in the new release the meson option `systemdsystemunitdir` is broken by
the new `sysusers.d` code in `meson.build`. we fix this by setting both
of these pkg-config variables through environment variables.

Changes: polkit-org/polkit@123...124

since the repo at gitlab.fredesktop.org is archived, it's likely safer
to pull down this patch into nixpkgs directly. in case the archived repo
vanishes in the future.

Add a test where a conflicting package can be found at the end of
multiple dependency chains. This is far too simple an example to
demonstrate the ill effects of exponential time complexity, but does
serve to demonstrate how the error output changes when each path is only
visited once.

The hook performs a depth first search on the graph defined by
propagatedBuildInputs. This traverses all paths through the graph,
except for any cycles. In the worst case with a highly connected graph,
this search can take exponential time. In practice, this means that in
cases with long dependency chains and multiple packages depending on the
same package, the hook can take several hours to run.

Avoid this problem by keeping track of already visited paths and only
visiting each path once. This makes the search complete in linear time.

The visible effect of this change is that, if a conflict is found, only
one dependency chain that leads to the conflicting package is printed,
rather than all the possible dependency chains.

Now that we only visit each path once, a few things can be simplified.
We no longer have to keep a list of different dependency chains leading
to a package, since only one chain will ever be found. Also, the already
visited check also takes care of cycles, so the other cycle check can be
removed.

…itespace

Currently, nix-support/propagated-build-inputs is parsed by splitting on
a single space. This means that if this file contains multiple spaces
separating two paths, the build_inputs list will end up containing an
empty string.

Instead, call split() with no arguments, which splits on runs of
whitespace and also ignores whitespace at the beginning and end of the
string, eliminating the need for strip().

Using python3Minimal avoids infinite recursions in the stdenv bootstrap on x86_64-darwin when building Python with configd support.

Changes: https://gitlab.gnome.org/GNOME/tracker/-/blob/3.7.3/NEWS

2.42.11 disables several loaders by default. The meson option "others" reenables
these for packages that still depend on them.

The "others" option includes ani which is currently affected by CVE-2022-48622.
Disable this by removing it from the build while allowing the other loaders
to build.

po4a: 0.62 -> 0.71

[staging] libcamera: fix binary reproduciblity

Instead of assuming that systemd is desired whenever it is availabe, introduce
flag that allows disabling systemd. This flag is still defaults to true as long
as systemd is available on the host platform.

This is no-rebuild change.

musl 1.2.5 no longer provides the GNU version.

Upstream is dead so patching is probably our only option, but at least
that means it's unlikely to break in a future release!

apple-source-releases: always use python3Minimal

Fixes GLIBC-SA-2024-0005 (CVE-2024-33599), GLIBC-SA-2024-0006 (CVE-2024-33600),
GLIBC-SA-2024-0007 (CVE-2024-33601) and GLIBC-SA-2024-0008 (CVE-2024-33602).

https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005;h=a59596610a0ea74d905a2452fc50283dad58e115;hb=HEAD
https://sourceware.org/git?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006;h=d44148d3d97bddac42450649032ebbd96b59062e;hb=HEAD
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007;h=b6928fa27a69e325624b1a395ecb1bbba537ad80;hb=HEAD
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008;h=d93e2a6f0bf084df419efadee2d1a48c4f9003d7;hb=HEAD

Fixes: CVE-2024-28085

kf5: 5.115 -> 5.116

rawtherapee: fix build

We're running into multiple issues, so let's be conservative.
In particular, this commit should fix *-darwin builds.
/cc PR #309805 as this is kind-of reverting it (partially for now)

We need this now to fix nixStatic build:
https://hydra.nixos.org/build/259722977
/cc PR #309805

Something something cflags I guess?

perlPackages: fix wine-staging build on i686