14 files changed, 70 insertions, 51 deletions
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
index 7be670425d7af..b661da75febe6 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
@@ -40,6 +40,7 @@ stdenvNoCC.mkDerivation {
     cp -d \
       ${MacOSX-SDK}/usr/include/*.h \
       ${MacOSX-SDK}/usr/include/*.modulemap \
+      ${MacOSX-SDK}/usr/include/*.apinotes \
       $out/include
 
     rm $out/include/tk*.h $out/include/tcl*.h
diff --git a/pkgs/os-specific/linux/anbox/0002-NixOS-Build-android-emugl-with-cpp-14.patch b/pkgs/os-specific/linux/anbox/0002-NixOS-Build-android-emugl-with-cpp-14.patch
new file mode 100644
index 0000000000000..bf87502826844
--- /dev/null
+++ b/pkgs/os-specific/linux/anbox/0002-NixOS-Build-android-emugl-with-cpp-14.patch
@@ -0,0 +1,11 @@
+--- a/external/android-emugl/CMakeLists.txt
++++ b/external/android-emugl/CMakeLists.txt
+@@ -1,7 +1,7 @@
+ # Don't treat any warnings as error as we take the source directly from
+ # upstream and just compile it.
+ set(CMAKE_C_FLAGS "-Wall")
+-set(CMAKE_CXX_FLAGS "-std=c++11 -Wall")
++set(CMAKE_CXX_FLAGS "-std=c++14 -Wall")
+ 
+ # Ensure -fPIC
+ set(CMAKE_POSITION_INDEPENDENT_CODE ON)
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index ad03ba1aefb23..a3724c792482e 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -130,6 +130,8 @@ stdenv.mkDerivation rec {
     })
     # Ensures generated desktop files work on store path change
     ./0001-NixOS-Use-anbox-from-PATH-in-desktop-files.patch
+    # Allows android-emugl to build with gtest 1.13+
+    ./0002-NixOS-Build-android-emugl-with-cpp-14.patch
     # Provide window icons
     (fetchpatch {
       url = "https://github.com/samueldr/anbox/commit/2387f4fcffc0e19e52e58fb6f8264fbe87aafe4d.patch";
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 99c1000f0e4c1..97fb7f0a6190f 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  apparmor-version = "3.1.6";
+  apparmor-version = "3.1.7";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -36,7 +36,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-VPgRmmQv+kgLduc6RTu9gotyjT6OImUXsPeatgG7m9E=";
+    hash = "sha256-AzY05bcpNYXix2GL4Rhc9d3RBA1pd2fwOa7yoiwc2nQ=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 4cbf950cdce48..59f2a6965daf5 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.61";
+  version = "0.62";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-spoZRT/gBCk/e/pn1AujCpCPdEM7hn/ImRyQq4hwctI=";
+    hash = "sha256-HgYwyE0jejEzg9LorjDz7F0GbiXUfYpKNJ+tFIBbYWA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index d1e78a312e05a..dfa974e3e683c 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -1,9 +1,12 @@
 { lib
+, stdenv
 , mkDerivation
+, argp-standalone
 , dbus
 , dbus_cplusplus
 , desktop-file-utils
 , fetchurl
+, fetchpatch
 , glibmm
 , kernel
 , libavc1394
@@ -41,6 +44,13 @@ mkDerivation rec {
   patches = [
     # fix installing metainfo file
     ./fix-build.patch
+
+    (fetchpatch {
+      name = "musl.patch";
+      url = "http://subversion.ffado.org/changeset?format=diff&new=2846&old=2845";
+      stripLen = 2;
+      hash = "sha256-iWeYnb5J69Uvo1lftc7MWg7WrLa+CGZyOwJPOe8/PKg=";
+    })
   ];
 
   outputs = [ "out" "bin" "dev" ];
@@ -79,8 +89,12 @@ mkDerivation rec {
     libraw1394
     libxmlxx3
     python
+  ] ++ lib.optionals (!stdenv.hostPlatform.isGnu) [
+    argp-standalone
   ];
 
+  NIX_LDFLAGS = lib.optionalString (!stdenv.hostPlatform.isGnu) "-largp";
+
   enableParallelBuilding = true;
   dontWrapQtApps = true;
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index a705a9fb5d381..7aeea8a8b59a5 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.378";
+  version = "0.379";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-YCx0b4crg8A7mGXwqk1XQZKsm/3TUE8C2bOYKnb/FSA=";
+    hash = "sha256-6IMvnXP9uy8kAKRyzV/raZzUnpVCzp7SHnGt8qDUDXY=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index 762678141bdee..ccaf54759d85d 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.13";
+  version = "2.14";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    hash = "sha256-Nyp7Gm3JK6bLzAZxuEjxKnzAK/eAYUO5owMbG90WQ8E=";
+    hash = "sha256-35hKb8IVL8jQG80y48a5CcozUEWxLCdTqAHhZlPFCYE=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index a66996b6c143c..4b9259d396b30 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -290,6 +290,7 @@ let
       IPW2200_MONITOR             = option yes; # support promiscuous mode
       HOSTAP_FIRMWARE             = option yes; # Support downloading firmware images with Host AP driver
       HOSTAP_FIRMWARE_NVRAM       = option yes;
+      MAC80211_MESH               = option yes; # Enable 802.11s (mesh networking) support
       ATH9K_PCI                   = option yes; # Detect Atheros AR9xxx cards on PCI(e) bus
       ATH9K_AHB                   = option yes; # Ditto, AHB bus
       # The description of this option makes it sound dangerous or even illegal
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 62db42e13aa0b..b42bffdc057df 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -1,5 +1,6 @@
-{ lib, stdenv, fetchurl, fetchpatch, buildPackages, pcre, pkg-config, libsepol
-, enablePython ? !stdenv.hostPlatform.isStatic, swig ? null, python3 ? null
+{ lib, stdenv, fetchurl, fetchpatch, buildPackages, pcre2, pkg-config, libsepol
+, enablePython ? !stdenv.hostPlatform.isStatic
+, swig ? null, python3 ? null, python3Packages
 , fts
 }:
 
@@ -9,14 +10,14 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libselinux";
-  version = "3.3";
+  version = "3.6";
   inherit (libsepol) se_url;
 
   outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
 
   src = fetchurl {
     url = "${se_url}/${version}/libselinux-${version}.tar.gz";
-    sha256 = "0mvh793g7fg6wb6zqhkdyrv80x6k84ypqwi8ii89c91xcckyxzdc";
+    hash = "sha256-uk4O80snDnZypeXxtSP+K+qzpAuzPZOJ9K06hyjyG1I=";
   };
 
   patches = [
@@ -40,8 +41,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ pkg-config python3 ] ++ optionals enablePython [ swig ];
-  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python3 ];
+  nativeBuildInputs = [ pkg-config python3 ] ++ optionals enablePython [
+    python3Packages.pip
+    python3Packages.setuptools
+    python3Packages.wheel
+    swig
+  ];
+  buildInputs = [ libsepol pcre2 fts ] ++ optionals enablePython [ python3 ];
 
   # drop fortify here since package uses it by default, leading to compile error:
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
@@ -68,6 +74,7 @@ stdenv.mkDerivation rec {
   ] ++ optionals enablePython [
     "PYTHON=${python3.pythonOnBuildForHost.interpreter}"
     "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
+    "PYTHON_SETUP_ARGS=--no-build-isolation"
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index a65d4ed041b41..16e2ae51f9572 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numactl";
-  version = "2.0.16";
+  version = "2.0.18";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aDKzkmvrPDzQl4n0KgeiU5LOLhQA0tmwzGiXvJDp7ZI=";
+    hash = "sha256-ry29RUNa0Hv5gIhy2RTVT94mHhgfdIwb5aqjBycxxj0=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index e81f42b65a23e..dcf146a01fa6a 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -5,7 +5,6 @@
 , mesonEmulatorHook
 , ninja
 , fetchFromGitLab
-, fetchpatch
 , libgudev
 , glib
 , polkit
@@ -21,22 +20,21 @@
 , umockdev
 , systemd
 , python3
-, wrapGAppsNoGuiHook
 , nixosTests
 }:
 
 stdenv.mkDerivation rec {
   pname = "power-profiles-daemon";
-  version = "0.13";
+  version = "0.20";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
-    owner = "hadess";
+    owner = "upower";
     repo = "power-profiles-daemon";
     rev = version;
-    sha256 = "sha256-ErHy+shxZQ/aCryGhovmJ6KmAMt9OZeQGDbHIkC0vUE=";
+    sha256 = "sha256-8wSRPR/1ELcsZ9K3LvSNlPcJvxRhb/LRjTIxKtdQlCA=";
   };
 
   nativeBuildInputs = [
@@ -50,8 +48,6 @@ stdenv.mkDerivation rec {
     libxml2 # for xmllint for stripping GResources
     libxslt # for xsltproc for building docs
     gobject-introspection
-    wrapGAppsNoGuiHook
-    python3.pkgs.wrapPython
     # checkInput but cheked for during the configuring
     (python3.pythonOnBuildForHost.withPackages (ps: with ps; [
       pygobject3
@@ -68,16 +64,16 @@ stdenv.mkDerivation rec {
     upower
     glib
     polkit
-    python3 # for cli tool
-    # Duplicate from nativeCheckInputs until https://github.com/NixOS/nixpkgs/issues/161570 is solved
-    umockdev
+    # for cli tool
+    (python3.withPackages (ps: [
+      ps.pygobject3
+    ]))
   ];
 
   strictDeps = true;
 
-  # for cli tool
-  pythonPath = [
-    python3.pkgs.pygobject3
+  checkInputs = [
+    umockdev
   ];
 
   nativeCheckInputs = [
@@ -95,26 +91,13 @@ stdenv.mkDerivation rec {
 
   PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
 
-  # Avoid double wrapping
-  dontWrapGApps = true;
-
   postPatch = ''
     patchShebangs --build \
       tests/integration-test.py \
       tests/unittest_inspector.py
-  '';
-
-  postCheck = ''
-    # Do not contaminate the wrapper with test dependencies.
-    unset GI_TYPELIB_PATH
-    unset XDG_DATA_DIRS
-  '';
 
-  postFixup = ''
-    # Avoid double wrapping
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-    # Make Python libraries available
-    wrapPythonProgramsIn "$out/bin" "$pythonPath"
+    patchShebangs --host \
+      src/powerprofilesctl
   '';
 
   passthru = {
diff --git a/pkgs/os-specific/linux/r8168/default.nix b/pkgs/os-specific/linux/r8168/default.nix
index 69e779dfaa66a..6eb53ca17f7a3 100644
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -6,18 +6,18 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 in stdenv.mkDerivation rec {
   name = "r8168-${kernel.version}-${version}";
   # on update please verify that the source matches the realtek version
-  version = "8.048.03";
+  version = "8.052.01";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
   # [1] https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-pci-express-software
-  # I've verified manually (`diff -r`) that the source code for version 8.046.00
+  # I've verified manually (`diff -r`) that the source code for version 8.052.01
   # is the same as the one available on the realtek website.
   src = fetchFromGitHub {
     owner = "mtorromeo";
     repo = "r8168";
     rev = version;
-    sha256 = "1l8llpcnapcaafxp7wlyny2ywh7k6q5zygwwjl9h0l6p04cghss4";
+    sha256 = "01mi7hh92nc7jaxkfrpz7j0ci78djrhgmq0im4k1270mwmvr0yzj";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/zfs/stable.nix b/pkgs/os-specific/linux/zfs/stable.nix
index 5f879320b4dc1..df06ea9a32854 100644
--- a/pkgs/os-specific/linux/zfs/stable.nix
+++ b/pkgs/os-specific/linux/zfs/stable.nix
@@ -17,20 +17,20 @@ callPackage ./generic.nix args {
   # check the release notes for compatible kernels
   kernelCompatible =
     if stdenv'.isx86_64 || removeLinuxDRM
-    then kernel.kernelOlder "6.7"
+    then kernel.kernelOlder "6.8"
     else kernel.kernelOlder "6.2";
 
   latestCompatibleLinuxPackages = if stdenv'.isx86_64 || removeLinuxDRM
-    then linuxKernel.packages.linux_6_6
+    then linuxKernel.packages.linux_6_7
     else linuxKernel.packages.linux_6_1;
 
   # this package should point to the latest release.
-  version = "2.2.2";
+  version = "2.2.3";
 
   tests = [
     nixosTests.zfs.installer
     nixosTests.zfs.stable
   ];
 
-  hash = "sha256-CqhETAwhWMhbld5ib3Rz1dxms+GQbLwjEZw/V7U/2nE=";
+  hash = "sha256-Bzkow15OitUUQ+mTYhCXgTrQl+ao/B4feleHY/rSSjg=";
 }