…in the nix store

zstd: 1.5.4 → 1.5.5

This reverts commit 398b54b.

This reverts commit e269122.

This reverts commit 46f29d4.

As suggested by @trofi here:

  #209870 (comment)

This should fix failures among packages which use gfortran:

  #209870 (comment)
  https://hydra.nixos.org/build/215195834

In #209870 I tried to unify the
treatment of clang and gcc in cc-wrapper as much as possible.
However it appears that I went too far.

Clang requires -isystem flags in order to be able to find gcc's
libstdc++.  Gcc does not need these flags.  If they are added,
gfortran will get confused:

  #209870 (comment)

This commit deunifies the chunk of code that adds the -isystem
flags, and explains why this chunk applies only to clang.

gcc: drop include-fixed/bits/statx.h

xorg.xcbutil{,errors,image,keysyms,renderutil,wm}: update to 2023 April

…isable-bootstrap

see https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/#MFSA-TMP-2023-0001
no CVE id or other identifier has been assigned

libwebp: fix MFSA-TMP-2023-0001

SDL2: don't propagate headers-only packages via RUNPATH

The patch is not in 1.68, and was mistakenly removed

Signed-off-by: Henri Rosten <henri.rosten@unikie.com>

QT apps tend to call makeWrapper with a lot of arguments, which causes
noticable slowdowns (+100ms for app startup). The slow down boils down
to two reasons:

- the required string processing is O(N^2)
- bash is slow at doing the processing

By using the binary wrapper, we fix the second point, brining the
overhead down from 100ms to just 4ms or thereabouts.

I tested this change by rebuilding my whole system with it (I use
plasma). It booted and it works (that's where I type this commit
message), but I am not 100% sure if this won't break anything else.

Closes: #225871

This reverts commit ac3acd9.

This reverts commit 9bf18e0.

pybind11's CMake module uses the Python sysconfig module to find the Python
site-packages and include directories. sysconfig returns the wrong values
(from build Python) when cross-compiling, so this patch adds a setup hook to
pass flags to CMake to override the sysconfig results.

Note that the setup hook references build Python, and therefore adds build
Python to pybind11's runtime closure. This is not a problem because pybind11
is a header only library and should never end up as part of another package's
runtime closure.

This packages has build-platform protobuf in propagatedNativeBuildInputs,
therefore it must use split outputs to avoid adding build-platform dependencies
to the runtime closure when cross-compiling.

Enable cross-compilation of or-tools and python3Packages.ortools. This requires
telling it where to find protoc and providing Python dependencies for the
correct platform. In nativeBuildInputs, we have to explicitly use pythonForBuild
because python3Packages.ortools overrides Python, which prevents splicing from
working.

Lastly, we need to split outputs to avoid protobuf's propagatedNativeBuildInputs
dependency on build-platform protobuf (protoc) becoming part of the runtime
closure.

python310Packages.aioquic: Fix build with pyopenssl>22 and on darwin

Various pypy3Packages fixes

…-2022-12-01

https://github.com/nodejs/node/releases/tag/v18.16.0

https://gitlab.gnome.org/GNOME/libxml2/-/compare/v2.10.3...v2.10.4

- CVE-2023-29469: Hashing of empty dict strings isn't deterministic
- CVE-2023-28484: Fix null deref in xmlSchemaFixupComplexType

linux: fix error with IR remotes

serf consumes apr-util's apu-1-config file to obtain linker flags, so we extend the existing Makefile patch there to also apply to apu-1-config

sbcl: 2.3.0 -> 2.3.2

...into staging

nodejs-18_x: 18.15.0 -> 18.16.0

…lelBuilding2

based on libde265's own test files

Replaces perl based c_rehash script with shell script wrapping `openssl rehash`
with the same functionality.

Fixes: #19965
Supersedes: #156776, #83446
Possibly related to: #157093, #82924

same as changes applied to openssl

Closes #225779
Closes #225780

cudaPackages: append $ORIGIN to Runpaths

Our rustc package is not universal, because we only build std for the
host and target platforms.  This means that a build graph where cross
is involved will end up with multiple rustc packages in it, so it
would be helpful to have a way to tell them apart, just like we do for
e.g. gcc.

This patches some more occurences, addresses upstream feedback, and was
sent upstream at systemd/systemd#27274.

…t-cha.patch

In NixOS, /etc is NOT read-only, and most things in /etc are symlinks
to /etc/static, which is a symlink into the nix store - so the upstream
systemd "/etc is read-only" detection doesn't work.

Fixes #224080.

https://github.com/rubygems/rubygems/releases/tag/bundler-v2.4.11
https://github.com/rubygems/rubygems/releases/tag/bundler-v2.4.12

GitLab doesn't support Ruby 3 yet
https://gitlab.com/groups/gitlab-org/-/epics/5149

Fixes CVE-2023-1801 (the vulnerable feature is not enabled by default).

https://git.tcpdump.org/tcpdump/blob/tcpdump-4.99.4:/CHANGES

https://git.tcpdump.org/libpcap/blob/libpcap-1.10.4:/CHANGES

…ging

tcpdump: 4.99.3 -> 4.99.4, libpcap: 1.10.3 -> 1.10.4

Changelog: https://github.com/git/git/blob/v2.40.0/Documentation/RelNotes/2.40.0.txt

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>