Rebase onto e4ad989506ec7d71f7302cc3067abd82730a4beb HEAD rootfs

Signed-off-by: Alyssa Ross <hi@alyssa.is>

6 files changed, 43 insertions, 49 deletions

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 8b615a55dd3..b1bd0ae912d 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -34,6 +34,7 @@ let
      */
   ]) (builtins.attrNames sharedLibDeps) ++ [
     "--with-intl=system-icu"
+    "--openssl-use-def-ca-store"
   ];
 
   copyLibHeaders =
@@ -52,6 +53,12 @@ let
 
     strictDeps = true;
 
+    env = lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
+      # Make sure libc++ uses `posix_memalign` instead of `aligned_alloc` on x86_64-darwin.
+      # Otherwise, nodejs would require the 11.0 SDK and macOS 10.15+.
+      NIX_CFLAGS_COMPILE = "-D__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__=101300";
+    };
+
     CC_host = "cc";
     CXX_host = "c++";
     depsBuildBuild = [ buildPackages.stdenv.cc openssl libuv zlib icu ];
diff --git a/pkgs/development/web/nodejs/v14.nix b/pkgs/development/web/nodejs/v14.nix
deleted file mode 100644
index e7dec1c12f6..00000000000
--- a/pkgs/development/web/nodejs/v14.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ callPackage, python3, lib, stdenv, openssl, enableNpm ? true }:
-
-let
-  buildNodejs = callPackage ./nodejs.nix {
-    inherit openssl;
-    python = python3;
-  };
-in
-  buildNodejs {
-    inherit enableNpm;
-    version = "14.21.3";
-    sha256 = "sha256-RY7AkuYK1wDdzwectj1DXBXaTHuz0/mbmo5YqZ5UB14=";
-    patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
-  }
diff --git a/pkgs/development/web/nodejs/v16.nix b/pkgs/development/web/nodejs/v16.nix
deleted file mode 100644
index d4bb94c07d3..00000000000
--- a/pkgs/development/web/nodejs/v16.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ callPackage, openssl, python3, fetchpatch, enableNpm ? true }:
-
-let
-  buildNodejs = callPackage ./nodejs.nix {
-    inherit openssl;
-    python = python3;
-  };
-
-  npmPatches = callPackage ./npm-patches.nix { };
-in
-  buildNodejs {
-    inherit enableNpm;
-    # If you do upgrade here, please update in pkgs/top-level/release.nix
-    # the permitted insecure version to ensure it gets cached for our users
-    # and backport this to stable release (23.05).
-    version = "16.20.2";
-    sha256 = "sha256-V28aA8RV5JGo0TK1h+trO4RlH8iXS7NjhDPdRNIsj0k=";
-    patches = [
-      ./disable-darwin-v8-system-instrumentation.patch
-      ./bypass-darwin-xcrun-node16.patch
-      ./node-npm-build-npm-package-logic-node16.patch
-    ] ++ npmPatches;
-  }
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 0eb1ab4ce3f..b36e8e3d0f3 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -1,27 +1,32 @@
-{ callPackage, fetchpatch, openssl, python3, enableNpm ? true }:
+{ callPackage, lib, overrideCC, pkgs, buildPackages, fetchpatch, openssl, python3, enableNpm ? true }:
 
 let
+  # Clang 16+ cannot build Node v18 due to -Wenum-constexpr-conversion errors.
+  # Use an older version of clang with the current libc++ for compatibility (e.g., with icu).
+  ensureCompatibleCC = packages:
+    if packages.stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion packages.stdenv.cc.cc) "16"
+      then overrideCC packages.llvmPackages_15.stdenv (packages.llvmPackages_15.stdenv.cc.override {
+        inherit (packages.llvmPackages) libcxx;
+        extraPackages = [ packages.llvmPackages.libcxxabi ];
+      })
+      else packages.stdenv;
+
   buildNodejs = callPackage ./nodejs.nix {
     inherit openssl;
+    stdenv = ensureCompatibleCC pkgs;
+    buildPackages = buildPackages // { stdenv = ensureCompatibleCC buildPackages; };
     python = python3;
   };
 in
 buildNodejs {
   inherit enableNpm;
-  version = "18.17.1";
-  sha256 = "sha256-8hXPA9DwDwesC2dMaBn4BMFULhbxUtoEmAAirsz15lo=";
+  version = "18.18.2";
+  sha256 = "sha256-ckni8K+UPsOFmVBPSyor0x+5OHhykbbMymyLrfAeO1Y=";
   patches = [
     ./disable-darwin-v8-system-instrumentation.patch
     ./bypass-darwin-xcrun-node16.patch
     ./revert-arm64-pointer-auth.patch
     ./node-npm-build-npm-package-logic.patch
     ./trap-handler-backport.patch
-    # Fixes target toolchain arguments being passed to the host toolchain when
-    # cross-compiling. For example, -m64 is not available on aarch64.
-    (fetchpatch {
-      name = "common-gypi-cross.patch";
-      url = "https://github.com/nodejs/node/pull/48597.patch";
-      hash = "sha256-FmHmwlTxPw5mTW6t4zuy9vr4FxopjU4Kx+F1aqabG1s=";
-    })
   ];
 }
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 7c4b390cc66..a66db24b0e0 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -8,8 +8,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.6.1";
-  sha256 = "sha256-Ouxeco2qOIAMNDsSkiHTSIBkolKaObtUZ7xVviJsais=";
+  version = "20.9.0";
+  sha256 = "sha256-oj2WgQq/BFVCazSdR85TEPMwlbe8BXG5zFEPSBw6RRk=";
   patches = [
     ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
diff --git a/pkgs/development/web/nodejs/v21.nix b/pkgs/development/web/nodejs/v21.nix
new file mode 100644
index 00000000000..af3af652fb7
--- /dev/null
+++ b/pkgs/development/web/nodejs/v21.nix
@@ -0,0 +1,19 @@
+{ callPackage, openssl, python3, enableNpm ? true }:
+
+let
+  buildNodejs = callPackage ./nodejs.nix {
+    inherit openssl;
+    python = python3;
+  };
+in
+buildNodejs {
+  inherit enableNpm;
+  version = "21.2.0";
+  sha256 = "sha256-1Xyc6jlHZPodmvUeUsdEn3EZPp1ExKgfvt7GU+yCdwc=";
+  patches = [
+    ./revert-arm64-pointer-auth.patch
+    ./disable-darwin-v8-system-instrumentation-node19.patch
+    ./bypass-darwin-xcrun-node16.patch
+    ./node-npm-build-npm-package-logic.patch
+  ];
+}