8 files changed, 100 insertions, 14 deletions
diff --git a/pkgs/tools/X11/xprintidle-ng/default.nix b/pkgs/tools/X11/xprintidle-ng/default.nix
index fdb3b7c58a5..ec8a2ed459d 100644
--- a/pkgs/tools/X11/xprintidle-ng/default.nix
+++ b/pkgs/tools/X11/xprintidle-ng/default.nix
@@ -27,6 +27,10 @@ stdenv.mkDerivation rec {
     sha256 = "0a5024vimpfrpj6w60j1ad8qvjkrmxiy8w1yijxfwk917ag9rkpq";
   };
 
+  patches = [
+    ./fix-config_h-includes-should-be-first.patch
+  ];
+
   postPatch = ''
     substituteInPlace configure.ac \
       --replace "AC_PREREQ([2.62])" "AC_PREREQ([2.64])"
@@ -59,8 +63,8 @@ stdenv.mkDerivation rec {
   meta = {
     inherit version;
     description = "A command-line tool to print idle time from libXss";
-    homepage = "http://taktoa.me/xprintidle-ng/";
-    license = lib.licenses.gpl2;
+    homepage = "https://github.com/taktoa/xprintidle-ng";
+    license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/tools/X11/xprintidle-ng/fix-config_h-includes-should-be-first.patch b/pkgs/tools/X11/xprintidle-ng/fix-config_h-includes-should-be-first.patch
new file mode 100644
index 00000000000..01b4b5d63bd
--- /dev/null
+++ b/pkgs/tools/X11/xprintidle-ng/fix-config_h-includes-should-be-first.patch
@@ -0,0 +1,62 @@
+Fixes the config.h include error during build:
+
+```console
+In file included from src/xprintidle-ng.c:36:
+lib/time.h:28:3: error: #error "Please include config.h first."
+    28 |  #error "Please include config.h first."
+      |   ^~~~~
+```
+
+Introduced since gnulib upgrade:
+* https://github.com/coreutils/gnulib/commit/8ad7bc6
+* https://lists.gnu.org/archive/html/bug-gnulib/2023-04/msg00088.html
+* https://www.gnu.org/software/gnulib/manual/html_node/Source-changes.html
+
+The last version of gnulib now checks that config.h is the first include
+in every compilation unit.
+
+This is not the case with the xprintidle-ng source code, so this patch
+moves these `config.h` inclusions to be first.
+
+---
+ src/time-format.c   | 2 +-
+ src/xprintidle-ng.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/time-format.c b/src/time-format.c
+index 3a46749..4c0a4d2 100644
+--- a/src/time-format.c
++++ b/src/time-format.c
+@@ -18,10 +18,10 @@
+ //     51 Franklin Street, Fifth Floor
+ //     Boston, MA 02110-1301, USA.
+
++#include <config.h>
+ #include <stdbool.h>
+ #include <signal.h>
+ #include <time.h>
+-#include <config.h>
+ #include "system.h"
+ #include "xalloc.h"
+
+diff --git a/src/xprintidle-ng.c b/src/xprintidle-ng.c
+index 5156adf..ca69b2d 100644
+--- a/src/xprintidle-ng.c
++++ b/src/xprintidle-ng.c
+@@ -28,13 +28,13 @@
+ // Eivind Magnus Hvidevold <hvidevold@gmail.com>.
+ // kpowersave is licensed under the GNU GPL, version 2 _only_.
+
++#include <config.h>
+ #include <X11/Xlib.h>
+ #include <X11/extensions/dpms.h>
+ #include <X11/extensions/scrnsaver.h>
+ #include <stdbool.h>
+ #include <signal.h>
+ #include <time.h>
+-#include <config.h>
+ #include "system.h"
+ #include "errno.h"
+ #include "error.h"
+--
+2.42.0
diff --git a/pkgs/tools/admin/winbox/default.nix b/pkgs/tools/admin/winbox/default.nix
index 6c9b9290494..f4a39b2cbbc 100644
--- a/pkgs/tools/admin/winbox/default.nix
+++ b/pkgs/tools/admin/winbox/default.nix
@@ -10,15 +10,15 @@ let
   inherit (lib) last splitString;
 
   pname = "winbox";
-  version = "3.38";
+  version = "3.40";
   name = "${pname}-${version}";
 
   executable = fetchurl (if (wine.meta.mainProgram == "wine64") then {
     url = "https://download.mikrotik.com/winbox/${version}/winbox64.exe";
-    sha256 = "RV+j8FQigpwPprR2xuMYpDRMDwugSZD+O2ZmyPZDz54=";
+    sha256 = "1dxny1qmq4pmdn40j9zk461p3qwwjin5d18ajhczrnqrcr2v1xwi";
   } else {
     url = "https://download.mikrotik.com/winbox/${version}/winbox.exe";
-    sha256 = "dh3P+otukhnEpVTqTu16MgIHVnJbzp4Voj+wZ3r5Fxg=";
+    sha256 = "11vmdkwi38y7wkdkgsqpfs4l2bdaj9yg6c8wlgfzp91227gjn5li";
   });
 
   # This is from the winbox AUR package:
diff --git a/pkgs/tools/misc/idutils/default.nix b/pkgs/tools/misc/idutils/default.nix
index 6a4fa896161..cbdf1b76104 100644
--- a/pkgs/tools/misc/idutils/default.nix
+++ b/pkgs/tools/misc/idutils/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, emacs, gnulib, autoconf, bison, automake, gettext, gperf, texinfo, perl, rsync}:
+{ fetchurl, lib, stdenv, emacs, gnulib, autoconf, bison, automake, gettext, gperf, texinfo, perl, rsync, darwin }:
 
 stdenv.mkDerivation rec {
   pname = "idutils";
@@ -16,7 +16,12 @@ stdenv.mkDerivation rec {
     ./bootstrap --force --gnulib-srcdir=${gnulib} --skip-po --bootstrap-sync --no-git
     '';
 
-  buildInputs = lib.optional stdenv.isLinux emacs;
+  buildInputs = lib.optionals stdenv.isLinux [
+    emacs
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreServices
+  ];
+
   nativeBuildInputs = [ gnulib autoconf bison automake gettext gperf texinfo perl rsync ];
 
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/tools/networking/wget2/default.nix b/pkgs/tools/networking/wget2/default.nix
index 03eb6135ccd..9b77133de56 100644
--- a/pkgs/tools/networking/wget2/default.nix
+++ b/pkgs/tools/networking/wget2/default.nix
@@ -10,6 +10,7 @@
   # libraries
 , brotli
 , bzip2
+, darwin
 , gpgme
 , libhsts
 , libidn2
@@ -65,7 +66,11 @@ stdenv.mkDerivation rec {
     xz
     zlib
     zstd
-  ] ++ lib.optional sslSupport openssl;
+  ] ++ lib.optionals sslSupport [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreServices
+  ];
 
   # TODO: include translation files
   autoreconfPhase = ''
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index a4c0fc51b64..34088e3afbc 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -30,11 +30,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.8.7";
+  version = "0.4.8.9";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-sg0rnHTbKKAMB/CQ7lsCQbK2hPOv3szMa4AIkxxVdJE=";
+    sha256 = "sha256-Wbt9iJD2ExtM5TRPPc6l3rIYK39PEP8MtOTYHxGyz2U=";
   };
 
   outputs = [ "out" "geoip" ];
@@ -46,6 +46,11 @@ stdenv.mkDerivation rec {
   patches = [ ./disable-monotonic-timer-tests.patch ];
 
   configureFlags =
+    # allow inclusion of GPL-licensed code (needed for Proof of Work defense for onion services)
+    # for more details see
+    # https://gitlab.torproject.org/tpo/onion-services/onion-support/-/wikis/Documentation/PoW-FAQ#compiling-c-tor-with-the-pow-defense
+    [ "--enable-gpl" ]
+    ++
     # cross compiles correctly but needs the following
     lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--disable-tool-name-check" ]
     ++
@@ -113,7 +118,7 @@ stdenv.mkDerivation rec {
       the TCP protocol.
     '';
 
-    license = licenses.bsd3;
+    license = with licenses; [ bsd3 gpl3Only ];
 
     maintainers = with maintainers;
       [ thoughtpolice joachifm prusnak ];
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index bb505f4062b..1a497c6affa 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -6,7 +6,7 @@
 , callPackage, ghostscript_headless, harfbuzz
 , makeWrapper, installShellFiles
 , python3, ruby, perl, tk, jdk, bash, snobol4
-, coreutils, findutils, gawk, getopt, gnugrep, gnumake, gnupg, gnused, gzip, ncurses, zip
+, coreutils, findutils, gawk, getopt, gnugrep, gnumake, gnupg, gnused, gzip, html-tidy, ncurses, zip
 , libfaketime, asymptote, biber-ms, makeFontsConf
 , useFixedHashes ? true
 , recurseIntoAttrs
@@ -33,7 +33,7 @@ let
         stdenv lib bin tlpdb tlpdbxz tl
         installShellFiles
         coreutils findutils gawk getopt ghostscript_headless gnugrep
-        gnumake gnupg gnused gzip ncurses perl python3 ruby zip;
+        gnumake gnupg gnused gzip html-tidy ncurses perl python3 ruby zip;
     };
   in overrides tlpdb;
 
diff --git a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
index e9b448dc430..83f07016bcd 100644
--- a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, tlpdb, bin, tlpdbxz, tl
 , installShellFiles
 , coreutils, findutils, gawk, getopt, ghostscript_headless, gnugrep
-, gnumake, gnupg, gnused, gzip, ncurses, perl, python3, ruby, zip
+, gnumake, gnupg, gnused, gzip, html-tidy, ncurses, perl, python3, ruby, zip
 }:
 
 oldTlpdb:
@@ -88,6 +88,7 @@ in lib.recursiveUpdate orig rec {
   pkfix-helper.extraBuildInputs = [ ghostscript_headless ];
   ps2eps.extraBuildInputs = [ ghostscript_headless ];
   pst2pdf.extraBuildInputs = [ ghostscript_headless ];
+  tex4ebook.extraBuildInputs = [ html-tidy ];
   tex4ht.extraBuildInputs = [ ruby ];
   texlive-scripts.extraBuildInputs = [ gnused ];
   texlive-scripts-extra.extraBuildInputs = [ coreutils findutils ghostscript_headless gnused ];
@@ -241,6 +242,10 @@ in lib.recursiveUpdate orig rec {
     sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pst2pdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pst2pdf
   '';
 
+  tex4ebook.postFixup = ''
+    sed -i '2ios.setenv("PATH","${lib.makeBinPath tex4ebook.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/tex4ebook
+  '';
+
   tex4ht.postFixup = ''
     sed -i -e '2iPATH="${lib.makeBinPath tex4ht.extraBuildInputs}''${PATH:+:$PATH}"' -e 's/\\rubyCall//g;' "$out"/bin/htcontext
   '';