Merge branch 'nixos-unstable-small' of https://github.com/NixOS/nixpkgs

11 files changed, 148 insertions, 131 deletions

diff --git a/nixpkgs/pkgs/development/libraries/ada/xmlada/default.nix b/nixpkgs/pkgs/development/libraries/ada/xmlada/default.nix
index 77e8094277a7..e80371e092e8 100644
--- a/nixpkgs/pkgs/development/libraries/ada/xmlada/default.nix
+++ b/nixpkgs/pkgs/development/libraries/ada/xmlada/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xmlada";
-  version = "24.0.0";
+  version = "23.0.0";
 
   src = fetchFromGitHub {
     name = "xmlada-${version}-src";
     owner = "AdaCore";
     repo = "xmlada";
     rev = "v${version}";
-    sha256 = "sha256-vvM7bdf3dAa3zKgxbGeAGlBT6fvafzmleimJHyRdlvc=";
+    sha256 = "sha256-covcSwlQQjRKTv0DdMEgahXXlch0TeKnvSyOsGO9+e0=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch b/nixpkgs/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch
deleted file mode 100644
index 32c0a4cab584..000000000000
--- a/nixpkgs/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-diff --git a/cmake_modules/FindProtobufAlt.cmake b/cmake_modules/FindprotobufAlt.cmake
-similarity index 60%
-rename from cmake_modules/FindProtobufAlt.cmake
-rename to cmake_modules/FindprotobufAlt.cmake
-index 15fe1b4f2..19bdd6291 100644
---- a/cmake_modules/FindProtobufAlt.cmake
-+++ b/cmake_modules/FindprotobufAlt.cmake
-@@ -16,24 +16,24 @@
- # under the License.
- 
- if(ARROW_PROTOBUF_USE_SHARED)
--  set(Protobuf_USE_STATIC_LIBS OFF)
-+  set(protobuf_USE_STATIC_LIBS OFF)
- else()
--  set(Protobuf_USE_STATIC_LIBS ON)
-+  set(protobuf_USE_STATIC_LIBS ON)
- endif()
- 
- set(find_package_args)
--if(ProtobufAlt_FIND_VERSION)
--  list(APPEND find_package_args ${ProtobufAlt_FIND_VERSION})
-+if(protobufAlt_FIND_VERSION)
-+  list(APPEND find_package_args ${protobufAlt_FIND_VERSION})
- endif()
--if(ProtobufAlt_FIND_QUIETLY)
-+if(protobufAlt_FIND_QUIETLY)
-   list(APPEND find_package_args QUIET)
- endif()
--find_package(Protobuf ${find_package_args})
--set(ProtobufAlt_FOUND ${Protobuf_FOUND})
--if(ProtobufAlt_FOUND)
--  set(ProtobufAlt_VERSION ${Protobuf_VERSION})
--  set(ProtobufAlt_VERSION_MAJOR ${Protobuf_VERSION_MAJOR})
--  set(ProtobufAlt_VERSION_MINOR ${Protobuf_VERSION_MINOR})
--  set(ProtobufAlt_VERSION_PATCH ${Protobuf_VERSION_PATCH})
--  set(ProtobufAlt_VERSION_TWEEK ${Protobuf_VERSION_TWEEK})
-+find_package(protobuf ${find_package_args} CONFIG)
-+set(protobufAlt_FOUND ${protobuf_FOUND})
-+if(protobufAlt_FOUND)
-+  set(protobufAlt_VERSION ${protobuf_VERSION})
-+  set(protobufAlt_VERSION_MAJOR ${protobuf_VERSION_MAJOR})
-+  set(protobufAlt_VERSION_MINOR ${protobuf_VERSION_MINOR})
-+  set(protobufAlt_VERSION_PATCH ${protobuf_VERSION_PATCH})
-+  set(protobufAlt_VERSION_TWEEK ${protobuf_VERSION_TWEEK})
- endif()
-diff --git a/cmake_modules/ThirdpartyToolchain.cmake b/cmake_modules/ThirdpartyToolchain.cmake
-index 94f926039..8efc98323 100644
---- a/cmake_modules/ThirdpartyToolchain.cmake
-+++ b/cmake_modules/ThirdpartyToolchain.cmake
-@@ -63,7 +63,7 @@ set(ARROW_THIRDPARTY_DEPENDENCIES
-     opentelemetry-cpp
-     ORC
-     re2
--    Protobuf
-+    protobuf
-     RapidJSON
-     Snappy
-     Substrait
-@@ -189,7 +189,7 @@ macro(build_dependency DEPENDENCY_NAME)
-     build_opentelemetry()
-   elseif("${DEPENDENCY_NAME}" STREQUAL "ORC")
-     build_orc()
--  elseif("${DEPENDENCY_NAME}" STREQUAL "Protobuf")
-+  elseif("${DEPENDENCY_NAME}" STREQUAL "protobuf")
-     build_protobuf()
-   elseif("${DEPENDENCY_NAME}" STREQUAL "RapidJSON")
-     build_rapidjson()
-@@ -1722,7 +1722,7 @@ if(ARROW_WITH_PROTOBUF)
-   # "3" for 3.12.0 are different. So 23.4 is rejected with 3.12.0. If
-   # we use FORCE_ANY_NEWER_VERSION here, we can bypass the check and
-   # use 23.4.
--  resolve_dependency(Protobuf
-+  resolve_dependency(protobuf
-                      FORCE_ANY_NEWER_VERSION
-                      TRUE
-                      HAVE_ALT
-@@ -1732,7 +1732,7 @@ if(ARROW_WITH_PROTOBUF)
-                      PC_PACKAGE_NAMES
-                      protobuf)
- 
--  if(NOT Protobuf_USE_STATIC_LIBS AND MSVC_TOOLCHAIN)
-+  if(NOT protobuf_USE_STATIC_LIBS AND MSVC_TOOLCHAIN)
-     add_definitions(-DPROTOBUF_USE_DLLS)
-   endif()
- 
-@@ -1768,8 +1768,8 @@ if(ARROW_WITH_PROTOBUF)
-   message(STATUS "Found protoc: ${PROTOBUF_PROTOC_EXECUTABLE}")
-   get_target_property(PROTOBUF_TYPE ${ARROW_PROTOBUF_LIBPROTOBUF} TYPE)
-   if(NOT STREQUAL "INTERFACE_LIBRARY")
--    # Protobuf_PROTOC_LIBRARY is set by all versions of FindProtobuf.cmake
--    message(STATUS "Found libprotoc: ${Protobuf_PROTOC_LIBRARY}")
-+    # protobuf_PROTOC_LIBRARY is set by all versions of FindProtobuf.cmake
-+    message(STATUS "Found libprotoc: ${protobuf_PROTOC_LIBRARY}")
-     get_target_property(PROTOBUF_LIBRARY ${ARROW_PROTOBUF_LIBPROTOBUF} IMPORTED_LOCATION)
-     message(STATUS "Found libprotobuf: ${PROTOBUF_LIBRARY}")
-     message(STATUS "Found protobuf headers: ${PROTOBUF_INCLUDE_DIR}")
-@@ -3986,7 +3986,7 @@ endmacro()
- 
- if(ARROW_WITH_GRPC)
-   set(ARROW_GRPC_REQUIRED_VERSION "1.30.0")
--  if(NOT Protobuf_SOURCE STREQUAL gRPC_SOURCE)
-+  if(NOT protobuf_SOURCE STREQUAL gRPC_SOURCE)
-     # ARROW-15495: Protobuf/gRPC must come from the same source
-     message(STATUS "Forcing gRPC_SOURCE to Protobuf_SOURCE (${Protobuf_SOURCE})")
-     set(gRPC_SOURCE "${Protobuf_SOURCE}")
diff --git a/nixpkgs/pkgs/development/libraries/arrow-cpp/default.nix b/nixpkgs/pkgs/development/libraries/arrow-cpp/default.nix
index ddf8db98b39b..4cc55effdaa5 100644
--- a/nixpkgs/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/nixpkgs/pkgs/development/libraries/arrow-cpp/default.nix
@@ -78,11 +78,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "arrow-cpp";
-  version = "13.0.0";
+  version = "14.0.1";
 
   src = fetchurl {
     url = "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    hash = "sha256-Nd/aGRJip1a+k07viv7o0JdiytJQIdqmJuskniUayeY=";
+    hash = "sha256-XHDq+xAR+dEkuvsyiv5U9izFuSgLcIDh49Zo94wOQH4=";
   };
 
   sourceRoot = "apache-arrow-${version}/cpp";
@@ -115,15 +115,10 @@ stdenv.mkDerivation rec {
   ARROW_SUBSTRAIT_URL = fetchFromGitHub {
     owner = "substrait-io";
     repo = "substrait";
-    rev = "v0.20.0";
-    hash = "sha256-71hAwJ0cGvpwK/ibeeQt82e9uqxcu9sM1rPtPENMPfs=";
+    rev = "v0.27.0";
+    hash = "sha256-wptEAXembah04pzqAz6UHeUxp+jMf6Lh/IdyuIhy/a8=";
   };
 
-  patches = [
-    # Protobuf switched to lower case project name.
-    ./cmake-find-protobuf.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/nixpkgs/pkgs/development/libraries/clap/default.nix b/nixpkgs/pkgs/development/libraries/clap/default.nix
index dd4d410bb874..1da0b31cb10c 100644
--- a/nixpkgs/pkgs/development/libraries/clap/default.nix
+++ b/nixpkgs/pkgs/development/libraries/clap/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clap";
-  version = "1.1.9";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     owner = "free-audio";
     repo = "clap";
     rev = version;
-    hash = "sha256-z2P0U2NkDK1/5oDV35jn/pTXCcspuM1y2RgZyYVVO3w=";
+    hash = "sha256-AH3kSCp4Q8Nw3To2vuPuMH/cWm3cmzj2OEH/Azcbdmo=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/development/libraries/java/commons/compress/default.nix b/nixpkgs/pkgs/development/libraries/java/commons/compress/default.nix
index 87dbd16d86c4..53265baaf8fe 100644
--- a/nixpkgs/pkgs/development/libraries/java/commons/compress/default.nix
+++ b/nixpkgs/pkgs/development/libraries/java/commons/compress/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "1.24.0";
+  version = "1.25.0";
   pname = "commons-compress";
 
   src = fetchurl {
     url    = "mirror://apache/commons/compress/binaries/${pname}-${version}-bin.tar.gz";
-    sha256 = "sha256-VQzXg16rnrghsRY2H3NnGJ+0HEbz8/Num7Xlm9pEqqw=";
+    sha256 = "sha256-isxV/gTOjVQW3716cr8ZrlLnOn8YWWr6p1SHYlwhdvA=";
   };
 
   installPhase = ''
diff --git a/nixpkgs/pkgs/development/libraries/libtiff/4.5.nix b/nixpkgs/pkgs/development/libraries/libtiff/4.5.nix
new file mode 100644
index 000000000000..3b24c6f1a2e1
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/libtiff/4.5.nix
@@ -0,0 +1,86 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchpatch
+
+, autoreconfHook
+, pkg-config
+, sphinx
+
+, libdeflate
+, libjpeg
+, xz
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libtiff";
+  version = "4.5.1";
+
+  src = fetchFromGitLab {
+    owner = "libtiff";
+    repo = "libtiff";
+    rev = "v${version}";
+    hash = "sha256-qQEthy6YhNAQmdDMyoCIvK8f3Tx25MgqhJZW74CB93E=";
+  };
+
+  patches = [
+    # cf. https://bugzilla.redhat.com/2224974
+    (fetchpatch {
+      name = "CVE-2023-40745.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/bdf7b2621c62e04d0408391b7d5611502a752cd0.diff";
+      hash = "sha256-HdU02YJ1/T3dnCT+yG03tUyAHkgeQt1yjZx/auCQxyw=";
+    })
+    # cf. https://bugzilla.redhat.com/2224971
+    (fetchpatch {
+      name = "CVE-2023-41175.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/965fa243004e012adc533ae8e38db3055f101a7f.diff";
+      hash = "sha256-Pvg6JfJWOIaTrfFF0YSREZkS9saTG9IsXnsXtcyKILA=";
+    })
+    # FreeImage needs this patch
+    ./headers-4.5.patch
+    # libc++abi 11 has an `#include <version>`, this picks up files name
+    # `version` in the project's include paths
+    ./rename-version-4.5.patch
+  ];
+
+  postPatch = ''
+    mv VERSION VERSION.txt
+  '';
+
+  outputs = [ "bin" "dev" "dev_private" "out" "man" "doc" ];
+
+  postFixup = ''
+    moveToOutput include/tif_config.h $dev_private
+    moveToOutput include/tif_dir.h $dev_private
+    moveToOutput include/tif_hash_set.h $dev_private
+    moveToOutput include/tiffiop.h $dev_private
+  '';
+
+  # If you want to change to a different build system, please make
+  # sure cross-compilation works first!
+  nativeBuildInputs = [ autoreconfHook pkg-config sphinx ];
+
+  propagatedBuildInputs = [
+    libdeflate
+    libjpeg
+    xz
+    zlib
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Library and utilities for working with the TIFF image file format";
+    homepage = "https://libtiff.gitlab.io/libtiff";
+    changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
+    # XXX not enabled for now to keep hydra builds running,
+    # but we have to keep an eye on security updates in supported version
+    #knownVulnerabilities = [ "support for version 4.5 ended in Sept 2023" ];
+    maintainers = with maintainers; [ yarny ];
+    license = licenses.libtiff;
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/development/libraries/libtiff/default.nix b/nixpkgs/pkgs/development/libraries/libtiff/default.nix
index 8055704b0890..22b0f8af2043 100644
--- a/nixpkgs/pkgs/development/libraries/libtiff/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libtiff/default.nix
@@ -26,6 +26,9 @@ stdenv.mkDerivation rec {
   pname = "libtiff";
   version = "4.6.0";
 
+  # if you update this, please consider adding patches and/or
+  # setting `knownVulnerabilities` in libtiff `4.5.nix`
+
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
diff --git a/nixpkgs/pkgs/development/libraries/libtiff/headers-4.5.patch b/nixpkgs/pkgs/development/libraries/libtiff/headers-4.5.patch
new file mode 100644
index 000000000000..49af1abb0a54
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/libtiff/headers-4.5.patch
@@ -0,0 +1,16 @@
+export private headers for freeimage
+--- i/libtiff/Makefile.am
++++ w/libtiff/Makefile.am
+@@ -36,8 +36,12 @@ EXTRA_DIST = \
+ 	tiffconf.h.cmake.in
+
+ libtiffinclude_HEADERS = \
++	tif_config.h \
++	tif_dir.h \
++	tif_hash_set.h \
+ 	tiff.h \
+ 	tiffio.h \
++	tiffiop.h \
+ 	tiffvers.h
+
+ if HAVE_CXX
diff --git a/nixpkgs/pkgs/development/libraries/libtiff/rename-version-4.5.patch b/nixpkgs/pkgs/development/libraries/libtiff/rename-version-4.5.patch
new file mode 100644
index 000000000000..3e93569d4245
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/libtiff/rename-version-4.5.patch
@@ -0,0 +1,21 @@
+fix case-insensitive build
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -34,7 +34,7 @@ docfiles = \
+ 	README.md \
+ 	RELEASE-DATE \
+ 	TODO \
+-	VERSION
++	VERSION.txt
+
+ EXTRA_DIST = \
+ 	cmake \
+@@ -61,7 +61,7 @@ SUBDIRS = port libtiff tools build contrib test doc
+
+ release:
+	(rm -f $(top_srcdir)/RELEASE-DATE && echo $(LIBTIFF_RELEASE_DATE) > $(top_srcdir)/RELEASE-DATE)
+-	(rm -f $(top_srcdir)/VERSION && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION)
++	(rm -f $(top_srcdir)/VERSION.txt && echo $(LIBTIFF_VERSION) > $(top_srcdir)/VERSION.txt)
+	(rm -f $(top_srcdir)/libtiff/tiffvers.h && sed 's,LIBTIFF_VERSION,$(LIBTIFF_VERSION),;s,LIBTIFF_RELEASE_DATE,$(LIBTIFF_RELEASE_DATE),;s,LIBTIFF_MAJOR_VERSION,$(LIBTIFF_MAJOR_VERSION),;s,LIBTIFF_MINOR_VERSION,$(LIBTIFF_MINOR_VERSION),;s,LIBTIFF_MICRO_VERSION,$(LIBTIFF_MICRO_VERSION),' $(top_srcdir)/libtiff/tiffvers.h.in > $(top_srcdir)/libtiff/tiffvers.h)
+
+ pkgconfigdir = $(libdir)/pkgconfig
diff --git a/nixpkgs/pkgs/development/libraries/ncnn/cmakelists.patch b/nixpkgs/pkgs/development/libraries/ncnn/cmakelists.patch
index 30f39a7a3f50..bdb3063acec4 100644
--- a/nixpkgs/pkgs/development/libraries/ncnn/cmakelists.patch
+++ b/nixpkgs/pkgs/development/libraries/ncnn/cmakelists.patch
@@ -2,15 +2,15 @@ diff --git a/CMakeLists.txt b/CMakeLists.txt
 index c453d23e..66b4aa24 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -478,6 +478,8 @@ if(NCNN_VULKAN)
- 
-             find_package(Threads)
- 
-+            include("${GLSLANG_TARGET_DIR}/SPIRV-Tools/SPIRV-ToolsTarget.cmake")
-+            include("${GLSLANG_TARGET_DIR}/SPIRV-Tools-opt/SPIRV-Tools-optTargets.cmake")
-             include("${GLSLANG_TARGET_DIR}/OSDependentTargets.cmake")
-             include("${GLSLANG_TARGET_DIR}/OGLCompilerTargets.cmake")
-             if(EXISTS "${GLSLANG_TARGET_DIR}/HLSLTargets.cmake")
+@@ -560,6 +560,8 @@ if(NCNN_VULKAN)
+                 message(WARNING "GLSLANG_TARGET_DIR must be defined! NCNN_SYSTEM_GLSLANG will be turned off.")
+                 set(NCNN_SYSTEM_GLSLANG OFF)
+             else()
++                include("${GLSLANG_TARGET_DIR}/SPIRV-Tools/SPIRV-ToolsTarget.cmake")
++                include("${GLSLANG_TARGET_DIR}/SPIRV-Tools-opt/SPIRV-Tools-optTargets.cmake")
+                 include("${GLSLANG_TARGET_DIR}/OSDependentTargets.cmake")
+                 include("${GLSLANG_TARGET_DIR}/OGLCompilerTargets.cmake")
+                 if(EXISTS "${GLSLANG_TARGET_DIR}/HLSLTargets.cmake")
 diff --git a/src/ncnn.pc.in b/src/ncnn.pc.in
 index b580fcee..be2becd0 100644
 --- a/src/ncnn.pc.in
diff --git a/nixpkgs/pkgs/development/libraries/ncnn/default.nix b/nixpkgs/pkgs/development/libraries/ncnn/default.nix
index 0b07fab8668c..69967eae160d 100644
--- a/nixpkgs/pkgs/development/libraries/ncnn/default.nix
+++ b/nixpkgs/pkgs/development/libraries/ncnn/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ncnn";
-  version = "20220729";
+  version = "20231027";
 
   src = fetchFromGitHub {
     owner = "Tencent";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hZVeW3svuVpwQhQz67uqTPZ7B9pisLCwHhXB2zMLygo=";
+    sha256 = "sha256-ak/5QTOptg5M2I+3olnrBK6JZ01haIE6oh+sagEboAc=";
   };
 
   patches = [
@@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/Tencent/ncnn";
     license = licenses.bsd3;
     maintainers = with maintainers; [ tilcreator ];
+    platforms = platforms.all;
   };
 }