summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/builders/fetchers.chapter.md8
-rw-r--r--doc/languages-frameworks/rust.section.md4
-rw-r--r--lib/attrsets.nix23
-rw-r--r--lib/default.nix2
-rw-r--r--lib/systems/platforms.nix2
-rw-r--r--lib/tests/misc.nix17
-rw-r--r--maintainers/maintainer-list.nix18
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2211.section.xml9
-rw-r--r--nixos/doc/manual/release-notes/rl-2211.section.md2
-rw-r--r--nixos/modules/services/matrix/mautrix-telegram.nix29
-rw-r--r--nixos/modules/services/security/vaultwarden/default.nix6
-rw-r--r--pkgs/applications/editors/nano/default.nix4
-rw-r--r--pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix24
-rw-r--r--pkgs/applications/misc/nerd-font-patcher/default.nix8
-rw-r--r--pkgs/applications/misc/waylock/default.nix52
-rw-r--r--pkgs/applications/terminal-emulators/xterm/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/i3ipc-glib.nix7
-rw-r--r--pkgs/build-support/docker/default.nix8
-rw-r--r--pkgs/build-support/fetchgit/default.nix14
-rw-r--r--pkgs/build-support/fetchgit/tests.nix16
-rw-r--r--pkgs/build-support/fetchgithub/default.nix4
-rw-r--r--pkgs/build-support/references-by-popularity/default.nix1
-rw-r--r--pkgs/data/fonts/noto-fonts/default.nix2
-rw-r--r--pkgs/data/icons/beauty-line-icon-theme/default.nix6
-rw-r--r--pkgs/data/misc/colemak-dh/default.nix2
-rw-r--r--pkgs/development/compilers/julia/1.0.nix207
-rw-r--r--pkgs/development/compilers/julia/1.5.nix147
-rw-r--r--pkgs/development/compilers/julia/1.8-bin.nix6
-rw-r--r--pkgs/development/compilers/julia/1.8.nix4
-rw-r--r--pkgs/development/compilers/julia/patches/1.0/use-system-utf8proc-julia-1.0.patch29
-rw-r--r--pkgs/development/compilers/julia/patches/1.5/use-system-utf8proc-julia-1.3.patch24
-rw-r--r--pkgs/development/compilers/llvm/11/default.nix1
-rw-r--r--pkgs/development/interpreters/guile/2.2.nix2
-rw-r--r--pkgs/development/interpreters/guile/3.0.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix13
-rw-r--r--pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh16
-rw-r--r--pkgs/development/libraries/aws-c-auth/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-io/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-sdkutils/default.nix4
-rw-r--r--pkgs/development/libraries/cyrus-sasl/default.nix7
-rw-r--r--pkgs/development/libraries/glib/default.nix20
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix8
-rw-r--r--pkgs/development/libraries/gobject-introspection/wrapper.nix131
-rw-r--r--pkgs/development/libraries/gtksourceview/4.x.nix7
-rw-r--r--pkgs/development/libraries/gtksourceview/5.x.nix7
-rw-r--r--pkgs/development/libraries/intel-media-driver/32bit.patch22
-rw-r--r--pkgs/development/libraries/intel-media-driver/default.nix14
-rw-r--r--pkgs/development/libraries/keybinder3/default.nix19
-rw-r--r--pkgs/development/libraries/libmilter/default.nix8
-rw-r--r--pkgs/development/libraries/libnftnl/default.nix4
-rw-r--r--pkgs/development/libraries/libsoup/3.x.nix4
-rw-r--r--pkgs/development/libraries/libva/default.nix9
-rw-r--r--pkgs/development/libraries/libwnck/default.nix3
-rw-r--r--pkgs/development/libraries/libxcrypt/default.nix2
-rw-r--r--pkgs/development/libraries/linenoise/default.nix2
-rw-r--r--pkgs/development/libraries/mesa/default.nix7
-rw-r--r--pkgs/development/libraries/openldap/default.nix2
-rw-r--r--pkgs/development/libraries/pipewire/default.nix27
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json20
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwayland.nix13
-rw-r--r--pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix15
-rw-r--r--pkgs/development/lisp-modules-new/lisp-packages.nix32
-rw-r--r--pkgs/development/lisp-modules-new/packages.nix8
-rw-r--r--pkgs/development/lisp-modules-new/patches/cffi-libffi-darwin-ffi-h.patch14
-rw-r--r--pkgs/development/lisp-modules-new/patches/magicl-dont-build-fortran-twice.patch21
-rw-r--r--pkgs/development/python-modules/ansible-compat/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-later/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-lint/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-runner/default.nix6
-rw-r--r--pkgs/development/python-modules/ansible/core.nix4
-rw-r--r--pkgs/development/python-modules/ansible/default.nix4
-rw-r--r--pkgs/development/python-modules/asyauth/default.nix5
-rw-r--r--pkgs/development/python-modules/babel/default.nix9
-rw-r--r--pkgs/development/python-modules/cftime/default.nix20
-rw-r--r--pkgs/development/python-modules/hatchling/default.nix5
-rw-r--r--pkgs/development/python-modules/incremental/default.nix4
-rw-r--r--pkgs/development/python-modules/invoke/default.nix4
-rw-r--r--pkgs/development/python-modules/jsonschema/default.nix4
-rw-r--r--pkgs/development/python-modules/msldap/default.nix5
-rw-r--r--pkgs/development/python-modules/mypy-boto3-builder/default.nix6
-rw-r--r--pkgs/development/python-modules/ocifs/default.nix4
-rw-r--r--pkgs/development/python-modules/orjson/default.nix12
-rw-r--r--pkgs/development/python-modules/oslo-log/default.nix4
-rw-r--r--pkgs/development/python-modules/pbr/default.nix4
-rw-r--r--pkgs/development/python-modules/pbr/tests.nix3
-rw-r--r--pkgs/development/python-modules/pymilter/default.nix40
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix11
-rw-r--r--pkgs/development/python-modules/pyotgw/default.nix7
-rw-r--r--pkgs/development/python-modules/pyside2/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-mockito/default.nix40
-rw-r--r--pkgs/development/python-modules/python-ldap/default.nix5
-rw-r--r--pkgs/development/python-modules/pytz-deprecation-shim/default.nix8
-rw-r--r--pkgs/development/python-modules/robotframework-pythonlibcore/default.nix53
-rw-r--r--pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix53
-rw-r--r--pkgs/development/python-modules/scipy/default.nix8
-rw-r--r--pkgs/development/python-modules/tzdata/default.nix4
-rw-r--r--pkgs/development/python-modules/zipp/default.nix4
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/analysis/cargo-tarpaulin/default.nix6
-rw-r--r--pkgs/development/tools/appthreat-depscan/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/dprint/default.nix6
-rw-r--r--pkgs/development/tools/hatch/default.nix10
-rw-r--r--pkgs/development/tools/misc/lsof/default.nix36
-rw-r--r--pkgs/development/tools/rust/bindgen/unwrapped.nix17
-rw-r--r--pkgs/games/itch/default.nix2
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix4
-rw-r--r--pkgs/os-specific/linux/bpftools/default.nix6
-rw-r--r--pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch13
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix4
-rw-r--r--pkgs/servers/dns/knot-dns/default.nix11
-rw-r--r--pkgs/servers/mail/pypolicyd-spf/default.nix26
-rw-r--r--pkgs/servers/mail/spf-engine/default.nix30
-rw-r--r--pkgs/servers/matrix-appservice-discord/package.json2
-rw-r--r--pkgs/servers/matrix-appservice-discord/pin.json4
-rw-r--r--pkgs/servers/monitoring/prometheus/bind-exporter.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/fastly-exporter.nix6
-rw-r--r--pkgs/servers/monitoring/unifi-poller/default.nix12
-rw-r--r--pkgs/servers/sql/postgresql/default.nix65
-rw-r--r--pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks-94.patch12
-rw-r--r--pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch12
-rw-r--r--pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path-96.patch14
-rw-r--r--pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch27
-rw-r--r--pkgs/servers/sql/postgresql/patches/less-is-more-96.patch12
-rw-r--r--pkgs/servers/sql/postgresql/patches/less-is-more.patch10
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/graphics/vulkan-caps-viewer/default.nix10
-rw-r--r--pkgs/tools/misc/arch-install-scripts/default.nix4
-rw-r--r--pkgs/tools/misc/goreleaser/default.nix6
-rw-r--r--pkgs/tools/networking/checkip/default.nix4
-rw-r--r--pkgs/tools/networking/obfs4/default.nix16
-rw-r--r--pkgs/tools/nix/nix-output-monitor/generated-package.nix14
-rw-r--r--pkgs/tools/package-management/pacman/default.nix16
-rw-r--r--pkgs/tools/security/grype/default.nix6
-rw-r--r--pkgs/tools/security/pcsclite/default.nix2
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix57
-rw-r--r--pkgs/top-level/python-packages.nix6
139 files changed, 1071 insertions, 962 deletions
diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md
index 12d8a5d887fd4..43aead0ad5e44 100644
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@@ -100,10 +100,10 @@ stdenv.mkDerivation {
   name = "hello";
   src = fetchgit {
     url = "https://...";
-    sparseCheckout = ''
-      directory/to/be/included
-      another/directory
-    '';
+    sparseCheckout = [
+      "directory/to/be/included"
+      "another/directory"
+    ];
     sha256 = "0000000000000000000000000000000000000000000000000000";
   };
 }
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 849c836b03fc0..48890cf53efa8 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -15,7 +15,7 @@ For other versions such as daily builds (beta and nightly),
 use either `rustup` from nixpkgs (which will manage the rust installation in your home directory),
 or use a community maintained [Rust overlay](#using-community-rust-overlays).
 
-## Compiling Rust applications with Cargo {#compiling-rust-applications-with-cargo}
+## `buildRustPackage`: Compiling Rust applications with Cargo {#compiling-rust-applications-with-cargo}
 
 Rust applications are packaged by using the `buildRustPackage` helper from `rustPlatform`:
 
@@ -608,7 +608,7 @@ buildPythonPackage rec {
 }
 ```
 
-## Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
+## `buildRustCrate`: Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
 
 ### Simple operation {#simple-operation}
 
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index de88763854d69..8b5c0ef4cea62 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -3,7 +3,7 @@
 
 let
   inherit (builtins) head tail length;
-  inherit (lib.trivial) id;
+  inherit (lib.trivial) flip id mergeAttrs pipe;
   inherit (lib.strings) concatStringsSep concatMapStringsSep escapeNixIdentifier sanitizeDerivationName;
   inherit (lib.lists) foldr foldl' concatMap concatLists elemAt all partition groupBy take foldl;
 in
@@ -77,6 +77,25 @@ rec {
     let errorMsg = "cannot find attribute `" + concatStringsSep "." attrPath + "'";
     in attrByPath attrPath (abort errorMsg);
 
+  /* Map each attribute in the given set and merge them into a new attribute set.
+
+     Type:
+       concatMapAttrs ::
+         (String -> a -> AttrSet)
+         -> AttrSet
+         -> AttrSet
+
+     Example:
+       concatMapAttrs
+         (name: value: {
+           ${name} = value;
+           ${name + value} = value;
+         })
+         { x = "a"; y = "b"; }
+       => { x = "a"; xa = "a"; y = "b"; yb = "b"; }
+  */
+  concatMapAttrs = f: flip pipe [ (mapAttrs f) attrValues (foldl' mergeAttrs { }) ];
+
 
   /* Update or set specific paths of an attribute set.
 
@@ -606,7 +625,7 @@ rec {
   getMan = getOutput "man";
 
   /* Pick the outputs of packages to place in buildInputs */
-  chooseDevOutputs = drvs: builtins.map getDev drvs;
+  chooseDevOutputs = builtins.map getDev;
 
   /* Make various Nix tools consider the contents of the resulting
      attribute set when looking for what to build, find, etc.
diff --git a/lib/default.nix b/lib/default.nix
index 8bb06954518b9..cc4bedc5869b6 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -78,7 +78,7 @@ let
     inherit (self.attrsets) attrByPath hasAttrByPath setAttrByPath
       getAttrFromPath attrVals attrValues getAttrs catAttrs filterAttrs
       filterAttrsRecursive foldAttrs collect nameValuePair mapAttrs
-      mapAttrs' mapAttrsToList mapAttrsRecursive mapAttrsRecursiveCond
+      mapAttrs' mapAttrsToList concatMapAttrs mapAttrsRecursive mapAttrsRecursiveCond
       genAttrs isDerivation toDerivation optionalAttrs
       zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
       recursiveUpdate matchAttrs overrideExisting showAttrPath getOutput getBin
diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
index 41c25484cea03..d574943e47df3 100644
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@@ -557,7 +557,7 @@ rec {
 
     else if platform.isRiscV then riscv-multiplatform
 
-    else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then fuloong2f_n32
+    else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then (import ./examples.nix { inherit lib; }).mipsel-linux-gnu
 
     else if platform.parsed.cpu == lib.systems.parse.cpuTypes.powerpc64le then powernv
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 31c938a8ffda1..b73da4f1010d4 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -478,6 +478,23 @@ runTests {
 
 # ATTRSETS
 
+  testConcatMapAttrs = {
+    expr = concatMapAttrs
+      (name: value: {
+        ${name} = value;
+        ${name + value} = value;
+      })
+      {
+        foo = "bar";
+        foobar = "baz";
+      };
+    expected = {
+      foo = "bar";
+      foobar = "baz";
+      foobarbaz = "baz";
+    };
+  };
+
   # code from the example
   testRecursiveUpdateUntil = {
     expr = recursiveUpdateUntil (path: l: r: path == ["foo"]) {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index bfd89bd6fa51c..0941b2516cd36 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4829,6 +4829,12 @@
     githubId = 868283;
     name = "Fatih Altinok";
   };
+  fstamour = {
+    email = "fr.st-amour@gmail.com";
+    github = "fstamour";
+    githubId = 2881922;
+    name = "Francis St-Amour";
+  };
   ftrvxmtrx = {
     email = "ftrvxmtrx@gmail.com";
     github = "ftrvxmtrx";
@@ -9435,12 +9441,6 @@
     githubId = 2072185;
     name = "Marc Scholten";
   };
-  mpsyco = {
-    email = "fr.st-amour@gmail.com";
-    github = "fstamour";
-    githubId = 2881922;
-    name = "Francis St-Amour";
-  };
   mtrsk = {
     email = "marcos.schonfinkel@protonmail.com";
     github = "mtrsk";
@@ -15909,4 +15909,10 @@
     github = "wuyoli";
     githubId = 104238274;
   };
+  jordanisaacs = {
+    name = "Jordan Isaacs";
+    email = "nix@jdisaacs.com";
+    github = "jordanisaacs";
+    githubId = 19742638;
+  };
 }
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 8e97e58f81a61..e681e33d71c04 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -582,6 +582,15 @@
       </listitem>
       <listitem>
         <para>
+          The <literal>fetchgit</literal> fetcher supports sparse
+          checkouts via the <literal>sparseCheckout</literal> option.
+          This used to accept a multi-line string with
+          directories/patterns to check out, but now requires a list of
+          strings.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           <literal>openssh</literal> was updated to version 9.1,
           disabling the generation of DSA keys when using
           <literal>ssh-keygen -A</literal> as they are insecure. Also,
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index ecfba7215c8b2..f08d17a7dfc0a 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -191,6 +191,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - The `fetchgit` fetcher now uses [cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalscone_mode_handling) by default for sparse checkouts. [Non-cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalsnon_cone_problems) can be enabled by passing `nonConeMode = true`, but note that non-cone mode is deprecated and this option may be removed alongside a future Git update without notice.
 
+- The `fetchgit` fetcher supports sparse checkouts via the `sparseCheckout` option. This used to accept a multi-line string with directories/patterns to check out, but now requires a list of strings.
+
 - `openssh` was updated to version 9.1, disabling the generation of DSA keys when using `ssh-keygen -A` as they are insecure. Also, `SetEnv` directives in `ssh_config` and `sshd_config` are now first-match-wins
 
 - `bsp-layout` no longer uses the command `cycle` to switch to other window layouts, as it got replaced by the commands `previous` and `next`.
diff --git a/nixos/modules/services/matrix/mautrix-telegram.nix b/nixos/modules/services/matrix/mautrix-telegram.nix
index fc8b95051ddbe..2d9c2dc76c29b 100644
--- a/nixos/modules/services/matrix/mautrix-telegram.nix
+++ b/nixos/modules/services/matrix/mautrix-telegram.nix
@@ -7,8 +7,8 @@ let
   registrationFile = "${dataDir}/telegram-registration.yaml";
   cfg = config.services.mautrix-telegram;
   settingsFormat = pkgs.formats.json {};
-  settingsFileUnsubstituted = settingsFormat.generate "mautrix-telegram-config-unsubstituted.json" cfg.settings;
-  settingsFile = "${dataDir}/config.json";
+  settingsFile =
+    settingsFormat.generate "mautrix-telegram-config.json" cfg.settings;
 
 in {
   options = {
@@ -97,12 +97,23 @@ in {
         default = null;
         description = lib.mdDoc ''
           File containing environment variables to be passed to the mautrix-telegram service,
-          in which secret tokens can be specified securely by defining values for
+          in which secret tokens can be specified securely by defining values for e.g.
           `MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN`,
           `MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN`,
           `MAUTRIX_TELEGRAM_TELEGRAM_API_ID`,
           `MAUTRIX_TELEGRAM_TELEGRAM_API_HASH` and optionally
           `MAUTRIX_TELEGRAM_TELEGRAM_BOT_TOKEN`.
+
+          These environment variables can also be used to set other options by
+          replacing hierachy levels by `.`, converting the name to uppercase
+          and prepending `MAUTRIX_TELEGRAM_`.
+          For example, the first value above maps to
+          {option}`settings.appservice.as_token`.
+
+          The environment variable values can be prefixed with `json::` to have
+          them be parsed as JSON. For example, `login_shared_secret_map` can be
+          set as follows:
+          `MAUTRIX_TELEGRAM_BRIDGE_LOGIN_SHARED_SECRET_MAP=json::{"example.com":"secret"}`.
         '';
       };
 
@@ -141,16 +152,6 @@ in {
       environment.HOME = dataDir;
 
       preStart = ''
-        # Not all secrets can be passed as environment variable (yet)
-        # https://github.com/tulir/mautrix-telegram/issues/584
-        [ -f ${settingsFile} ] && rm -f ${settingsFile}
-        old_umask=$(umask)
-        umask 0177
-        ${pkgs.envsubst}/bin/envsubst \
-          -o ${settingsFile} \
-          -i ${settingsFileUnsubstituted}
-        umask $old_umask
-
         # generate the appservice's registration file if absent
         if [ ! -f '${registrationFile}' ]; then
           ${pkgs.mautrix-telegram}/bin/mautrix-telegram \
@@ -186,8 +187,6 @@ in {
             --config='${settingsFile}'
         '';
       };
-
-      restartTriggers = [ settingsFileUnsubstituted ];
     };
   };
 
diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index 81423e57fd2c3..3ef0bfb090ac4 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -22,9 +22,9 @@ let
   # we can only check for values consistently after converting them to their corresponding environment variable name.
   configEnv =
     let
-      configEnv = listToAttrs (concatLists (mapAttrsToList (name: value:
-        if value != null then [ (nameValuePair (nameToEnvVar name) (if isBool value then boolToString value else toString value)) ] else []
-      ) cfg.config));
+      configEnv = concatMapAttrs (name: value: optionalAttrs (value != null) {
+        ${nameToEnvVar name} = if isBool value then boolToString value else toString value;
+      }) cfg.config;
     in { DATA_FOLDER = "/var/lib/bitwarden_rs"; } // optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {
       WEB_VAULT_FOLDER = "${cfg.webVaultPackage}/share/vaultwarden/vault";
     } // configEnv;
diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index 5d4d84e6fe9b9..d7b1f54d39121 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -16,11 +16,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "6.4";
+  version = "7.0";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "QZmujKeKd5beVt4aQbgh3EeRLAMH6YFrVswxffNGYcA=";
+    sha256 = "jdbqw4srh4bYJoHw4a/YT2t1IQ0XORtkQ8Q35FFVIUk=";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
index 0272c73b17303..f4e0c99115f31 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
@@ -14,18 +14,18 @@ let
   #   ocaml-interface
   #   tree-sitter-ocaml-interface
   #   tree-sitter-ocaml_interface
-  builtGrammars = generatedGrammars // lib.listToAttrs
-    (lib.concatLists (lib.mapAttrsToList
-      (k: v:
-        let
-          replaced = lib.replaceStrings [ "_" ] [ "-" ] k;
-        in
-        map (lib.flip lib.nameValuePair v)
-          ([ "tree-sitter-${k}" ] ++ lib.optionals (k != replaced) [
-            replaced
-            "tree-sitter-${replaced}"
-          ]))
-      generatedDerivations));
+  builtGrammars = generatedGrammars // lib.concatMapAttrs
+    (k: v:
+      let
+        replaced = lib.replaceStrings [ "_" ] [ "-" ] k;
+      in
+      {
+        "tree-sitter-${k}" = v;
+      } // lib.optionalAttrs (k != replaced) {
+        ${replaced} = v;
+        "tree-sitter-${replaced}" = v;
+      })
+    generatedDerivations;
 
   allGrammars = lib.attrValues generatedDerivations;
 
diff --git a/pkgs/applications/misc/nerd-font-patcher/default.nix b/pkgs/applications/misc/nerd-font-patcher/default.nix
index e865479f8da02..21c77316c1ab9 100644
--- a/pkgs/applications/misc/nerd-font-patcher/default.nix
+++ b/pkgs/applications/misc/nerd-font-patcher/default.nix
@@ -9,10 +9,10 @@ python3Packages.buildPythonApplication rec {
     owner = "ryanoasis";
     repo = "nerd-fonts";
     rev = "v${version}";
-    sparseCheckout = ''
-      font-patcher
-      /src/glyphs
-    '';
+    sparseCheckout = [
+      "font-patcher"
+      "/src/glyphs"
+    ];
     sha256 = "sha256-boZUd1PM8puc9BTgOwCJpkfk6VMdXLsIyp+fQmW/ZqI=";
   };
 
diff --git a/pkgs/applications/misc/waylock/default.nix b/pkgs/applications/misc/waylock/default.nix
new file mode 100644
index 0000000000000..2a29eab29730d
--- /dev/null
+++ b/pkgs/applications/misc/waylock/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  zig,
+  wayland,
+  pkg-config,
+  scdoc,
+  wayland-protocols,
+  libxkbcommon,
+  pam,
+}:
+stdenv.mkDerivation rec {
+  pname = "waylock";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "ifreund";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-yWjWcnGa4a+Dpc82H65yr8H7v88g/tDq0FSguubhbEI=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [zig wayland scdoc pkg-config];
+
+  buildInputs = [
+    wayland-protocols
+    libxkbcommon
+    pam
+  ];
+
+  dontConfigure = true;
+
+  preBuild = ''
+    export HOME=$TMPDIR
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    zig build -Drelease-safe -Dman-pages --prefix $out install
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/ifreund/waylock";
+    description = "A small screenlocker for Wayland compositors";
+    license = licenses.isc;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [jordanisaacs];
+  };
+}
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index c277e241ca303..ff0856734628b 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "374";
+  version = "375";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    sha256 = "sha256-EdTWJmcNTW17aft0Z+nsIxgX5a0iUC+RZ3aP2IrBvfU=";
+    sha256 = "sha256-MCxZor+B55xqcBUl13gWGiGNEjnyFWjYnivdMcAVIX8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/window-managers/i3/i3ipc-glib.nix b/pkgs/applications/window-managers/i3/i3ipc-glib.nix
index 572b12d986c10..a6a77600ee5f1 100644
--- a/pkgs/applications/window-managers/i3/i3ipc-glib.nix
+++ b/pkgs/applications/window-managers/i3/i3ipc-glib.nix
@@ -4,7 +4,6 @@
 }:
 
 stdenv.mkDerivation rec {
-
   pname = "i3ipc-glib";
   version = "1.0.1";
 
@@ -15,10 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "01fzvrbnzcwx0vxw29igfpza9zwzp2s7msmzb92v01z0rz0y5m0p";
   };
 
-  nativeBuildInputs = [ autoreconfHook which pkg-config ];
-
-  buildInputs = [ libxcb json-glib gtk-doc xorgproto gobject-introspection ];
+  strictDeps = true;
+  nativeBuildInputs = [ autoreconfHook which pkg-config gtk-doc gobject-introspection ];
 
+  buildInputs = [ libxcb json-glib xorgproto ];
 
   preAutoreconf = ''
     gtkdocize
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index a3145e504f23e..6b07865928e62 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -547,10 +547,14 @@ rec {
           pure = writeText "${baseName}-config.json" (builtins.toJSON {
             inherit created config;
             architecture = defaultArch;
+            preferLocalBuild = true;
             os = "linux";
           });
           impure = runCommand "${baseName}-config.json"
-            { nativeBuildInputs = [ jq ]; }
+            {
+              nativeBuildInputs = [ jq ];
+              preferLocalBuild = true;
+            }
             ''
               jq ".created = \"$(TZ=utc date --iso-8601="seconds")\"" ${pure} > $out
             '';
@@ -925,6 +929,7 @@ rec {
           {
             inherit fromImage maxLayers created;
             imageName = lib.toLower name;
+            preferLocalBuild = true;
             passthru.imageTag =
               if tag != null
               then tag
@@ -1015,6 +1020,7 @@ rec {
         result = runCommand "stream-${baseName}"
           {
             inherit (conf) imageName;
+            preferLocalBuild = true;
             passthru = passthru // {
               inherit (conf) imageTag;
 
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index f516c3d5a03b7..1fec0c8874748 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -15,7 +15,7 @@ in
 { url, rev ? "HEAD", md5 ? "", sha256 ? "", hash ? "", leaveDotGit ? deepClone
 , fetchSubmodules ? true, deepClone ? false
 , branchName ? null
-, sparseCheckout ? ""
+, sparseCheckout ? []
 , nonConeMode ? false
 , name ? urlToName url rev
 , # Shell code executed after the file has been fetched
@@ -55,13 +55,16 @@ in
 */
 
 assert deepClone -> leaveDotGit;
-assert nonConeMode -> (sparseCheckout != "");
+assert nonConeMode -> !(sparseCheckout == "" || sparseCheckout == []);
 
 if md5 != "" then
   throw "fetchgit does not support md5 anymore, please use sha256"
 else if hash != "" && sha256 != "" then
   throw "Only one of sha256 or hash can be set"
 else
+# Added 2022-11-12
+lib.warnIf (builtins.isString sparseCheckout)
+  "Please provide directories/patterns for sparse checkout as a list of strings. Support for passing a (multi-line) string is deprecated and will be removed in the next release."
 stdenvNoCC.mkDerivation {
   inherit name;
   builder = ./builder.sh;
@@ -79,7 +82,12 @@ stdenvNoCC.mkDerivation {
   else
     lib.fakeSha256;
 
-  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName sparseCheckout nonConeMode postFetch;
+  # git-sparse-checkout(1) says:
+  # > When the --stdin option is provided, the directories or patterns are read
+  # > from standard in as a newline-delimited list instead of from the arguments.
+  sparseCheckout = if builtins.isString sparseCheckout then sparseCheckout else builtins.concatStringsSep "\n" sparseCheckout;
+
+  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName nonConeMode postFetch;
 
   postHook = if netrcPhase == null then null else ''
     ${netrcPhase}
diff --git a/pkgs/build-support/fetchgit/tests.nix b/pkgs/build-support/fetchgit/tests.nix
index 62fe3f77bbdd7..a18be65327b5d 100644
--- a/pkgs/build-support/fetchgit/tests.nix
+++ b/pkgs/build-support/fetchgit/tests.nix
@@ -12,10 +12,10 @@
     name = "nix-source";
     url = "https://github.com/NixOS/nix";
     rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
-    sparseCheckout = ''
-      src
-      tests
-    '';
+    sparseCheckout = [
+      "src"
+      "tests"
+    ];
     sha256 = "sha256-g1PHGTWgAcd/+sXHo1o6AjVWCvC6HiocOfMbMh873LQ=";
   };
 
@@ -23,10 +23,10 @@
     name = "nix-source";
     url = "https://github.com/NixOS/nix";
     rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
-    sparseCheckout = ''
-      src
-      tests
-    '';
+    sparseCheckout = [
+      "src"
+      "tests"
+    ];
     nonConeMode = true;
     sha256 = "sha256-FknO6C/PSnMPfhUqObD4vsW4PhkwdmPa9blNzcNvJQ4=";
   };
diff --git a/pkgs/build-support/fetchgithub/default.nix b/pkgs/build-support/fetchgithub/default.nix
index cfb6a6ca7cd80..fcde7447cbd36 100644
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@@ -3,7 +3,7 @@
 { owner, repo, rev, name ? "source"
 , fetchSubmodules ? false, leaveDotGit ? null
 , deepClone ? false, private ? false, forceFetchGit ? false
-, sparseCheckout ? ""
+, sparseCheckout ? []
 , githubBase ? "github.com", varPrefix ? null
 , meta ? { }
 , ... # For hash agility
@@ -24,7 +24,7 @@ let
   };
   passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "forceFetchGit" "private" "githubBase" "varPrefix" ];
   varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
-  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || (sparseCheckout != "");
+  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || !(sparseCheckout == "" || sparseCheckout == []);
   # We prefer fetchzip in cases we don't need submodules as the hash
   # is more stable in that case.
   fetcher = if useFetchGit then fetchgit else fetchzip;
diff --git a/pkgs/build-support/references-by-popularity/default.nix b/pkgs/build-support/references-by-popularity/default.nix
index 4cae2dcf3ca96..dfc25275f34c5 100644
--- a/pkgs/build-support/references-by-popularity/default.nix
+++ b/pkgs/build-support/references-by-popularity/default.nix
@@ -5,6 +5,7 @@ path: runCommand "closure-paths"
 {
   exportReferencesGraph.graph = path;
   __structuredAttrs = true;
+  preferLocalBuild = true;
   PATH = "${coreutils}/bin:${python3}/bin";
   builder = builtins.toFile "builder"
     ''
diff --git a/pkgs/data/fonts/noto-fonts/default.nix b/pkgs/data/fonts/noto-fonts/default.nix
index 019ed1f371c01..da3b0f81d4319 100644
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@@ -71,7 +71,7 @@ let
         owner = "googlefonts";
         repo = "noto-cjk";
         inherit rev sha256;
-        sparseCheckout = "${typeface}/Variable/OTC";
+        sparseCheckout = [ "${typeface}/Variable/OTC" ];
       };
 
       installPhase = ''
diff --git a/pkgs/data/icons/beauty-line-icon-theme/default.nix b/pkgs/data/icons/beauty-line-icon-theme/default.nix
index 66e5ac57dd175..dc332b0fc3281 100644
--- a/pkgs/data/icons/beauty-line-icon-theme/default.nix
+++ b/pkgs/data/icons/beauty-line-icon-theme/default.nix
@@ -18,9 +18,9 @@ stdenvNoCC.mkDerivation rec {
     owner = "gvolpe";
     repo = pname;
     rev = version;
-    sparseCheckout = ''
-      BeautyLine-V3
-    '';
+    sparseCheckout = [
+      "BeautyLine-V3"
+    ];
     sha256 = "sha256-IkkypAj250+OXbf19TampCnqYsSbJVIjeYlxJoyhpzk=";
   };
 
diff --git a/pkgs/data/misc/colemak-dh/default.nix b/pkgs/data/misc/colemak-dh/default.nix
index f36832ff42d88..261a7741f16fd 100644
--- a/pkgs/data/misc/colemak-dh/default.nix
+++ b/pkgs/data/misc/colemak-dh/default.nix
@@ -12,7 +12,7 @@ stdenvNoCC.mkDerivation rec {
     repo  = "mod-dh";
     rev = "e846a5bd24d59ed15ba70b3a9d5363a38ca51d09";
     sha256  = "sha256-RFOpN+tIMfakb7AZN0ock9eq2mytvL0DWedvQV67+ks=";
-    sparseCheckout = "console";
+    sparseCheckout = [ "console" ];
   };
 
   phases = [ "unpackPhase" "installPhase" ];
diff --git a/pkgs/development/compilers/julia/1.0.nix b/pkgs/development/compilers/julia/1.0.nix
deleted file mode 100644
index 28500815639a7..0000000000000
--- a/pkgs/development/compilers/julia/1.0.nix
+++ /dev/null
@@ -1,207 +0,0 @@
-{ lib, stdenv, fetchpatch, fetchurl, fetchzip
-# build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python3
-, cmake
-# libjulia dependencies
-, libunwind, readline, utf8proc, zlib
-# standard library dependencies
-, curl, fftwSinglePrec, fftw, gmp, libgit2, mpfr, openlibm, openspecfun, pcre2
-# linear algebra
-, blas, lapack, arpack
-# Darwin frameworks
-, CoreServices, ApplicationServices
-}:
-
-
-let
-  majorVersion = "1";
-  minorVersion = "0";
-  maintenanceVersion = "4";
-  src_sha256 = "1dfx68wbrrzpbh74rla7i2g3r5z6wa1pxq3ahyfm5m27vfyjbkhg";
-
-  libuvVersion = "ed3700c849289ed01fe04273a7bf865340b2bd7e";
-  libuvSha256 = "137w666zsjw1p0ma3lf94d75hr1q45sgkfmbizkyji2qm57cnxjs";
-
-  dsfmtVersion = "2.2.3";
-  dsfmt = fetchurl {
-    url = "http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/SFMT/dSFMT-src-${dsfmtVersion}.tar.gz";
-    sha256 = "03kaqbjbi6viz0n33dk5jlf6ayxqlsq4804n7kwkndiga9s4hd42";
-  };
-
-  libuv = fetchurl {
-    url = "https://api.github.com/repos/JuliaLang/libuv/tarball/${libuvVersion}";
-    sha256 = libuvSha256;
-  };
-
-  rmathVersion = "0.1";
-  rmath-julia = fetchurl {
-    url = "https://api.github.com/repos/JuliaLang/Rmath-julia/tarball/v${rmathVersion}";
-    sha256 = "1qyps217175qhid46l8f5i1v8i82slgp23ia63x2hzxwfmx8617p";
-  };
-
-  virtualenvVersion = "15.0.0";
-  virtualenv = fetchurl {
-    url = "mirror://pypi/v/virtualenv/virtualenv-${virtualenvVersion}.tar.gz";
-    sha256 = "06fw4liazpx5vf3am45q2pdiwrv0id7ckv7n6zmpml29x6vkzmkh";
-  };
-
-  libwhichVersion = "81e9723c0273d78493dc8c8ed570f68d9ce7e89e";
-  libwhich = fetchurl {
-    url = "https://api.github.com/repos/vtjnash/libwhich/tarball/${libwhichVersion}";
-    sha256 = "1p7zg31kpmpbmh1znrk1xrbd074agx13b9q4dcw8n2zrwwdlbz3b";
-  };
-
-  llvmVersion = "6.0.0";
-  llvm = fetchurl {
-    url = "http://releases.llvm.org/6.0.0/llvm-${llvmVersion}.src.tar.xz";
-    sha256 = "0224xvfg6h40y5lrbnb9qaq3grmdc5rg00xq03s1wxjfbf8krx8z";
-  };
-
-  suitesparseVersion = "4.4.5";
-  suitesparse = fetchurl {
-    url = "http://faculty.cse.tamu.edu/davis/SuiteSparse/SuiteSparse-${suitesparseVersion}.tar.gz";
-    sha256 = "1jcbxb8jx5wlcixzf6n5dca2rcfx6mlcms1k2rl5gp67ay3bix43";
-  };
-  version = "${majorVersion}.${minorVersion}.${maintenanceVersion}";
-in
-
-stdenv.mkDerivation rec {
-  pname = "julia";
-  inherit version;
-
-  src = fetchzip {
-    url = "https://github.com/JuliaLang/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = src_sha256;
-  };
-
-  nativeBuildInputs = [ cmake curl gfortran m4 makeWrapper patchelf perl python3 which ];
-  # cmake is only used to build the bundled deps
-  dontUseCmakeConfigure = true;
-
-  # We assert that compatible blas and lapack are used.
-  buildInputs = assert (blas.isILP64 == lapack.isILP64); [
-    arpack fftw fftwSinglePrec gmp libgit2 libunwind mpfr
-    pcre2.dev blas lapack openlibm openspecfun readline utf8proc
-    zlib
-  ]
-  ++ lib.optionals stdenv.isDarwin [CoreServices ApplicationServices]
-  ;
-
-  patches = [
-    ./patches/1.0/use-system-utf8proc-julia-1.0.patch
-  ];
-
-  postPatch = ''
-    patchShebangs . contrib
-    for i in backtrace cmdlineargs; do
-      mv test/$i.jl{,.off}
-      touch test/$i.jl
-    done
-    rm stdlib/Sockets/test/runtests.jl && touch stdlib/Sockets/test/runtests.jl
-    rm stdlib/Distributed/test/runtests.jl && touch stdlib/Distributed/test/runtests.jl
-    sed -e 's/Invalid Content-Type:/invalid Content-Type:/g' -i ./stdlib/LibGit2/test/libgit2.jl
-    sed -e 's/Failed to resolve /failed to resolve /g' -i ./stdlib/LibGit2/test/libgit2.jl
-  '';
-  prePatch = ''
-    mkdir deps/srccache
-    cp "${dsfmt}" "./deps/srccache/dsfmt-${dsfmtVersion}.tar.gz"
-    cp "${rmath-julia}" "./deps/srccache/Rmath-julia-${rmathVersion}.tar.gz"
-    cp "${libuv}" "./deps/srccache/libuv-${libuvVersion}.tar.gz"
-    cp "${virtualenv}" "./deps/srccache/virtualenv-${virtualenvVersion}.tar.gz"
-    cp "${libwhich}" "./deps/srccache/libwhich-${libwhichVersion}.tar.gz"
-    cp "${llvm}" "./deps/srccache/llvm-${llvmVersion}.src.tar.xz"
-    cp "${suitesparse}" "./deps/srccache/SuiteSparse-${suitesparseVersion}.tar.gz"
-  '';
-
-  makeFlags =
-    let
-      arch = lib.head (lib.splitString "-" stdenv.system);
-      march = {
-        x86_64 = stdenv.hostPlatform.gcc.arch or "x86-64";
-        i686 = "pentium4";
-        aarch64 = "armv8-a";
-      }.${arch}
-              or (throw "unsupported architecture: ${arch}");
-      # Julia requires Pentium 4 (SSE2) or better
-      cpuTarget = { x86_64 = "x86-64"; i686 = "pentium4"; aarch64 = "generic"; }.${arch}
-                  or (throw "unsupported architecture: ${arch}");
-    in [
-      "ARCH=${arch}"
-      "MARCH=${march}"
-      "JULIA_CPU_TARGET=${cpuTarget}"
-      "PREFIX=$(out)"
-      "prefix=$(out)"
-      "SHELL=${stdenv.shell}"
-
-      (lib.optionalString (!stdenv.isDarwin) "USE_SYSTEM_BLAS=1")
-      "USE_BLAS64=${if blas.isILP64 then "1" else "0"}"
-
-      "USE_SYSTEM_LAPACK=1"
-
-      "USE_SYSTEM_ARPACK=1"
-      "USE_SYSTEM_FFTW=1"
-      "USE_SYSTEM_GMP=1"
-      "USE_SYSTEM_LIBGIT2=1"
-      "USE_SYSTEM_LIBUNWIND=1"
-
-      # We will probably never do that
-      #"USE_SYSTEM_LLVM=1"
-      "LLVM_VER=6.0.0"
-
-      "USE_SYSTEM_MPFR=1"
-      "USE_SYSTEM_OPENLIBM=1"
-      "USE_SYSTEM_OPENSPECFUN=1"
-      "USE_SYSTEM_PATCHELF=1"
-      "USE_SYSTEM_PCRE=1"
-      "PCRE_CONFIG=${pcre2.dev}/bin/pcre2-config"
-      "PCRE_INCL_PATH=${pcre2.dev}/include/pcre2.h"
-      "USE_SYSTEM_READLINE=1"
-      "USE_SYSTEM_UTF8PROC=1"
-      "USE_SYSTEM_ZLIB=1"
-    ];
-
-  LD_LIBRARY_PATH = assert (blas.isILP64 == lapack.isILP64); (lib.makeLibraryPath [
-    arpack fftw fftwSinglePrec gmp libgit2 mpfr blas lapack openlibm
-    openspecfun pcre2
-  ]);
-
-  doCheck = !stdenv.isDarwin;
-  checkTarget = "testall";
-  # Julia's tests require read/write access to $HOME
-  preCheck = ''
-    export HOME="$NIX_BUILD_TOP"
-  '';
-
-  preBuild = ''
-    sed -e '/^install:/s@[^ ]*/doc/[^ ]*@@' -i Makefile
-    sed -e '/[$](DESTDIR)[$](docdir)/d' -i Makefile
-    export LD_LIBRARY_PATH=${LD_LIBRARY_PATH}
-  '';
-
-  enableParallelBuilding = true;
-
-  postInstall = ''
-    # Symlink shared libraries from LD_LIBRARY_PATH into lib/julia,
-    # as using a wrapper with LD_LIBRARY_PATH causes segmentation
-    # faults when program returns an error:
-    #   $ julia -e 'throw(Error())'
-    find $(echo $LD_LIBRARY_PATH | sed 's|:| |g') -maxdepth 1 -name '*.${if stdenv.isDarwin then "dylib" else "so"}*' | while read lib; do
-      if [[ ! -e $out/lib/julia/$(basename $lib) ]]; then
-        ln -sv $lib $out/lib/julia/$(basename $lib)
-      fi
-    done
-  '';
-
-  passthru = {
-    inherit majorVersion minorVersion maintenanceVersion;
-    site = "share/julia/site/v${majorVersion}.${minorVersion}";
-  };
-
-  meta = {
-    description = "High-level performance-oriented dynamical language for technical computing";
-    homepage = "https://julialang.org/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ raskin rob garrison ];
-    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
-  };
-}
diff --git a/pkgs/development/compilers/julia/1.5.nix b/pkgs/development/compilers/julia/1.5.nix
deleted file mode 100644
index 3421af681a250..0000000000000
--- a/pkgs/development/compilers/julia/1.5.nix
+++ /dev/null
@@ -1,147 +0,0 @@
-{ lib, stdenv, fetchzip
-# build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python3, cmake
-# libjulia dependencies
-, libunwind, readline, utf8proc, zlib
-# standard library dependencies
-, curl, fftwSinglePrec, fftw, libgit2, mpfr, openlibm, openspecfun, pcre2
-# linear algebra
-, blas, lapack, arpack
-# Darwin frameworks
-, CoreServices, ApplicationServices
-}:
-
-assert (!blas.isILP64) && (!lapack.isILP64);
-
-with lib;
-
-let
-  majorVersion = "1";
-  minorVersion = "5";
-  maintenanceVersion = "4";
-  src_sha256 = "1ba1v7hakgj95xvhyff0zcp0574qv6vailjl48wl1f8w5k54lsw2";
-  version = "${majorVersion}.${minorVersion}.${maintenanceVersion}";
-in
-
-stdenv.mkDerivation rec {
-  pname = "julia";
-  inherit version;
-
-  src = fetchzip {
-    url = "https://github.com/JuliaLang/julia/releases/download/v${version}/julia-${version}-full.tar.gz";
-    sha256 = src_sha256;
-  };
-
-  patches = [
-    ./patches/1.5/use-system-utf8proc-julia-1.3.patch
-  ];
-
-  postPatch = ''
-    patchShebangs . contrib
-  '';
-
-  dontUseCmakeConfigure = true;
-
-  buildInputs = [
-    arpack fftw fftwSinglePrec libgit2 libunwind mpfr
-    pcre2.dev blas lapack openlibm openspecfun readline utf8proc
-    zlib
-  ] ++ lib.optionals stdenv.isDarwin [CoreServices ApplicationServices];
-
-  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python3 which cmake ];
-
-  makeFlags =
-    let
-      arch = head (splitString "-" stdenv.system);
-      march = {
-        x86_64 = stdenv.hostPlatform.gcc.arch or "x86-64";
-        i686 = "pentium4";
-        aarch64 = "armv8-a";
-      }.${arch}
-              or (throw "unsupported architecture: ${arch}");
-      # Julia requires Pentium 4 (SSE2) or better
-      cpuTarget = { x86_64 = "x86-64"; i686 = "pentium4"; aarch64 = "generic"; }.${arch}
-                  or (throw "unsupported architecture: ${arch}");
-    # Julia applies a lot of patches to its dependencies, so for now do not use the system LLVM
-    # https://github.com/JuliaLang/julia/tree/master/deps/patches
-    in [
-      "ARCH=${arch}"
-      "MARCH=${march}"
-      "JULIA_CPU_TARGET=${cpuTarget}"
-      "PREFIX=$(out)"
-      "prefix=$(out)"
-      "SHELL=${stdenv.shell}"
-
-      (lib.optionalString (!stdenv.isDarwin) "USE_SYSTEM_BLAS=1")
-      "USE_BLAS64=${if blas.isILP64 then "1" else "0"}"
-
-      "USE_SYSTEM_LAPACK=1"
-
-      "USE_SYSTEM_ARPACK=1"
-      "USE_SYSTEM_FFTW=1"
-      "USE_SYSTEM_GMP=0"
-      "USE_SYSTEM_LIBGIT2=1"
-      "USE_SYSTEM_LIBUNWIND=1"
-
-      "USE_SYSTEM_MPFR=1"
-      "USE_SYSTEM_OPENLIBM=1"
-      "USE_SYSTEM_OPENSPECFUN=1"
-      "USE_SYSTEM_PATCHELF=1"
-      "USE_SYSTEM_PCRE=1"
-      "PCRE_CONFIG=${pcre2.dev}/bin/pcre2-config"
-      "PCRE_INCL_PATH=${pcre2.dev}/include/pcre2.h"
-      "USE_SYSTEM_READLINE=1"
-      "USE_SYSTEM_UTF8PROC=1"
-      "USE_SYSTEM_ZLIB=1"
-
-      "USE_BINARYBUILDER=0"
-    ];
-
-  LD_LIBRARY_PATH = makeLibraryPath [
-    arpack fftw fftwSinglePrec libgit2 mpfr blas openlibm
-    openspecfun pcre2 lapack
-  ];
-
-  preBuild = ''
-    sed -e '/^install:/s@[^ ]*/doc/[^ ]*@@' -i Makefile
-    sed -e '/[$](DESTDIR)[$](docdir)/d' -i Makefile
-    export LD_LIBRARY_PATH=${LD_LIBRARY_PATH}
-  '';
-
-  enableParallelBuilding = true;
-
-  # Julia's tests require read/write access to $HOME
-  preCheck = ''
-    export HOME="$NIX_BUILD_TOP"
-  '';
-  doCheck = true;
-  checkTarget = "test";
-
-  postInstall = ''
-    # Symlink shared libraries from LD_LIBRARY_PATH into lib/julia,
-    # as using a wrapper with LD_LIBRARY_PATH causes segmentation
-    # faults when program returns an error:
-    #   $ julia -e 'throw(Error())'
-    find $(echo $LD_LIBRARY_PATH | sed 's|:| |g') -maxdepth 1 -name '*.${if stdenv.isDarwin then "dylib" else "so"}*' | while read lib; do
-      if [[ ! -e $out/lib/julia/$(basename $lib) ]]; then
-        ln -sv $lib $out/lib/julia/$(basename $lib)
-      fi
-    done
-  '';
-
-  passthru = {
-    inherit majorVersion minorVersion maintenanceVersion;
-    site = "share/julia/site/v${majorVersion}.${minorVersion}";
-  };
-
-  meta = {
-    description = "High-level performance-oriented dynamical language for technical computing";
-    homepage = "https://julialang.org/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ raskin rob garrison ];
-    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
-    # Unfortunately, this derivation does not pass Julia's test suite. See
-    # https://github.com/NixOS/nixpkgs/pull/121114.
-    broken = true;
-  };
-}
diff --git a/pkgs/development/compilers/julia/1.8-bin.nix b/pkgs/development/compilers/julia/1.8-bin.nix
index 59966f48fd3fb..325ed73e2d588 100644
--- a/pkgs/development/compilers/julia/1.8-bin.nix
+++ b/pkgs/development/compilers/julia/1.8-bin.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "julia-bin";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = {
     x86_64-linux = fetchurl {
       url = "https://julialang-s3.julialang.org/bin/linux/x64/${lib.versions.majorMinor version}/julia-${version}-linux-x86_64.tar.gz";
-      sha256 = "sha256-ZxzzpFC2OnF+Hu3X9pCH44VvAVsuFGy1SSjxmjwF55Y=";
+      sha256 = "sha256-M8Owk1b/qiXTMxw2RrHy1LCZROj5P8uZSVeAG4u/WKk=";
     };
     aarch64-linux = fetchurl {
       url = "https://julialang-s3.julialang.org/bin/linux/aarch64/${lib.versions.majorMinor version}/julia-${version}-linux-aarch64.tar.gz";
-      sha256 = "sha256-+RwnZCj/swrMIJ4Os+cLHJEmDoh+EdS2b1VFCEtTBUc=";
+      sha256 = "sha256-2/+xNKQTtxLUqOHujmZepV7bCGVxmhutmXkSPWQzrMk=";
     };
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
diff --git a/pkgs/development/compilers/julia/1.8.nix b/pkgs/development/compilers/julia/1.8.nix
index e67a02b040abb..f8b0daa1ace73 100644
--- a/pkgs/development/compilers/julia/1.8.nix
+++ b/pkgs/development/compilers/julia/1.8.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation rec {
   pname = "julia";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchurl {
     url = "https://github.com/JuliaLang/julia/releases/download/v${version}/julia-${version}-full.tar.gz";
-    sha256 = "sha256-5Xz8Lm2JF1Ckf3zwNVmk6PchK/VJAPJqnxL9bQCdTKk=";
+    hash = "sha256-UraJWp1K0v422yYe6MTIzJISuDehL5MAL6r1N6IVH1A=";
   };
 
   patches =
diff --git a/pkgs/development/compilers/julia/patches/1.0/use-system-utf8proc-julia-1.0.patch b/pkgs/development/compilers/julia/patches/1.0/use-system-utf8proc-julia-1.0.patch
deleted file mode 100644
index be4391399f559..0000000000000
--- a/pkgs/development/compilers/julia/patches/1.0/use-system-utf8proc-julia-1.0.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 54a66b5728ec98f44a1768f064509be4fd3f2ef6 Mon Sep 17 00:00:00 2001
-From: Thomas Tuegel <ttuegel@gmail.com>
-Date: Sat, 10 Oct 2015 13:09:48 -0500
-Subject: [PATCH 1/3] use system utf8proc
-
----
- src/flisp/Makefile | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/flisp/Makefile b/src/flisp/Makefile
-index bec8624..5437b5c 100644
---- a/src/flisp/Makefile
-+++ b/src/flisp/Makefile
-@@ -24,9 +24,9 @@ DOBJS = $(SRCS:%.c=$(BUILDDIR)/%.dbg.obj)
- LLTDIR := ../support
- LLT_release := $(BUILDDIR)/$(LLTDIR)/libsupport.a
- LLT_debug := $(BUILDDIR)/$(LLTDIR)/libsupport-debug.a
--LIBFILES_release := $(LLT_release) $(LIBUV) $(LIBUTF8PROC)
--LIBFILES_debug := $(LLT_debug) $(LIBUV) $(LIBUTF8PROC)
--LIBS :=
-+LIBFILES_release := $(LLT_release) $(LIBUV)
-+LIBFILES_debug := $(LLT_debug) $(LIBUV)
-+LIBS := $(LIBUTF8PROC)
- ifneq ($(OS),WINNT)
- LIBS += -lpthread
- endif
--- 
-2.5.2
-
diff --git a/pkgs/development/compilers/julia/patches/1.5/use-system-utf8proc-julia-1.3.patch b/pkgs/development/compilers/julia/patches/1.5/use-system-utf8proc-julia-1.3.patch
deleted file mode 100644
index 63e0ba9ab0573..0000000000000
--- a/pkgs/development/compilers/julia/patches/1.5/use-system-utf8proc-julia-1.3.patch
+++ /dev/null
@@ -1,24 +0,0 @@
----
- src/flisp/Makefile | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-
-diff --git a/src/flisp/Makefile b/src/flisp/Makefile
-index d97075e..6bebca7 100644
---- a/src/flisp/Makefile
-+++ b/src/flisp/Makefile
-@@ -32,9 +32,9 @@ OBJS := $(SRCS:%.c=$(BUILDDIR)/%.o)
- DOBJS := $(SRCS:%.c=$(BUILDDIR)/%.dbg.obj)
- LLT_release := $(LLT_BUILDDIR)/libsupport.a
- LLT_debug := $(LLT_BUILDDIR)/libsupport-debug.a
--LIBFILES_release := $(LLT_release) $(LIBUV) $(LIBUTF8PROC)
--LIBFILES_debug := $(LLT_debug) $(LIBUV) $(LIBUTF8PROC)
--LIBS :=
-+LIBFILES_release := $(LLT_release) $(LIBUV)
-+LIBFILES_debug := $(LLT_debug) $(LIBUV)
-+LIBS := $(LIBUTF8PROC)
- ifneq ($(OS),WINNT)
- LIBS += -lpthread
- endif
-
--- 
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index a29df9051e7c2..da24f496117db 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -43,7 +43,6 @@ let
       mkdir "$rsrc"
       ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-      echo "-B $rsrc/lib" >> $out/nix-support/cc-cflags
     '';
     mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
       ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
diff --git a/pkgs/development/interpreters/guile/2.2.nix b/pkgs/development/interpreters/guile/2.2.nix
index c101f5ae39030..91cb993fae06f 100644
--- a/pkgs/development/interpreters/guile/2.2.nix
+++ b/pkgs/development/interpreters/guile/2.2.nix
@@ -38,7 +38,7 @@ builder rec {
     buildPackages.stdenv.cc
   ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-    pkgsBuildBuild.guile;
+    pkgsBuildBuild.guile_2_2;
   nativeBuildInputs = [
     makeWrapper
     pkg-config
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index ced8561720d3f..afad1c7a29ff8 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -38,7 +38,7 @@ builder rec {
   depsBuildBuild = [
     buildPackages.stdenv.cc
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
-    pkgsBuildBuild.guile;
+    pkgsBuildBuild.guile_3_0;
   nativeBuildInputs = [
     makeWrapper
     pkg-config
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 424258167150b..e84b4918afb86 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -7,7 +7,6 @@
 , mailcap, mimetypesSupport ? true
 , ncurses
 , openssl
-, openssl_1_1
 , readline
 , sqlite
 , tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
@@ -77,10 +76,6 @@ assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
 with lib;
 
 let
-  # cpython does support/build with openssl 3.0, but some libraries using the ssl module seem to have issues with it
-  # null check for Minimal
-  openssl' = if openssl != null then openssl_1_1 else null;
-
   buildPackages = pkgsBuildHost;
   inherit (passthru) pythonForBuild;
 
@@ -121,7 +116,7 @@ let
   ];
 
   buildInputs = filter (p: p != null) ([
-    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl' ]
+    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl ]
     ++ optionals x11Support [ tcl tk libX11 xorgproto ]
     ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
     ++ optionals stdenv.isDarwin [ configd ])
@@ -327,8 +322,8 @@ in with passthru; stdenv.mkDerivation {
     "--with-threads"
   ] ++ optionals (sqlite != null && isPy3k) [
     "--enable-loadable-sqlite-extensions"
-  ] ++ optionals (openssl' != null) [
-    "--with-openssl=${openssl'.dev}"
+  ] ++ optionals (openssl != null) [
+    "--with-openssl=${openssl.dev}"
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_buggy_getaddrinfo=no"
     # Assume little-endian IEEE 754 floating point when cross compiling
@@ -493,7 +488,7 @@ in with passthru; stdenv.mkDerivation {
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
   disallowedReferences =
-    lib.optionals (openssl' != null && !static) [ openssl'.dev ]
+    lib.optionals (openssl != null && !static) [ openssl.dev ]
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # Ensure we don't have references to build-time packages.
     # These typically end up in shebangs.
diff --git a/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh b/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh
index e73e45cd597a1..83b79d01fa404 100644
--- a/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh
@@ -3,7 +3,21 @@ echo "Sourcing python-catch-conflicts-hook.sh"
 
 pythonOutputDistPhase() {
     echo "Executing pythonOutputDistPhase"
-    mv "dist" "$dist"
+    if [[ -d dist ]]; then
+        mv "dist" "$dist"
+    else
+        cat >&2 <<EOF
+The build contains no ./dist directory.
+If this project is not setuptools-based, pass
+
+  format = "other";
+
+to buildPythonApplication/buildPythonPackage or another appropriate value as described here:
+
+  https://nixos.org/manual/nixpkgs/stable/#buildpythonpackage-function
+EOF
+        false
+    fi
     echo "Finished executing pythonOutputDistPhase"
 }
 
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 0720b836388b6..e901d8887bd49 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.6.20";
+  version = "0.6.21";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    sha256 = "sha256-d6o+ClQMhoSU8wjdP0nr+g6r4ZqzXhxBJcEfTOSlS7o=";
+    sha256 = "sha256-RVwSSr0EgVnZt/uUAldWQdjBw6/L+CHUutWcinysvNw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index 4bb38144763e2..3f3ade4065e1c 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.13.9";
+  version = "0.13.11";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G7FYWrpg4TLsfK6C3JCTWkZ65iu3+gF3To5qYgUAqb0=";
+    sha256 = "sha256-3HNfEZ/PMHLhPp7boYyY/x5wXN9Eg+G1400q1riG2oI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-sdkutils/default.nix b/pkgs/development/libraries/aws-c-sdkutils/default.nix
index 3022cf4627460..298ea5cb946c6 100644
--- a/pkgs/development/libraries/aws-c-sdkutils/default.nix
+++ b/pkgs/development/libraries/aws-c-sdkutils/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-sdkutils";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-sdkutils";
     rev = "v${version}";
-    sha256 = "sha256-KfQKOQrSgTy9Z+iUGnLblRArkq3xnFEnSq6HajcbysQ=";
+    sha256 = "sha256-qu/+xYorB+QXP5Ixj5ZFP9ZenVYV6hcmxHnH14DEgrU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index 632c8427e4db6..db23009b8fa93 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, openssl, openldap, libkrb5, db, gettext
+{ lib, stdenv, fetchurl, fetchpatch, openssl, openldap, libkrb5, db, gettext
 , pam, libxcrypt, fixDarwinDylibNames, autoreconfHook, enableLdap ? false
 , buildPackages, pruneLibtoolFiles, nixosTests }:
 
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
   patches = [
     # Fix cross-compilation
     ./cyrus-sasl-ac-try-run-fix.patch
+    # make compatible with openssl3. can probably be dropped with any release after 2.1.28
+    (fetchpatch {
+      url = "https://github.com/cyrusimap/cyrus-sasl/compare/cb549ef71c5bb646fe583697ebdcaba93267a237...c2bd3afbca57f176d8c650670ce371444bb7fcc0.patch";
+      hash = "sha256-bYeIkvle1Ms7Lnoob4eLd4RbPFHtPkKRZvfHNCBJY/s=";
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index b38ba682a76be..9fc05f5f8754c 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -1,4 +1,14 @@
-{ config, lib, stdenv, fetchurl, gettext, meson, ninja, pkg-config, perl, python3
+{ config
+, lib
+, stdenv
+, fetchurl
+, fetchpatch
+, gettext
+, meson
+, ninja
+, pkg-config
+, perl
+, python3
 , libiconv, zlib, libffi, pcre2, libelf, gnome, libselinux, bash, gnum4, gtk-doc, docbook_xsl, docbook_xml_dtd_45, libxslt
 # use util-linuxMinimal to avoid circular dependency (util-linux, systemd, glib)
 , util-linuxMinimal ? null
@@ -95,6 +105,14 @@ stdenv.mkDerivation (finalAttrs: {
     # Disable flaky test.
     # https://gitlab.gnome.org/GNOME/glib/-/issues/820
     ./skip-timer-test.patch
+
+    # Fix infinite loop (e.g. in gnome-keyring)
+    # https://github.com/NixOS/nixpkgs/pull/197754#issuecomment-1312805358
+    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3039
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/2a36bb4b7e46f9ac043561c61f9a790786a5440c.patch";
+      sha256 = "b77Hxt6WiLxIGqgAj9ZubzPWrWmorcUOEe/dp01BcXA=";
+    })
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index bb306fb3a8591..ec109cbee8dc9 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -138,14 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     rm $out/lib/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary}
   '';
 
-  # add self to buildInputs to avoid needing to add gobject-introspection to buildInputs in addition to nativeBuildInputs
-  # builds use target-pkg-config to look for gobject-introspection instead of just looking for binaries in $PATH
-  # wrapper uses depsTargetTargetPropagated so ignore it
-  preFixup = lib.optionalString (!lib.hasSuffix "-wrapped" finalAttrs.pname) ''
-    mkdir -p $dev/nix-support
-    echo "$out" > $dev/nix-support/propagated-target-target-deps
-  '';
-
   setupHook = ./setup-hook.sh;
 
   passthru = {
diff --git a/pkgs/development/libraries/gobject-introspection/wrapper.nix b/pkgs/development/libraries/gobject-introspection/wrapper.nix
index f887b7d18c77a..d59cbe6faffa4 100644
--- a/pkgs/development/libraries/gobject-introspection/wrapper.nix
+++ b/pkgs/development/libraries/gobject-introspection/wrapper.nix
@@ -9,50 +9,99 @@
 # to build, run
 # `nix build ".#pkgsCross.aarch64-multiplatform.buildPackages.gobject-introspection"`
 
+# a comment for both depsTargetTargetPropagated's
+# add self to buildInputs to avoid needing to add gobject-introspection to buildInputs in addition to nativeBuildInputs
+# builds use target-pkg-config to look for gobject-introspection instead of just looking for binaries in $PATH
+
 let
-  # ensure that `.override` works when gobject-introspection == gobject-introspection-wrapped
+  # ensure that `.override` works
   args = builtins.removeAttrs _args [ "buildPackages" "targetPackages" "gobject-introspection-unwrapped" ];
   # passing this stdenv to `targetPackages...` breaks due to splicing not working in `.override``
   argsForTarget = builtins.removeAttrs args [ "stdenv" ];
+
+  overridenUnwrappedGir = gobject-introspection-unwrapped.override args;
+  # if we have targetPackages.gobject-introspection then propagate that
+  overridenTargetUnwrappedGir =
+    if targetPackages ? gobject-introspection-unwrapped
+    then targetPackages.gobject-introspection-unwrapped.override argsForTarget
+    else overridenUnwrappedGir;
 in
 
-(gobject-introspection-unwrapped.override args).overrideAttrs (previousAttrs: {
-  pname = "gobject-introspection-wrapped";
-  depsTargetTargetPropagated = [ gobject-introspection-unwrapped ];
-  postFixup = (previousAttrs.postFixup or "") + ''
-    mv $dev/bin/g-ir-compiler $dev/bin/.g-ir-compiler-wrapped
-    mv $dev/bin/g-ir-scanner $dev/bin/.g-ir-scanner-wrapped
-
-    (
-      export bash="${buildPackages.bash}"
-      export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
-      export emulatorwrapper="$dev/bin/g-ir-scanner-qemuwrapper"
-      export buildlddtree="${buildPackages.pax-utils}/bin/lddtree"
-
-      export targetgir="${lib.getDev (targetPackages.gobject-introspection-unwrapped.override argsForTarget)}"
-
-      substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
-      substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
-      substituteAll "${./wrappers/g-ir-scanner-lddwrapper.sh}" "$dev/bin/g-ir-scanner-lddwrapper"
-      substituteAll "${./wrappers/g-ir-scanner-qemuwrapper.sh}" "$dev/bin/g-ir-scanner-qemuwrapper"
-      chmod +x $dev/bin/g-ir-*
-    )
-  ''
-  # when cross-compiling and using the wrapper then when a package looks up the g_ir_X
-  # variable with pkg-config they'll get the host version which can't be run
-  # override the variable to use the absolute path to g_ir_X in PATH which can be run
-  + ''
-    cat >> $dev/nix-support/setup-hook <<-'EOF'
-      override-pkg-config-gir-variables() {
-        PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER="$(type -p g-ir-scanner)"
-        PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER="$(type -p g-ir-compiler)"
-        PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE="$(type -p g-ir-generate)"
-        export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER
-        export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER
-        export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE
-      }
-
-      preConfigureHooks+=(override-pkg-config-gir-variables)
-    EOF
-  '';
-})
+# wrap both pkgsCrossX.buildPackages.gobject-introspection and {pkgs,pkgsSomethingExecutableOnBuildSystem).buildPackages.gobject-introspection
+if (!stdenv.hostPlatform.canExecute stdenv.targetPlatform) && stdenv.targetPlatform.emulatorAvailable buildPackages
+then
+  stdenv.mkDerivation
+    (builtins.removeAttrs overridenUnwrappedGir.drvAttrs [ "name" ] # so we can get a fresh name generated from the pname
+      // {
+
+      inherit (overridenUnwrappedGir) meta;
+      pname = "gobject-introspection-wrapped";
+      passthru = overridenUnwrappedGir.passthru // {
+        unwrapped = overridenUnwrappedGir;
+      };
+      phases = [ "fixupPhase" ]; # don't remove, it is valid to set phases here.
+      dontStrip = true;
+      depsTargetTargetPropagated = [ overridenTargetUnwrappedGir ];
+      postFixup = ''
+        ${lib.concatMapStrings (output: ''
+          mkdir -p ${"$" + "${output}"}
+          ${lib.getExe buildPackages.xorg.lndir} ${gobject-introspection-unwrapped.${output}} ${"$" + "${output}"}
+        '') gobject-introspection-unwrapped.outputs}
+
+        cp $dev/bin/g-ir-compiler $dev/bin/.g-ir-compiler-wrapped
+        cp $dev/bin/g-ir-scanner $dev/bin/.g-ir-scanner-wrapped
+
+        (
+          rm "$dev/bin/g-ir-compiler"
+          rm "$dev/bin/g-ir-scanner"
+          export bash="${buildPackages.bash}"
+          export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
+          export emulatorwrapper="$dev/bin/g-ir-scanner-qemuwrapper"
+          export buildlddtree="${buildPackages.pax-utils}/bin/lddtree"
+
+          export targetgir="${lib.getDev overridenTargetUnwrappedGir}"
+
+          substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
+          substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
+          substituteAll "${./wrappers/g-ir-scanner-lddwrapper.sh}" "$dev/bin/g-ir-scanner-lddwrapper"
+          substituteAll "${./wrappers/g-ir-scanner-qemuwrapper.sh}" "$dev/bin/g-ir-scanner-qemuwrapper"
+          chmod +x $dev/bin/g-ir-compiler
+          chmod +x $dev/bin/g-ir-scanner*
+        )
+      ''
+      # when cross-compiling and using the wrapper then when a package looks up the g_ir_X
+      # variable with pkg-config they'll get the host version which can't be run
+      # override the variable to use the absolute path to g_ir_X in PATH which can be run
+      + ''
+        cat >> $dev/nix-support/setup-hook <<-'EOF'
+          override-pkg-config-gir-variables() {
+            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER="$(type -p g-ir-scanner)"
+            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER="$(type -p g-ir-compiler)"
+            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE="$(type -p g-ir-generate)"
+            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER
+            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER
+            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE
+          }
+
+          preConfigureHooks+=(override-pkg-config-gir-variables)
+        EOF
+      '';
+    })
+else
+  stdenv.mkDerivation (builtins.removeAttrs overridenUnwrappedGir.drvAttrs [ "name" ] # so we can get a fresh name generated from the pname
+    // {
+    inherit (overridenUnwrappedGir) meta;
+    pname = "gobject-introspection-wrapped";
+    passthru = overridenUnwrappedGir.passthru // {
+      unwrapped = overridenUnwrappedGir;
+    };
+    phases = [ "fixupPhase" ]; # don't remove, it is valid to set phases here.
+    dontStrip = true;
+    depsTargetTargetPropagated = [ overridenTargetUnwrappedGir ];
+    postFixup = ''
+      ${lib.concatMapStrings (output: ''
+        mkdir -p ${"$" + "${output}"}
+        ${lib.getExe buildPackages.xorg.lndir} ${gobject-introspection-unwrapped.${output}} ${"$" + "${output}"}
+      '') gobject-introspection-unwrapped.outputs}
+    '';
+  })
diff --git a/pkgs/development/libraries/gtksourceview/4.x.nix b/pkgs/development/libraries/gtksourceview/4.x.nix
index 315547ad38681..f3414c39270ac 100644
--- a/pkgs/development/libraries/gtksourceview/4.x.nix
+++ b/pkgs/development/libraries/gtksourceview/4.x.nix
@@ -70,6 +70,13 @@ stdenv.mkDerivation rec {
     dbus
   ];
 
+  postPatch = ''
+    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/295
+    # build: drop unnecessary vapigen check
+    substituteInPlace meson.build \
+      --replace "if generate_vapi" "if false"
+  '';
+
   # Broken by PCRE 2 bump in GLib.
   # https://gitlab.gnome.org/GNOME/gtksourceview/-/issues/283
   doCheck = false;
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index 25bd8127a546f..d3b1cc42a12fd 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -74,6 +74,13 @@ stdenv.mkDerivation rec {
     "-Dgtk_doc=true"
   ];
 
+  postPatch = ''
+    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/295
+    # build: drop unnecessary vapigen check
+    substituteInPlace meson.build \
+      --replace "if generate_vapi" "if false"
+  '';
+
   doCheck = stdenv.isLinux;
 
   checkPhase = ''
diff --git a/pkgs/development/libraries/intel-media-driver/32bit.patch b/pkgs/development/libraries/intel-media-driver/32bit.patch
new file mode 100644
index 0000000000000..ddeeea66e3b88
--- /dev/null
+++ b/pkgs/development/libraries/intel-media-driver/32bit.patch
@@ -0,0 +1,22 @@
+diff --git a/media_softlet/linux/common/ddi/media_libva_util_next.cpp b/media_softlet/linux/common/ddi/media_libva_util_next.cpp
+index 66fab63de..a2cdf79d7 100644
+--- a/media_softlet/linux/common/ddi/media_libva_util_next.cpp
++++ b/media_softlet/linux/common/ddi/media_libva_util_next.cpp
+@@ -2195,8 +2195,8 @@ void MediaLibvaUtilNext::MediaPrintFps()
+ 
+         int64_t diff  = (tv2.tv_sec - m_tv1.tv_sec)*1000000 + tv2.tv_usec - m_tv1.tv_usec;
+         float fps     = m_frameCountFps / (diff / 1000000.0);
+-        DDI_NORMALMESSAGE("FPS:%6.4f, Interval:%11lu.", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
+-        sprintf(temp,"FPS:%6.4f, Interval:%11lu\n", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
++        DDI_NORMALMESSAGE("FPS:%6.4f, Interval:%11llu.", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
++        sprintf(temp,"FPS:%6.4f, Interval:%11llu\n", fps,((uint64_t)tv2.tv_sec)*1000 + (tv2.tv_usec/1000));
+ 
+         MOS_ZeroMemory(fpsFileName,LENGTH_OF_FPS_FILE_NAME);
+         sprintf(fpsFileName, FPS_FILE_NAME);
+@@ -2213,4 +2213,4 @@ void MediaLibvaUtilNext::MediaPrintFps()
+     pthread_mutex_unlock(&m_fpsMutex);
+     return;
+ }
+-#endif
+\ No newline at end of file
++#endif
diff --git a/pkgs/development/libraries/intel-media-driver/default.nix b/pkgs/development/libraries/intel-media-driver/default.nix
index 925cd2eeb8f85..4f5f8fc286131 100644
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "22.5.3.1";
+  version = "22.6.3";
 
   outputs = [ "out" "dev" ];
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "media-driver";
     rev = "intel-media-${version}";
-    sha256 = "sha256-3l8mfw1h1se0+w4VtfMr0xuPW8G3JA6hbvkyCaEGTek=";
+    sha256 = "sha256-lQg+L64DW2ZIBeJRimNkba7EL+SM4jSnX9PWIx4j2AY=";
   };
 
   patches = [
@@ -33,12 +33,10 @@ stdenv.mkDerivation rec {
       url = "https://salsa.debian.org/multimedia-team/intel-media-driver-non-free/-/raw/master/debian/patches/0002-Remove-settings-based-on-ARCH.patch";
       sha256 = "sha256-f4M0CPtAVf5l2ZwfgTaoPw7sPuAP/Uxhm5JSHEGhKT0=";
     })
-    # fix compilation on i686-linux
-    (fetchpatch {
-      url = "https://github.com/intel/media-driver/commit/5ee502b84eb70f0d677a3b49d624c356b3f0c2b1.patch";
-      revert = true;
-      sha256 = "sha256-yRS10BKD5IkW8U0PxmyB7ryQiLwrqeetm0NivnoM224=";
-    })
+  ] ++ lib.optional stdenv.is32bit [
+    # fix compilation on i686-linux but also breaks x86_64
+    # a similar issue got fixed in https://github.com/intel/media-driver/pull/1493 but thats to much C magic for me
+    ./32bit.patch
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/keybinder3/default.nix b/pkgs/development/libraries/keybinder3/default.nix
index 94f10426c7156..cee48d5e9eff6 100644
--- a/pkgs/development/libraries/keybinder3/default.nix
+++ b/pkgs/development/libraries/keybinder3/default.nix
@@ -13,14 +13,25 @@ stdenv.mkDerivation rec {
     sha256 = "196ibn86j54fywfwwgyh89i9wygm4vh7ls19fn20vrnm6ijlzh9r";
   };
 
-  nativeBuildInputs = [ autoconf automake libtool pkg-config ];
+  strictDeps = true;
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
+    gnome.gnome-common
+    gtk-doc
+    gobject-introspection
+  ];
   buildInputs = [
-    gnome.gnome-common gtk-doc gtk3
-    libX11 libXext libXrender gobject-introspection
+    gtk3 libX11 libXext libXrender
   ];
 
   preConfigure = ''
-    ./autogen.sh --prefix="$out"
+    # NOCONFIGURE fixes 'If you meant to cross compile, use `--host'.'
+    NOCONFIGURE=1 ./autogen.sh --prefix="$out"
+    substituteInPlace ./configure \
+      --replace "dummy pkg-config" 'dummy ''${ac_tool_prefix}pkg-config'
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libmilter/default.nix b/pkgs/development/libraries/libmilter/default.nix
index 9287b0a0dea78..38788b3c964ba 100644
--- a/pkgs/development/libraries/libmilter/default.nix
+++ b/pkgs/development/libraries/libmilter/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m4 }:
+{ lib, stdenv, fetchurl, m4, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
   pname = "libmilter";
@@ -34,7 +34,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./install.patch ./sharedlib.patch ./glibc-2.30.patch ./darwin.patch ];
 
-  nativeBuildInputs = [ m4 ];
+  nativeBuildInputs = [ m4 ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    fixDarwinDylibNames $out/lib/libmilter.dylib.1
+  '';
 
   meta = with lib; {
     description = "Sendmail Milter mail filtering API library";
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 4df7ddaffb258..10ef8e5395a38 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.3";
+  version = "1.2.4";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-6Rbqm3n5UYVguaGHJRp8BCRCqey85/Nr55CIiGBdAlU=";
+    hash = "sha256-wP4jO+TN/XA+fVl37462P8vx0AUrYEThsj1HyjViR38=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index a5c6498166f51..62abb162b00d0 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.2.1";
+  version = "3.2.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ses9LDvkn7vQUacfZTLJYmvOzqaXgxkGkM1+Tf3yjyk=";
+    sha256 = "sha256-g2c8aFuRD7fTnx8o7uWvvvtxwFeY/DUKw78biF4e+qE=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index ad4083bf6fea5..0ded7e20088e2 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -3,17 +3,18 @@
 , minimal ? false, libva-minimal
 , libX11, libXext, libXfixes, wayland, libffi, libGL
 , mesa
+, intel-media-driver
 }:
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.15.0";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "sha256-NJA2FTPrhLj9+vmkBy+GcTiH57gBEQnYhZzYk3sEOBo=";
+    sha256 = "sha256-HTwJQpDND4PjiNpUjHtTgkQdkahm2BUe71UDRQpvo6M=";
   };
 
   outputs = [ "dev" "out" ];
@@ -29,6 +30,10 @@ stdenv.mkDerivation rec {
     "-Ddriverdir=${mesa.drivers.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri:/usr/lib/x86_64-linux-gnu/dri:/usr/lib/i386-linux-gnu/dri"
   ];
 
+  passthru.tests = {
+    inherit intel-media-driver;
+  };
+
   meta = with lib; {
     description = "An implementation for VA-API (Video Acceleration API)";
     longDescription = ''
diff --git a/pkgs/development/libraries/libwnck/default.nix b/pkgs/development/libraries/libwnck/default.nix
index d6e6475917291..2f535930ed037 100644
--- a/pkgs/development/libraries/libwnck/default.nix
+++ b/pkgs/development/libraries/libwnck/default.nix
@@ -3,6 +3,7 @@
 , fetchurl
 , fetchpatch
 , meson
+, mesonEmulatorHook
 , ninja
 , pkg-config
 , gtk-doc
@@ -50,6 +51,8 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_412
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index d4ce1f8bc7351..8fe6a7ee0a99b 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     "--enable-hashes=all"
     "--enable-obsolete-api=glibc"
     "--disable-failure-tokens"
-  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+  ] ++ lib.optionals (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.libc == "bionic") [
     "--disable-werror"
   ];
 
diff --git a/pkgs/development/libraries/linenoise/default.nix b/pkgs/development/libraries/linenoise/default.nix
index d465b48a8f46a..e337e32b2353c 100644
--- a/pkgs/development/libraries/linenoise/default.nix
+++ b/pkgs/development/libraries/linenoise/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://github.com/antirez/linenoise";
     description = "A minimal, zero-config, BSD licensed, readline replacement";
-    maintainers = with lib.maintainers; [ mpsyco ];
+    maintainers = with lib.maintainers; [ fstamour ];
     platforms = lib.platforms.unix;
     license = lib.licenses.bsd2;
   };
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 24ce9ff207719..54c1e8acf0415 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -7,7 +7,8 @@
 , libglvnd, libunwind
 , vulkan-loader, glslang
 , galliumDrivers ? ["auto"]
-, vulkanDrivers ? ["auto"]
+# upstream Mesa defaults to only enabling swrast (aka lavapipe) on aarch64 for some reason, so force building the others
+, vulkanDrivers ? [ "auto" ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [ "broadcom" "freedreno" "panfrost" ]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
 , vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ "device-select" "overlay" ] # No Vulkan support on Darwin
 , OpenGL, Xplugin
@@ -36,7 +37,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.2.2";
+  version = "22.2.3";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -51,7 +52,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "2de11fb74fc5cc671b818e49fe203cea0cd1d8b69756e97cdb06a2f4e78948f9";
+    sha256 = "ee7d026f7b1991dbae0861d359b671145c3a86f2a731353b885d2ea2d5c098d6";
   };
 
   # TODO:
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 97a84356f8181..5db0a7c8bfa94 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -92,6 +92,8 @@ stdenv.mkDerivation rec {
   preCheck = ''
     substituteInPlace tests/scripts/all \
       --replace "/bin/rm" "rm"
+    # fails saying "SASL(-1): generic failure: internal error: failed to init cipher 'rc4'"
+    rm tests/scripts/test076-authid-rewrite
   '';
 
   doCheck = true;
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index f2907afab0188..6110d459ecca5 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -68,11 +68,10 @@
 
 let
   mesonEnableFeature = b: if b then "enabled" else "disabled";
-  mesonList = l: "[" + lib.concatStringsSep "," l + "]";
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.59";
+    version = "0.3.60";
 
     outputs = [
       "out"
@@ -90,7 +89,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-4wDtdgkjBRlthhwbI3cSQFnbr+gxPQP5j5YnrWiQVp4=";
+      sha256 = "sha256-HDE2QAV2jnEJCqgiGx4TVP4ceeKAqwd4P3OYw6auNAM=";
     };
 
     patches = [
@@ -107,10 +106,24 @@ let
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
 
-      # remove when updating to 0.3.60
-      (fetchpatch { # filter-chain: iterate the port correctly
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/94a64268613adac8ef6f3e6c1f04468220540d00.patch";
-        sha256 = "sha256-IDTB7NgadgR3vKv97Nvd9pBfnOnMi21YsvLdD1Ew7HE=";
+      # Following are backported patches as recommended by upstream.
+      # FIXME: remove in 0.3.61
+      # fix tdesktop with pw-pulse
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b720da771efa950cf380101bed42d5d5ee177908.diff";
+        hash = "sha256-p/BvatnbEJAMLQUUOECKAK7FppaNp9ei3FHjAw2spM8=";
+      })
+
+      # fix a crash when quickly switching Bluetooth profiles
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/bf3516ba0496b644b3944b114253f23964178897.diff";
+        hash = "sha256-LqasplS/azCPekslJQPTd9MZkUcRqA0ks94FtwyY3GA=";
+      })
+
+      # fix no sound in VMs (Pipewire on the guest)
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b46d8a8c921a8da6883610ad4b68da95bf59b59e.diff";
+        hash = "sha256-2VHBwXbzUAGP/fG4xxoFLHSb9oXQK1BPuNv3zAV8cEg=";
       })
     ];
 
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 83f73c993072b..4639bf53a52f3 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "98c727f273fc83c24550274bd2728e1aafbd213a",
-    "sha256": "1hwswan0yw6l4rka60ch173sd71ijx0y15gb2hnd3mhzws8gjsb5"
+    "rev": "51258629f2cf37fff8406bf705d79c07fc7135ca",
+    "sha256": "0wsjw7wc493kx6w954plmd5y8qsshbd5wqxdwj350gnv48n63g2k"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "45d43c04088efb8346979f633f72bb1f23183461",
-    "sha256": "1ad6r1zwzzvl1i2rxkjgp8x5k4ahcf6grfq6xarbbj9qvvb08ny4"
+    "rev": "959b1ac3b7c699ef67ec81155e6e1e579d4e1df7",
+    "sha256": "0f8l214x38hdn768jjfy31pqdjgya6221k38vidnfap522qs1fcm"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -56,8 +56,8 @@
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "1b83a9c73d6e5459ec4c2221b2bd7e5396b5e874",
-    "sha256": "07ry1bfim24aa530xslp8njn1bzalrmrwcx0xz2p2jilhfvvp5fc"
+    "rev": "adbc372b890ed90f006a6c4f3ca56bf0cba477ef",
+    "sha256": "05v47ba06lmhrmm9ivnfnxzv9qdhyx2bbx2lkqjfwax2czmnf81j"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
@@ -101,8 +101,8 @@
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "9ff77702cc3649cbaf94046742d682d77cdea698",
-    "sha256": "0sq2j94csmd7ifd1hw4lwv7b82l59iz2258jg50d0j5hcf3acydz"
+    "rev": "5465566a4ad9f6f9758bed304153f0c7fec3437b",
+    "sha256": "03qayykxd07fwp5m1s7dwjvdcv45m3v6zia9k6ipif2bbjbi4dyd"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@@ -166,8 +166,8 @@
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "9c607c771acdb3d820be7f112db99213a6c6d7eb",
-    "sha256": "1dbilhkldvhwwd2j0g7mwz1jyw9zgzwyyx43rsmnmv9lh36pb3dc"
+    "rev": "4b43f2dc58e71732ebdbe1eaf4392272bc692e6d",
+    "sha256": "157wqyh9wv9kn8671l7dhnv3a4glmqpisqk0vdgnx19b6jdxymvj"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
diff --git a/pkgs/development/libraries/qt-5/modules/qtwayland.nix b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
index 851e4ad6966b0..10e18b3b98447 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
@@ -1,4 +1,4 @@
-{ qtModule, qtbase, qtquickcontrols, wayland, pkg-config }:
+{ lib, qtModule, qtbase, qtquickcontrols, wayland, pkg-config, fetchpatch }:
 
 qtModule {
   pname = "qtwayland";
@@ -11,5 +11,14 @@ qtModule {
     # wrapped executables from `wrapQtAppsHook` (see comment in patch for further
     # context).  Beware: shared among different Qt5 versions.
     ./qtwayland-app_id.patch
-  ];
+  ] ++ lib.optional (lib.versionAtLeast qtbase.version "5.15")
+    # Backport of https://codereview.qt-project.org/c/qt/qtwayland/+/388338
+    # Pulled from Fedora as they modified it to not apply to KDE as Plasma 5.x
+    # doesn't behave properly with the patch applied. See the discussion at
+    # https://invent.kde.org/qt/qt/qtwayland/-/merge_requests/39 for details
+    # This patch won't apply to versions before 5.15.
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/qt5-qtwayland/raw/46376bb00d4c3dd3db2e82ad7ca5301ce16ea4ab/f/0080-Client-set-constraint-adjustments-for-popups-in-xdg.patch";
+      sha256 = "sha256-XP+noYCk8fUdA0ItCqMjV7lSXDlNdB7Az9q7NRpupHc=";
+    });
 }
diff --git a/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix b/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
index 5ccd9d6fa49e1..a2dc93845c472 100644
--- a/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal-wlr/default.nix
@@ -1,11 +1,13 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , makeWrapper
 , meson
 , ninja
 , pkg-config
 , wayland-protocols
+, wayland-scanner
 , grim
 , inih
 , libdrm
@@ -28,8 +30,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-UztkfvMIbslPd/d262NZFb6WfESc9nBsSSH96BA4Aqw=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config wayland-protocols makeWrapper ];
-  buildInputs = [ inih libdrm mesa pipewire scdoc systemd wayland ];
+  # scdoc: mark as build-time dependency
+  # https://github.com/emersion/xdg-desktop-portal-wlr/pull/248
+  patches = [(fetchpatch {
+    url = "https://github.com/emersion/xdg-desktop-portal-wlr/commit/92ccd62428082ba855e359e83730c4370cd1aac7.patch";
+    hash = "sha256-mU1whfp7BoSylaS3y+YwfABImZFOeuItSXCon0C7u20=";
+  })];
+
+  strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
+  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner makeWrapper ];
+  buildInputs = [ inih libdrm mesa pipewire systemd wayland wayland-protocols ];
 
   mesonFlags = [
     "-Dsd-bus-provider=libsystemd"
diff --git a/pkgs/development/lisp-modules-new/lisp-packages.nix b/pkgs/development/lisp-modules-new/lisp-packages.nix
index 513f72a985e0e..aebcfdb1878eb 100644
--- a/pkgs/development/lisp-modules-new/lisp-packages.nix
+++ b/pkgs/development/lisp-modules-new/lisp-packages.nix
@@ -133,10 +133,6 @@ let
     in stdenv.mkDerivation (rec {
       inherit pname version nativeLibs javaLibs lispLibs lisp systems asds;
 
-      src = if builtins.length patches > 0
-            then apply-patches args
-            else args.src;
-
       # When src is null, we are building a lispWithPackages and only
       # want to make use of the dependency environment variables
       # generated by build-asdf-system
@@ -201,7 +197,7 @@ let
         #
         # NOTE: It's important to read files from `src` instead of
         # from pwd to get go-to-definition working with SLIME
-        export CL_SOURCE_REGISTRY=$CL_SOURCE_REGISTRY:${src}//
+        export CL_SOURCE_REGISTRY=$CL_SOURCE_REGISTRY:$src//
 
         # Similiarily for native deps
         export LD_LIBRARY_PATH=${makeLibraryPath nativeLibs}:$LD_LIBRARY_PATH
@@ -209,7 +205,7 @@ let
 
         # Make asdf compile from `src` to pwd and load `lispLibs`
         # from storeDir. Otherwise it could try to recompile lisp deps.
-        export ASDF_OUTPUT_TRANSLATIONS="${src}:$(pwd):${storeDir}:${storeDir}"
+        export ASDF_OUTPUT_TRANSLATIONS="$src:$(pwd):${storeDir}:${storeDir}"
 
         # track lisp dependencies for graph generation
         # TODO: Do the propagation like for lisp, native and java like this:
@@ -248,24 +244,12 @@ let
       dontStrip = true;
       dontFixup = true;
 
-    } // args));
-
-  # Need to do that because we always want to compile straight from
-  # `src` for go-to-definition to work in SLIME.
-  apply-patches = { patches, src, ... }:
-    stdenv.mkDerivation {
-      inherit patches src;
-      pname = "source";
-      version = "patched";
-      dontConfigure = true;
-      dontBuild = true;
-      dontStrip = true;
-      dontFixup = true;
-      installPhase = ''
-        mkdir -pv $out
-        cp -r * $out
-      '';
-    };
+    } // (args // {
+      src = if builtins.length (args.patches or []) > 0
+            then pkgs.applyPatches { inherit (args) src patches; }
+            else args.src;
+      patches = [];
+    })));
 
   # Build the set of lisp packages using `lisp`
   # These packages are defined manually for one reason or another:
diff --git a/pkgs/development/lisp-modules-new/packages.nix b/pkgs/development/lisp-modules-new/packages.nix
index 1ad06f615b56e..244d2f4b5b5f0 100644
--- a/pkgs/development/lisp-modules-new/packages.nix
+++ b/pkgs/development/lisp-modules-new/packages.nix
@@ -102,6 +102,7 @@ let
       url = "https://github.com/cffi/cffi/archive/3f842b92ef808900bf20dae92c2d74232c2f6d3a.tar.gz";
       sha256 = "1jilvmbbfrmb23j07lwmkbffc6r35wnvas5s4zjc84i856ccclm2";
     };
+    patches = [ ./patches/cffi-libffi-darwin-ffi-h.patch ];
   });
 
   cl-unicode = build-with-compile-into-pwd {
@@ -423,6 +424,13 @@ let
     patches = [ ./patches/qtools-use-nix-libs.patch ];
   };
 
+  magicl = build-with-compile-into-pwd {
+    inherit (ql.magicl) pname version src lispLibs;
+    nativeBuildInputs = [ pkgs.gfortran ];
+    nativeLibs = [ pkgs.openblas ];
+    patches = [ ./patches/magicl-dont-build-fortran-twice.patch ];
+  };
+
   };
 
 in packages
diff --git a/pkgs/development/lisp-modules-new/patches/cffi-libffi-darwin-ffi-h.patch b/pkgs/development/lisp-modules-new/patches/cffi-libffi-darwin-ffi-h.patch
new file mode 100644
index 0000000000000..15c4a45887550
--- /dev/null
+++ b/pkgs/development/lisp-modules-new/patches/cffi-libffi-darwin-ffi-h.patch
@@ -0,0 +1,14 @@
+--- a/libffi/libffi-types.lisp
++++ b/libffi/libffi-types.lisp
+@@ -43,9 +43,6 @@
+ 
+ (pkg-config-cflags "libffi" :optional t)
+ 
+-#+darwin
+-(include "ffi/ffi.h")
+-#-darwin
+ (include "ffi.h")
+ 
+ (cenum status
+
+Diff finished.  Sun Nov 13 00:23:10 2022
\ No newline at end of file
diff --git a/pkgs/development/lisp-modules-new/patches/magicl-dont-build-fortran-twice.patch b/pkgs/development/lisp-modules-new/patches/magicl-dont-build-fortran-twice.patch
new file mode 100644
index 0000000000000..f63b6949b1fd5
--- /dev/null
+++ b/pkgs/development/lisp-modules-new/patches/magicl-dont-build-fortran-twice.patch
@@ -0,0 +1,21 @@
+--- a/magicl.asd
++++ b/magicl.asd
+@@ -143,6 +143,7 @@
+            (shared-object (make-pathname :type #+darwin "dylib" #-darwin "so"
+                                          :name "libexpokit"
+                                          :defaults fortran-file)))
++      (unless (probe-file (nn shared-object))
+       (uiop:run-program
+        (list "gfortran" "-fPIC" "-std=legacy"
+              "-c"
+@@ -155,7 +156,7 @@
+              (nn object-file)
+              #+darwin "-lblas"
+              #+darwin "-llapack"))
+-      (delete-file object-file))))
++      (delete-file object-file)))))
+ 
+ 
+ (asdf:defsystem #:magicl/ext-expokit
+
+Diff finished.  Mon Oct 10 22:03:54 2022
diff --git a/pkgs/development/python-modules/ansible-compat/default.nix b/pkgs/development/python-modules/ansible-compat/default.nix
index d2363d3e14a7a..f92423fde31a5 100644
--- a/pkgs/development/python-modules/ansible-compat/default.nix
+++ b/pkgs/development/python-modules/ansible-compat/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "ansible-compat";
-  version = "2.2.3";
+  version = "2.2.5";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-H06GH6OwhDaIrdMsWHOyCEjr75bvcV0dgI0mWDViBCg=";
+    sha256 = "sha256-KMfFRf1g75wwWc+y/v0n+S2wkf9rWGj4PxIc614f4bU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ansible-later/default.nix b/pkgs/development/python-modules/ansible-later/default.nix
index 964a008412911..b383453f7b925 100644
--- a/pkgs/development/python-modules/ansible-later/default.nix
+++ b/pkgs/development/python-modules/ansible-later/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-later";
-  version = "2.0.22";
+  version = "2.0.23";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-RFyQvg7CF5Fa+DnOo0PoDtGPJMOx0Md8I+gshMH2Fvs=";
+    hash = "sha256-FQnyWC7d9h8Ya2BlaTGTrNXkHtJJLdeNL7qXP7scLFA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ansible-lint/default.nix b/pkgs/development/python-modules/ansible-lint/default.nix
index 37948ff4ea66d..6460c0c923dbd 100644
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "ansible-lint";
-  version = "6.8.5";
+  version = "6.8.6";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-r+lWJWLp5tGxehhltUDU9xZb8Bz+8q0DA9HK1q05f4g=";
+    sha256 = "sha256-Fx/o2tYgeLmBm1x01g61r6ow6py5ybqHBhSeVsVam24=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index 614bbe28a21c8..44e5a519a7bba 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -3,6 +3,7 @@
 , ansible-core
 , buildPythonPackage
 , fetchPypi
+, glibcLocales
 , mock
 , openssh
 , pbr
@@ -20,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "ansible-runner";
-  version = "2.3.0";
+  version = "2.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mcTfu+reRGOXvRqeC/BQhz2KBrWSbVXSQIWyld2/Ecs=";
+    hash = "sha256-HS8C06Ylc/OOaKI3kBGLeYF5HCvtK18i96NqIhwoh1Y=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +46,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     ansible-core # required to place ansible CLI onto the PATH in tests
+    glibcLocales
     pytestCheckHook
     pytest-mock
     pytest-timeout
diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix
index 5858fa875cd36..b4d09d38f8873 100644
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@@ -24,11 +24,11 @@
 
 buildPythonPackage rec {
   pname = "ansible-core";
-  version = "2.13.5";
+  version = "2.14.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JtzZIY1VRMwVFE9gu1tjTyJ25HbIn0gbP2GcT53vFYg=";
+    hash = "sha256-+ki0gctiO/ebuQPyIwl2gaDBPhtOx+eOfdfYWNNqNLI=";
   };
 
   # ansible_connection is already wrapped, so don't pass it through
diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix
index bd435fc617e6a..81839ecce0079 100644
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@@ -20,7 +20,7 @@
 
 let
   pname = "ansible";
-  version = "6.5.0";
+  version = "6.6.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -30,7 +30,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-fAzc0RIaXxKrLaS90uFMLBU+ASFL/GprwVa2G9dAHFs=";
+    sha256 = "sha256-4blAqNT0EhI+3jwUsly5nDyKTVNf0ECqv45Pt7Dk8JI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/asyauth/default.nix b/pkgs/development/python-modules/asyauth/default.nix
index ca276bc37e8b4..4ac397875ec94 100644
--- a/pkgs/development/python-modules/asyauth/default.nix
+++ b/pkgs/development/python-modules/asyauth/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "asyauth";
-  version = "0.0.6";
+  version = "0.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XUUeZ8yqnZEMj3fCtq8YrZJH6Ci77f2OKXcCIHMbY8w=";
+    hash = "sha256-a4M2I+xIla+S3Hi5F+AZpZRicTp7EycGRWWldVyAV8E=";
   };
 
   propagatedBuildInputs = [
@@ -37,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Unified authentication library";
     homepage = "https://github.com/skelsec/asyauth";
+    changelog = "https://github.com/skelsec/asyauth/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index 5273069d019c6..eee9f58cc30d3 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -1,21 +1,20 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, pytz, pytestCheckHook, freezegun }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, pythonOlder, pytz, pytestCheckHook, freezegun }:
 
 buildPythonPackage rec {
   pname = "babel";
-  version = "2.10.3";
+  version = "2.11.0";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Babel";
     inherit version;
-    sha256 = "sha256-dhRVNxHul0kPcyEm3Ad/jQrghOvGqW4j2xSCr6vbLFE=";
+    sha256 = "sha256-XvSzImsBgN7d7UIpZRyLDho6aig31FoHMnLzE+TPl/Y=";
   };
 
   propagatedBuildInputs = [ pytz ];
 
   checkInputs = [ pytestCheckHook freezegun ];
 
-  doCheck = !stdenv.isDarwin;
-
   meta = with lib; {
     homepage = "https://babel.pocoo.org/";
     description = "Collection of internationalizing tools";
diff --git a/pkgs/development/python-modules/cftime/default.nix b/pkgs/development/python-modules/cftime/default.nix
index 865282cfa6508..c925381d00f13 100644
--- a/pkgs/development/python-modules/cftime/default.nix
+++ b/pkgs/development/python-modules/cftime/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , cython
 , fetchPypi
+, fetchpatch
 , numpy
 , pytestCheckHook
 , pythonOlder
@@ -16,9 +17,22 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-hhTAD7ilBG3jBP3Ybb0iT5lAgYXXskWsZijQJ2WW5tI=";
+    hash = "sha256-hhTAD7ilBG3jBP3Ybb0iT5lAgYXXskWsZijQJ2WW5tI=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Fix test_num2date_precision by checking per platform precision
+      url = "https://github.com/Unidata/cftime/commit/221ff2195d588a43a7984597033b678f330fbc41.patch";
+      hash = "sha256-3XTJuET20g9QElM/8WGnNzJBFZ0oUN4ikhWKppwcyNM=";
+    })
+  ];
+
+  postPatch = ''
+    sed -i "/--cov/d" setup.cfg
+  '';
+
+
   nativeBuildInputs = [
     cython
     numpy
@@ -32,10 +46,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    sed -i "/--cov/d" setup.cfg
-  '';
-
   pythonImportsCheck = [
     "cftime"
   ];
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 6006c30219e12..6d948889341d3 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -20,7 +20,7 @@
 
 let
   pname = "hatchling";
-  version = "1.9.0";
+  version = "1.11.1";
 in
 buildPythonPackage {
   inherit pname version;
@@ -28,7 +28,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-tXxzYvQ3uUJuS5QiiiHSrFgE+7KrywGt3iVEo1uzA80=";
+    hash = "sha256-n4Q2H3DPOnq5VDsMPsxkIR7SuopganHrakc8HJsI4dA=";
   };
 
   # listed in backend/src/hatchling/ouroboros.py
@@ -72,6 +72,7 @@ buildPythonPackage {
   meta = with lib; {
     description = "Modern, extensible Python build backend";
     homepage = "https://hatch.pypa.io/latest/";
+    changelog = "https://github.com/pypa/hatch/blob/hatchling-v${version}/docs/history.md#hatchling";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ofek ];
   };
diff --git a/pkgs/development/python-modules/incremental/default.nix b/pkgs/development/python-modules/incremental/default.nix
index 55123163dbf58..cf22ae79d8daf 100644
--- a/pkgs/development/python-modules/incremental/default.nix
+++ b/pkgs/development/python-modules/incremental/default.nix
@@ -7,11 +7,11 @@
 
 let incremental = buildPythonPackage rec {
   pname = "incremental";
-  version = "21.3.0";
+  version = "22.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "02f5de5aff48f6b9f665d99d48bfc7ec03b6e3943210de7cfc88856d755d6f57";
+    sha256 = "sha256-kS/uteD34BiOb0IkHS9FAALhG7wJN8ZYZQRYVMJMC9A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/invoke/default.nix b/pkgs/development/python-modules/invoke/default.nix
index a2180f5b964a6..65f4fe105f66f 100644
--- a/pkgs/development/python-modules/invoke/default.nix
+++ b/pkgs/development/python-modules/invoke/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "invoke";
-  version = "1.7.1";
+  version = "1.7.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e23q9YXu4KhIIF0LjAAUub9vKHqOt5iBimQt/x3xSxk=";
+    hash = "sha256-QbQoNC1GaoITXVqzcRloWpiXE3Qr5G5Co6OZ1oVXkxQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index 536389fb3b109..69dba8bd472ea 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "4.16.0";
+  version = "4.17.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FlBZ8Hbv9pcbrlt0L8App7TvP5vPBMFOR3anYF3hSyM=";
+    sha256 = "sha256-W/zyvKFqCHreF+ArKC00r3zNdJ73YkHn+b18DLipQk0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/msldap/default.nix b/pkgs/development/python-modules/msldap/default.nix
index 445eea622d243..4afd120430b88 100644
--- a/pkgs/development/python-modules/msldap/default.nix
+++ b/pkgs/development/python-modules/msldap/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "msldap";
-  version = "0.4.6";
+  version = "0.4.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iiAtylJIzcfNyh1d92wA1oOYk7UWdD/F0sWtlAMMv2g=";
+    hash = "sha256-WMMqNSRDBwPQ/1ACgtuSvA50j+xNyjnxl7rTbx3uQ1w=";
   };
 
   propagatedBuildInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python LDAP library for auditing MS AD";
     homepage = "https://github.com/skelsec/msldap";
+    changelog = "https://github.com/skelsec/msldap/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index 659ca88d0f9a7..00be47cf82070 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.11.10";
+  version = "7.11.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "youtype";
     repo = "mypy_boto3_builder";
-    rev = version;
-    hash = "sha256-bS56xHrAoYKjwfbz5vh6O41EGDM821z4ZFZfpqc65cE=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-4iyh/oXuYsdtqEf1Dh4Z3y8AHWiS1TmimO5HUwsHrHA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ocifs/default.nix b/pkgs/development/python-modules/ocifs/default.nix
index bf5bbe175aded..2d4e4bfa8757a 100644
--- a/pkgs/development/python-modules/ocifs/default.nix
+++ b/pkgs/development/python-modules/ocifs/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ocifs";
-  version = "1.1.3";
+  version = "1.1.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "oracle";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-wMKrK7ONc3M6beF9czrGddSeElCOTGh+JD9efb4Shbg=";
+    hash = "sha256-zZREWEFWQj4G2RyEMH0X3oPr5Yu5/96UX6nm9HDmJCY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index d649d6ccbbace..98e3ede7fb925 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,20 +16,20 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.8.0";
+  version = "3.8.1";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ijl";
     repo = pname;
     rev = version;
-    hash = "sha256-P1n0r5181Wt4tml2SKMI7pDNh2YakCp1I+cvQM6RRWg=";
+    hash = "sha256-3U27JuKMsMla3BKbbpO0uXesGHYaVQs8MwtQvumkksY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-8k0DetamwLqkdcg8V/D2J5ja6IJSLi50CE+ZjFa7Hdc=";
+    hash = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY";
   };
 
   format = "pyproject";
@@ -52,6 +52,12 @@ buildPythonPackage rec {
     xxhash
   ];
 
+  disabledTests = lib.optionals (stdenv.is32bit) [
+    # integer overflow on 32bit
+    "test_numpy_array_d1_intp"
+    "test_numpy_array_d1_uintp"
+  ];
+
   pythonImportsCheck = [ pname ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/oslo-log/default.nix b/pkgs/development/python-modules/oslo-log/default.nix
index 0e5850da05ae2..87e2b969f7341 100644
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "oslo-log";
-  version = "5.0.1";
+  version = "5.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "oslo.log";
     inherit version;
-    hash = "sha256-+2Xy+dJEI/pt1urY7NIfZlxi4P2fkL8xHkwVO1+Kt+o=";
+    hash = "sha256-5F5zEqpxUooWc2zkUVK+PxrxI/XvYqqB2gRoBVhPzKM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index 0fe9ac5a73676..ff77f7526b808 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "5.10.0";
+  version = "5.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-z8xP+OaYJW/BfqP/eWR4sFCFJYWqW6557NBbKrezm5o=";
+    sha256 = "sha256-uXvGaVsq/wIUQTPC5zmdWIUiPUK3kS/67CyjiY5nO/4=";
   };
 
   # importlib-metadata could be added here if it wouldn't cause an infinite recursion
diff --git a/pkgs/development/python-modules/pbr/tests.nix b/pkgs/development/python-modules/pbr/tests.nix
index aacb726d6a1d1..b04751231872e 100644
--- a/pkgs/development/python-modules/pbr/tests.nix
+++ b/pkgs/development/python-modules/pbr/tests.nix
@@ -24,6 +24,9 @@ buildPythonPackage rec {
 
   dontBuild = true;
   dontInstall = true;
+  preConfigure = ''
+    pythonOutputDistPhase() { touch $dist; }
+  '';
 
   checkInputs = [
     pbr
diff --git a/pkgs/development/python-modules/pymilter/default.nix b/pkgs/development/python-modules/pymilter/default.nix
new file mode 100644
index 0000000000000..0724161bf4236
--- /dev/null
+++ b/pkgs/development/python-modules/pymilter/default.nix
@@ -0,0 +1,40 @@
+{ lib, python, buildPythonPackage, fetchFromGitHub, libmilter, bsddb3, pydns, iana-etc, libredirect }:
+
+buildPythonPackage rec {
+  pname = "pymilter";
+  version = "1.0.5";
+
+  src = fetchFromGitHub {
+    owner = "sdgathman";
+    repo = pname;
+    rev = "${pname}-${version}";
+    hash = "sha256-gZUWEDVZfDRiOOdG3lpiQldHxm/93l8qYVOHOEpHhzQ=";
+  };
+
+  buildInputs = [ libmilter ];
+  propagatedBuildInputs = [ bsddb3 pydns ];
+
+  preBuild = ''
+    sed -i 's/import thread/import _thread as thread/' Milter/greylist.py
+  '';
+
+  # requires /etc/resolv.conf
+  # testpolicy: requires makemap (#100419)
+  #   using exec -a makemap smtpctl results in "unknown group smtpq"
+  preCheck = ''
+    echo "nameserver 127.0.0.1" > resolv.conf
+    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/resolv.conf=$(realpath resolv.conf)
+    export LD_PRELOAD=${libredirect}/lib/libredirect.so
+    sed -i '/testpolicy/d' test.py
+    rm testpolicy.py
+  '';
+
+  pythonImportsCheck = [ "Milter" ];
+
+  meta = with lib; {
+    homepage = "http://bmsi.com/python/milter.html";
+    description = "Python bindings for libmilter api";
+    maintainers = with maintainers; [ yorickvp ];
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 1b847100a955a..2a81ebf40efe0 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -11,15 +11,20 @@
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "22.0.0";
+  version = "22.1.0";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchPypi {
     pname = "pyOpenSSL";
     inherit version;
-    sha256 = "sha256-ZgsbFCWqxKG+odlBaKhdmfCzFEyGndQ5DSdinQCH8b8=";
+    sha256 = "sha256-eoO3snLdWVIi1nL1zimqAw8fuDdjDvIp9i5y45XOiWg=";
   };
 
-  outputs = [ "out" "dev" ];
+  postPatch = ''
+    # remove cryptography pin
+    sed "/cryptography/ s/,<[0-9]*//g" setup.py
+  '';
 
   # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
   # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
diff --git a/pkgs/development/python-modules/pyotgw/default.nix b/pkgs/development/python-modules/pyotgw/default.nix
index c0f24aa3dc6d0..7e6807854180e 100644
--- a/pkgs/development/python-modules/pyotgw/default.nix
+++ b/pkgs/development/python-modules/pyotgw/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyotgw";
-  version = "2.1.1";
+  version = "2.1.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mvn23";
     repo = pname;
-    rev = version;
-    hash = "sha256-gMrLoITDBO7T9JtY4O43aMKF88zhwnJ/rlw8U3yvG8k=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-qUwpW9C9VqsbDNa9zqa/BZtMuzmPU21Au/q0iGRkBNY=";
   };
 
   propagatedBuildInputs = [
@@ -37,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to interact the OpenTherm Gateway";
     homepage = "https://github.com/mvn23/pyotgw";
+    changelog = "https://github.com/mvn23/pyotgw/blob/${version}/CHANGELOG.md";
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyside2/default.nix b/pkgs/development/python-modules/pyside2/default.nix
index 81df3cbe94c60..5826ed7be1606 100644
--- a/pkgs/development/python-modules/pyside2/default.nix
+++ b/pkgs/development/python-modules/pyside2/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
     "-DPYTHON_EXECUTABLE=${python.interpreter}"
   ];
 
+  NIX_CFLAGS_COMPILE = "-I${qt5.qtdeclarative.dev}/include/QtQuick/${qt5.qtdeclarative.version}/QtQuick";
+
   nativeBuildInputs = [ cmake ninja qt5.qmake python ];
   buildInputs = (with qt5; [
     qtbase qtxmlpatterns qtmultimedia qttools qtx11extras qtlocation qtscript
diff --git a/pkgs/development/python-modules/pytest-mockito/default.nix b/pkgs/development/python-modules/pytest-mockito/default.nix
new file mode 100644
index 0000000000000..240cf44343e21
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-mockito/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytest
+, mockito
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-mockito";
+  version = "0.0.4";
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "kaste";
+    repo = "pytest-mockito";
+    rev = version;
+    hash = "sha256-vY/i1YV1lo4mZvnxsXBOyaq31YTiF0BY6PTVwdVX10I=";
+  };
+
+  buildInputs = [
+    pytest
+  ];
+
+  propagatedBuildInputs = [
+    mockito
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Base fixtures for mockito";
+    homepage = "https://github.com/kaste/pytest-mockito";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-ldap/default.nix b/pkgs/development/python-modules/python-ldap/default.nix
index 7b3c2bdbc0ba4..f8844c5eaec77 100644
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@@ -45,6 +45,11 @@ buildPythonPackage rec {
     export SCHEMA="${openldap}/etc/schema"
   '';
 
+  disabledTests = [
+    # https://github.com/python-ldap/python-ldap/issues/501
+    "test_tls_ext_noca"
+  ];
+
   doCheck = !stdenv.isDarwin;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pytz-deprecation-shim/default.nix b/pkgs/development/python-modules/pytz-deprecation-shim/default.nix
index 6ea1c2c8f2e03..cce3c469cc22c 100644
--- a/pkgs/development/python-modules/pytz-deprecation-shim/default.nix
+++ b/pkgs/development/python-modules/pytz-deprecation-shim/default.nix
@@ -41,11 +41,9 @@ buildPythonPackage rec {
   ];
 
   # https://github.com/pganssle/pytz-deprecation-shim/issues/27
-  doCheck = pythonAtLeast "3.9";
-
-  disabledTests = [
-    "test_localize_explicit_is_dst"
-  ];
+  # https://github.com/pganssle/pytz-deprecation-shim/issues/30
+  # The test suite is just very flaky and breaks all the time
+  doCheck = false;
 
   meta = with lib; {
     description = "Shims to make deprecation of pytz easier";
diff --git a/pkgs/development/python-modules/robotframework-pythonlibcore/default.nix b/pkgs/development/python-modules/robotframework-pythonlibcore/default.nix
new file mode 100644
index 0000000000000..01e6a98c02280
--- /dev/null
+++ b/pkgs/development/python-modules/robotframework-pythonlibcore/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, fetchpatch
+, pytest-mockito
+, pytestCheckHook
+, robotframework
+}:
+
+buildPythonPackage rec {
+  pname = "robotframework-pythonlibcore";
+  version = "4.0.0";
+
+  disabled = pythonOlder "3.7";
+
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "robotframework";
+    repo = "PythonLibCore";
+    rev = "v${version}";
+    hash = "sha256-86o5Lh9zWo4vUF2186dN7e8tTUu5PIxM/ZukPwNl0S8=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "fix-finding-version.patch";
+      url = "https://github.com/robotframework/PythonLibCore/commit/84c73979e309f59de057ae6a77725ab0f468b71f.patch";
+      hash = "sha256-zrjsNvXpJDLpXql200NV+QGWFLtnRVZTeAjT52dRn2s=";
+    })
+  ];
+
+  checkInputs = [
+    pytest-mockito
+    pytestCheckHook
+    robotframework
+  ];
+
+  preCheck = ''
+    export PYTHONPATH="atest:utest/helpers:$PYTHONPATH"
+  '';
+
+  pythonImportsCheck = [ "robotlibcore" ];
+
+  meta = {
+    changelog = "https://github.com/robotframework/PythonLibCore/blob/${src.rev}/docs/PythonLibCore-${version}.rst";
+    description = "Tools to ease creating larger test libraries for Robot Framework using Python";
+    homepage = "https://github.com/robotframework/PythonLibCore";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
index 806387f1095e5..7f08c345bc6b8 100644
--- a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
@@ -1,4 +1,16 @@
-{ stdenv, lib, buildPythonPackage, fetchFromGitHub, python, robotframework, selenium, mockito, robotstatuschecker, approvaltests }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, python
+, robotframework
+, robotframework-pythonlibcore
+, selenium
+, approvaltests
+, pytest-mockito
+, pytestCheckHook
+, robotstatuschecker
+}:
 
 buildPythonPackage rec {
   version = "6.0.0";
@@ -12,17 +24,40 @@ buildPythonPackage rec {
     sha256 = "1rjzz6mrx4zavcck2ry8269rf3dkvvs1qfa9ra7dkppbarrjin3f";
   };
 
-  propagatedBuildInputs = [ robotframework selenium ];
-  checkInputs = [ mockito robotstatuschecker approvaltests ];
+  propagatedBuildInputs = [
+    robotframework
+    robotframework-pythonlibcore
+    selenium
+  ];
 
-  # Only execute Unit Tests. Acceptance Tests require headlesschrome, currently
-  # not available in nixpkgs
-  checkPhase = ''
-    ${python.interpreter} utest/run.py
-  '';
+  checkInputs = [
+    approvaltests
+    pytest-mockito
+    pytestCheckHook
+    robotstatuschecker
+  ];
+
+  disabledTestPaths = [
+    # https://github.com/robotframework/SeleniumLibrary/issues/1804
+    "utest/test/keywords/test_webdrivercache.py"
+  ];
+
+  disabledTests = [
+    "test_create_opera_executable_path_not_set"
+    "test_create_opera_executable_path_set"
+    "test_create_opera_with_options"
+    "test_create_opera_with_service_log_path_real_path"
+    "test_get_executable_path"
+    "test_get_ff_profile_instance_FirefoxProfile"
+    "test_has_options"
+    "test_importer"
+    "test_log_file_with_index_exist"
+    "test_opera"
+    "test_single_method"
+  ];
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    changelog = "https://github.com/robotframework/SeleniumLibrary/blob/${src.rev}/docs/SeleniumLibrary-${version}.rst";
     description = "Web testing library for Robot Framework";
     homepage = "https://github.com/robotframework/SeleniumLibrary";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index f85121a39ac3e..457a9c622a121 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchPypi
+, fetchpatch
 , python
 , pythonOlder
 , buildPythonPackage
@@ -28,6 +29,13 @@ buildPythonPackage rec {
     sha256 = "sha256-JtKMRokA5tX9s30oEqtG2wzNIsY7qglQV4cfqjpJi8k=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/scipy/scipy/commit/318d8c6d16fdf000be8637e9917989729f2c8ce7.diff";
+      sha256 = "sha256-Zfb9GYP0r9MDJ91hSzMN1r4eNilajPThNIvZmDzFEXo=";
+    })
+  ];
+
   nativeBuildInputs = [ cython gfortran meson-python pythran pkg-config wheel ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/tzdata/default.nix b/pkgs/development/python-modules/tzdata/default.nix
index d1fed0b21fa96..2e3cdafc8a125 100644
--- a/pkgs/development/python-modules/tzdata/default.nix
+++ b/pkgs/development/python-modules/tzdata/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "tzdata";
-  version = "2022.2";
+  version = "2022.6";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IfTw1yQVcu+n96T9q7BS5htV3EgnTmhCaXzN9SU+VFE=";
+    hash = "sha256-kfEdtFAzhZKMFVmMmFc+OvB+cikYG+5Tdb0w8Wld3K4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index e773960730f6f..cdabed860c92c 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -9,14 +9,14 @@
 
 let zipp = buildPythonPackage rec {
   pname = "zipp";
-  version = "3.8.1";
+  version = "3.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-BbRfHuj4B9DMkoSFykCgfLSRzwkv9YfA35yx/RVISNI=";
+    sha256 = "sha256-enJi/ZML0+NsULmmSJeuw/r/89/e7JYjriK0DpP5m7g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 9d2edcb749c5b..5ba3503d98610 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.3.24";
-  source.sha256 = "sha256-6qLrjDiS6HD5eSUrIZa9d+tVHh2/PNxOsWS6AexEOMQ=";
+  version = "2.3.25";
+  source.sha256 = "sha256-/YHsRjXEGJtm/QeJU31cs4s4ELcHZfbh6C3aFbl1ka0=";
   dontPatchShebangs = true;
 
   passthru.updateScript = writeScript "gem-update-script" ''
diff --git a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
index 890ce162164a5..17e8458e7dcf6 100644
--- a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
+++ b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tarpaulin";
-  version = "0.22.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     rev = version;
-    sha256 = "sha256-NABmCLEJBt+lpe28pgztMmPFja2httg3THlvk9EMbUI=";
+    sha256 = "sha256-UDUbndsuXZDu7j+JhkS6kkFP6ju88+hXffy42XQY8gQ=";
   };
 
   nativeBuildInputs = [
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ curl Security ];
 
-  cargoSha256 = "sha256-PyY7H7he/LhfhIhZnT13rSc7zNnOWnLMfgwTUfX39bQ=";
+  cargoSha256 = "sha256-iLqxixUEZhz3Kv7D84RqVyvtoZx69dhdLKTnVnsO0k0=";
   #checkFlags = [ "--test-threads" "1" ];
   doCheck = false;
 
diff --git a/pkgs/development/tools/appthreat-depscan/default.nix b/pkgs/development/tools/appthreat-depscan/default.nix
index c4ba4b27939f0..fc8f3a9bd528a 100644
--- a/pkgs/development/tools/appthreat-depscan/default.nix
+++ b/pkgs/development/tools/appthreat-depscan/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "appthreat-depscan";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner = "AppThreat";
     repo = "dep-scan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AxdtphC9dVd/o52hW8L+5gaEDeP9wvR0vSZS3XY9sAw=";
+    hash = "sha256-JxaimM9sL6khTGJoSUFO2Dzlki6uoyqXEJznk6UHK/0=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index d64b3bbe1a881..7f0d94a9f30ee 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.24.2";
+  version = "3.24.3";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-DZAg8G893xf7U33CKOGlbJJ+5Qa0hvVf4twZ9pvwyNs=";
+    sha256 = "sha256-tTqhD6gr/4TM21kGWSe3LTvuSfTYYmEkn8CYSzs2cpE=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/dprint/default.nix b/pkgs/development/tools/dprint/default.nix
index 8f5435f82728a..1ff2577b5d9f3 100644
--- a/pkgs/development/tools/dprint/default.nix
+++ b/pkgs/development/tools/dprint/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dprint";
-  version = "0.32.2";
+  version = "0.33.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-F7hqSbCGP3p+6khNMfuUABAvtB8MMABcpX7zK9rWhrQ=";
+    sha256 = "sha256-7UgE8/FPEG3VUtQLdlvfaFx9N6iIci5eu+Z2HBo+7c0=";
   };
 
-  cargoSha256 = "sha256-Azsky2rst+z33EKfZ+6LSeF+MpSNjNxQrLkqxgLAQ1o=";
+  cargoSha256 = "sha256-/7YUbbuoN/qUIHk95ndaKjHZdJOPNTqZqOBvM2dHvoc=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/development/tools/hatch/default.nix b/pkgs/development/tools/hatch/default.nix
index 777028a008f90..952a8ecb16cbc 100644
--- a/pkgs/development/tools/hatch/default.nix
+++ b/pkgs/development/tools/hatch/default.nix
@@ -7,22 +7,25 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hatch";
-  version = "1.3.1";
+  version = "1.6.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "hatch";
     rev = "hatch-v${version}";
-    sha256 = "sha256-ftT86HX5CVbiHe5yzXT2gNl8Rx+f+fmiAJRnOuDpvYI=";
+    hash = "sha256-3nPh6F+TmLoogz9FgaZMub7hPJIzANCY4oWk9Mq22Pc=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
     click
     hatchling
     httpx
+    hyperlink
     keyring
+    packaging
     pexpect
+    platformdirs
     pyperclip
     rich
     shellingham
@@ -36,6 +39,7 @@ python3.pkgs.buildPythonApplication rec {
     git
     pytestCheckHook
     pytest-mock
+    pytest-xdist
   ];
 
   preCheck = ''
@@ -54,6 +58,7 @@ python3.pkgs.buildPythonApplication rec {
     "test_editable_exact"
     "test_editable_exact_extra_dependencies"
     "test_editable_exact_force_include"
+    "test_editable_exact_force_include_option"
     "test_editable_exact_force_include_build_data_precedence"
     "test_editable_pth"
     # AssertionError: assert len(extract_installed_requirements(output.splitlines())) > 0
@@ -63,6 +68,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Modern, extensible Python project manager";
     homepage = "https://hatch.pypa.io/latest/";
+    changelog = "https://github.com/pypa/hatch/blob/${src.rev}/docs/history.md#hatch";
     license = licenses.mit;
     maintainers = with maintainers; [ onny ];
   };
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index 9cf752af5b8f0..ac80fc471e063 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -1,37 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, buildPackages, ncurses }:
+{ lib, stdenv, fetchFromGitHub, buildPackages, perl, which, ncurses }:
 
-let dialect = with lib; last (splitString "-" stdenv.hostPlatform.system); in
+let
+  dialect = with lib; last (splitString "-" stdenv.hostPlatform.system);
+in
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.95.0";
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  buildInputs = [ ncurses ];
+  version = "4.96.4";
 
   src = fetchFromGitHub {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    sha256 = "sha256-HgU7/HxLdUOfLU2E/dpusko6gBOoEKeWPJIFbBQGzFU=";
+    sha256 = "sha256-S+8KizjayqeiWsMySWjRoZQf7ODCjdMq5ULoetOdYiA=";
   };
 
   patches = [
     ./no-build-info.patch
-
-    # Pull upstream fix for -fno-common toolchains:
-    #   https://github.com/lsof-org/lsof/pull/226
-    #   https://github.com/lsof-org/lsof/pull/233
-    (fetchpatch {
-      name = "add-extern.patch";
-      url = "https://github.com/lsof-org/lsof/commit/180ffa29b0544f77cabbc54d7f77d50d33dd27d7.patch";
-      sha256 = "sha256-zzcN9HrFYMTBeEekeAwi2RIcVukymgaqtpvFIBV6njU=";
-    })
-    (fetchpatch {
-      name = "add-declaration.patch";
-      url = "https://github.com/lsof-org/lsof/commit/8e47e1491636e8cf41baf834554391be45177b00.patch";
-      sha256 = "sha256-kwkDQp7VApLenOLTPMY24Me+/xUhD56skHWRd4ZB1I4=";
-    })
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -40,9 +25,14 @@ stdenv.mkDerivation rec {
     sed -i 's|lcurses|lncurses|g' Configure
   '';
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ perl which ];
+  buildInputs = [ ncurses ];
+
   # Stop build scripts from searching global include paths
   LSOF_INCLUDE = "${lib.getDev stdenv.cc.libc}/include";
   configurePhase = "LINUX_CONF_CC=$CC_FOR_BUILD LSOF_CC=$CC LSOF_AR=\"$AR cr\" LSOF_RANLIB=$RANLIB ./Configure -n ${dialect}";
+
   preBuild = ''
     for filepath in $(find dialects/${dialect} -type f); do
       sed -i "s,/usr/include,$LSOF_INCLUDE,g" $filepath
@@ -67,8 +57,8 @@ stdenv.mkDerivation rec {
       socket (IPv6/IPv4/UNIX local), or partition (by opening a file
       from it).
     '';
-    maintainers = [ maintainers.dezgeg ];
-    platforms = platforms.unix;
     license = licenses.purdueBsd;
+    maintainers = with maintainers; [ dezgeg ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index 458b4a10c8d08..3a4cd640d9586 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, clang, rustfmt
+{ lib, fetchCrate, rustPlatform, clang, rustfmt
 , runtimeShell
 , bash
 }:
@@ -7,18 +7,15 @@ let
   rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.59.2";
+  version = "0.61.0";
 
-  RUSTFLAGS = "--cap-lints warn"; # probably OK to remove after update
-
-  src = fetchFromGitHub {
-    owner = "rust-lang";
-    repo = "rust-bindgen";
-    rev = "v${version}";
-    sha256 = "sha256-bJYdyf5uZgWe7fQ80/3QsRV0qyExYn6P9UET3tzwPFs=";
+  src = fetchCrate {
+    pname = "bindgen-cli";
+    inherit version;
+    sha256 = "sha256-sKcKIAkUC2GfAZ4tJBNweXhoFzqO95iCpHgekpOyHzc=";
   };
 
-  cargoSha256 = "sha256-RKZY5vf6CSFaKweuuNkeFF0ZXlSUibAkcL/YhkE0MoQ=";
+  cargoSha256 = "sha256-P246tw5Kznpxav0LashIkLlmQGVB+aKbFUQQdmcASPw=";
 
   buildInputs = [ clang.cc.lib ];
 
diff --git a/pkgs/games/itch/default.nix b/pkgs/games/itch/default.nix
index 7aed72dd531da..5776a1b43b2b0 100644
--- a/pkgs/games/itch/default.nix
+++ b/pkgs/games/itch/default.nix
@@ -41,7 +41,7 @@ stdenvNoCC.mkDerivation rec {
         repo = pname;
         rev = "v${version}";
         hash = "sha256-DZBmf8fe0zw5uiQjNKXw8g/vU2hjNDa87z/7XuhyXog=";
-        inherit sparseCheckout;
+        sparseCheckout = [ sparseCheckout ];
       } + sparseCheckout;
 
   nativeBuildInputs = [ copyDesktopItems makeWrapper ];
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 933b4e176f762..2d1b57417e680 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  apparmor-version = "3.1.1";
+  apparmor-version = "3.1.2";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -36,7 +36,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-phEHfrza0EeX2HEM5ts8wVCFlSLlnEtZd2MwbG/XbFY=";
+    hash = "sha256-0csF6dPel1CxbvNkg7fIrdPpnCM+hqht2a5nwPlR58A=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
diff --git a/pkgs/os-specific/linux/bpftools/default.nix b/pkgs/os-specific/linux/bpftools/default.nix
index d3bb96afb3e78..287ad9d42264b 100644
--- a/pkgs/os-specific/linux/bpftools/default.nix
+++ b/pkgs/os-specific/linux/bpftools/default.nix
@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xDalSMcxLOb8WjRyy+rYle749ShB++fHH9jki9/isLo=";
   };
 
-  patches = [ ./strip-binary-name.patch ];
+  patches = [
+    ./strip-binary-name.patch
+    # fix unknown type name '__vector128' on ppc64le
+    ./include-asm-types-for-ppc64le.patch
+  ];
 
   nativeBuildInputs = [ python3 bison flex ];
   buildInputs = (if (lib.versionAtLeast version "5.20")
diff --git a/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch b/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch
new file mode 100644
index 0000000000000..47c8f8077a5a7
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch
@@ -0,0 +1,13 @@
+diff --git a/tools/include/uapi/linux/types.h b/tools/include/uapi/linux/types.h
+index 91fa51a9c31d..bfbd9b47277f 100644
+--- a/tools/include/uapi/linux/types.h
++++ b/tools/include/uapi/linux/types.h
+@@ -2,7 +2,7 @@
+ #ifndef _UAPI_LINUX_TYPES_H
+ #define _UAPI_LINUX_TYPES_H
+ 
+-#include <asm-generic/int-ll64.h>
++#include <asm/types.h>
+ 
+ /* copied from linux:include/uapi/linux/types.h */
+ #define __bitwise
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index fe789d51dbb50..c121ef6f6f539 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.360";
+  version = "0.363";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-dF1Yeb3xH4keQzcydZ3h3kyuSZ1knW/2YAJ8xvFSoMo=";
+    sha256 = "sha256-A6GNrHc/t2SVyAyJWmzQTa+pD9wGESsz7DNruW2kH4s=";
   };
 
   postPatch = ''
@@ -19,9 +19,6 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
 
-  outputHashMode = "recursive";
-  outputHash = "sha256-gkgnHy1XwP87qpQiAm31AIAkxgGm5JYxMBr60kvd+gE=";
-
   meta = {
     homepage = "https://github.com/vcrhonek/hwdata";
     description = "Hardware Database, including Monitors, pci.ids, usb.ids, and video cards";
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index d8841b2c96109..6dc9bc6b0f47b 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -388,7 +388,9 @@ let
     # Filesystem options - in particular, enable extended attributes and
     # ACLs for all filesystems that support them.
     filesystem = {
-      FANOTIFY        = yes;
+      FANOTIFY                    = yes;
+      FANOTIFY_ACCESS_PERMISSIONS = yes;
+
       TMPFS           = yes;
       TMPFS_POSIX_ACL = yes;
       FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else whenAtLeast "4.9" (option module);
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index d212c65cec72b..eaa1d06585816 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
+{ lib, stdenv, fetchurl, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
 , systemd, nettle, libedit, zlib, libiconv, libintl, libmaxminddb, libbpf, nghttp2, libmnl
 , ngtcp2-gnutls
 , autoreconfHook
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "cea9c1988cdce7752f88fbe37378f65e83c4e54048978b94fb21a9c92f88788f";
+    sha256 = "f736ef284358923e312f8e1e3c6ce7c97b20965b09eb65705e9f7e3d5e9a9d79";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -27,11 +27,6 @@ stdenv.mkDerivation rec {
     # They are later created from NixOS itself.
     ./dont-create-run-time-dirs.patch
     ./runtime-deps.patch
-    # knsupdate: fix segfault due to NULL pointer access when sending an update
-    (fetchpatch {
-      url = "https://gitlab.nic.cz/knot/knot-dns/-/commit/8a6645dab63d8fa7932c7d8f747fe33e8cc97e84.patch";
-      hash = "sha256-qzhSdRH5GqHqN9eLMWbDXmjO4JagsMRSZh3NWRFprao=";
-    })
   ];
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/servers/mail/pypolicyd-spf/default.nix b/pkgs/servers/mail/pypolicyd-spf/default.nix
deleted file mode 100644
index cbc63ff535a11..0000000000000
--- a/pkgs/servers/mail/pypolicyd-spf/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, buildPythonApplication, fetchurl, pyspf }:
-
-buildPythonApplication rec {
-  pname = "pypolicyd-spf";
-  majorVersion = "2.0";
-  version = "${majorVersion}.2";
-
-  src = fetchurl {
-    url = "https://launchpad.net/pypolicyd-spf/${majorVersion}/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "1nm8y1jjgx6mxrbcxrbdnmkf8vglwp0wiw6jipzh641wb24gi76z";
-  };
-
-  propagatedBuildInputs = [ pyspf ];
-
-  preBuild = ''
-    substituteInPlace setup.py --replace "'/etc'" "'$out/etc'"
-  '';
-
-  meta = with lib; {
-    homepage = "https://launchpad.net/pypolicyd-spf/";
-    description = "Postfix policy engine for Sender Policy Framework (SPF) checking";
-    maintainers = with maintainers; [ abbradar ];
-    license = licenses.asl20;
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/servers/mail/spf-engine/default.nix b/pkgs/servers/mail/spf-engine/default.nix
new file mode 100644
index 0000000000000..0f2e985825141
--- /dev/null
+++ b/pkgs/servers/mail/spf-engine/default.nix
@@ -0,0 +1,30 @@
+{ lib, buildPythonApplication, fetchurl, pyspf, dnspython, authres, pymilter }:
+
+buildPythonApplication rec {
+  pname = "spf-engine";
+  version = "2.9.3";
+
+  src = fetchurl {
+    url = "https://launchpad.net/${pname}/${lib.versions.majorMinor version}/${version}/+download/${pname}-${version}.tar.gz";
+    sha256 = "sha256-w0Nb+L/Os3KPApENoylxCVaCD4FvgmvpfVvwCkt2IDE=";
+  };
+
+  propagatedBuildInputs = [ pyspf dnspython authres pymilter ];
+
+  pythonImportsCheck = [
+    "spf_engine"
+    "spf_engine.milter_spf"
+    "spf_engine.policyd_spf"
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py --replace "'/etc'" "'$out/etc'"
+  '';
+
+  meta = with lib; {
+    homepage = "https://launchpad.net/spf-engine/";
+    description = "Postfix policy engine for Sender Policy Framework (SPF) checking";
+    maintainers = with maintainers; [ abbradar ];
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/servers/matrix-appservice-discord/package.json b/pkgs/servers/matrix-appservice-discord/package.json
index f3a2026a208d5..d382f29c686ae 100644
--- a/pkgs/servers/matrix-appservice-discord/package.json
+++ b/pkgs/servers/matrix-appservice-discord/package.json
@@ -1,6 +1,6 @@
 {
   "name": "matrix-appservice-discord",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "A bridge between Matrix and Discord",
   "main": "discordas.js",
   "engines": {
diff --git a/pkgs/servers/matrix-appservice-discord/pin.json b/pkgs/servers/matrix-appservice-discord/pin.json
index 4f454988f0c64..57b7ffd28a2c3 100644
--- a/pkgs/servers/matrix-appservice-discord/pin.json
+++ b/pkgs/servers/matrix-appservice-discord/pin.json
@@ -1,5 +1,5 @@
 {
-  "version": "3.1.0",
-  "srcSha256": "gJ093wPP0ZniOP73ZrfZzqWXNowjo/Ire8DwlgHnM1A=",
+  "version": "3.1.1",
+  "srcSha256": "g681w7RD96/xKP+WnIyY4bcVHVQhysgDPZo4TgCRiuY=",
   "yarnSha256": "0cm9yprj0ajmrdpap3p2lx3xrrkar6gghlxnj9127ks6p5c1ji3r"
 }
diff --git a/pkgs/servers/monitoring/prometheus/bind-exporter.nix b/pkgs/servers/monitoring/prometheus/bind-exporter.nix
index 4e0ef709496ec..46c428c59e05d 100644
--- a/pkgs/servers/monitoring/prometheus/bind-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/bind-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bind_exporter";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "prometheus-community";
     repo = "bind_exporter";
-    sha256 = "sha256-ta+uy0FUEMcL4SW1K3v2j2bfDRmdAIz42MKPsNj4FbA=";
+    sha256 = "sha256-MZ+WjEtSTGsi+2iKSZ4Xy6gq+Zf7DZHolBiq3wop22A=";
   };
 
-  vendorSha256 = "sha256-L0jZM83u423tiLf7kcqnXsQi7QBvNEXhuU+IwXXAhE0=";
+  vendorSha256 = "sha256-uTjY4Fx2GR6e/3nXKNcmjsWbDjnOnu/jOShXzMF+b3Q=";
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) bind; };
 
diff --git a/pkgs/servers/monitoring/prometheus/fastly-exporter.nix b/pkgs/servers/monitoring/prometheus/fastly-exporter.nix
index a61466470ca5f..5acecd40bb6a8 100644
--- a/pkgs/servers/monitoring/prometheus/fastly-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/fastly-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fastly-exporter";
-  version = "7.2.5";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "peterbourgon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-W/P4jUBNDR3t7FESNyUUnNWfGR0PI/dG03EVKYt8S2Y=";
+    sha256 = "sha256-oeRf/qjoe8ThzuyIGPOWO+5KTY318Fz3TGp5svXBGQU=";
   };
 
-  vendorSha256 = "sha256-exoDUxcOXVn7wUqfLLtJpklPYFHjLodEYa3lF+qFD+A=";
+  vendorSha256 = "sha256-BBfI5SyTgaoXXHxhraH09YVi43v1mD6Ia8oyh+TYqvA=";
 
   meta = with lib; {
     description = "Prometheus exporter for the Fastly Real-time Analytics API";
diff --git a/pkgs/servers/monitoring/unifi-poller/default.nix b/pkgs/servers/monitoring/unifi-poller/default.nix
index 83140c81f6379..c0aa3dd7f7db6 100644
--- a/pkgs/servers/monitoring/unifi-poller/default.nix
+++ b/pkgs/servers/monitoring/unifi-poller/default.nix
@@ -1,17 +1,20 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "unifi-poller";
-  version = "2.1.3";
+  version = "2.1.9";
 
   src = fetchFromGitHub {
     owner = "unifi-poller";
     repo = "unifi-poller";
     rev = "v${version}";
-    sha256 = "sha256-xh9s1xAhIeEmeDprl7iPdE6pxmxZjzgMvilobiIoJp0=";
+    hash = "sha256-eC+jEtSLWhiL3V+GKfRN5MVF18/2tnA1kI096j3XQB0=";
   };
 
-  vendorSha256 = "sha256-HoYgBKTl9HIMVzzzNYtRrfmqb7HCpPHVPeR4gUXneWk=";
+  vendorHash = "sha256-WVYQ3cZOO+EyJRTFcMjziDHwqqinm1IvxvSLuHTaqT8=";
 
   ldflags = [
     "-w" "-s"
@@ -24,6 +27,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Collect ALL UniFi Controller, Site, Device & Client Data - Export to InfluxDB or Prometheus";
     homepage = "https://github.com/unifi-poller/unifi-poller";
+    changelog = "https://github.com/unpoller/unpoller/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 975f486629ad0..1da94ceebd7d6 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -7,7 +7,7 @@ let
       , pkg-config, libxml2, tzdata, libkrb5
 
       # This is important to obtain a version of `libpq` that does not depend on systemd.
-      , enableSystemd ? (lib.versionAtLeast version "9.6" && !stdenv.isDarwin && !stdenv.hostPlatform.isStatic)
+      , enableSystemd ? !stdenv.isDarwin && !stdenv.hostPlatform.isStatic
       , gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic
 
       # for postgresql.pkgs
@@ -37,14 +37,22 @@ let
     outputs = [ "out" "lib" "doc" "man" ];
     setOutputFlags = false; # $out retains configureFlags :-/
 
-    buildInputs =
-      [ zlib readline openssl libxml2 icu ]
+    buildInputs = [
+      zlib
+      readline
+      openssl
+      libxml2
+      icu
+    ]
       ++ lib.optionals lz4Enabled [ lz4 ]
       ++ lib.optionals enableSystemd [ systemd ]
       ++ lib.optionals gssSupport [ libkrb5 ]
       ++ lib.optionals (!stdenv.isDarwin) [ libossp_uuid ];
 
-    nativeBuildInputs = [ makeWrapper pkg-config ];
+    nativeBuildInputs = [
+      makeWrapper
+      pkg-config
+    ];
 
     enableParallelBuilding = !stdenv.isDarwin;
 
@@ -71,25 +79,24 @@ let
       ++ lib.optionals gssSupport [ "--with-gssapi" ]
       ++ lib.optionals stdenv.hostPlatform.isRiscV [ "--disable-spinlocks" ];
 
-    patches =
-      [ (if atLeast "9.4" then ./patches/disable-resolve_symlinks-94.patch else ./patches/disable-resolve_symlinks.patch)
-        (if atLeast "9.6" then ./patches/less-is-more-96.patch             else ./patches/less-is-more.patch)
-        (if atLeast "9.6" then ./patches/hardcode-pgxs-path-96.patch       else ./patches/hardcode-pgxs-path.patch)
-        ./patches/specify_pkglibdir_at_runtime.patch
-        ./patches/findstring.patch
-      ]
-      ++ lib.optional stdenv.isLinux (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch);
+    patches = [
+      ./patches/disable-resolve_symlinks.patch
+      ./patches/less-is-more.patch
+      ./patches/hardcode-pgxs-path.patch
+      ./patches/specify_pkglibdir_at_runtime.patch
+      ./patches/findstring.patch
+    ] ++ lib.optionals stdenv.isLinux [
+      (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch)
+    ];
 
     installTargets = [ "install-world" ];
 
     LC_ALL = "C";
 
-    postConfigure =
-      let path = if atLeast "9.6" then "src/common/config_info.c" else "src/bin/pg_config/pg_config.c"; in
-        ''
-          # Hardcode the path to pgxs so pg_config returns the path in $out
-          substituteInPlace "${path}" --replace HARDCODED_PGXS_PATH $out/lib
-        '';
+    postPatch = ''
+      # Hardcode the path to pgxs so pg_config returns the path in $out
+      substituteInPlace "src/common/config_info.c" --replace HARDCODED_PGXS_PATH "$out/lib"
+    '';
 
     postInstall =
       ''
@@ -162,8 +169,6 @@ let
       license     = licenses.postgresql;
       maintainers = with maintainers; [ thoughtpolice danbst globin marsam ivan ];
       platforms   = platforms.unix;
-      knownVulnerabilities = optional (!atLeast "9.4")
-        "PostgreSQL versions older than 9.4 are not maintained anymore!";
     };
   };
 
@@ -199,45 +204,45 @@ let
 in self: {
 
   postgresql_11 = self.callPackage generic {
-    version = "11.17";
+    version = "11.18";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    hash = "sha256-bphJY64HZeYVd5lRA6fmWU2w8L0BUorBI+DeSmpMtMQ=";
+    hash = "sha256-0k8g78UukYrPvMoh6c6ijg4mO4RqDECPz6w7PEoPdQQ=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.12";
+    version = "12.13";
     psqlSchema = "12";
-    hash = "sha256-NLPxxpQI4iBowMcbGCdpHxyJFTsK1XbBpE+JIKhYA5w=";
+    hash = "sha256-tsYjBGr0VI8RqEtAeTTWddEe0HDHk9FbBGg79fMi4C0=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.8";
+    version = "13.9";
     psqlSchema = "13";
-    hash = "sha256-c4dv3TpRcIc0BFjcpM4VuNKk286zNMBEFCRVGubEze0=";
+    hash = "sha256-7xlmwKXkn77TNwrSgkkoy2sRZGF67q4WBtooP38zpBU=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.5";
+    version = "14.6";
     psqlSchema = "14";
-    hash = "sha256-1PcstfuFfJqfdeyM8JGhdxJygC8hePCy5lt7b/ZPSjA=";
+    hash = "sha256-UIhA/BgJ05q3InTV8Tfau5/X+0+TPaQWiu67IAae3yI=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
   };
 
   postgresql_15 = self.callPackage generic {
-    version = "15.0";
+    version = "15.1";
     psqlSchema = "15";
-    hash = "sha256-cux09KfBbmhPQ+pC4hVJf81MVdAopo+3LpnmH/QNpNY=";
+    hash = "sha256-ZP3yPXNK+tDf5Ad9rKlqxR3NaX5ori09TKbEXLFOIa4=";
     this = self.postgresql_15;
     thisAttr = "postgresql_15";
     inherit self;
diff --git a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks-94.patch b/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks-94.patch
deleted file mode 100644
index fadeea90ac4b6..0000000000000
--- a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks-94.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/src/common/exec.c	2014-09-04 20:19:12.236057588 +0200
-+++ b/src/common/exec.c	2014-09-04 20:19:50.550251633 +0200
-@@ -218,6 +218,9 @@
- static int
- resolve_symlinks(char *path)
- {
-+	// On NixOS we *want* stuff relative to symlinks.
-+	return 0;
-+
- #ifdef HAVE_READLINK
- 	struct stat buf;
- 	char		orig_wd[MAXPGPATH],
diff --git a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch b/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch
index 3e6fd5e838a24..fadeea90ac4b6 100644
--- a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch
+++ b/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch
@@ -1,13 +1,11 @@
-diff --git a/src/port/exec.c b/src/port/exec.c
-index c79e8ba..42c4091 100644
---- a/src/port/exec.c
-+++ b/src/port/exec.c
-@@ -216,6 +216,9 @@ find_my_exec(const char *argv0, char *retpath)
+--- a/src/common/exec.c	2014-09-04 20:19:12.236057588 +0200
++++ b/src/common/exec.c	2014-09-04 20:19:50.550251633 +0200
+@@ -218,6 +218,9 @@
  static int
  resolve_symlinks(char *path)
  {
-+    // On NixOS we *want* stuff relative to symlinks.
-+    return 0;
++	// On NixOS we *want* stuff relative to symlinks.
++	return 0;
 +
  #ifdef HAVE_READLINK
  	struct stat buf;
diff --git a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path-96.patch b/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path-96.patch
deleted file mode 100644
index 6cd449769baac..0000000000000
--- a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path-96.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -Naur postgresql-9.6.1-orig/src/common/config_info.c postgresql-9.6.1/src/common/config_info.c
---- postgresql-9.6.1-orig/src/common/config_info.c	2016-11-22 21:39:29.231929261 +0100
-+++ postgresql-9.6.1/src/common/config_info.c	2016-11-22 23:36:53.685163543 +0100
-@@ -118,7 +118,10 @@
- 	i++;
-
- 	configdata[i].name = pstrdup("PGXS");
-+	strlcpy(path, "HARDCODED_PGXS_PATH", sizeof(path));
-+/* commented out to be able to point to nix $out path
- 	get_pkglib_path(my_exec_path, path);
-+*/
- 	strlcat(path, "/pgxs/src/makefiles/pgxs.mk", sizeof(path));
- 	cleanup_path(path);
- 	configdata[i].setting = pstrdup(path);
diff --git a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch b/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch
index 355813ffe20e2..6cd449769baac 100644
--- a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch
+++ b/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch
@@ -1,17 +1,14 @@
---- a/src/bin/pg_config/pg_config.c
-+++ b/src/bin/pg_config/pg_config.c
-@@ -220,11 +220,13 @@ show_sysconfdir(bool all)
- static void
- show_pgxs(bool all)
- {
--	char		path[MAXPGPATH];
-+	char		path[MAXPGPATH] = "HARDCODED_PGXS_PATH";
- 
- 	if (all)
- 		printf("PGXS = ");
-+  /* commented out to be able to point to nix $out path
- 	get_pkglib_path(mypath, path);
-+  */
+diff -Naur postgresql-9.6.1-orig/src/common/config_info.c postgresql-9.6.1/src/common/config_info.c
+--- postgresql-9.6.1-orig/src/common/config_info.c	2016-11-22 21:39:29.231929261 +0100
++++ postgresql-9.6.1/src/common/config_info.c	2016-11-22 23:36:53.685163543 +0100
+@@ -118,7 +118,10 @@
+ 	i++;
+
+ 	configdata[i].name = pstrdup("PGXS");
++	strlcpy(path, "HARDCODED_PGXS_PATH", sizeof(path));
++/* commented out to be able to point to nix $out path
+ 	get_pkglib_path(my_exec_path, path);
++*/
  	strlcat(path, "/pgxs/src/makefiles/pgxs.mk", sizeof(path));
  	cleanup_path(path);
- 	printf("%s\n", path);
+ 	configdata[i].setting = pstrdup(path);
diff --git a/pkgs/servers/sql/postgresql/patches/less-is-more-96.patch b/pkgs/servers/sql/postgresql/patches/less-is-more-96.patch
deleted file mode 100644
index f14af9dc22073..0000000000000
--- a/pkgs/servers/sql/postgresql/patches/less-is-more-96.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur postgresql-9.6.1-orig/src/include/fe_utils/print.h postgresql-9.6.1/src/include/fe_utils/print.h
---- postgresql-9.6.1-orig/src/include/fe_utils/print.h	2016-11-22 21:39:29.148932827 +0100
-+++ postgresql-9.6.1/src/include/fe_utils/print.h	2016-11-22 21:39:36.283626258 +0100
-@@ -18,7 +18,7 @@
- 
- /* This is not a particularly great place for this ... */
- #ifndef __CYGWIN__
--#define DEFAULT_PAGER "more"
-+#define DEFAULT_PAGER "less"
- #else
- #define DEFAULT_PAGER "less"
- #endif
diff --git a/pkgs/servers/sql/postgresql/patches/less-is-more.patch b/pkgs/servers/sql/postgresql/patches/less-is-more.patch
index d640d24bdaad6..f14af9dc22073 100644
--- a/pkgs/servers/sql/postgresql/patches/less-is-more.patch
+++ b/pkgs/servers/sql/postgresql/patches/less-is-more.patch
@@ -1,9 +1,9 @@
-diff -Naur postgresql-9.2.7-orig/src/bin/psql/print.h postgresql-9.2.7/src/bin/psql/print.h
---- postgresql-9.2.7-orig/src/bin/psql/print.h	2014-02-17 14:38:15.000000000 -0500
-+++ postgresql-9.2.7/src/bin/psql/print.h	2014-03-04 14:42:28.874014415 -0500
-@@ -178,7 +178,7 @@
- extern const printTextFormat *get_line_style(const printTableOpt *opt);
+diff -Naur postgresql-9.6.1-orig/src/include/fe_utils/print.h postgresql-9.6.1/src/include/fe_utils/print.h
+--- postgresql-9.6.1-orig/src/include/fe_utils/print.h	2016-11-22 21:39:29.148932827 +0100
++++ postgresql-9.6.1/src/include/fe_utils/print.h	2016-11-22 21:39:36.283626258 +0100
+@@ -18,7 +18,7 @@
  
+ /* This is not a particularly great place for this ... */
  #ifndef __CYGWIN__
 -#define DEFAULT_PAGER "more"
 +#define DEFAULT_PAGER "less"
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index 1253531a3fcf8..87f601d4b4b02 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.119.0";
+  version = "0.120.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "sha256-eW16B3VSxuqKVqhVmxtyTnm1wItJS5HZMW7a7DDiIVg=";
+    sha256 = "sha256-XrXT+SivZ240lSiCWmxB4N4miI6xYojqLVmDJbhhWko=";
   };
 
-  vendorSha256 = "sha256-/WSc6Q/OBxPKuVrdmMczaKCZO7MvQXkzQ2Q1y43w3Hw=";
+  vendorSha256 = "sha256-S1gnnhI0U7OLd6vEW5qpxGAiOdORYWsEst11Vfj6pdI=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/graphics/vulkan-caps-viewer/default.nix b/pkgs/tools/graphics/vulkan-caps-viewer/default.nix
index 291c70d8eccfe..cf13c3b5b3eef 100644
--- a/pkgs/tools/graphics/vulkan-caps-viewer/default.nix
+++ b/pkgs/tools/graphics/vulkan-caps-viewer/default.nix
@@ -10,16 +10,16 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-caps-viewer";
-  version = "3.25";
+  version = "3.27";
 
   src = fetchFromGitHub {
     owner = "SaschaWillems";
     repo = "VulkanCapsViewer";
-    rev = if version == "3.25" then "${version}_fixed" else version;
-    hash = "sha256-JQMnR9WNR8OtcgVfE5iZebdvZ/JmZNDchET5cK/Bruc=";
+    rev = version;
+    hash = "sha256-B/FBX63JnBdshNLVMPA0qGnm0c/RGilIahX3VjJnpkI=";
     # Note: this derivation strictly requires vulkan-header to be the same it was developed against.
-    # To help they put in a git-submodule.
-    # It works with older vulkan-loaders.
+    # To help us, they've put it in a git-submodule.
+    # The result will work with any vulkan-loader version.
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/misc/arch-install-scripts/default.nix b/pkgs/tools/misc/arch-install-scripts/default.nix
index f8f2e10be85c4..caaf298c2f94e 100644
--- a/pkgs/tools/misc/arch-install-scripts/default.nix
+++ b/pkgs/tools/misc/arch-install-scripts/default.nix
@@ -22,13 +22,13 @@
 
 resholve.mkDerivation rec {
   pname = "arch-install-scripts";
-  version = "27";
+  version = "28";
 
   src = fetchFromGitHub {
     owner = "archlinux";
     repo = "arch-install-scripts";
     rev = "v${version}";
-    hash = "sha256-owJImToG8GIk1TfkSKJyXCu9RTJ1qYlvQ6DTMSazaeQ=";
+    hash = "sha256-TytCeejhjWYDzWFjGubUl08OrsAQa9fFULoamDfbdDY=";
   };
 
   nativeBuildInputs = [ asciidoc gnum4 ];
diff --git a/pkgs/tools/misc/goreleaser/default.nix b/pkgs/tools/misc/goreleaser/default.nix
index 9bc7b2d4898cf..74837d367ade1 100644
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "goreleaser";
-  version = "1.12.3";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-64oivUXAPP0Wo4CYt82Xs/yVhvuiyWVEurZrporCyJw=";
+    sha256 = "sha256-sgYTWiiFsrr+1c3C5GFpwSiGHfYizbjBTcj0JDuZXkE=";
   };
 
-  vendorSha256 = "sha256-DJwHLitsyHJmZ8FhVAoLTI6HwoHPFAAv8RYmhMwh1Bg=";
+  vendorSha256 = "sha256-UpQ2yFprWdwE67MR5voPjgY7wqrtw/ZQbt05Tbo50XY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/networking/checkip/default.nix b/pkgs/tools/networking/checkip/default.nix
index dff7dee6d445e..1096bf899dc6d 100644
--- a/pkgs/tools/networking/checkip/default.nix
+++ b/pkgs/tools/networking/checkip/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "checkip";
-  version = "0.43.0";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "jreisinger";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-KeHITGUf0/sSYwMmwIxh9195KZiMVLb8IXI7SxeOz6A=";
+    sha256 = "sha256-B+gi3BNEQUZL5McSPnSRyUssa9AhnMHswfmCrK0BP2o=";
   };
 
   vendorSha256 = "sha256-bFhSMjm9rqUUbCV9keeXm+yhzQMKrYKs1DbCt53J8aM=";
diff --git a/pkgs/tools/networking/obfs4/default.nix b/pkgs/tools/networking/obfs4/default.nix
index 03e1d0ad5af22..af64c8190ebc7 100644
--- a/pkgs/tools/networking/obfs4/default.nix
+++ b/pkgs/tools/networking/obfs4/default.nix
@@ -13,9 +13,23 @@ buildGoModule rec {
   vendorSha256 = "0yjanv5piygffpdfysviijl7cql2k0r05bsxnlj4hbamsriz9xqy";
 
   meta = with lib; {
-    description = "A pluggable transport proxy";
+    description = "Circumvents censorship by transforming Tor traffic between clients and bridges";
+    longDescription = ''
+      Obfs4proxy is a tool that attempts to circumvent censorship by
+      transforming the Tor traffic between the client and the bridge.
+      This way censors, who usually monitor traffic between the client
+      and the bridge, will see innocent-looking transformed traffic
+      instead of the actual Tor traffic.  obfs4proxy implements the
+      obfsucation protocols obfs2, obfs3, and obfs4.  It is written in
+      Go and is compliant with the Tor pluggable transports
+      specification, and its modular architecture allows it to support
+      multiple pluggable transports.
+    '';
     homepage = "https://www.torproject.org/projects/obfsproxy";
     maintainers = with maintainers; [ thoughtpolice ];
     mainProgram = "obfs4proxy";
+    changelog = "https://gitweb.torproject.org/pluggable-transports/obfs4.git/plain/ChangeLog";
+    downloadPage = "https://gitweb.torproject.org/pluggable-transports/obfs4.git/";
+    license = with lib.licenses; [ bsd2 bsd3 gpl3 ];
   };
 }
diff --git a/pkgs/tools/nix/nix-output-monitor/generated-package.nix b/pkgs/tools/nix/nix-output-monitor/generated-package.nix
index f48056a2e4a4f..5f924c81a4e1c 100644
--- a/pkgs/tools/nix/nix-output-monitor/generated-package.nix
+++ b/pkgs/tools/nix/nix-output-monitor/generated-package.nix
@@ -28,6 +28,8 @@
   safe,
   stm,
   streamly,
+  strict,
+  strict-types,
   terminal-size,
   text,
   time,
@@ -37,10 +39,10 @@
 }:
 mkDerivation {
   pname = "nix-output-monitor";
-  version = "2.0.0.3";
+  version = "2.0.0.4";
   src = fetchzip {
-    url = "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/v2.0.0.3.tar.gz";
-    sha256 = "0mgg309vncjvx80mhqcyb7kk1918nfl02d38jczm9lsrlrmdafd9";
+    url = "https://github.com/maralorn/nix-output-monitor/archive/refs/tags/v2.0.0.4.tar.gz";
+    sha256 = "1pgrynsjjry253fqpmm3yr4k9xcvqffnbs4p8i1nlfi9l821wj8c";
   };
   isLibrary = true;
   isExecutable = true;
@@ -66,6 +68,8 @@ mkDerivation {
     safe
     stm
     streamly
+    strict
+    strict-types
     terminal-size
     text
     time
@@ -94,6 +98,8 @@ mkDerivation {
     safe
     stm
     streamly
+    strict
+    strict-types
     terminal-size
     text
     time
@@ -126,6 +132,8 @@ mkDerivation {
     safe
     stm
     streamly
+    strict
+    strict-types
     terminal-size
     text
     time
diff --git a/pkgs/tools/package-management/pacman/default.nix b/pkgs/tools/package-management/pacman/default.nix
index f65b18c7a95ef..517abf26f9083 100644
--- a/pkgs/tools/package-management/pacman/default.nix
+++ b/pkgs/tools/package-management/pacman/default.nix
@@ -6,7 +6,6 @@
 , binutils
 , coreutils
 , curl
-, gnupg
 , gpgme
 , installShellFiles
 , libarchive
@@ -29,6 +28,12 @@
 , lz4
 , lzip
 
+# pacman-key runtime dependencies
+, gawk
+, gettext
+, gnugrep
+, gnupg
+
 # Tells pacman where to find ALPM hooks provided by packages.
 # This path is very likely to be used in an Arch-like root.
 , sysHookDir ? "/usr/share/libalpm/hooks/"
@@ -106,7 +111,14 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/makepkg \
       --prefix PATH : ${lib.makeBinPath [ binutils ]}
     wrapProgram $out/bin/pacman-key \
-      --prefix PATH : ${lib.makeBinPath [ "${placeholder "out"}" gnupg ]}
+      --prefix PATH : ${lib.makeBinPath [
+        "${placeholder "out"}"
+        coreutils
+        gawk
+        gettext
+        gnugrep
+        gnupg
+      ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index c690c0f629410..e55b721034333 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.52.0";
+  version = "0.53.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RZBO8TpFwRwr1CkGSX06jtAtLiNVHhe+8AJsHwNyPMY=";
+    sha256 = "sha256-um+uyY8kPkouF/9Kms0xZYhgYeZC/pE6w+JCVcKWdpI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildGoModule rec {
     '';
   };
   proxyVendor = true;
-  vendorSha256 = "sha256-tRux9M9vFPj3TqhsF1zSV4V1YKnLVViuQjum9YFr5FU=";
+  vendorSha256 = "sha256-BP5Tvv5s74uxjVcEC0QPaw2tGPmkOjZmyCrPwwoz7o4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index a4ade683b1362..478cca8be0e2f 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     "--enable-confdir=/etc"
     # The OS should care on preparing the drivers into this location
     "--enable-usbdropdir=/var/lib/pcsc/drivers"
-    (lib.enableFeature stdenv.isLinux "systemd")
+    (lib.enableFeature stdenv.isLinux "libsystemd")
     (lib.enableFeature polkitSupport "polkit")
   ] ++ lib.optionals stdenv.isLinux [
     "--enable-ipcdir=/run/pcscd"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2397944714690..a28f2799458b5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -676,8 +676,10 @@ mapAliases ({
   # Julia
   julia_07 = throw "julia_07 has been deprecated in favor of the latest LTS version"; # Added 2020-09-15
   julia_1 = throw "julia_1 has been deprecated in favor of julia_10 as it was ambiguous"; # Added 2021-03-13
+  julia_10 = throw "julia_10 has been deprecated in favor of the latest stable version"; # Added 2022-11-15
   julia_11 = throw "julia_11 has been deprecated in favor of the latest stable version"; # Added 2020-09-15
   julia_13 = throw "julia_13 has been deprecated in favor of the latest stable version"; # Added 2021-03-13
+  julia_15 = throw "julia_15 has been deprecated in favor of the latest stable version"; # Added 2022-11-15
   julia_10-bin = throw "julia_10-bin has been deprecated in favor of the latest LTS version"; # Added 2021-12-02
   julia_17-bin = throw "julia_17-bin has been deprecated in favor of the latest stable version"; # Added 2022-09-04
 
@@ -1232,6 +1234,7 @@ mapAliases ({
   pyload = throw "pyload has been removed from nixpkgs, as it was unmaintained"; # Added 2021-03-21
   pynagsystemd = throw "pynagsystemd was removed as it was unmaintained and incompatible with recent systemd versions. Instead use its fork check_systemd"; # Added 2020-10-24
   pyo3-pack = maturin;
+  pypolicyd-spf = spf-engine; # Added 2022-10-09
   pyrex = throw "pyrex has been removed from nixpkgs as the project is still stuck on python2"; # Added 2022-01-12
   pyrex095 = throw "pyrex has been removed from nixpkgs as the project is still stuck on python2"; # Added 2022-01-12
   pyrex096 = throw "pyrex has been removed from nixpkgs as the project is still stuck on python2"; # Added 2022-01-12
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fcb049f54fc02..e104b1719d4ca 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5283,8 +5283,6 @@ with pkgs;
   libceph = ceph.lib;
   inherit (callPackages ../tools/filesystems/ceph {
     lua = lua5_4;
-    # needs to be the same openssl version as python/pyopenssl
-    curl = (curl.override { openssl = openssl_1_1; });
   })
     ceph
     ceph-client;
@@ -14521,31 +14519,8 @@ with pkgs;
 
   juniper = callPackage ../development/compilers/juniper { };
 
-  julia_10 = callPackage ../development/compilers/julia/1.0.nix {
-    gmp = gmp6;
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices CoreServices;
-    libgit2 = libgit2.overrideAttrs (_: rec {
-      version = "0.27.10";
-      src = fetchFromGitHub {
-        owner = "libgit2";
-        repo = "libgit2";
-        rev = "v${version}";
-        sha256 = "09jz2fzv0zl5058s0g1cpnw87a2rgg8wnjwlygi18i2n9nn6m0ad";
-      };
-      patches = [];
-      meta.knownVulnerabilities = [
-        "CVE-2020-12278"
-        "CVE-2020-12279"
-      ];
-    });
-  };
-
-  julia_15 = callPackage ../development/compilers/julia/1.5.nix {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices CoreServices;
-  };
-
-  julia-lts = julia_10;
-  julia-stable = julia_15;
+  julia-lts = julia_16-bin;
+  julia-stable = julia_18;
   julia = julia-stable;
 
   julia_16-bin = callPackage ../development/compilers/julia/1.6-bin.nix { };
@@ -16263,14 +16238,20 @@ with pkgs;
 
   autoadb = callPackage ../misc/autoadb { };
 
-  ansible = ansible_2_12;
-  ansible_2_13 = python3Packages.toPythonApplication python3Packages.ansible-core;
+  ansible = ansible_2_14;
+  ansible_2_14 = python3Packages.toPythonApplication python3Packages.ansible-core;
+  ansible_2_13 = python3Packages.toPythonApplication (python3Packages.ansible-core.overridePythonAttrs (oldAttrs: rec {
+    version = "2.13.6";
+    src = oldAttrs.src.override {
+      inherit version;
+      hash = "sha256-Mf4yK2MpBnSo9zhhEN9QHwBEqkSJC+OrMTpuIluaKc8=";
+    };
+  }));
   ansible_2_12 = python3Packages.toPythonApplication (python3Packages.ansible-core.overridePythonAttrs (oldAttrs: rec {
-    version = "2.12.6";
+    version = "2.12.10";
     src = oldAttrs.src.override {
       inherit version;
-      hash = "sha256-XzZuhRFZ2Pcs5o0yuMDt2lbuU3wB6faOyjgr0VEK9l0=";
-      sha256 = "";
+      hash = "sha256-/rHfYXOM/B9eiTtCouwafeMpd9Z+hnB7Retj0MXDwjY=";
     };
     meta.changelog = "https://github.com/ansible/ansible/blob/v${version}/changelogs/CHANGELOG-v${lib.versions.majorMinor version}.rst";
   }));
@@ -18595,7 +18576,6 @@ with pkgs;
 
   cyrus_sasl = callPackage ../development/libraries/cyrus-sasl {
     libkrb5 = if stdenv.isFreeBSD then heimdal else libkrb5;
-    openssl = openssl_1_1;
   };
 
   # Make bdb5 the default as it is the last release under the custom
@@ -19258,8 +19238,7 @@ with pkgs;
   gns3-gui = gns3Packages.guiStable;
   gns3-server = gns3Packages.serverStable;
 
-  gobject-introspection = if (!stdenv.hostPlatform.canExecute stdenv.targetPlatform) && stdenv.targetPlatform.emulatorAvailable buildPackages
-    then callPackage ../development/libraries/gobject-introspection/wrapper.nix { } else gobject-introspection-unwrapped;
+  gobject-introspection = callPackage ../development/libraries/gobject-introspection/wrapper.nix { };
 
   gobject-introspection-unwrapped = callPackage ../development/libraries/gobject-introspection {
     nixStoreDir = config.nix.storeDir or builtins.storeDir;
@@ -21689,9 +21668,7 @@ with pkgs;
 
   openexrid-unstable = callPackage ../development/libraries/openexrid-unstable { };
 
-  openldap = callPackage ../development/libraries/openldap {
-    openssl = openssl_1_1;
-  };
+  openldap = callPackage ../development/libraries/openldap { };
 
   opencolorio = darwin.apple_sdk_11_0.callPackage ../development/libraries/opencolorio {
     inherit (darwin.apple_sdk_11_0.frameworks) Carbon GLUT Cocoa;
@@ -24406,7 +24383,7 @@ with pkgs;
 
   pure-ftpd = callPackage ../servers/ftp/pure-ftpd { };
 
-  pypolicyd-spf = python3.pkgs.callPackage ../servers/mail/pypolicyd-spf { };
+  spf-engine = python3.pkgs.callPackage ../servers/mail/spf-engine { };
 
   pypiserver = with python3Packages; toPythonApplication pypiserver;
 
@@ -29439,6 +29416,8 @@ with pkgs;
 
   waybar = callPackage ../applications/misc/waybar {};
 
+  waylock = callPackage ../applications/misc/waylock {};
+
   wayshot = callPackage ../tools/misc/wayshot { };
 
   waylevel = callPackage ../tools/misc/waylevel { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dd1dca64c91ca..d119be13e323b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7059,6 +7059,8 @@ self: super: with self; {
 
   pysyncthru = callPackage ../development/python-modules/pysyncthru { };
 
+  pytest-mockito = callPackage ../development/python-modules/pytest-mockito { };
+
   python-codon-tables = callPackage ../development/python-modules/python-codon-tables { };
 
   python-crfsuite = callPackage ../development/python-modules/python-crfsuite { };
@@ -8142,6 +8144,8 @@ self: super: with self; {
 
   pymicrobot = callPackage ../development/python-modules/pymicrobot { };
 
+  pymilter = callPackage ../development/python-modules/pymilter { };
+
   pymitv = callPackage ../development/python-modules/pymitv { };
 
   pymfy = callPackage ../development/python-modules/pymfy { };
@@ -9812,6 +9816,8 @@ self: super: with self; {
 
   robotframework-databaselibrary = callPackage ../development/python-modules/robotframework-databaselibrary { };
 
+  robotframework-pythonlibcore = callPackage ../development/python-modules/robotframework-pythonlibcore { };
+
   robotframework-requests = callPackage ../development/python-modules/robotframework-requests { };
 
   robotframework-selenium2library = callPackage ../development/python-modules/robotframework-selenium2library { };