Merge remote-tracking branch 'origin/master' into staging-next

Conflicts:
 pkgs/tools/networking/xh/default.nix

pkgs/development/libraries/abseil-cpp/cmake-full-dirs.patch

@@ -0,0 +1,15 @@
+diff --git a/CMake/AbseilHelpers.cmake b/CMake/AbseilHelpers.cmake
+index 1a80b5b..1fa57a7 100644
+--- a/CMake/AbseilHelpers.cmake
++++ b/CMake/AbseilHelpers.cmake
+@@ -171,8 +171,8 @@ function(absl_cc_library)
+       FILE(GENERATE OUTPUT "${CMAKE_BINARY_DIR}/lib/pkgconfig/absl_${_NAME}.pc" CONTENT "\
+ prefix=${CMAKE_INSTALL_PREFIX}\n\
+ exec_prefix=\${prefix}\n\
+-libdir=\${prefix}/${CMAKE_INSTALL_LIBDIR}\n\
+-includedir=\${prefix}/${CMAKE_INSTALL_INCLUDEDIR}\n\
++libdir=${CMAKE_INSTALL_FULL_LIBDIR}\n\
++includedir=${CMAKE_INSTALL_FULL_INCLUDEDIR}\n\
+ \n\
+ Name: absl_${_NAME}\n\
+ Description: Abseil ${_NAME} library\n\

pkgs/development/libraries/abseil-cpp/default.nix

@@ -1,16 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, cmake, static ? stdenv.hostPlatform.isStatic }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, static ? stdenv.hostPlatform.isStatic }:
 
 stdenv.mkDerivation rec {
   pname = "abseil-cpp";
-  version = "20200923.3";
+  version = "20210324.1";
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-cpp";
     rev = version;
-    sha256 = "1p4djhm1f011ficbjjxx3n8428p8481p20j4glpaawnpsi362hkl";
+    sha256 = "16w63brfwgiayiyhvawsnr14xyy5hpp68k8fj0z6yk0bjzw6jvjw";
   };
 
+  patches = [
+    # Use CMAKE_INSTALL_FULL_{LIBDIR,INCLUDEDIR}
+    # https://github.com/abseil/abseil-cpp/pull/963
+    (fetchpatch {
+      url = "https://github.com/abseil/abseil-cpp/commit/5bfa70c75e621c5d5ec095c8c4c0c050dcb2957e.patch";
+      sha256 = "0nhjxqfxpi2pkfinnqvd5m4npf9l1kg39mjx9l3087ajhadaywl5";
+    })
+  ];
+
   cmakeFlags = [
     "-DCMAKE_CXX_STANDARD=17"
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"

pkgs/development/libraries/cairomm/1.16.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cairomm";
-  version = "1.16.0";
+  version = "1.16.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://www.cairographics.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "1ya4y7qa000cjawqwswbqv26y5icfkmhs5iiiil4dxgrqn91923y";
+    sha256 = "sha256-b2Bg2OmN1Lis/uIpX92904z0h8B8JqrY0ag7ub/0osY=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/cereal/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 stdenv.mkDerivation rec {
   pname = "cereal";
   version = "1.3.0";
@@ -12,7 +12,19 @@ stdenv.mkDerivation rec {
     sha256 = "0hc8wh9dwpc1w1zf5lfss4vg5hmgpblqxbrpp1rggicpx9ar831p";
   };
 
-  cmakeFlagsArray = [ "-DJUST_INSTALL_CEREAL=yes" ];
+  patches = [
+    # https://nvd.nist.gov/vuln/detail/CVE-2020-11105
+    # serialized std::shared_ptr variables cannot always be expected to
+    # serialize back into their original values. This can have any number of
+    # consequences, depending on the context within which this manifests.
+    (fetchpatch {
+      name = "CVE-2020-11105.patch";
+      url = "https://github.com/USCiLab/cereal/commit/f27c12d491955c94583512603bf32c4568f20929.patch";
+      sha256 = "CIkbJ7bAN0MXBhTXQdoQKXUmY60/wQvsdn99FaWt31w=";
+    })
+  ];
+
+  cmakeFlags = [ "-DJUST_INSTALL_CEREAL=yes" ];
 
   meta = with lib; {
     description = "A header-only C++11 serialization library";

pkgs/development/libraries/glibmm/2.68.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.68.0";
+  version = "2.68.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-wfOFcxkdzu2FoFYAiIz0z0aVlB8zlxW9Z9UcJBb083U=";
+    sha256 = "sha256-ZmTifJqcyoHCnjVof0ny4NFzovyemMNCgxH3B9tTL4w=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/liblinphone/default.nix

@@ -46,7 +46,7 @@
 
 stdenv.mkDerivation rec {
   pname = "liblinphone";
-  version = "4.5.15";
+  version = "4.5.17";
 
   src = fetchFromGitLab {
     domain = "gitlab.linphone.org";
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     group = "BC";
     repo = pname;
     rev = version;
-    sha256 = "sha256-lDj2OkWuodPHpvoJ5W2GivzVIeMnprb42kAnJKfKtdg=";
+    sha256 = "sha256-ryyT4bG3lnE72ydvCAoiT3IeHY4mZwX9nCqaTRC1wyc=";
   };
 
   # Do not build static libraries

pkgs/development/libraries/science/math/or-tools/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , abseil-cpp
 , bzip2
@@ -17,25 +16,16 @@
 
 stdenv.mkDerivation rec {
   pname = "or-tools";
-  version = "8.1";
+  version = "9.0";
   disabled = python.pythonOlder "3.6";  # not supported upstream
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "or-tools";
     rev = "v${version}";
-    sha256 = "1zqgvkaw5vf2d8pwsa34g9jysbpiwplzxc8jyy8kdbzmj8ax3gpg";
+    sha256 = "0yihrsg8wj4b82xwg1hbn97my8zqd7xhw7dk7wm2axsyvqd6m3b3";
   };
 
-  patches = [
-    # This patch (on master as of Feb 11, 2021) fixes or-tools failing to respect
-    # USE_SCIP=OFF and then failing to find scip/scip.h
-    (fetchpatch {
-      url = "https://github.com/google/or-tools/commit/17321869832b5adaccd9864e7e5576122730a5d5.patch";
-      sha256 = "0bi2z1hqlpdm1if3xa5dzc2zv0qlm5xi2x979brx10f8k779ghn0";
-    })
-  ];
-
   # The original build system uses cmake which does things like pull
   # in dependencies through git and Makefile creation time. We
   # obviously don't want to do this so instead we provide the