux) ''
+      # Find all executables in any directory that contains '/bin/'
+      for bin in $(find "$out" -executable -type f -wholename '*/bin/*'); do
+        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+      done
+    '' + concatProducts "preFixup";
+    postFixup = concatProducts "postFixup";
+
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+
+      echo ${
+        lib.escapeShellArg ''
+          public class HelloWorld {
+            public static void main(String[] args) {
+              System.out.println("Hello World");
+            }
+          }
+        ''
+      } > HelloWorld.java
+      $out/bin/javac HelloWorld.java
+
+      # run on JVM with Graal Compiler
+      echo "Testing GraalVM"
+      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+
+      ${concatProducts "installCheckPhase"}
+
+      runHook postInstallCheck
+    '';
+
+    passthru = {
+      inherit products;
+      home = graalvmXXX-ce;
+      updateScript = ./update.sh;
+    };
+
+    meta = with lib; ({
+      inherit platforms;
+      homepage = "https://www.graalvm.org/";
+      description = "High-Performance Polyglot VM";
+      license = with licenses; [ upl gpl2Classpath bsd3 ];
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+      mainProgram = "java";
+      maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
+    } // meta);
+  });
+in graalvmXXX-ce
--- a/Show More
+++ b/Show More