Merge branch 'nixos-unstable-small' of https://github.com/NixOS/nixpkgs

20 files changed, 46 insertions, 682 deletions

diff --git a/nixpkgs/pkgs/data/documentation/stdman/default.nix b/nixpkgs/pkgs/data/documentation/stdman/default.nix
index 57e32d864053..adb735c38a1e 100644
--- a/nixpkgs/pkgs/data/documentation/stdman/default.nix
+++ b/nixpkgs/pkgs/data/documentation/stdman/default.nix
@@ -14,7 +14,6 @@ stdenv.mkDerivation rec {
   outputDevdoc = "out";
 
   preConfigure = "
-    patchShebangs ./configure
     patchShebangs ./do_install
   ";
 
diff --git a/nixpkgs/pkgs/data/fonts/commit-mono/default.nix b/nixpkgs/pkgs/data/fonts/commit-mono/default.nix
index 895e70a544b9..16fd6b7dd1a1 100644
--- a/nixpkgs/pkgs/data/fonts/commit-mono/default.nix
+++ b/nixpkgs/pkgs/data/fonts/commit-mono/default.nix
@@ -4,11 +4,11 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "commit-mono";
-  version = "1.141";
+  version = "1.142";
 
   src = fetchzip {
     url = "https://github.com/eigilnikolajsen/commit-mono/releases/download/v${version}/CommitMono-${version}.zip";
-    hash = "sha256-ErC4ZM17rYq+5FRW9m9nIbQOjQGTCCoNhXHxb7Swd84=";
+    hash = "sha256-ZOEo+uD1Vug+F38/eXD6xG1netEIAYn25bPBZ1H7aEE=";
     stripRoot = false;
   };
 
diff --git a/nixpkgs/pkgs/data/fonts/fg-virgil/default.nix b/nixpkgs/pkgs/data/fonts/fg-virgil/default.nix
index fdf83df42e03..e0837c71d8eb 100644
--- a/nixpkgs/pkgs/data/fonts/fg-virgil/default.nix
+++ b/nixpkgs/pkgs/data/fonts/fg-virgil/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fg-virgil";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "excalidraw";
     repo = "excalidraw";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iziCCHacaShPqb0f5nI8cCinFFs5fB3TcMJrifNhg4I=";
+    hash = "sha256-awd5jTz4sSiliEq7xt6dUR31C85oDcCP5GLuQn0ohj0=";
   };
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/data/fonts/lxgw-wenkai/default.nix b/nixpkgs/pkgs/data/fonts/lxgw-wenkai/default.nix
index cd15891f2f4a..7b75f7a394bc 100644
--- a/nixpkgs/pkgs/data/fonts/lxgw-wenkai/default.nix
+++ b/nixpkgs/pkgs/data/fonts/lxgw-wenkai/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-wenkai";
-  version = "1.311";
+  version = "1.312";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwWenKai/releases/download/v${version}/${pname}-v${version}.tar.gz";
-    hash = "sha256-R7j6SBWGbkS4cJI1J8M5NDIDeJDFMjtXZnGiyxm2rjg=";
+    hash = "sha256-KU0cTzdHfWIqYbBksGym9JaN/M3VRASYcQOxrAxip4I=";
   };
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/data/fonts/noto-fonts/default.nix b/nixpkgs/pkgs/data/fonts/noto-fonts/default.nix
deleted file mode 100644
index fee51ebacf4a..000000000000
--- a/nixpkgs/pkgs/data/fonts/noto-fonts/default.nix
+++ /dev/null
@@ -1,305 +0,0 @@
-{ stdenv
-, stdenvNoCC
-, lib
-, gitUpdater
-, fetchFromGitHub
-, fetchurl
-, cairo
-, nixosTests
-, pkg-config
-, pngquant
-, which
-, imagemagick
-, zopfli
-, buildPackages
-, variants ? [ ]
-}:
-let
-  notoLongDescription = ''
-    When text is rendered by a computer, sometimes characters are
-    displayed as “tofu”. They are little boxes to indicate your device
-    doesn’t have a font to display the text.
-
-    Google has been developing a font family called Noto, which aims to
-    support all languages with a harmonious look and feel. Noto is
-    Google’s answer to tofu. The name noto is to convey the idea that
-    Google’s goal is to see “no more tofu”.  Noto has multiple styles and
-    weights, and freely available to all.
-  '';
-in
-rec {
-  mkNoto =
-    { pname
-    , variants ? [ ]
-    , longDescription ? notoLongDescription
-    }:
-    stdenvNoCC.mkDerivation rec {
-      inherit pname;
-      version = "23.11.1";
-
-      src = fetchFromGitHub {
-        owner = "notofonts";
-        repo = "notofonts.github.io";
-        rev = "noto-monthly-release-${version}";
-        hash = "sha256-qBHLCOfVBOn9CV194S4cYw9nhHyAe2AUBJHQMvyEfW8=";
-      };
-
-      _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
-
-      installPhase = ''
-        # We check availability in order of variable -> otf -> ttf
-        # unhinted -- the hinted versions use autohint
-        # maintaining maximum coverage.
-        #
-        # We have a mix of otf and ttf fonts
-        local out_font=$out/share/fonts/noto
-      '' + (if _variants == [ ] then ''
-        for folder in $(ls -d fonts/*/); do
-          if [[ -d "$folder"unhinted/variable-ttf ]]; then
-            install -m444 -Dt $out_font "$folder"unhinted/variable-ttf/*.ttf
-          elif [[ -d "$folder"unhinted/otf ]]; then
-            install -m444 -Dt $out_font "$folder"unhinted/otf/*.otf
-          else
-            install -m444 -Dt $out_font "$folder"unhinted/ttf/*.ttf
-          fi
-        done
-      '' else ''
-        for variant in $_variants; do
-          if [[ -d fonts/"$variant"/unhinted/variable-ttf ]]; then
-            install -m444 -Dt $out_font fonts/"$variant"/unhinted/variable-ttf/*.ttf
-          elif [[ -d fonts/"$variant"/unhinted/otf ]]; then
-            install -m444 -Dt $out_font fonts/"$variant"/unhinted/otf/*.otf
-          else
-            install -m444 -Dt $out_font fonts/"$variant"/unhinted/ttf/*.ttf
-          fi
-        done
-      '');
-
-      passthru.updateScript = gitUpdater {
-        rev-prefix = "noto-monthly-release-";
-      };
-
-      meta = with lib; {
-        description = "Beautiful and free fonts for many languages";
-        homepage = "https://www.google.com/get/noto/";
-        inherit longDescription;
-        license = licenses.ofl;
-        platforms = platforms.all;
-        maintainers = with maintainers; [ mathnerd314 emily jopejoe1 ];
-      };
-    };
-
-  mkNotoCJK = { typeface, version, sha256 }:
-    stdenvNoCC.mkDerivation {
-      pname = "noto-fonts-cjk-${lib.toLower typeface}";
-      inherit version;
-
-      src = fetchFromGitHub {
-        owner = "googlefonts";
-        repo = "noto-cjk";
-        rev = "${typeface}${version}";
-        inherit sha256;
-        sparseCheckout = [ "${typeface}/Variable/OTC" ];
-      };
-
-      installPhase = ''
-        install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/Variable/OTC/*.otf.ttc
-      '';
-
-      passthru.tests.noto-fonts = nixosTests.noto-fonts;
-
-      meta = with lib; {
-        description = "Beautiful and free fonts for CJK languages";
-        homepage = "https://www.google.com/get/noto/help/cjk/";
-        longDescription = ''
-          Noto ${typeface} CJK is a ${lib.toLower typeface} typeface designed as
-          an intermediate style between the modern and traditional. It is
-          intended to be a multi-purpose digital font for user interface
-          designs, digital content, reading on laptops, mobile devices, and
-          electronic books. Noto ${typeface} CJK comprehensively covers
-          Simplified Chinese, Traditional Chinese, Japanese, and Korean in a
-          unified font family. It supports regional variants of ideographic
-          characters for each of the four languages. In addition, it supports
-          Japanese kana, vertical forms, and variant characters (itaiji); it
-          supports Korean hangeul — both contemporary and archaic.
-        '';
-        license = licenses.ofl;
-        platforms = platforms.all;
-        maintainers = with maintainers; [ mathnerd314 emily ];
-      };
-    };
-
-  noto-fonts = mkNoto {
-    pname = "noto-fonts";
-  };
-
-  noto-fonts-lgc-plus = mkNoto {
-    pname = "noto-fonts-lgc-plus";
-    variants = [
-      "Noto Sans"
-      "Noto Serif"
-      "Noto Sans Mono"
-      "Noto Music"
-      "Noto Sans Symbols"
-      "Noto Sans Symbols 2"
-      "Noto Sans Math"
-    ];
-    longDescription = ''
-      This package provides the Noto Fonts, but only for latin, greek
-      and cyrillic scripts, as well as some extra fonts. To create a
-      custom Noto package with custom variants, see the `mkNoto`
-      helper function.
-    '';
-  };
-
-  noto-fonts-cjk-sans = mkNotoCJK {
-    typeface = "Sans";
-    version = "2.004";
-    sha256 = "sha256-IgalJkiOAVjNxKaPAQWfb5hKeqclliR4qVXCq63FGWY=";
-  };
-
-  noto-fonts-cjk-serif = mkNotoCJK {
-    typeface = "Serif";
-    version = "2.002";
-    sha256 = "sha256-GLjpTAiHfygj1J4AdUVDJh8kykkFOglq+h4kyat5W9s=";
-  };
-
-  noto-fonts-color-emoji =
-    let
-      version = "2.038";
-      emojiPythonEnv =
-        buildPackages.python3.withPackages (p: with p; [ fonttools nototools ]);
-    in
-    stdenvNoCC.mkDerivation {
-      pname = "noto-fonts-emoji";
-      inherit version;
-
-      src = fetchFromGitHub {
-        owner = "googlefonts";
-        repo = "noto-emoji";
-        rev = "v${version}";
-        sha256 = "1rgmcc6nqq805iqr8kvxxlk5cf50q714xaxk3ld6rjrd69kb8ix9";
-      };
-
-      depsBuildBuild = [
-        buildPackages.stdenv.cc
-        pkg-config
-        cairo
-      ];
-
-      nativeBuildInputs = [
-        imagemagick
-        zopfli
-        pngquant
-        which
-        emojiPythonEnv
-      ];
-
-      postPatch = ''
-        patchShebangs *.py
-        patchShebangs third_party/color_emoji/*.py
-        # remove check for virtualenv, since we handle
-        # python requirements using python.withPackages
-        sed -i '/ifndef VIRTUAL_ENV/,+2d' Makefile
-
-        # Make the build verbose so it won't get culled by Hydra thinking that
-        # it somehow got stuck doing nothing.
-        sed -i 's;\t@;\t;' Makefile
-      '';
-
-      enableParallelBuilding = true;
-
-      installPhase = ''
-        runHook preInstall
-        mkdir -p $out/share/fonts/noto
-        cp NotoColorEmoji.ttf $out/share/fonts/noto
-        runHook postInstall
-      '';
-
-      meta = with lib; {
-        description = "Color emoji font";
-        homepage = "https://github.com/googlefonts/noto-emoji";
-        license = with licenses; [ ofl asl20 ];
-        platforms = platforms.all;
-        maintainers = with maintainers; [ mathnerd314 sternenseemann ];
-      };
-    };
-
-  noto-fonts-monochrome-emoji =
-    # Metadata fetched from
-    #  https://www.googleapis.com/webfonts/v1/webfonts?key=${GOOGLE_FONTS_TOKEN}&family=Noto+Emoji
-    let metadata = with builtins; head (fromJSON (readFile ./noto-emoji.json)).items;
-        urlHashes = with builtins; fromJSON (readFile ./noto-emoji.hashes.json);
-
-    in
-    stdenvNoCC.mkDerivation {
-      pname = "noto-fonts-monochrome-emoji";
-      version = "${lib.removePrefix "v" metadata.version}.${metadata.lastModified}";
-      preferLocalBuild = true;
-
-      dontUnpack = true;
-      srcs = let
-        weightNames = {
-          "300"   = "Light";
-          regular = "Regular";
-          "500"   = "Medium";
-          "600"   = "SemiBold";
-          "700"   = "Bold";
-        };
-      in lib.mapAttrsToList
-        (variant: url: fetchurl { name = "NotoEmoji-${weightNames.${variant}}.ttf";
-                                  hash = urlHashes.${url};
-                                  inherit url; } )
-        metadata.files;
-
-      installPhase = ''
-        runHook preInstall
-        for src in $srcs; do
-          install -D $src $out/share/fonts/noto/$(stripHash $src)
-        done
-        runHook postInstall
-      '';
-
-      meta = with lib; {
-        description = "Monochrome emoji font";
-        homepage = "https://fonts.google.com/noto/specimen/Noto+Emoji";
-        license = [ licenses.ofl ];
-        maintainers = [ maintainers.nicoo ];
-
-        platforms = platforms.all;
-        sourceProvenance = [ sourceTypes.binaryBytecode ];
-      };
-    };
-
-  noto-fonts-emoji-blob-bin =
-    let
-      pname = "noto-fonts-emoji-blob-bin";
-      version = "15.0";
-    in
-    stdenvNoCC.mkDerivation {
-      inherit pname version;
-
-      src = fetchurl {
-        url = "https://github.com/C1710/blobmoji/releases/download/v${version}/Blobmoji.ttf";
-        hash = "sha256-3MPWZ1A2ups171dNIiFTJ3C1vZiGy6I8ZF70aUfrePk=";
-      };
-
-      dontUnpack = true;
-
-      installPhase = ''
-        runHook preInstall
-
-        install -Dm 444 $src $out/share/fonts/blobmoji/Blobmoji.ttf
-
-        runHook postInstall
-      '';
-
-      meta = with lib; {
-        description = "Noto Emoji with extended Blob support";
-        homepage = "https://github.com/C1710/blobmoji";
-        license = with licenses; [ ofl asl20 ];
-        platforms = platforms.all;
-        maintainers = with maintainers; [ rileyinman jk ];
-      };
-    };
-}
diff --git a/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.hashes.json b/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.hashes.json
deleted file mode 100644
index e9ad1c327f4f..000000000000
--- a/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.hashes.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob_10jwvS-FGJCMY.ttf": "sha256-B8XBpYycOYBjrhjlnyiz42YukIoOjGTd3NN3EY00NiQ=",
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-r0jwvS-FGJCMY.ttf": "sha256-Zfwh9q2GrL5Dwp+J/8Ddd2IXCaUXpQ7dE3CqgCMMyPs=",
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-Z0jwvS-FGJCMY.ttf": "sha256-/O5b2DzM8g97NAdJgIC/RsQ7E5P7USKq7TXyDuUE3WQ=",
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob911TwvS-FGJCMY.ttf": "sha256-vrjB8GlhzWAe6jG/Srpy8R431VivNtWbCa5Uh4ATnmU=",
-  "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob9M1TwvS-FGJCMY.ttf": "sha256-EbnZt8h4Lcl0yJoOKmXlF1nfcP5hZv7n4cEQ10yBkcg="
-}
diff --git a/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.json b/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.json
deleted file mode 100644
index c729634b9e1e..000000000000
--- a/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.json
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  "kind": "webfonts#webfontList",
-  "items": [
-    {
-      "family": "Noto Emoji",
-      "variants": [
-        "300",
-        "regular",
-        "500",
-        "600",
-        "700"
-      ],
-      "subsets": [
-        "emoji"
-      ],
-      "version": "v47",
-      "lastModified": "2023-09-27",
-      "files": {
-        "300": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob_10jwvS-FGJCMY.ttf",
-        "regular": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-r0jwvS-FGJCMY.ttf",
-        "500": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-Z0jwvS-FGJCMY.ttf",
-        "600": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob911TwvS-FGJCMY.ttf",
-        "700": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob9M1TwvS-FGJCMY.ttf"
-      },
-      "category": "sans-serif",
-      "kind": "webfonts#webfont",
-      "menu": "http://fonts.gstatic.com/s/notoemoji/v47/bMrnmSyK7YY-MEu6aWjPDs-ar6uWaGWuob-r0gwuQeU.ttf"
-    }
-  ]
-}
diff --git a/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.py b/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.py
deleted file mode 100755
index 9f1eadd95bca..000000000000
--- a/nixpkgs/pkgs/data/fonts/noto-fonts/noto-emoji.py
+++ /dev/null
@@ -1,183 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i "python3 -I" -p python3
-
-from contextlib import contextmanager
-from pathlib import Path
-from typing import Iterable, Optional
-from urllib import request
-
-import hashlib, json
-
-
-def getMetadata(apiKey: str, family: str = "Noto Emoji"):
-    '''Fetch the Google Fonts metadata for a given family.
-
-    An API key can be obtained by anyone with a Google account (🚮) from
-      `https://developers.google.com/fonts/docs/developer_api#APIKey`
-    '''
-    from urllib.parse import urlencode
-
-    with request.urlopen(
-            "https://www.googleapis.com/webfonts/v1/webfonts?" +
-            urlencode({ 'key': apiKey, 'family': family })
-    ) as req:
-        return json.load(req)
-
-def getUrls(metadata) -> Iterable[str]:
-    '''Fetch all files' URLs from Google Fonts' metadata.
-
-    The metadata must obey the API v1 schema, and can be obtained from:
-      https://www.googleapis.com/webfonts/v1/webfonts?key=${GOOGLE_FONTS_TOKEN}&family=${FAMILY}
-    '''
-    return ( url for i in metadata['items'] for _, url in i['files'].items() )
-
-
-def hashUrl(url: str, *, hash: str = 'sha256'):
-    '''Compute the hash of the data from HTTP GETing a given `url`.
-
-    The `hash` must be an algorithm name `hashlib.new` accepts.
-    '''
-    with request.urlopen(url) as req:
-        return hashlib.new(hash, req.read())
-
-
-def sriEncode(h) -> str:
-    '''Encode a hash in the SRI format.
-
-    Takes a `hashlib` object, and produces a string that
-    nixpkgs' `fetchurl` accepts as `hash` parameter.
-    '''
-    from base64 import b64encode
-    return f"{h.name}-{b64encode(h.digest()).decode()}"
-
-def validateSRI(sri: Optional[str]) -> Optional[str]:
-    '''Decode an SRI hash, return `None` if invalid.
-
-    This is not a full SRI hash parser, hash options aren't supported.
-    '''
-    from base64 import b64decode
-
-    if sri is None:
-        return None
-
-    try:
-        hashName, b64 = sri.split('-', 1)
-
-        h = hashlib.new(hashName)
-        digest = b64decode(b64, validate=True)
-        assert len(digest) == h.digest_size
-
-    except:
-        return None
-    else:
-        return sri
-
-
-def hashUrls(
-    urls: Iterable[str],
-    knownHashes: dict[str, str] = {},
-) -> dict[str, str]:
-    '''Generate a `dict` mapping URLs to SRI-encoded hashes.
-
-    The `knownHashes` optional parameter can be used to avoid
-    re-downloading files whose URL have not changed.
-    '''
-    return {
-        url: validateSRI(knownHashes.get(url)) or sriEncode(hashUrl(url))
-        for url in urls
-    }
-
-
-@contextmanager
-def atomicFileUpdate(target: Path):
-    '''Atomically replace the contents of a file.
-
-    Yields an open file to write into; upon exiting the context,
-    the file is closed and (atomically) replaces the `target`.
-
-    Guarantees that the `target` was either successfully overwritten
-    with new content and no exception was raised, or the temporary
-    file was cleaned up.
-    '''
-    from tempfile import mkstemp
-    fd, _p = mkstemp(
-        dir = target.parent,
-        prefix = target.name,
-    )
-    tmpPath = Path(_p)
-
-    try:
-        with open(fd, 'w') as f:
-            yield f
-
-        tmpPath.replace(target)
-
-    except Exception:
-        tmpPath.unlink(missing_ok = True)
-        raise
-
-
-if __name__ == "__main__":
-    from os import environ
-    from urllib.error import HTTPError
-
-    environVar = 'GOOGLE_FONTS_TOKEN'
-    currentDir = Path(__file__).parent
-    metadataPath = currentDir / 'noto-emoji.json'
-
-    try:
-        apiToken = environ[environVar]
-        metadata = getMetadata(apiToken)
-
-    except (KeyError, HTTPError) as exn:
-        # No API key in the environment, or the query was rejected.
-        match exn:
-            case KeyError if exn.args[0] == environVar:
-                print(f"No '{environVar}' in the environment, "
-                       "skipping metadata update")
-
-            case HTTPError if exn.getcode() == 403:
-                print("Got HTTP 403 (Forbidden)")
-                if apiToken != '':
-                    print("Your Google API key appears to be valid "
-                          "but does not grant access to the fonts API.")
-                    print("Aborting!")
-                    raise SystemExit(1)
-
-            case HTTPError if exn.getcode() == 400:
-                # Printing the supposed token should be fine, as this is
-                #  what the API returns on invalid tokens.
-                print(f"Got HTTP 400 (Bad Request), is this really an API token: '{apiToken}' ?")
-            case _:
-                # Unknown error, let's bubble it up
-                raise
-
-        # In that case just use the existing metadata
-        with metadataPath.open() as metadataFile:
-            metadata = json.load(metadataFile)
-
-        lastModified = metadata["items"][0]["lastModified"];
-        print(f"Using metadata from file, last modified {lastModified}")
-
-    else:
-        # If metadata was successfully fetched, validate and persist it
-        lastModified = metadata["items"][0]["lastModified"];
-        print(f"Fetched current metadata, last modified {lastModified}")
-        with atomicFileUpdate(metadataPath) as metadataFile:
-            json.dump(metadata, metadataFile, indent = 2)
-            metadataFile.write("\n")  # Pacify nixpkgs' dumb editor config check
-
-    hashPath = currentDir / 'noto-emoji.hashes.json'
-    try:
-        with hashPath.open() as hashFile:
-            hashes = json.load(hashFile)
-    except FileNotFoundError:
-        hashes = {}
-
-    with atomicFileUpdate(hashPath) as hashFile:
-        json.dump(
-            hashUrls(getUrls(metadata), knownHashes = hashes),
-            hashFile,
-            indent = 2,
-        )
-        hashFile.write("\n")  # Pacify nixpkgs' dumb editor config check
diff --git a/nixpkgs/pkgs/data/fonts/noto-fonts/tools.nix b/nixpkgs/pkgs/data/fonts/noto-fonts/tools.nix
deleted file mode 100644
index 1b515b486f5f..000000000000
--- a/nixpkgs/pkgs/data/fonts/noto-fonts/tools.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ fetchFromGitHub, lib, buildPythonPackage, pythonOlder
-, afdko, appdirs, attrs, booleanoperations, brotlipy, click
-, defcon, fontmath, fontparts, fontpens, fonttools, lxml
-, mutatormath, pathspec, psautohint, pyclipper, pytz, regex, scour
-, toml, typed-ast, ufonormalizer, ufoprocessor, unicodedata2, zopfli
-, pillow, six, bash, setuptools-scm }:
-
-buildPythonPackage rec {
-  pname = "nototools";
-  version = "0.2.17";
-
-  disabled = pythonOlder "3.6";
-
-  src = fetchFromGitHub {
-    owner = "googlefonts";
-    repo = "nototools";
-    rev = "v${version}";
-    sha256 = "0jxydivqzggirc31jv7b4mrsjkg646zmra5m4h0pk4amgy65rvyp";
-  };
-
-  postPatch = ''
-    sed -i 's/use_scm_version=.*,/version="${version}",/' setup.py
-  '';
-
-  nativeBuildInputs = [ setuptools-scm ];
-
-  propagatedBuildInputs = [
-    afdko
-    appdirs
-    attrs
-    booleanoperations
-    brotlipy
-    click
-    defcon
-    fontmath
-    fontparts
-    fontpens
-    fonttools
-    lxml
-    mutatormath
-    pathspec
-    psautohint
-    pyclipper
-    pytz
-    regex
-    scour
-    toml
-    typed-ast
-    ufonormalizer
-    ufoprocessor
-    unicodedata2
-    zopfli
-  ];
-
-  nativeCheckInputs = [
-    pillow
-    six
-    bash
-  ];
-
-  checkPhase = ''
-    patchShebangs tests/
-    cd tests
-    rm gpos_diff_test.py # needs ttxn?
-    ./run_tests
-  '';
-
-  postInstall = ''
-    cp -r third_party $out
-  '';
-
-  meta = with lib; {
-    description = "Noto fonts support tools and scripts plus web site generation";
-    homepage = "https://github.com/googlefonts/nototools";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
-  };
-}
diff --git a/nixpkgs/pkgs/data/icons/papirus-icon-theme/default.nix b/nixpkgs/pkgs/data/icons/papirus-icon-theme/default.nix
index 75237237e203..e940bc7d52be 100644
--- a/nixpkgs/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/nixpkgs/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "papirus-icon-theme";
-  version = "20231101";
+  version = "20231201";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = pname;
     rev = version;
-    hash = "sha256-0ooHuMqGzlMLVTR/u+kCJLibfqTAtq662EG8i3JIzPA=";
+    hash = "sha256-nLc2nt8YI193loMHjzzEwgvb+tdNrVTZskqssX2oFrU=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/data/misc/cacert/default.nix b/nixpkgs/pkgs/data/misc/cacert/default.nix
index d489c23c6b8d..30f2ee38c72f 100644
--- a/nixpkgs/pkgs/data/misc/cacert/default.nix
+++ b/nixpkgs/pkgs/data/misc/cacert/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , writeText
-, fetchurl
+, fetchFromGitHub
 , buildcatrust
 , blacklist ? []
 , extraCertificateFiles ? []
@@ -17,20 +17,10 @@
 }:
 
 let
-  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" (blacklist ++ [
-    # Mozilla does not trust new certificates issued by these CAs after 2022/11/30¹
-    # in their products, but unfortunately we don't have such a fine-grained
-    # solution for most system packages², so we decided to eject these.
-    #
-    # [1] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
-    # [2] https://utcc.utoronto.ca/~cks/space/blog/linux/CARootStoreTrustProblem
-    "TrustCor ECA-1"
-    "TrustCor RootCert CA-1"
-    "TrustCor RootCert CA-2"
-  ]));
+  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.92";
+  srcVersion = "3.95";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -43,9 +33,11 @@ let
     pname = "nss-cacert-certdata";
     inherit version;
 
-    src = if nssOverride != null then nssOverride.src else fetchurl {
-      url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      hash = "sha256-PbGS1uiCA5rwKufq8yF+0RS7etg0FMZGdyq4Ah4kolQ=";
+    src = if nssOverride != null then nssOverride.src else fetchFromGitHub {
+      owner = "nss-dev";
+      repo = "nss";
+      rev = "NSS_${lib.replaceStrings ["."] ["_"] version}_RTM";
+      hash = "sha256-qgSbzlRbU+gElC2ae3FEGRUFSM1JHd/lNGNXC0x4xt4=";
     };
 
     dontBuild = true;
@@ -54,7 +46,7 @@ let
       runHook preInstall
 
       mkdir $out
-      cp nss/lib/ckfw/builtins/certdata.txt $out
+      cp lib/ckfw/builtins/certdata.txt $out
 
       runHook postInstall
     '';
diff --git a/nixpkgs/pkgs/data/misc/clash-geoip/default.nix b/nixpkgs/pkgs/data/misc/clash-geoip/default.nix
index c7ca80ccb008..7dcb0c63e8de 100644
--- a/nixpkgs/pkgs/data/misc/clash-geoip/default.nix
+++ b/nixpkgs/pkgs/data/misc/clash-geoip/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "clash-geoip";
-  version = "20231112";
+  version = "20231212";
 
   src = fetchurl {
     url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-CTygf2/CbxNO/9e8OfxeGZFaSrKXdlQdvUgywZX1U9o=";
+    sha256 = "sha256-h6EojfOWfDwD5Akvb8NrSvg3xyQZhOUrKhUxlWwio8A=";
   };
 
   dontUnpack = true;
diff --git a/nixpkgs/pkgs/data/misc/cldr-annotations/default.nix b/nixpkgs/pkgs/data/misc/cldr-annotations/default.nix
index 6d06d49eb711..953ae5562628 100644
--- a/nixpkgs/pkgs/data/misc/cldr-annotations/default.nix
+++ b/nixpkgs/pkgs/data/misc/cldr-annotations/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cldr-annotations";
-  version = "43.0";
+  version = "44.0";
 
   src = fetchzip {
     url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
     stripRoot = false;
-    hash = "sha256-L8ikzRpSw4mDCV79TiUqhPHWC0PmGi4i4He0OAB54R0=";
+    hash = "sha256-oK+NlzuRF45laEMJKhNDzr12RF4CHIfDFNBFsIjJh1I=";
   };
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/data/misc/dns-root-data/default.nix b/nixpkgs/pkgs/data/misc/dns-root-data/default.nix
index abf945e9df55..1c6121473c74 100644
--- a/nixpkgs/pkgs/data/misc/dns-root-data/default.nix
+++ b/nixpkgs/pkgs/data/misc/dns-root-data/default.nix
@@ -6,11 +6,11 @@ let
     # Original source https://www.internic.net/domain/named.root
     # occasionally suffers from pointless hash changes,
     # and having stable sources for older versions has advantages, too.
-    urls = map (prefix: prefix + "cc5e14a264912/etc/root.hints") [
+    urls = map (prefix: prefix + "d9c96ae96f066a85d7/etc/root.hints") [
       "https://gitlab.nic.cz/knot/knot-resolver/raw/"
       "https://raw.githubusercontent.com/CZ-NIC/knot-resolver/"
     ];
-    sha256 = "0vdrff4l8s8grif52dnh091s8qydhh88k25zqd9rj66sf1qwcwxl";
+    hash = "sha256-4lG/uPnNHBNIZ/XIeDM1w3iukrpeW0JIjTnGSwkJ8U4=";
   };
 
   rootKey = ./root.key;
@@ -20,7 +20,7 @@ in
 
 stdenv.mkDerivation {
   pname = "dns-root-data";
-  version = "2019-01-11";
+  version = "2023-11-27";
 
   buildCommand = ''
     mkdir $out
diff --git a/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix b/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
index 8de13f2eaf36..6bad73e68392 100644
--- a/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
+++ b/nixpkgs/pkgs/data/misc/shared-mime-info/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -14,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "shared-mime-info";
-  version = "2.3";
+  version = "2.4";
 
   outputs = [ "out" "dev" ];
 
@@ -23,15 +22,9 @@ stdenv.mkDerivation rec {
     owner = "xdg";
     repo = pname;
     rev = version;
-    sha256 = "sha256-cEfknRVtOJykEO9Iqlb0UoiayYtu+ugvmmZqAD5cGnE=";
+    hash = "sha256-5eyMkfSBUOD7p8woIYTgz5C/L8uQMXyr0fhL0l23VMA=";
   };
 
-  patches = [
-    # Submitted upstream at
-    # https://gitlab.freedesktop.org/xdg/shared-mime-info/-/issues/211
-    ./fix-clang-warnings.patch
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
diff --git a/nixpkgs/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch b/nixpkgs/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch
deleted file mode 100644
index 2d185549c4e6..000000000000
--- a/nixpkgs/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 1780c44..7998a51 100644
---- a/meson.build
-+++ b/meson.build
-@@ -49,12 +49,7 @@ endif
- ###############################################################################
- # Dependencies
- 
--check_functions = [
--    'fdatasync',
--]
--foreach function : check_functions
--    config.set('HAVE_'+function.to_upper(), cc.has_function(function))
--endforeach
-+config.set('HAVE_FDATASYNC', cc.has_function('fdatasync', prefix: '#include <unistd.h>'))
- 
- 
- if get_option('build-translations')
-diff --git a/src/update-mime-database.cpp b/src/update-mime-database.cpp
-index 733ba06..4ca6d06 100644
---- a/src/update-mime-database.cpp
-+++ b/src/update-mime-database.cpp
-@@ -2158,7 +2158,7 @@ static void check_in_path_xdg_data(const char *mime_path)
- 
- 	env = getenv("XDG_DATA_DIRS");
- 	if (!env)
--		env = "/usr/local/share/"PATH_SEPARATOR"/usr/share/";
-+		env = "/usr/local/share/" PATH_SEPARATOR "/usr/share/";
- 	dirs = g_strsplit(env, PATH_SEPARATOR, 0);
- 	g_return_if_fail(dirs != NULL);
- 	for (n = 0; dirs[n]; n++)
diff --git a/nixpkgs/pkgs/data/misc/tzdata/default.nix b/nixpkgs/pkgs/data/misc/tzdata/default.nix
index 98aeb7638e12..f04005af7452 100644
--- a/nixpkgs/pkgs/data/misc/tzdata/default.nix
+++ b/nixpkgs/pkgs/data/misc/tzdata/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   outputs = [ "out" "bin" "man" "dev" ];
-  propagatedBuildOutputs = [];
+  propagatedBuildOutputs = [ ];
 
   makeFlags = [
     "TOPDIR=$(out)"
@@ -59,6 +59,8 @@ stdenv.mkDerivation rec {
       ( cd $out/share/zoneinfo/posix; ln -s ../* .; rm posix )
       mv $out/share/zoneinfo-leaps $out/share/zoneinfo/right
 
+      cp leap-seconds.list $out/share/zoneinfo
+
       mkdir -p "$dev/include"
       cp tzfile.h "$dev/include/tzfile.h"
     '';
diff --git a/nixpkgs/pkgs/data/misc/v2ray-domain-list-community/default.nix b/nixpkgs/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 88ff72c28c76..235c26c737b0 100644
--- a/nixpkgs/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/nixpkgs/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20231201183121";
+    version = "20231208065009";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-BOq4hT8K+m/bdAj6f1TbT3BvAn05bH3EdphcaWqFYFk=";
+      hash = "sha256-Z5yUtkumr/JuKzq47QdPuHSJOSxD2XsK9sYE1hUhoyY=";
     };
     vendorHash = "sha256-6167kRAC5m5FlBr7uk+qKUcjWsb45P5Vvovyb6hHSVQ=";
     meta = with lib; {
diff --git a/nixpkgs/pkgs/data/themes/adw-gtk3/default.nix b/nixpkgs/pkgs/data/themes/adw-gtk3/default.nix
index 79dcc88a6f5d..db4fa114110f 100644
--- a/nixpkgs/pkgs/data/themes/adw-gtk3/default.nix
+++ b/nixpkgs/pkgs/data/themes/adw-gtk3/default.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "adw-gtk3";
-  version = "5.1";
+  version = "5.2";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vRB6+C27M4u7v10c6dqGsKpxHMGfpCSiScZ+8qlJRr0=";
+    sha256 = "sha256-S6Yo67DTyRzS9uz/6g87SRmfPIBmAKfy4c23M5aENNg=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/data/themes/catppuccin/default.nix b/nixpkgs/pkgs/data/themes/catppuccin/default.nix
index e8cdb0456d17..c9a51ba241d4 100644
--- a/nixpkgs/pkgs/data/themes/catppuccin/default.nix
+++ b/nixpkgs/pkgs/data/themes/catppuccin/default.nix
@@ -1,5 +1,5 @@
 let
-  validThemes = [ "bat" "bottom" "btop" "grub" "hyprland" "k9s" "kvantum" "lazygit" "plymouth" "refind" "rofi" "waybar" ];
+  validThemes = [ "bat" "bottom" "btop" "grub" "hyprland" "k9s" "kvantum" "lazygit" "plymouth" "qt5ct" "refind" "rofi" "waybar" ];
 in
 { fetchFromGitHub
 , lib
@@ -88,6 +88,14 @@ let
       hash = "sha256-quBSH8hx3gD7y1JNWAKQdTk3CmO4t1kVo4cOGbeWlNE=";
     };
 
+    qt5ct = fetchFromGitHub {
+      name = "qt5ct";
+      owner = "catppuccin";
+      repo = "qt5ct";
+      rev = "89ee948e72386b816c7dad72099855fb0d46d41e";
+      hash = "sha256-t/uyK0X7qt6qxrScmkTU2TvcVJH97hSQuF0yyvSO/qQ=";
+    };
+
     refind = fetchFromGitHub {
       name = "refind";
       owner = "catppuccin";
@@ -174,6 +182,10 @@ stdenvNoCC.mkDerivation {
     cp ${sources.plymouth}/themes/catppuccin-${variant}/* $out/share/plymouth/themes/catppuccin-${variant}
     sed -i 's:\(^ImageDir=\)/usr:\1'"$out"':' $out/share/plymouth/themes/catppuccin-${variant}/catppuccin-${variant}.plymouth
 
+  '' + lib.optionalString (lib.elem "qt5ct" themeList) ''
+    mkdir -p $out/qt5ct
+    cp ${sources.qt5ct}/themes/Catppuccin-"$capitalizedVariant".conf $out/qt5ct/
+
   '' + lib.optionalString (lib.elem "rofi" themeList) ''
     mkdir -p $out/rofi
     cp ${sources.rofi}/basic/.local/share/rofi/themes/catppuccin-${variant}.rasi $out/rofi/