Re-Revert "Merge #101508: libraw: 0.20.0 -> 0.20.2"

This reverts commit c778945806b44d46ec16bc4302e7e7163e6bab97.

I believe this is exactly what brings the staging branch into
the right shape after the last merge from master (through staging-next);
otherwise part of staging changes would be lost
(due to being already reachable from master but reverted).

59 files changed, 352 insertions, 417 deletions

diff --git a/pkgs/development/compilers/dmd/binary.nix b/pkgs/development/compilers/dmd/binary.nix
index cd3a15889b21a..2ff2b35060b81 100644
--- a/pkgs/development/compilers/dmd/binary.nix
+++ b/pkgs/development/compilers/dmd/binary.nix
@@ -17,7 +17,8 @@ in mkDerivation {
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ fixDarwinDylibNames autoPatchelfHook ];
+  nativeBuildInputs = [ autoPatchelfHook ]
+    ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
   propagatedBuildInputs = [ curl tzdata ] ++ lib.optional hostPlatform.isLinux glibc;
 
   installPhase = ''
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 2204744a4b594..e1c4768413f49 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -287,7 +287,12 @@ postInstall() {
     done
 
     # Two identical man pages are shipped (moving and compressing is done later)
-    ln -sf gcc.1 "$out"/share/man/man1/g++.1
+    for i in "$out"/share/man/man1/*g++.1; do
+        if test -e "$i"; then
+            man_prefix=`echo "$i" | sed "s,.*/\(.*\)g++.1,\1,"`
+            ln -sf "$man_prefix"gcc.1 "$i"
+        fi
+    done
 }
 
 genericBuild
diff --git a/pkgs/development/compilers/ldc/binary.nix b/pkgs/development/compilers/ldc/binary.nix
index 56d40be86194b..cbdb56efb17f8 100644
--- a/pkgs/development/compilers/ldc/binary.nix
+++ b/pkgs/development/compilers/ldc/binary.nix
@@ -17,7 +17,8 @@ in mkDerivation {
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ fixDarwinDylibNames autoPatchelfHook ];
+  nativeBuildInputs = [ autoPatchelfHook ]
+    ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxml2 stdenv.cc.cc ];
 
diff --git a/pkgs/development/compilers/llvm/10/clang/default.nix b/pkgs/development/compilers/llvm/10/clang/default.nix
index a3d6e7e402ab6..fef7720d726dc 100644
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -19,10 +19,10 @@ let
     '';
 
     nativeBuildInputs = [ cmake python3 lld ]
-      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx
+      ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-    buildInputs = [ libxml2 llvm ]
-      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    buildInputs = [ libxml2 llvm ];
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++14"
diff --git a/pkgs/development/compilers/llvm/10/libc++/default.nix b/pkgs/development/compilers/llvm/10/libc++/default.nix
index 651f1887553d8..95711903932e8 100644
--- a/pkgs/development/compilers/llvm/10/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/10/libc++/default.nix
@@ -21,9 +21,10 @@ stdenv.mkDerivation {
     patchShebangs utils/cat_files.py
   '';
   nativeBuildInputs = [ cmake ]
-    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3;
+    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  buildInputs = [ libcxxabi ];
 
   cmakeFlags = [
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 4f5e20cfe7700..2de5f65b4a136 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -20,10 +20,10 @@ let
     '';
 
     nativeBuildInputs = [ cmake python3 lld ]
-      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx
+      ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-    buildInputs = [ libxml2 llvm ]
-      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    buildInputs = [ libxml2 llvm ];
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++14"
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index cd7d952243ce6..b5e7b54fa5be9 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -19,10 +19,10 @@ let
     '';
 
     nativeBuildInputs = [ cmake python3 ]
-      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx
+      ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-    buildInputs = [ libxml2 llvm ]
-      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    buildInputs = [ libxml2 llvm ];
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
diff --git a/pkgs/development/compilers/llvm/5/libc++/default.nix b/pkgs/development/compilers/llvm/5/libc++/default.nix
index f8185fc3ff4b3..9bebedbc04425 100644
--- a/pkgs/development/compilers/llvm/5/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/5/libc++/default.nix
@@ -25,9 +25,11 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;
+  nativeBuildInputs = [ cmake ]
+    ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  buildInputs = [ libcxxabi ];
 
   cmakeFlags = [
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
diff --git a/pkgs/development/compilers/llvm/6/clang/default.nix b/pkgs/development/compilers/llvm/6/clang/default.nix
index 8f6479fe2f4e6..ec3effebfd77c 100644
--- a/pkgs/development/compilers/llvm/6/clang/default.nix
+++ b/pkgs/development/compilers/llvm/6/clang/default.nix
@@ -19,10 +19,10 @@ let
     '';
 
     nativeBuildInputs = [ cmake python3 ]
-      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx
+      ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-    buildInputs = [ libxml2 llvm ]
-      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    buildInputs = [ libxml2 llvm ];
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
diff --git a/pkgs/development/compilers/llvm/6/libc++/default.nix b/pkgs/development/compilers/llvm/6/libc++/default.nix
index a922bcfaf0ea4..727a322608728 100644
--- a/pkgs/development/compilers/llvm/6/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/6/libc++/default.nix
@@ -25,9 +25,11 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;
+  nativeBuildInputs = [ cmake ]
+    ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  buildInputs = [ libcxxabi ];
 
   cmakeFlags = [
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index 905ec862ad7ec..969938681fe92 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -20,10 +20,10 @@ let
     '';
 
     nativeBuildInputs = [ cmake python3 ]
-      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx
+      ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-    buildInputs = [ libxml2 llvm lld ]
-      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    buildInputs = [ libxml2 llvm lld ];
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
diff --git a/pkgs/development/compilers/llvm/7/libc++/default.nix b/pkgs/development/compilers/llvm/7/libc++/default.nix
index 83c05cf0e6346..76baadf1c6e97 100644
--- a/pkgs/development/compilers/llvm/7/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/7/libc++/default.nix
@@ -24,9 +24,12 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;
 
-  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [ cmake ]
+    ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+
+  buildInputs = [ libcxxabi ] ;
 
   cmakeFlags = [
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index 2d7fc8068900c..5c1dca5e33b18 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -20,10 +20,10 @@ let
     '';
 
     nativeBuildInputs = [ cmake python3 ]
-      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx
+      ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-    buildInputs = [ libxml2 llvm lld ]
-      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    buildInputs = [ libxml2 llvm lld ];
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
diff --git a/pkgs/development/compilers/llvm/8/libc++/default.nix b/pkgs/development/compilers/llvm/8/libc++/default.nix
index 9c0c7951c7944..01e0d8e008cb8 100644
--- a/pkgs/development/compilers/llvm/8/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/8/libc++/default.nix
@@ -25,9 +25,10 @@ stdenv.mkDerivation {
     patchShebangs utils/cat_files.py
   '';
   nativeBuildInputs = [ cmake ]
-    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3;
+    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  buildInputs = [ libcxxabi ];
 
   cmakeFlags = [
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index 81117e904d82a..cfaee05944caf 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -20,10 +20,10 @@ let
     '';
 
     nativeBuildInputs = [ cmake python3 ]
-      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx
+      ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-    buildInputs = [ libxml2 llvm lld ]
-      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    buildInputs = [ libxml2 llvm lld ];
 
     cmakeFlags = [
       "-DCMAKE_CXX_FLAGS=-std=c++11"
diff --git a/pkgs/development/compilers/llvm/9/libc++/default.nix b/pkgs/development/compilers/llvm/9/libc++/default.nix
index cec6de61ca999..c9f0e6254ab46 100644
--- a/pkgs/development/compilers/llvm/9/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/9/libc++/default.nix
@@ -21,9 +21,10 @@ stdenv.mkDerivation {
     patchShebangs utils/cat_files.py
   '';
   nativeBuildInputs = [ cmake ]
-    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3;
+    ++ stdenv.lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) python3
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  buildInputs = [ libcxxabi ];
 
   cmakeFlags = [
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
diff --git a/pkgs/development/compilers/purescript/psc-package/default.nix b/pkgs/development/compilers/purescript/psc-package/default.nix
index 0bebd5d2f50d6..88f7adce5a1ac 100644
--- a/pkgs/development/compilers/purescript/psc-package/default.nix
+++ b/pkgs/development/compilers/purescript/psc-package/default.nix
@@ -44,12 +44,10 @@ stdenv.mkDerivation rec {
   '' + ''
     chmod u-w $PSC_PACKAGE
 
-    $PSC_PACKAGE --bash-completion-script $PSC_PACKAGE > psc-package.bash
-    $PSC_PACKAGE --fish-completion-script $PSC_PACKAGE > psc-package.fish
-    $PSC_PACKAGE --zsh-completion-script $PSC_PACKAGE > _psc-package
-    installShellCompletion \
-      psc-package.{bash,fish} \
-      --zsh _psc-package
+    installShellCompletion --cmd psc-package \
+      --bash <($PSC_PACKAGE --bash-completion-script $PSC_PACKAGE) \
+      --fish <($PSC_PACKAGE --fish-completion-script $PSC_PACKAGE) \
+      --zsh <($PSC_PACKAGE --zsh-completion-script $PSC_PACKAGE)
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/compilers/rust/1_46.nix b/pkgs/development/compilers/rust/1_47.nix
index c999b346ee6f9..e5cbae193bf16 100644
--- a/pkgs/development/compilers/rust/1_46.nix
+++ b/pkgs/development/compilers/rust/1_47.nix
@@ -19,24 +19,24 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.46.0";
-  rustcSha256 = "0a17jby2pd050s24cy4dfc0gzvgcl585v3vvyfilniyvjrqknsid";
+  rustcVersion = "1.47.0";
+  rustcSha256 = "sha256-MYXfBkxHR/LIubuMRGjt1Y/0rW0HiAyHmsGxc7do2B0=";
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.45.2";
+  bootstrapVersion = "1.46.0";
 
   # fetch hashes by running `print-hashes.sh 1.45.2`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "5b2050dde23152750de89f7e59acaab6bf088d0beb5854c69c9a545fd254b936";
-    x86_64-unknown-linux-gnu = "860feed955726a4d96ffe40758a110053326b9ae11c9e1ee059e9c6222f25643";
-    arm-unknown-linux-gnueabihf = "ddb5f59bbdef84e0b7c83049461e003ed031dd881a4622365c3d475102535c60";
-    armv7-unknown-linux-gnueabihf = "7a556581f87602705f9c89b04cce621cfbba9050b6fbe478166e91d164567531";
-    aarch64-unknown-linux-gnu = "151fad66442d28a4e4786753d1afb559c4a3d359081c64769273a31c2f0f4d30";
-    x86_64-apple-darwin = "6e8067624ede10aa23081d62e0086c6f42f7228cc0d00fb5ff24d4dac65249d6";
+    i686-unknown-linux-gnu = "6ebd7e04dc18a36d08b9731cdb42d5caf8460e1eb41b75f3a8596c39f5e71206";
+    x86_64-unknown-linux-gnu = "e3b98bc3440fe92817881933f9564389eccb396f5f431f33d48b979fa2fbdcf5";
+    arm-unknown-linux-gnueabihf = "bb8af68565321f54608e918597083eb016ed0f9f4f3cc23f7cc5f467b934ce7f";
+    armv7-unknown-linux-gnueabihf = "7c0640879d7f2c38db60352e3c0f09e3fc6fa3bac6ca8f22cbccb1eb5e950121";
+    aarch64-unknown-linux-gnu = "f0c6d630f3dedb3db69d69ed9f833aa6b472363096f5164f1068c7001ca42aeb";
+    x86_64-apple-darwin = "82d61582a3772932432a99789c3b3bd4abe6baca339e355048ca9efb9ea5b4db";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_46;
+  selectRustPackage = pkgs: pkgs.rust_1_47;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index 9ae7e51e5fef8..b84e390e0b0d7 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, bash, curl, darwin
+{ stdenv, makeWrapper, bash, curl, darwin, zlib
 , version
 , src
 , platform
@@ -42,17 +42,23 @@ rec {
       ./install.sh --prefix=$out \
         --components=${installComponents}
 
-      ${optionalString (stdenv.isLinux && bootstrapping) ''
+      ${optionalString (stdenv.isLinux && bootstrapping) (''
         patchelf \
           --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/rustc"
+        '' + optionalString (stdenv.lib.versionAtLeast version "1.46")
+        # rustc bootstrap needs libz starting from 1.46
+        ''
+          ln -s ${zlib}/lib/libz.so.1 $out/lib/libz.so.1
+          ln -s ${zlib}/lib/libz.so $out/lib/libz.so
+        '' + ''
         patchelf \
           --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/rustdoc"
         patchelf \
           --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/cargo"
-      ''}
+      '')}
 
       # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
       # (or similar) here. It causes strange effects where rustc loads
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 0bbcadba3f512..8263a987d639e 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "rubygems";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    sha256 = "0h7ij4jpj8rgnpkl63cwh2lnav73pw5wpfqra3va7077lsyadlgd";
+    sha256 = "181wjclxnq5lrwnr53famy9pg8911hi9w2v0vy7dqgjqnc4iy1hp";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/atk/default.nix b/pkgs/development/libraries/atk/default.nix
index b54ba5313011d..aa132515b3e99 100644
--- a/pkgs/development/libraries/atk/default.nix
+++ b/pkgs/development/libraries/atk/default.nix
@@ -17,9 +17,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  buildInputs = stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
-
-  nativeBuildInputs = [ meson ninja pkgconfig gettext gobject-introspection glib ];
+  nativeBuildInputs = [ meson ninja pkgconfig gettext gobject-introspection glib ]
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   propagatedBuildInputs = [
     # Required by atk.pc
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 8295be238fc5b..a195a2c7bb981 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -146,11 +146,11 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ which ];
+  nativeBuildInputs = [ which ]
+    ++ optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ expat zlib bzip2 libiconv ]
     ++ optional (stdenv.hostPlatform == stdenv.buildPlatform) icu
-    ++ optional stdenv.isDarwin fixDarwinDylibNames
     ++ optional enablePython python
     ++ optional enableNumpy python.pkgs.numpy;
 
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index 1ffb535999240..cd3fa3bb7fd2a 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ autoreconfHook fixDarwinDylibNames pruneLibtoolFiles ];
+  nativeBuildInputs = [ autoreconfHook pruneLibtoolFiles ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs =
     [ openssl db gettext kerberos ]
     ++ lib.optional enableLdap openldap
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index b7b86de92c01e..cbc3f21732603 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.2.11";
+  version = "2.2.12";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "opxXd8TkX8rCWVwVxJ1tKqQ0+l58mT3/P582e2X+Ryo=";
+    sha256 = "0zi20s62gax9rkhwj318kqrxa62pmks6dsdd6m9pzvhlwy5cb6vb";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index a356d7be1a9e8..29d2c2b3acb9b 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -1,16 +1,18 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, lib }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
-  name = "expat-2.2.8";
+let
+  version = "2.2.10";
+in stdenv.mkDerivation rec {
+  name = "expat-${version}";
 
   src = fetchurl {
-    url = "https://github.com/libexpat/libexpat/releases/download/R_2_2_8/${name}.tar.xz";
-    sha256 = "16vpj5mk3lps3x7fr8cs03rffx3ir4jilyqw0frayn6q94daijk1";
+    url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${name}.tar.xz";
+    sha256 = "sha256-Xf5Tj4tbY/A+mO2sUg19mmpNIuSC5cltTQb8xUhcJfI=";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 24757af09e3d2..b87e64c2afbf7 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -14,7 +14,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "freetype";
-  version = "2.10.2";
+  version = "2.10.4";
 
   meta = with stdenv.lib; {
     description = "A font rendering engine";
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "12rd181yzz6952cyjqaa4253f5szam93cmhw18p33rnj4l8dchqm";
+    sha256 = "112pyy215chg7f7fmp2l9374chhhpihbh8wgpj5nj6avj3c59a46";
   };
 
   propagatedBuildInputs = [ zlib bzip2 libpng ]; # needed when linking against freetype
diff --git a/pkgs/development/libraries/gamin/abstract-socket-namespace.patch b/pkgs/development/libraries/gamin/abstract-socket-namespace.patch
new file mode 100644
index 0000000000000..ff1610559721e
--- /dev/null
+++ b/pkgs/development/libraries/gamin/abstract-socket-namespace.patch
@@ -0,0 +1,73 @@
+From 737452159d521aef2041a2767f3ebf9f68f4b6a9 Mon Sep 17 00:00:00 2001
+From: Christian Kampka <christian@kampka.net>
+Date: Tue, 1 Sep 2020 13:54:35 +0200
+Subject: [PATCH] Pin abstract namespace sockets to host_os
+
+Running programs with AC_RUN_IFELSE fails when cross-compiling.
+Since abstract namespace sockets are linux feature, we can easily
+assume it is available for linux and not for darwin.
+---
+ configure.in | 47 ++++++-----------------------------------------
+ 1 file changed, 6 insertions(+), 41 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index eb129db..0ed82ba 100644
+--- a/configure.in
++++ b/configure.in
+@@ -387,47 +387,12 @@ fi
+ 
+ #### Abstract sockets
+ 
+-AC_MSG_CHECKING(abstract socket namespace)
+-AC_LANG_PUSH(C)
+-AC_RUN_IFELSE([AC_LANG_PROGRAM(
+-[[
+-#include <sys/types.h>
+-#include <stdlib.h>
+-#include <string.h>
+-#include <stdio.h>
+-#include <sys/socket.h>
+-#include <sys/un.h>
+-#include <errno.h>
+-]],
+-[[
+-  int listen_fd;
+-  struct sockaddr_un addr;
+-  
+-  listen_fd = socket (PF_UNIX, SOCK_STREAM, 0);
+-  
+-  if (listen_fd < 0)
+-    {
+-      fprintf (stderr, "socket() failed: %s\n", strerror (errno));
+-      exit (1);
+-    }
+-
+-  memset (&addr, '\0', sizeof (addr));
+-  addr.sun_family = AF_UNIX;
+-  strcpy (addr.sun_path, "X/tmp/dbus-fake-socket-path-used-in-configure-test");
+-  addr.sun_path[0] = '\0'; /* this is what makes it abstract */
+-  
+-  if (bind (listen_fd, (struct sockaddr*) &addr, SUN_LEN (&addr)) < 0)
+-    {
+-       fprintf (stderr, "Abstract socket namespace bind() failed: %s\n", 
+-                strerror (errno));
+-       exit (1);
+-    }
+-  else 
+-    exit (0);
+-]])],
+-              [have_abstract_sockets=yes],
+-              [have_abstract_sockets=no])
+-AC_LANG_POP(C)
++AC_MSG_CHECKING([whether target os has abstract socket namespace])
++if test x$target_os = xlinux-gnu ; then
++    have_abstract_sockets=yes
++else
++    have_abstract_sockets=no
++fi	
+ AC_MSG_RESULT($have_abstract_sockets)
+ 
+ if test x$enable_abstract_sockets = xyes; then
+-- 
+2.25.4
+
diff --git a/pkgs/development/libraries/gamin/default.nix b/pkgs/development/libraries/gamin/default.nix
index 38451571d8b67..89096c8874508 100644
--- a/pkgs/development/libraries/gamin/default.nix
+++ b/pkgs/development/libraries/gamin/default.nix
@@ -1,6 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, glib }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, glib, autoreconfHook }:
 
-stdenv.mkDerivation (rec {
+let
+  cross = stdenv.hostPlatform != stdenv.buildPlatform;
+in stdenv.mkDerivation (rec {
   name = "gamin-0.1.10";
 
   src = fetchurl {
@@ -8,7 +10,7 @@ stdenv.mkDerivation (rec {
     sha256 = "18cr51y5qacvs2fc2p1bqv32rs8bzgs6l67zhasyl45yx055y218";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
 
   buildInputs = [ glib ];
 
@@ -27,7 +29,7 @@ stdenv.mkDerivation (rec {
       name = "fix-pthread-mutex.patch";
       url = "https://git.alpinelinux.org/aports/plain/main/gamin/fix-pthread-mutex.patch?h=3.4-stable&id=a1a836b089573752c1b0da7d144c0948b04e8ea8";
       sha256 = "13igdbqsxb3sz0h417k6ifmq2n4siwqspj6slhc7fdl5wd1fxmdz";
-    });
+    }) ++ stdenv.lib.optional (cross) ./abstract-socket-namespace.patch ;
 
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 1f4bc5c12ada8..9b2fd0b778bfc 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -61,9 +61,7 @@ stdenv.mkDerivation rec {
     gobject-introspection
     makeWrapper
     glib
-  ] ++ stdenv.lib.optional stdenv.isDarwin [
-    fixDarwinDylibNames
-  ];
+  ] ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   propagatedBuildInputs = [
     glib
diff --git a/pkgs/development/libraries/glfw/3.x.nix b/pkgs/development/libraries/glfw/3.x.nix
index 1b9fcb9586b3b..fbc1cb818ca84 100644
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@@ -18,10 +18,11 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ libGL ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   buildInputs = [ libX11 libXrandr libXinerama libXcursor libXi libXext ]
-    ++ lib.optionals stdenv.isDarwin [ Cocoa Kernel fixDarwinDylibNames ];
+    ++ lib.optionals stdenv.isDarwin [ Cocoa Kernel ];
 
   cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
 
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 8110f13d14cad..6c5703f521d72 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -11,7 +11,7 @@
 }:
 
 let
-  version = "2.7.1";
+  version = "2.7.2";
   inherit (stdenv.lib) optional optionals optionalString;
   mesonFeatureFlag = opt: b:
     "-D${opt}=${if b then "enabled" else "disabled"}";
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     owner  = "harfbuzz";
     repo   = "harfbuzz";
     rev    = version;
-    sha256 = "172jmwp666xbs6yy1pc2495gnkz8xw11b8zkz3j19jxlvvp4mxcs";
+    sha256 = "0vfyxr3lvzp80j1347nrwpr1ndv265p15rj2q8rj31lb26nyz4dm";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index 81f75ad526a74..d8e9bd16ab890 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -57,7 +57,7 @@ let
 
     # FIXME: This fixes dylib references in the dylibs themselves, but
     # not in the programs in $out/bin.
-    buildInputs = stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    nativeBuildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
     # remove dependency on bootstrap-tools in early stdenv build
     postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index a6eb56423954a..4004c9f387efc 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jbig2dec";
-  version = "0.18";
+  version = "0.19";
 
   src = fetchurl {
-    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs952/${pname}-${version}.tar.gz";
-    sha256 = "0pigfw2v0ppvr0lbysm69gx0zsa5q2q92yrb8af2j3im6x97f6cy";
+    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs9533/${pname}-${version}.tar.gz";
+    sha256 = "0dwa24kjqyg9hmm40fh048sdxfpnasz43l2rm8wlkw1qbdlpd517";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index 4ae4a71091e44..f89d4bc453410 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -14,8 +14,8 @@ in stdenv.mkDerivation rec {
   };
 
   propagatedBuildInputs = [ glib ];
-  nativeBuildInputs = [ meson ninja pkgconfig gettext gobject-introspection glib ];
-  buildInputs = stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = [ meson ninja pkgconfig gettext gobject-introspection glib ]
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/leveldb/default.nix b/pkgs/development/libraries/leveldb/default.nix
index 33eca603c267b..14d426701ba31 100644
--- a/pkgs/development/libraries/leveldb/default.nix
+++ b/pkgs/development/libraries/leveldb/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ snappy ];
 
   nativeBuildInputs = []
-    ++ stdenv.lib.optional stdenv.isDarwin [ fixDarwinDylibNames ];
+    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   buildPhase = ''
     make all
diff --git a/pkgs/development/libraries/libLAS/default.nix b/pkgs/development/libraries/libLAS/default.nix
index 95569c0a8132b..27db14e716601 100644
--- a/pkgs/development/libraries/libLAS/default.nix
+++ b/pkgs/development/libraries/libLAS/default.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xjfxb3ydvr2258ji3spzyf81g9caap19ql2pk91wiivqsc4mnws";
   };
 
-  buildInputs = [ boost cmake gdal libgeotiff libtiff LASzip2 ]
-                ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  buildInputs = [ boost cmake gdal libgeotiff libtiff LASzip2 ];
 
   cmakeFlags = [
     "-DGDAL_CONFIG=${gdal}/bin/gdal-config"
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 9b6a54d92f97b..ae5154eac0348 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcbor";
-  version = "unstable-2019-07-25";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "PJK";
     repo = pname;
-    rev = "82512d851205fbc7f65d96a0b4a8e1bad2e4f3c6";
-    sha256 = "01hy7n21gxz4gp3gdwm2ywz822p415bj2k9ccxgwz3plvncs4xa1";
+    rev = "v${version}";
+    sha256 = "01dv4vxcmbvpphqy16vqiwh25wx11x630js5wfnx7cryarsh9ld7";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -16,9 +16,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # needs "-DWITH_TESTS=ON", but fails w/compilation error
 
-  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" ];
-
-  NIX_CFLAGS_COMPILE = "-fno-lto";
+  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" "-DBUILD_SHARED_LIBS=on" ];
 
   meta = with stdenv.lib; {
     description = "CBOR protocol implementation for C and others";
diff --git a/pkgs/development/libraries/libevent/default.nix b/pkgs/development/libraries/libevent/default.nix
index e23c7d55c5eda..cbde320671721 100644
--- a/pkgs/development/libraries/libevent/default.nix
+++ b/pkgs/development/libraries/libevent/default.nix
@@ -23,10 +23,13 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional sslSupport "openssl"
     ;
 
+  nativeBuildInputs = []
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames
+    ;
+
   buildInputs = []
     ++ stdenv.lib.optional sslSupport openssl
     ++ stdenv.lib.optional stdenv.isCygwin findutils
-    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames
     ;
 
   doCheck = false; # needs the net
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 576a2fec921a8..3a651087510b3 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, meson, ninja
+{ stdenv, fetchFromGitLab, pkgconfig, meson, ninja
 , libevdev, mtdev, udev, libwacom
 , documentationSupport ? false, doxygen ? null, graphviz ? null # Documentation
 , eventGUISupport ? false, cairo ? null, glib ? null, gtk3 ? null # GUI event viewer support
@@ -27,11 +27,14 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.16.1";
-
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "e6fRru3RUWi7IdF+nmKKocJ5V5Y6Qjo/6jk4pQF1hTk=";
+  version = "1.16.2";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "0qii6yh3dlhgv9z970cpzbz19ii8zjvq4k7pg75sy2gmia7smwd1";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -80,7 +83,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
-    homepage    = "http://www.freedesktop.org/wiki/Software/libinput";
+    homepage    = "https://www.freedesktop.org/wiki/Software/libinput/";
     license     = licenses.mit;
     platforms   = platforms.unix;
     maintainers = with maintainers; [ codyopel ];
diff --git a/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch b/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
deleted file mode 100644
index 552c4e08d5f93..0000000000000
--- a/pkgs/development/libraries/libvpx/CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
+++ /dev/null
@@ -1,211 +0,0 @@
-Backports of
-
-From 46e17f0cb4a80b36755c84b8bf15731d3386c08f Mon Sep 17 00:00:00 2001
-From: kyslov <kyslov@google.com>
-Date: Fri, 4 Jan 2019 17:04:09 -0800
-Subject: [PATCH] Fix OOB memory access on fuzzed data
-
-From 0681cff1ad36b3ef8ec242f59b5a6c4234ccfb88 Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 24 Jul 2018 21:36:50 -0700
-Subject: [PATCH] vp9: fix OOB read in decoder_peek_si_internal
-
-From f00890eecdf8365ea125ac16769a83aa6b68792d Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 11 Dec 2018 18:06:20 -0800
-Subject: [PATCH] update libwebm to libwebm-1.0.0.27-352-g6ab9fcf
-
-From 34d54b04e98dd0bac32e9aab0fbda0bf501bc742 Mon Sep 17 00:00:00 2001
-From: James Zern <jzern@google.com>
-Date: Tue, 9 Apr 2019 18:37:44 -0700
-Subject: [PATCH] update libwebm to libwebm-1.0.0.27-358-gdbf1d10
-
-From 52add5896661d186dec284ed646a4b33b607d2c7 Mon Sep 17 00:00:00 2001
-From: Jerome Jiang <jianj@google.com>
-Date: Wed, 23 May 2018 15:43:00 -0700
-Subject: [PATCH] VP8: Fix use-after-free in postproc.
-
-to address CVE-2019-9232 CVE-2019-9325 CVE-2019-9371 CVE-2019-9433
-
---- libvpx-1.7.0.orig/test/decode_api_test.cc
-+++ libvpx-1.7.0/test/decode_api_test.cc
-@@ -138,8 +138,30 @@ TEST(DecodeAPI, Vp9InvalidDecode) {
-   EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
- }
- 
--TEST(DecodeAPI, Vp9PeekSI) {
-+void TestPeekInfo(const uint8_t *const data, uint32_t data_sz,
-+                  uint32_t peek_size) {
-   const vpx_codec_iface_t *const codec = &vpx_codec_vp9_dx_algo;
-+  // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
-+  // to decoder_peek_si_internal on frames of size < 8.
-+  if (data_sz >= 8) {
-+    vpx_codec_ctx_t dec;
-+    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
-+    EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM
-+                                    : VPX_CODEC_CORRUPT_FRAME,
-+              vpx_codec_decode(&dec, data, data_sz, NULL, 0));
-+    vpx_codec_iter_t iter = NULL;
-+    EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
-+    EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
-+  }
-+
-+  // Verify behavior of vpx_codec_peek_stream_info.
-+  vpx_codec_stream_info_t si;
-+  si.sz = sizeof(si);
-+  EXPECT_EQ((data_sz < peek_size) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
-+            vpx_codec_peek_stream_info(codec, data, data_sz, &si));
-+}
-+
-+TEST(DecodeAPI, Vp9PeekStreamInfo) {
-   // The first 9 bytes are valid and the rest of the bytes are made up. Until
-   // size 10, this should return VPX_CODEC_UNSUP_BITSTREAM and after that it
-   // should return VPX_CODEC_CORRUPT_FRAME.
-@@ -150,24 +172,18 @@ TEST(DecodeAPI, Vp9PeekSI) {
-   };
- 
-   for (uint32_t data_sz = 1; data_sz <= 32; ++data_sz) {
--    // Verify behavior of vpx_codec_decode. vpx_codec_decode doesn't even get
--    // to decoder_peek_si_internal on frames of size < 8.
--    if (data_sz >= 8) {
--      vpx_codec_ctx_t dec;
--      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_dec_init(&dec, codec, NULL, 0));
--      EXPECT_EQ(
--          (data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_CORRUPT_FRAME,
--          vpx_codec_decode(&dec, data, data_sz, NULL, 0));
--      vpx_codec_iter_t iter = NULL;
--      EXPECT_EQ(NULL, vpx_codec_get_frame(&dec, &iter));
--      EXPECT_EQ(VPX_CODEC_OK, vpx_codec_destroy(&dec));
--    }
--
--    // Verify behavior of vpx_codec_peek_stream_info.
--    vpx_codec_stream_info_t si;
--    si.sz = sizeof(si);
--    EXPECT_EQ((data_sz < 10) ? VPX_CODEC_UNSUP_BITSTREAM : VPX_CODEC_OK,
--              vpx_codec_peek_stream_info(codec, data, data_sz, &si));
-+    TestPeekInfo(data, data_sz, 10);
-+  }
-+}
-+
-+TEST(DecodeAPI, Vp9PeekStreamInfoTruncated) {
-+  // This profile 1 header requires 10.25 bytes, ensure
-+  // vpx_codec_peek_stream_info doesn't over read.
-+  const uint8_t profile1_data[10] = { 0xa4, 0xe9, 0x30, 0x68, 0x53,
-+                                      0xe9, 0x30, 0x68, 0x53, 0x04 };
-+
-+  for (uint32_t data_sz = 1; data_sz <= 10; ++data_sz) {
-+    TestPeekInfo(profile1_data, data_sz, 11);
-   }
- }
- #endif  // CONFIG_VP9_DECODER
---- libvpx-1.7.0.orig/third_party/libwebm/mkvparser/mkvparser.cc
-+++ libvpx-1.7.0/third_party/libwebm/mkvparser/mkvparser.cc
-@@ -5307,8 +5307,8 @@ long VideoTrack::Parse(Segment* pSegment
- 
-   const long long stop = pos + s.size;
- 
--  Colour* colour = NULL;
--  Projection* projection = NULL;
-+  std::unique_ptr<Colour> colour_ptr;
-+  std::unique_ptr<Projection> projection_ptr;
- 
-   while (pos < stop) {
-     long long id, size;
-@@ -5357,11 +5357,19 @@ long VideoTrack::Parse(Segment* pSegment
-       if (rate <= 0)
-         return E_FILE_FORMAT_INVALID;
-     } else if (id == libwebm::kMkvColour) {
--      if (!Colour::Parse(pReader, pos, size, &colour))
-+      Colour* colour = NULL;
-+      if (!Colour::Parse(pReader, pos, size, &colour)) {
-         return E_FILE_FORMAT_INVALID;
-+      } else {
-+        colour_ptr.reset(colour);
-+      }
-     } else if (id == libwebm::kMkvProjection) {
--      if (!Projection::Parse(pReader, pos, size, &projection))
-+      Projection* projection = NULL;
-+      if (!Projection::Parse(pReader, pos, size, &projection)) {
-         return E_FILE_FORMAT_INVALID;
-+      } else {
-+        projection_ptr.reset(projection);
-+      }
-     }
- 
-     pos += size;  // consume payload
-@@ -5392,8 +5400,8 @@ long VideoTrack::Parse(Segment* pSegment
-   pTrack->m_display_unit = display_unit;
-   pTrack->m_stereo_mode = stereo_mode;
-   pTrack->m_rate = rate;
--  pTrack->m_colour = colour;
--  pTrack->m_projection = projection;
-+  pTrack->m_colour = colour_ptr.release();
-+  pTrack->m_projection = projection_ptr.release();
- 
-   pResult = pTrack;
-   return 0;  // success
---- libvpx-1.7.0.orig/vp8/common/postproc.c
-+++ libvpx-1.7.0/vp8/common/postproc.c
-@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BU
-   double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
-   int ppl = (int)(level + .5);
- 
--  const MODE_INFO *mode_info_context = cm->show_frame_mi;
-+  const MODE_INFO *mode_info_context = cm->mi;
-   int mbr, mbc;
- 
-   /* The pixel thresholds are adjusted according to if or not the macroblock
---- libvpx-1.7.0.orig/vp8/decoder/dboolhuff.h
-+++ libvpx-1.7.0/vp8/decoder/dboolhuff.h
-@@ -76,7 +76,7 @@ static int vp8dx_decode_bool(BOOL_DECODE
-   }
- 
-   {
--    register int shift = vp8_norm[range];
-+    const unsigned char shift = vp8_norm[(unsigned char)range];
-     range <<= shift;
-     value <<= shift;
-     count -= shift;
---- libvpx-1.7.0.orig/vp9/vp9_dx_iface.c
-+++ libvpx-1.7.0/vp9/vp9_dx_iface.c
-@@ -97,7 +97,7 @@ static vpx_codec_err_t decoder_peek_si_i
-     const uint8_t *data, unsigned int data_sz, vpx_codec_stream_info_t *si,
-     int *is_intra_only, vpx_decrypt_cb decrypt_cb, void *decrypt_state) {
-   int intra_only_flag = 0;
--  uint8_t clear_buffer[10];
-+  uint8_t clear_buffer[11];
- 
-   if (data + data_sz <= data) return VPX_CODEC_INVALID_PARAM;
- 
-@@ -158,6 +158,9 @@ static vpx_codec_err_t decoder_peek_si_i
-         if (profile > PROFILE_0) {
-           if (!parse_bitdepth_colorspace_sampling(profile, &rb))
-             return VPX_CODEC_UNSUP_BITSTREAM;
-+          // The colorspace info may cause vp9_read_frame_size() to need 11
-+          // bytes.
-+          if (data_sz < 11) return VPX_CODEC_UNSUP_BITSTREAM;
-         }
-         rb.bit_offset += REF_FRAMES;  // refresh_frame_flags
-         vp9_read_frame_size(&rb, (int *)&si->w, (int *)&si->h);
---- libvpx-1.7.0.orig/vpx_dsp/bitreader.h
-+++ libvpx-1.7.0/vpx_dsp/bitreader.h
-@@ -94,7 +94,7 @@ static INLINE int vpx_read(vpx_reader *r
-   }
- 
-   {
--    register int shift = vpx_norm[range];
-+    const unsigned char shift = vpx_norm[(unsigned char)range];
-     range <<= shift;
-     value <<= shift;
-     count -= shift;
---- libvpx-1.7.0.orig/vpx_dsp/bitreader_buffer.c
-+++ libvpx-1.7.0/vpx_dsp/bitreader_buffer.c
-@@ -23,7 +23,7 @@ int vpx_rb_read_bit(struct vpx_read_bit_
-     rb->bit_offset = off + 1;
-     return bit;
-   } else {
--    rb->error_handler(rb->error_handler_data);
-+    if (rb->error_handler != NULL) rb->error_handler(rb->error_handler_data);
-     return 0;
-   }
- }
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index 007df403ff735..83e60466c1462 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -56,20 +56,16 @@ assert isCygwin -> unitTestsSupport && webmIOSupport && libyuvSupport;
 
 stdenv.mkDerivation rec {
   pname = "libvpx";
-  version = "1.7.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "webmproject";
-    repo = "libvpx";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "0vvh89hvp8qg9an9vcmwb7d9k3nixhxaz6zi65qdjnd0i56kkcz6";
+    sha256 = "16xv6ambc82g14h1y0q1vyy57wp6j9fbp0nk0wd5csnrw407rhry";
   };
 
-  patches = [
-    ./CVE-2019-9232.CVE-2019-9325.CVE-2019-9371.CVE-2019-9433.patch
-  ];
-
-  postPatch = ''patchShebangs .'';
+  postPatch = "patchShebangs .";
 
   outputs = [ "bin" "dev" "out" ];
   setOutputFlags = false;
@@ -135,6 +131,12 @@ stdenv.mkDerivation rec {
                     experimentalFpMbStatsSupport ||
                     experimentalEmulateHardwareSupport) "experimental")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    #"--extra-cflags="
+    #"--extra-cxxflags="
+    #"--prefix="
+    #"--libc="
+    #"--libdir="
+    "--enable-external-build"
     # libvpx darwin targets include darwin version (ie. ARCH-darwinXX-gcc, XX being the darwin version)
     # See all_platforms: https://github.com/webmproject/libvpx/blob/master/configure
     # Darwin versions: 10.4=8, 10.5=9, 10.6=10, 10.7=11, 10.8=12, 10.9=13, 10.10=14
@@ -159,6 +161,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ ]
     ++ optionals unitTestsSupport [ coreutils curl ];
 
+  NIX_LDFLAGS = [
+    "-lpthread" # fixes linker errors
+  ];
+
   enableParallelBuilding = true;
 
   postInstall = ''moveToOutput bin "$bin" '';
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index d2a98c4a8476c..6d24ba7f2ed25 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchFromGitHub, autoreconfHook, libtool
 , threadingSupport ? true # multi-threading
 , openglSupport ? false, freeglut ? null, libGL ? null, libGLU ? null # OpenGL (required for vwebp)
 , pngSupport ? true, libpng ? null # PNG image format
@@ -27,13 +27,17 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libwebp";
-  version = "1.0.3";
+  version = "1.1.0";
 
-  src = fetchurl {
-    url = "http://downloads.webmproject.org/releases/webp/${pname}-${version}.tar.gz";
-    sha256 = "0kxk4sic34bln3k09mml7crvrmhj97swdk7b1ahbp5w6bj30f2p2";
+  src = fetchFromGitHub {
+    owner  = "webmproject";
+    repo   = pname;
+    rev    = version;
+    sha256 = "1kl6qqa29ygqb2fpv140y59v539gdqx4vcf3mlaxhca2bks98qgm";
   };
 
+  prePatch = "patchShebangs .";
+
   configureFlags = [
     (mkFlag threadingSupport "threading")
     (mkFlag openglSupport "gl")
@@ -50,6 +54,7 @@ stdenv.mkDerivation rec {
     (mkFlag libwebpdecoderSupport "libwebpdecoder")
   ];
 
+  nativeBuildInputs = [ autoreconfHook libtool ];
   buildInputs = [ ]
     ++ optionals openglSupport [ freeglut libGL libGLU ]
     ++ optional pngSupport libpng
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index aeeb0514fabba..aa180b94d747b 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -8,7 +8,7 @@
 , galliumDrivers ? ["auto"]
 , driDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
-, eglPlatforms ? [ "x11" "surfaceless" ] ++ lib.optionals stdenv.isLinux [ "wayland" "drm" ]
+, eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
 , OpenGL, Xplugin
 , withValgrind ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
@@ -31,7 +31,7 @@ with stdenv.lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.1.9";
+  version = "20.2.1";
   branch  = versions.major version;
 in
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "10kk8a8k7f4ip8yaiqdyrx162nbw8pw4h3b4hs4ha8mpd43wlldj";
+    sha256 = "0ji4s1gwcvx3fbj9h0x5zbma6kw4b75vs0266zhc06r97yd6v96i";
   };
 
   prePatch = "patchShebangs .";
@@ -58,7 +58,6 @@ stdenv.mkDerivation {
     ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
     ./opencl-install-dir.patch
     ./disk_cache-include-dri-driver-path-in-cache-key.patch
-    ./link-radv-with-ld_args_build_id.patch
   ]
     ++ lib.optionals stdenv.hostPlatform.isMusl [
       # Fix `-Werror=int-conversion` pthread warnings on musl.
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index acf3d827c5625..fa78f4ae730ad 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -1,4 +1,4 @@
-From 46b10f2bc28fd79d561c8c49bbae3aee6a4cf0e6 Mon Sep 17 00:00:00 2001
+From 980164fd92f5c2302624cd046d30ff21e6e4ba8a Mon Sep 17 00:00:00 2001
 From: David McFarland <corngood@gmail.com>
 Date: Mon, 6 Aug 2018 15:52:11 -0300
 Subject: [PATCH] disk_cache: include dri driver path in cache key
@@ -12,10 +12,10 @@ timestamps in /nix/store are zero.
  3 files changed, 15 insertions(+), 1 deletion(-)
 
 diff --git a/meson_options.txt b/meson_options.txt
-index 1a2dd8ebd12..2ac741af5a6 100644
+index 2d39d13b6ad..daf06480a60 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -348,6 +348,12 @@ option(
+@@ -368,6 +368,12 @@ option(
    value : true,
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
@@ -26,13 +26,13 @@ index 1a2dd8ebd12..2ac741af5a6 100644
 +  description : 'Mesa cache key.'
 +)
  option(
-   'I-love-half-baked-turnips',
+   'prefer-iris',
    type : 'boolean',
 diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index d1f14736725..2ed328f292e 100644
+index a92d621927a..3bd65c6890c 100644
 --- a/src/util/disk_cache.c
 +++ b/src/util/disk_cache.c
-@@ -402,8 +402,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -401,8 +401,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
  
     /* Create driver id keys */
     size_t id_size = strlen(driver_id) + 1;
@@ -43,7 +43,7 @@ index d1f14736725..2ed328f292e 100644
     cache->driver_keys_blob_size += gpu_name_size;
  
     /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -424,6 +426,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -423,6 +425,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
     uint8_t *drv_key_blob = cache->driver_keys_blob;
     DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
     DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
@@ -52,22 +52,23 @@ index d1f14736725..2ed328f292e 100644
     DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
     DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
 diff --git a/src/util/meson.build b/src/util/meson.build
-index 9da29cc7390..5f549bb1d99 100644
+index 0893f64793b..d46ce85a85f 100644
 --- a/src/util/meson.build
 +++ b/src/util/meson.build
-@@ -170,7 +170,12 @@ _libmesa_util = static_library(
-   include_directories : inc_common,
+@@ -179,7 +179,12 @@ _libmesa_util = static_library(
+   include_directories : [inc_include, inc_src, inc_mapi, inc_mesa, inc_gallium, inc_gallium_aux],
    dependencies : deps_for_libmesa_util,
    link_with: libmesa_format,
--  c_args : [c_msvc_compat_args, c_vis_args],
+-  c_args : [c_msvc_compat_args],
 +  c_args : [
-+    c_msvc_compat_args, c_vis_args,
++    c_msvc_compat_args,
 +    '-DDISK_CACHE_KEY="@0@"'.format(
 +      get_option('disk-cache-key')
 +    ),
 +  ],
+   gnu_symbol_visibility : 'hidden',
    build_by_default : false
  )
- 
 -- 
-2.25.1
+2.28.0
+
diff --git a/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch b/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
deleted file mode 100644
index 0a660332392dd..0000000000000
--- a/pkgs/development/libraries/mesa/link-radv-with-ld_args_build_id.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From b49bcb6eece322b70fc2e8b0c8498f5a38ea7b82 Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Sun, 26 Jul 2020 17:29:49 -0300
-Subject: [PATCH] link radv with ld_args_build_id
-
-This is needed for radv_device_get_cache_uuid to work correctly.
----
- src/amd/vulkan/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/amd/vulkan/meson.build b/src/amd/vulkan/meson.build
-index eec026e8f60..a07a0821938 100644
---- a/src/amd/vulkan/meson.build
-+++ b/src/amd/vulkan/meson.build
-@@ -183,7 +183,7 @@ libvulkan_radeon = shared_library(
-   ],
-   c_args : [c_vis_args, no_override_init_args, radv_flags],
-   cpp_args : [cpp_vis_args, radv_flags],
--  link_args : [ld_args_bsymbolic, ld_args_gc_sections, libvulkan_radeon_ld_args],
-+  link_args : [ld_args_build_id, ld_args_bsymbolic, ld_args_gc_sections, libvulkan_radeon_ld_args],
-   link_depends : [libvulkan_radeon_link_depends,],
-   install : true,
- )
---
-2.28.0
diff --git a/pkgs/development/libraries/mesa/missing-includes.patch b/pkgs/development/libraries/mesa/missing-includes.patch
index 9685a1619a58a..72488893c6b6a 100644
--- a/pkgs/development/libraries/mesa/missing-includes.patch
+++ b/pkgs/development/libraries/mesa/missing-includes.patch
@@ -9,18 +9,6 @@
  #include "pipe/p_compiler.h"
  #include "pipe/p_state.h"
  
---- ./src/util/rand_xor.c.orig	2017-06-20 00:38:57.199474067 +0200
-+++ ./src/util/rand_xor.c	2017-06-20 00:40:31.351279557 +0200
-@@ -23,7 +23,9 @@
-  */
- 
- #if defined(__linux__)
-+#include <sys/types.h>
- #include <sys/file.h>
-+#include <sys/stat.h>
- #include <unistd.h>
- #include <fcntl.h>
- #else
 --- ./src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
 +++ ./src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h
 @@ -28,6 +28,8 @@
diff --git a/pkgs/development/libraries/nss/3.44.nix b/pkgs/development/libraries/nss/3.44.nix
index ad58bfccaee66..1c89dd7933161 100644
--- a/pkgs/development/libraries/nss/3.44.nix
+++ b/pkgs/development/libraries/nss/3.44.nix
@@ -19,10 +19,10 @@ in stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ perl ]
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
-  buildInputs = [ zlib sqlite ]
-    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  buildInputs = [ zlib sqlite ];
 
   propagatedBuildInputs = [ nspr ];
 
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index e9ca475802d6b..395617aa7bce2 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -20,10 +20,9 @@ in stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   nativeBuildInputs = [ perl ninja (buildPackages.python3.withPackages (ps: with ps; [ gyp ])) ]
-    ++ stdenv.lib.optional stdenv.isDarwin darwin.cctools;
+    ++ stdenv.lib.optionals stdenv.hostPlatform.isDarwin [ darwin.cctools fixDarwinDylibNames ];
 
-  buildInputs = [ zlib sqlite ]
-    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  buildInputs = [ zlib sqlite ];
 
   propagatedBuildInputs = [ nspr ];
 
diff --git a/pkgs/development/libraries/odpic/default.nix b/pkgs/development/libraries/odpic/default.nix
index 6c3744493d210..7f27f7d1c1795 100644
--- a/pkgs/development/libraries/odpic/default.nix
+++ b/pkgs/development/libraries/odpic/default.nix
@@ -16,7 +16,7 @@ in stdenv.mkDerivation {
     sha256 = "1g2wdchlwdihqj0ynx58nwyrpncxanghlnykgir97p0wimg3hnxl";
   };
 
-  nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin [ fixDarwinDylibNames ];
+  nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   buildInputs = [ oracle-instantclient ]
     ++ stdenv.lib.optionals stdenv.isLinux [ libaio ];
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 1fc38dd8aaa84..c4a9a4a018087 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -160,8 +160,8 @@ in {
   };
 
   openssl_1_1 = common {
-    version = "1.1.1g";
-    sha256 = "0ikdcc038i7jk8h7asq5xcn8b1xc2rrbc88yfm4hqbz3y5s4gc6x";
+    version = "1.1.1h";
+    sha256 = "1ncmcnh5bmxkwrvm0m1q4kdcjjfpwvlyjspjhibkxc6p9dvsi72w";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 46f520e41e4ad..31a7e7e908672 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -36,6 +36,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # Tests run in fakeroot for non-root users
+  preCheck = ''
+    if [ "$(id -u)" != "0" ]; then
+      export FAKED_MODE=1
+    fi
+  '';
+
   doCheck = !stdenv.isDarwin;
 
   installFlags = [
diff --git a/pkgs/development/libraries/tiledb/default.nix b/pkgs/development/libraries/tiledb/default.nix
index 2726ed7f237b9..89318dd4e75bf 100644
--- a/pkgs/development/libraries/tiledb/default.nix
+++ b/pkgs/development/libraries/tiledb/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     cmake
     python
     doxygen
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   checkInputs = [
     gtest
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     openssl
     boost
     libpqxx
-  ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  ];
 
   # emulate the process of pulling catch down
   postPatch = ''
diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index 8302ebbd1e80f..d5819ff7ee9af 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -1,17 +1,19 @@
-{ stdenv, fetchFromGitHub, cmake, asciidoc, enableDrafts ? false }:
+{ stdenv, fetchFromGitHub, cmake, asciidoc, pkg-config, libsodium
+, enableDrafts ? false }:
 
 stdenv.mkDerivation rec {
   pname = "zeromq";
-  version = "4.3.2";
+  version = "4.3.3";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "libzmq";
     rev = "v${version}";
-    sha256 = "1q37z05i76ili31j6jlw8988iy6vxadlmd306f99phxfdpqa6bn9";
+    sha256 = "155kb0ih0xj4jvd39bq8d04bgvhy9143r3632ks1m04455z4qdzd";
   };
 
-  nativeBuildInputs = [ cmake asciidoc ];
+  nativeBuildInputs = [ cmake asciidoc pkg-config ];
+  buildInputs = [ libsodium ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/python-modules/arrow/default.nix b/pkgs/development/python-modules/arrow/default.nix
index bc3de37526a1f..7dbe3b98fca3b 100644
--- a/pkgs/development/python-modules/arrow/default.nix
+++ b/pkgs/development/python-modules/arrow/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "arrow";
-  version = "0.15.8";
+  version = "0.17.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "edc31dc051db12c95da9bac0271cd1027b8e36912daf6d4580af53b23e62721a";
+    sha256 = "ff08d10cda1d36c68657d6ad20d74fbea493d980f8b2d45344e00d6ed2bf6ed4";
   };
 
   propagatedBuildInputs = [ python-dateutil ]
diff --git a/pkgs/development/python-modules/pycairo/default.nix b/pkgs/development/python-modules/pycairo/default.nix
index d61279e38d5d2..24e0f9792d7ad 100644
--- a/pkgs/development/python-modules/pycairo/default.nix
+++ b/pkgs/development/python-modules/pycairo/default.nix
@@ -1,4 +1,13 @@
-{ lib, fetchFromGitHub, meson, ninja, buildPythonPackage, pytest, pkgconfig, cairo, xlibsWrapper, isPy3k }:
+{ lib
+, fetchFromGitHub
+, meson
+, ninja
+, buildPythonPackage
+, pytestCheckHook
+, pkg-config
+, cairo
+, isPy3k
+}:
 
 buildPythonPackage rec {
   pname = "pycairo";
@@ -16,22 +25,25 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     meson
     ninja
-    pkgconfig
+    pkg-config
   ];
 
   buildInputs = [
     cairo
-    xlibsWrapper
   ];
 
-  checkInputs = [ pytest ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  mesonFlags = [ "-Dpython=${if isPy3k then "python3" else "python"}" ];
+  mesonFlags = [
+    "-Dpython=${if isPy3k then "python3" else "python"}"
+  ];
 
   meta = with lib; {
     description = "Python 2/3 bindings for cairo";
     homepage = "https://pycairo.readthedocs.io/";
-    license = with licenses; [ lgpl2 mpl11 ];
+    license = with licenses; [ lgpl21Only mpl11 ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 559a4c191b688..010f1d9c6c2c0 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -5,6 +5,7 @@
 , ps
 , isBootstrap ? false
 , useSharedLibraries ? (!isBootstrap && !stdenv.isCygwin)
+, useOpenSSL ? !isBootstrap, openssl
 , useNcurses ? false, ncurses
 , useQt4 ? false, qt4
 , withQt5 ? false, qtbase
@@ -44,15 +45,17 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  buildInputs =
-    [ setupHook pkgconfig ]
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ setupHook pkgconfig ];
+
+  buildInputs = []
     ++ lib.optionals useSharedLibraries [ bzip2 curl expat libarchive xz zlib libuv rhash ]
+    ++ lib.optional useOpenSSL openssl
     ++ lib.optional useNcurses ncurses
     ++ lib.optional useQt4 qt4
     ++ lib.optional withQt5 qtbase;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
   propagatedBuildInputs = lib.optional stdenv.isDarwin ps;
 
   preConfigure = ''
@@ -91,13 +94,15 @@ stdenv.mkDerivation rec {
     "-DCMAKE_AR=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar"
     "-DCMAKE_RANLIB=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ranlib"
     "-DCMAKE_STRIP=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}strip"
-  ]
+
+    "-DCMAKE_USE_OPENSSL=${if useOpenSSL then "ON" else "OFF"}"
     # Avoid depending on frameworks.
-    ++ lib.optional (!useNcurses) "-DBUILD_CursesDialog=OFF";
+    "-DBUILD_CursesDialog=${if useNcurses then "ON" else "OFF"}"
+  ];
 
   # make install attempts to use the just-built cmake
   preInstall = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ''
-    sed -i 's|bin/cmake|${buildPackages.cmake}/bin/cmake|g' Makefile
+    sed -i 's|bin/cmake|${buildPackages.cmakeMinimal}/bin/cmake|g' Makefile
   '';
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch b/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
new file mode 100644
index 0000000000000..5b9020b3d5402
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/boost-Do-not-add-system-paths-on-nix.patch
@@ -0,0 +1,40 @@
+From 536108b10271f2f42d41c7d9ddb4ce2ea1851f4f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
+Date: Sat, 17 Oct 2020 19:27:08 +0200
+Subject: [PATCH] boost: Do not add system paths on nix
+
+---
+ mesonbuild/dependencies/boost.py | 17 +----------------
+ 1 file changed, 1 insertion(+), 16 deletions(-)
+
+diff --git a/mesonbuild/dependencies/boost.py b/mesonbuild/dependencies/boost.py
+index 907c0c275..ecaf11b18 100644
+--- a/mesonbuild/dependencies/boost.py
++++ b/mesonbuild/dependencies/boost.py
+@@ -643,22 +643,7 @@ class BoostDependency(ExternalDependency):
+             roots += [x for x in candidates if x.name.lower().startswith('boost') and x.is_dir()]
+         else:
+             tmp = []  # type: T.List[Path]
+-
+-            # Homebrew
+-            brew_boost = Path('/usr/local/Cellar/boost')
+-            if brew_boost.is_dir():
+-                tmp += [x for x in brew_boost.iterdir()]
+-
+-            # Add some default system paths
+-            tmp += [Path('/opt/local')]
+-            tmp += [Path('/usr/local/opt/boost')]
+-            tmp += [Path('/usr/local')]
+-            tmp += [Path('/usr')]
+-
+-            # Cleanup paths
+-            tmp = [x for x in tmp if x.is_dir()]
+-            tmp = [x.resolve() for x in tmp]
+-            roots += tmp
++            # Do not add any non-explicit paths on nix
+ 
+         return roots
+ 
+-- 
+2.25.4
+
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 8421fb7d70a01..1b9c3ef64774a 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -52,6 +52,11 @@ python3.pkgs.buildPythonApplication rec {
     # cut-in-half-by-\0 store path references.
     # Let’s just clear the whole rpath and hope for the best.
     ./clear-old-rpath.patch
+
+    # Patch out default boost search paths to avoid impure builds on
+    # unsandboxed non-NixOS builds, see:
+    # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
+    ./boost-Do-not-add-system-paths-on-nix.patch
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/misc/ycmd/default.nix b/pkgs/development/tools/misc/ycmd/default.nix
index 02298d93b8afe..4bbff3ca33f88 100644
--- a/pkgs/development/tools/misc/ycmd/default.nix
+++ b/pkgs/development/tools/misc/ycmd/default.nix
@@ -18,9 +18,10 @@ stdenv.mkDerivation {
     sha256 = "1c5axdngxaxj5vc6lr8sxb99mr5adsm1dnjckaxc23kq78pc8cn7";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ]
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [ boost llvmPackages.libclang ]
-    ++ stdenv.lib.optional stdenv.isDarwin [ fixDarwinDylibNames Cocoa ];
+    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin Cocoa;
 
   buildPhase = ''
     export EXTRA_CMAKE_ARGS=-DPATH_TO_LLVM_ROOT=${llvmPackages.clang-unwrapped}