summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--pkgs/applications/terminal-emulators/xterm/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/i3ipc-glib.nix7
-rw-r--r--pkgs/development/compilers/llvm/11/default.nix1
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix13
-rw-r--r--pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh16
-rw-r--r--pkgs/development/libraries/cyrus-sasl/default.nix7
-rw-r--r--pkgs/development/libraries/glib/default.nix20
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix8
-rw-r--r--pkgs/development/libraries/gobject-introspection/wrapper.nix128
-rw-r--r--pkgs/development/libraries/gtksourceview/4.x.nix7
-rw-r--r--pkgs/development/libraries/gtksourceview/5.x.nix7
-rw-r--r--pkgs/development/libraries/keybinder3/default.nix19
-rw-r--r--pkgs/development/libraries/libnftnl/default.nix4
-rw-r--r--pkgs/development/libraries/libsoup/3.x.nix4
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libwnck/default.nix3
-rw-r--r--pkgs/development/libraries/mesa/default.nix7
-rw-r--r--pkgs/development/libraries/openldap/default.nix2
-rw-r--r--pkgs/development/libraries/pipewire/default.nix27
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json20
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwayland.nix13
-rw-r--r--pkgs/development/lisp-modules-new/lisp-packages.nix32
-rw-r--r--pkgs/development/lisp-modules-new/packages.nix8
-rw-r--r--pkgs/development/lisp-modules-new/patches/cffi-libffi-darwin-ffi-h.patch14
-rw-r--r--pkgs/development/lisp-modules-new/patches/magicl-dont-build-fortran-twice.patch21
-rw-r--r--pkgs/development/python-modules/ansible-later/default.nix4
-rw-r--r--pkgs/development/python-modules/babel/default.nix9
-rw-r--r--pkgs/development/python-modules/hatchling/default.nix5
-rw-r--r--pkgs/development/python-modules/incremental/default.nix4
-rw-r--r--pkgs/development/python-modules/invoke/default.nix4
-rw-r--r--pkgs/development/python-modules/jsonschema/default.nix4
-rw-r--r--pkgs/development/python-modules/orjson/default.nix12
-rw-r--r--pkgs/development/python-modules/pbr/default.nix4
-rw-r--r--pkgs/development/python-modules/pbr/tests.nix3
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix11
-rw-r--r--pkgs/development/python-modules/python-ldap/default.nix5
-rw-r--r--pkgs/development/python-modules/pytz-deprecation-shim/default.nix4
-rw-r--r--pkgs/development/python-modules/scipy/default.nix8
-rw-r--r--pkgs/development/python-modules/tzdata/default.nix4
-rw-r--r--pkgs/development/python-modules/zipp/default.nix4
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix4
-rw-r--r--pkgs/development/tools/hatch/default.nix10
-rw-r--r--pkgs/development/tools/misc/lsof/default.nix36
-rw-r--r--pkgs/development/tools/rust/bindgen/unwrapped.nix17
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix4
-rw-r--r--pkgs/os-specific/linux/bpftools/default.nix6
-rw-r--r--pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch13
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix7
-rw-r--r--pkgs/servers/sql/postgresql/default.nix65
-rw-r--r--pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks-94.patch12
-rw-r--r--pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch12
-rw-r--r--pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path-96.patch14
-rw-r--r--pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch27
-rw-r--r--pkgs/servers/sql/postgresql/patches/less-is-more-96.patch12
-rw-r--r--pkgs/servers/sql/postgresql/patches/less-is-more.patch10
-rw-r--r--pkgs/tools/security/pcsclite/default.nix2
-rw-r--r--pkgs/top-level/all-packages.nix8
58 files changed, 442 insertions, 302 deletions
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index c277e241ca303..ff0856734628b 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "374";
+  version = "375";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    sha256 = "sha256-EdTWJmcNTW17aft0Z+nsIxgX5a0iUC+RZ3aP2IrBvfU=";
+    sha256 = "sha256-MCxZor+B55xqcBUl13gWGiGNEjnyFWjYnivdMcAVIX8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/window-managers/i3/i3ipc-glib.nix b/pkgs/applications/window-managers/i3/i3ipc-glib.nix
index 572b12d986c10..a6a77600ee5f1 100644
--- a/pkgs/applications/window-managers/i3/i3ipc-glib.nix
+++ b/pkgs/applications/window-managers/i3/i3ipc-glib.nix
@@ -4,7 +4,6 @@
 }:
 
 stdenv.mkDerivation rec {
-
   pname = "i3ipc-glib";
   version = "1.0.1";
 
@@ -15,10 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "01fzvrbnzcwx0vxw29igfpza9zwzp2s7msmzb92v01z0rz0y5m0p";
   };
 
-  nativeBuildInputs = [ autoreconfHook which pkg-config ];
-
-  buildInputs = [ libxcb json-glib gtk-doc xorgproto gobject-introspection ];
+  strictDeps = true;
+  nativeBuildInputs = [ autoreconfHook which pkg-config gtk-doc gobject-introspection ];
 
+  buildInputs = [ libxcb json-glib xorgproto ];
 
   preAutoreconf = ''
     gtkdocize
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index a29df9051e7c2..da24f496117db 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -43,7 +43,6 @@ let
       mkdir "$rsrc"
       ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-      echo "-B $rsrc/lib" >> $out/nix-support/cc-cflags
     '';
     mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
       ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 424258167150b..e84b4918afb86 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -7,7 +7,6 @@
 , mailcap, mimetypesSupport ? true
 , ncurses
 , openssl
-, openssl_1_1
 , readline
 , sqlite
 , tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
@@ -77,10 +76,6 @@ assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
 with lib;
 
 let
-  # cpython does support/build with openssl 3.0, but some libraries using the ssl module seem to have issues with it
-  # null check for Minimal
-  openssl' = if openssl != null then openssl_1_1 else null;
-
   buildPackages = pkgsBuildHost;
   inherit (passthru) pythonForBuild;
 
@@ -121,7 +116,7 @@ let
   ];
 
   buildInputs = filter (p: p != null) ([
-    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl' ]
+    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl ]
     ++ optionals x11Support [ tcl tk libX11 xorgproto ]
     ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
     ++ optionals stdenv.isDarwin [ configd ])
@@ -327,8 +322,8 @@ in with passthru; stdenv.mkDerivation {
     "--with-threads"
   ] ++ optionals (sqlite != null && isPy3k) [
     "--enable-loadable-sqlite-extensions"
-  ] ++ optionals (openssl' != null) [
-    "--with-openssl=${openssl'.dev}"
+  ] ++ optionals (openssl != null) [
+    "--with-openssl=${openssl.dev}"
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_buggy_getaddrinfo=no"
     # Assume little-endian IEEE 754 floating point when cross compiling
@@ -493,7 +488,7 @@ in with passthru; stdenv.mkDerivation {
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
   disallowedReferences =
-    lib.optionals (openssl' != null && !static) [ openssl'.dev ]
+    lib.optionals (openssl != null && !static) [ openssl.dev ]
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # Ensure we don't have references to build-time packages.
     # These typically end up in shebangs.
diff --git a/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh b/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh
index e73e45cd597a1..83b79d01fa404 100644
--- a/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-output-dist-hook.sh
@@ -3,7 +3,21 @@ echo "Sourcing python-catch-conflicts-hook.sh"
 
 pythonOutputDistPhase() {
     echo "Executing pythonOutputDistPhase"
-    mv "dist" "$dist"
+    if [[ -d dist ]]; then
+        mv "dist" "$dist"
+    else
+        cat >&2 <<EOF
+The build contains no ./dist directory.
+If this project is not setuptools-based, pass
+
+  format = "other";
+
+to buildPythonApplication/buildPythonPackage or another appropriate value as described here:
+
+  https://nixos.org/manual/nixpkgs/stable/#buildpythonpackage-function
+EOF
+        false
+    fi
     echo "Finished executing pythonOutputDistPhase"
 }
 
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index 632c8427e4db6..db23009b8fa93 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, openssl, openldap, libkrb5, db, gettext
+{ lib, stdenv, fetchurl, fetchpatch, openssl, openldap, libkrb5, db, gettext
 , pam, libxcrypt, fixDarwinDylibNames, autoreconfHook, enableLdap ? false
 , buildPackages, pruneLibtoolFiles, nixosTests }:
 
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
   patches = [
     # Fix cross-compilation
     ./cyrus-sasl-ac-try-run-fix.patch
+    # make compatible with openssl3. can probably be dropped with any release after 2.1.28
+    (fetchpatch {
+      url = "https://github.com/cyrusimap/cyrus-sasl/compare/cb549ef71c5bb646fe583697ebdcaba93267a237...c2bd3afbca57f176d8c650670ce371444bb7fcc0.patch";
+      hash = "sha256-bYeIkvle1Ms7Lnoob4eLd4RbPFHtPkKRZvfHNCBJY/s=";
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index b38ba682a76be..9fc05f5f8754c 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -1,4 +1,14 @@
-{ config, lib, stdenv, fetchurl, gettext, meson, ninja, pkg-config, perl, python3
+{ config
+, lib
+, stdenv
+, fetchurl
+, fetchpatch
+, gettext
+, meson
+, ninja
+, pkg-config
+, perl
+, python3
 , libiconv, zlib, libffi, pcre2, libelf, gnome, libselinux, bash, gnum4, gtk-doc, docbook_xsl, docbook_xml_dtd_45, libxslt
 # use util-linuxMinimal to avoid circular dependency (util-linux, systemd, glib)
 , util-linuxMinimal ? null
@@ -95,6 +105,14 @@ stdenv.mkDerivation (finalAttrs: {
     # Disable flaky test.
     # https://gitlab.gnome.org/GNOME/glib/-/issues/820
     ./skip-timer-test.patch
+
+    # Fix infinite loop (e.g. in gnome-keyring)
+    # https://github.com/NixOS/nixpkgs/pull/197754#issuecomment-1312805358
+    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3039
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/2a36bb4b7e46f9ac043561c61f9a790786a5440c.patch";
+      sha256 = "b77Hxt6WiLxIGqgAj9ZubzPWrWmorcUOEe/dp01BcXA=";
+    })
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index bb306fb3a8591..ec109cbee8dc9 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -138,14 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     rm $out/lib/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary}
   '';
 
-  # add self to buildInputs to avoid needing to add gobject-introspection to buildInputs in addition to nativeBuildInputs
-  # builds use target-pkg-config to look for gobject-introspection instead of just looking for binaries in $PATH
-  # wrapper uses depsTargetTargetPropagated so ignore it
-  preFixup = lib.optionalString (!lib.hasSuffix "-wrapped" finalAttrs.pname) ''
-    mkdir -p $dev/nix-support
-    echo "$out" > $dev/nix-support/propagated-target-target-deps
-  '';
-
   setupHook = ./setup-hook.sh;
 
   passthru = {
diff --git a/pkgs/development/libraries/gobject-introspection/wrapper.nix b/pkgs/development/libraries/gobject-introspection/wrapper.nix
index f887b7d18c77a..518dda781a642 100644
--- a/pkgs/development/libraries/gobject-introspection/wrapper.nix
+++ b/pkgs/development/libraries/gobject-introspection/wrapper.nix
@@ -9,50 +9,96 @@
 # to build, run
 # `nix build ".#pkgsCross.aarch64-multiplatform.buildPackages.gobject-introspection"`
 
+# a comment for both depsTargetTargetPropagated's
+# add self to buildInputs to avoid needing to add gobject-introspection to buildInputs in addition to nativeBuildInputs
+# builds use target-pkg-config to look for gobject-introspection instead of just looking for binaries in $PATH
+
 let
-  # ensure that `.override` works when gobject-introspection == gobject-introspection-wrapped
+  # ensure that `.override` works
   args = builtins.removeAttrs _args [ "buildPackages" "targetPackages" "gobject-introspection-unwrapped" ];
   # passing this stdenv to `targetPackages...` breaks due to splicing not working in `.override``
   argsForTarget = builtins.removeAttrs args [ "stdenv" ];
+
+  overridenUnwrappedGir = gobject-introspection-unwrapped.override args;
+  # if we have targetPackages.gobject-introspection then propagate that
+  overridenTargetUnwrappedGir =
+    if targetPackages ? gobject-introspection-unwrapped
+    then targetPackages.gobject-introspection-unwrapped.override argsForTarget
+    else overridenUnwrappedGir;
 in
 
-(gobject-introspection-unwrapped.override args).overrideAttrs (previousAttrs: {
-  pname = "gobject-introspection-wrapped";
-  depsTargetTargetPropagated = [ gobject-introspection-unwrapped ];
-  postFixup = (previousAttrs.postFixup or "") + ''
-    mv $dev/bin/g-ir-compiler $dev/bin/.g-ir-compiler-wrapped
-    mv $dev/bin/g-ir-scanner $dev/bin/.g-ir-scanner-wrapped
-
-    (
-      export bash="${buildPackages.bash}"
-      export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
-      export emulatorwrapper="$dev/bin/g-ir-scanner-qemuwrapper"
-      export buildlddtree="${buildPackages.pax-utils}/bin/lddtree"
-
-      export targetgir="${lib.getDev (targetPackages.gobject-introspection-unwrapped.override argsForTarget)}"
-
-      substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
-      substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
-      substituteAll "${./wrappers/g-ir-scanner-lddwrapper.sh}" "$dev/bin/g-ir-scanner-lddwrapper"
-      substituteAll "${./wrappers/g-ir-scanner-qemuwrapper.sh}" "$dev/bin/g-ir-scanner-qemuwrapper"
-      chmod +x $dev/bin/g-ir-*
-    )
-  ''
-  # when cross-compiling and using the wrapper then when a package looks up the g_ir_X
-  # variable with pkg-config they'll get the host version which can't be run
-  # override the variable to use the absolute path to g_ir_X in PATH which can be run
-  + ''
-    cat >> $dev/nix-support/setup-hook <<-'EOF'
-      override-pkg-config-gir-variables() {
-        PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER="$(type -p g-ir-scanner)"
-        PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER="$(type -p g-ir-compiler)"
-        PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE="$(type -p g-ir-generate)"
-        export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER
-        export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER
-        export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE
-      }
-
-      preConfigureHooks+=(override-pkg-config-gir-variables)
-    EOF
-  '';
-})
+# wrap both pkgsCrossX.buildPackages.gobject-introspection and {pkgs,pkgsSomethingExecutableOnBuildSystem).buildPackages.gobject-introspection
+if (!stdenv.hostPlatform.canExecute stdenv.targetPlatform) && stdenv.targetPlatform.emulatorAvailable buildPackages
+then
+  stdenv.mkDerivation
+    (builtins.removeAttrs overridenUnwrappedGir.drvAttrs [ "name" ] # so we can get a fresh name generated from the pname
+      // {
+      pname = "gobject-introspection-wrapped";
+      passthru = overridenUnwrappedGir.passthru // {
+        unwrapped = overridenUnwrappedGir;
+      };
+      phases = [ "fixupPhase" ]; # don't remove, it is valid to set phases here.
+      dontStrip = true;
+      depsTargetTargetPropagated = [ overridenTargetUnwrappedGir ];
+      postFixup = ''
+        ${lib.concatMapStrings (output: ''
+          mkdir -p ${"$" + "${output}"}
+          ${lib.getExe buildPackages.xorg.lndir} ${gobject-introspection-unwrapped.${output}} ${"$" + "${output}"}
+        '') gobject-introspection-unwrapped.outputs}
+
+        cp $dev/bin/g-ir-compiler $dev/bin/.g-ir-compiler-wrapped
+        cp $dev/bin/g-ir-scanner $dev/bin/.g-ir-scanner-wrapped
+
+        (
+          rm "$dev/bin/g-ir-compiler"
+          rm "$dev/bin/g-ir-scanner"
+          export bash="${buildPackages.bash}"
+          export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
+          export emulatorwrapper="$dev/bin/g-ir-scanner-qemuwrapper"
+          export buildlddtree="${buildPackages.pax-utils}/bin/lddtree"
+
+          export targetgir="${lib.getDev overridenTargetUnwrappedGir}"
+
+          substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
+          substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
+          substituteAll "${./wrappers/g-ir-scanner-lddwrapper.sh}" "$dev/bin/g-ir-scanner-lddwrapper"
+          substituteAll "${./wrappers/g-ir-scanner-qemuwrapper.sh}" "$dev/bin/g-ir-scanner-qemuwrapper"
+          chmod +x $dev/bin/g-ir-compiler
+          chmod +x $dev/bin/g-ir-scanner*
+        )
+      ''
+      # when cross-compiling and using the wrapper then when a package looks up the g_ir_X
+      # variable with pkg-config they'll get the host version which can't be run
+      # override the variable to use the absolute path to g_ir_X in PATH which can be run
+      + ''
+        cat >> $dev/nix-support/setup-hook <<-'EOF'
+          override-pkg-config-gir-variables() {
+            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER="$(type -p g-ir-scanner)"
+            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER="$(type -p g-ir-compiler)"
+            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE="$(type -p g-ir-generate)"
+            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER
+            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER
+            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE
+          }
+
+          preConfigureHooks+=(override-pkg-config-gir-variables)
+        EOF
+      '';
+    })
+else
+  stdenv.mkDerivation (builtins.removeAttrs overridenUnwrappedGir.drvAttrs [ "name" ] # so we can get a fresh name generated from the pname
+    // {
+    pname = "gobject-introspection-wrapped";
+    passthru = overridenUnwrappedGir.passthru // {
+      unwrapped = overridenUnwrappedGir;
+    };
+    phases = [ "fixupPhase" ]; # don't remove, it is valid to set phases here.
+    dontStrip = true;
+    depsTargetTargetPropagated = [ overridenTargetUnwrappedGir ];
+    postFixup = ''
+      ${lib.concatMapStrings (output: ''
+        mkdir -p ${"$" + "${output}"}
+        ${lib.getExe buildPackages.xorg.lndir} ${gobject-introspection-unwrapped.${output}} ${"$" + "${output}"}
+      '') gobject-introspection-unwrapped.outputs}
+    '';
+  })
diff --git a/pkgs/development/libraries/gtksourceview/4.x.nix b/pkgs/development/libraries/gtksourceview/4.x.nix
index 315547ad38681..f3414c39270ac 100644
--- a/pkgs/development/libraries/gtksourceview/4.x.nix
+++ b/pkgs/development/libraries/gtksourceview/4.x.nix
@@ -70,6 +70,13 @@ stdenv.mkDerivation rec {
     dbus
   ];
 
+  postPatch = ''
+    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/295
+    # build: drop unnecessary vapigen check
+    substituteInPlace meson.build \
+      --replace "if generate_vapi" "if false"
+  '';
+
   # Broken by PCRE 2 bump in GLib.
   # https://gitlab.gnome.org/GNOME/gtksourceview/-/issues/283
   doCheck = false;
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index 25bd8127a546f..d3b1cc42a12fd 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -74,6 +74,13 @@ stdenv.mkDerivation rec {
     "-Dgtk_doc=true"
   ];
 
+  postPatch = ''
+    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/295
+    # build: drop unnecessary vapigen check
+    substituteInPlace meson.build \
+      --replace "if generate_vapi" "if false"
+  '';
+
   doCheck = stdenv.isLinux;
 
   checkPhase = ''
diff --git a/pkgs/development/libraries/keybinder3/default.nix b/pkgs/development/libraries/keybinder3/default.nix
index 94f10426c7156..cee48d5e9eff6 100644
--- a/pkgs/development/libraries/keybinder3/default.nix
+++ b/pkgs/development/libraries/keybinder3/default.nix
@@ -13,14 +13,25 @@ stdenv.mkDerivation rec {
     sha256 = "196ibn86j54fywfwwgyh89i9wygm4vh7ls19fn20vrnm6ijlzh9r";
   };
 
-  nativeBuildInputs = [ autoconf automake libtool pkg-config ];
+  strictDeps = true;
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
+    gnome.gnome-common
+    gtk-doc
+    gobject-introspection
+  ];
   buildInputs = [
-    gnome.gnome-common gtk-doc gtk3
-    libX11 libXext libXrender gobject-introspection
+    gtk3 libX11 libXext libXrender
   ];
 
   preConfigure = ''
-    ./autogen.sh --prefix="$out"
+    # NOCONFIGURE fixes 'If you meant to cross compile, use `--host'.'
+    NOCONFIGURE=1 ./autogen.sh --prefix="$out"
+    substituteInPlace ./configure \
+      --replace "dummy pkg-config" 'dummy ''${ac_tool_prefix}pkg-config'
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 4df7ddaffb258..10ef8e5395a38 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.3";
+  version = "1.2.4";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-6Rbqm3n5UYVguaGHJRp8BCRCqey85/Nr55CIiGBdAlU=";
+    hash = "sha256-wP4jO+TN/XA+fVl37462P8vx0AUrYEThsj1HyjViR38=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index a5c6498166f51..62abb162b00d0 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.2.1";
+  version = "3.2.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-ses9LDvkn7vQUacfZTLJYmvOzqaXgxkGkM1+Tf3yjyk=";
+    sha256 = "sha256-g2c8aFuRD7fTnx8o7uWvvvtxwFeY/DUKw78biF4e+qE=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index ad4083bf6fea5..045b060a04fb7 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.15.0";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "sha256-NJA2FTPrhLj9+vmkBy+GcTiH57gBEQnYhZzYk3sEOBo=";
+    sha256 = "sha256-HTwJQpDND4PjiNpUjHtTgkQdkahm2BUe71UDRQpvo6M=";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libwnck/default.nix b/pkgs/development/libraries/libwnck/default.nix
index d6e6475917291..2f535930ed037 100644
--- a/pkgs/development/libraries/libwnck/default.nix
+++ b/pkgs/development/libraries/libwnck/default.nix
@@ -3,6 +3,7 @@
 , fetchurl
 , fetchpatch
 , meson
+, mesonEmulatorHook
 , ninja
 , pkg-config
 , gtk-doc
@@ -50,6 +51,8 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_412
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 24ce9ff207719..54c1e8acf0415 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -7,7 +7,8 @@
 , libglvnd, libunwind
 , vulkan-loader, glslang
 , galliumDrivers ? ["auto"]
-, vulkanDrivers ? ["auto"]
+# upstream Mesa defaults to only enabling swrast (aka lavapipe) on aarch64 for some reason, so force building the others
+, vulkanDrivers ? [ "auto" ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [ "broadcom" "freedreno" "panfrost" ]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
 , vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ "device-select" "overlay" ] # No Vulkan support on Darwin
 , OpenGL, Xplugin
@@ -36,7 +37,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.2.2";
+  version = "22.2.3";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -51,7 +52,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "2de11fb74fc5cc671b818e49fe203cea0cd1d8b69756e97cdb06a2f4e78948f9";
+    sha256 = "ee7d026f7b1991dbae0861d359b671145c3a86f2a731353b885d2ea2d5c098d6";
   };
 
   # TODO:
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 97a84356f8181..5db0a7c8bfa94 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -92,6 +92,8 @@ stdenv.mkDerivation rec {
   preCheck = ''
     substituteInPlace tests/scripts/all \
       --replace "/bin/rm" "rm"
+    # fails saying "SASL(-1): generic failure: internal error: failed to init cipher 'rc4'"
+    rm tests/scripts/test076-authid-rewrite
   '';
 
   doCheck = true;
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index f2907afab0188..6110d459ecca5 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -68,11 +68,10 @@
 
 let
   mesonEnableFeature = b: if b then "enabled" else "disabled";
-  mesonList = l: "[" + lib.concatStringsSep "," l + "]";
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.59";
+    version = "0.3.60";
 
     outputs = [
       "out"
@@ -90,7 +89,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-4wDtdgkjBRlthhwbI3cSQFnbr+gxPQP5j5YnrWiQVp4=";
+      sha256 = "sha256-HDE2QAV2jnEJCqgiGx4TVP4ceeKAqwd4P3OYw6auNAM=";
     };
 
     patches = [
@@ -107,10 +106,24 @@ let
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
 
-      # remove when updating to 0.3.60
-      (fetchpatch { # filter-chain: iterate the port correctly
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/94a64268613adac8ef6f3e6c1f04468220540d00.patch";
-        sha256 = "sha256-IDTB7NgadgR3vKv97Nvd9pBfnOnMi21YsvLdD1Ew7HE=";
+      # Following are backported patches as recommended by upstream.
+      # FIXME: remove in 0.3.61
+      # fix tdesktop with pw-pulse
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b720da771efa950cf380101bed42d5d5ee177908.diff";
+        hash = "sha256-p/BvatnbEJAMLQUUOECKAK7FppaNp9ei3FHjAw2spM8=";
+      })
+
+      # fix a crash when quickly switching Bluetooth profiles
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/bf3516ba0496b644b3944b114253f23964178897.diff";
+        hash = "sha256-LqasplS/azCPekslJQPTd9MZkUcRqA0ks94FtwyY3GA=";
+      })
+
+      # fix no sound in VMs (Pipewire on the guest)
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b46d8a8c921a8da6883610ad4b68da95bf59b59e.diff";
+        hash = "sha256-2VHBwXbzUAGP/fG4xxoFLHSb9oXQK1BPuNv3zAV8cEg=";
       })
     ];
 
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 83f73c993072b..4639bf53a52f3 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "98c727f273fc83c24550274bd2728e1aafbd213a",
-    "sha256": "1hwswan0yw6l4rka60ch173sd71ijx0y15gb2hnd3mhzws8gjsb5"
+    "rev": "51258629f2cf37fff8406bf705d79c07fc7135ca",
+    "sha256": "0wsjw7wc493kx6w954plmd5y8qsshbd5wqxdwj350gnv48n63g2k"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "45d43c04088efb8346979f633f72bb1f23183461",
-    "sha256": "1ad6r1zwzzvl1i2rxkjgp8x5k4ahcf6grfq6xarbbj9qvvb08ny4"
+    "rev": "959b1ac3b7c699ef67ec81155e6e1e579d4e1df7",
+    "sha256": "0f8l214x38hdn768jjfy31pqdjgya6221k38vidnfap522qs1fcm"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -56,8 +56,8 @@
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "1b83a9c73d6e5459ec4c2221b2bd7e5396b5e874",
-    "sha256": "07ry1bfim24aa530xslp8njn1bzalrmrwcx0xz2p2jilhfvvp5fc"
+    "rev": "adbc372b890ed90f006a6c4f3ca56bf0cba477ef",
+    "sha256": "05v47ba06lmhrmm9ivnfnxzv9qdhyx2bbx2lkqjfwax2czmnf81j"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
@@ -101,8 +101,8 @@
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "9ff77702cc3649cbaf94046742d682d77cdea698",
-    "sha256": "0sq2j94csmd7ifd1hw4lwv7b82l59iz2258jg50d0j5hcf3acydz"
+    "rev": "5465566a4ad9f6f9758bed304153f0c7fec3437b",
+    "sha256": "03qayykxd07fwp5m1s7dwjvdcv45m3v6zia9k6ipif2bbjbi4dyd"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
@@ -166,8 +166,8 @@
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "9c607c771acdb3d820be7f112db99213a6c6d7eb",
-    "sha256": "1dbilhkldvhwwd2j0g7mwz1jyw9zgzwyyx43rsmnmv9lh36pb3dc"
+    "rev": "4b43f2dc58e71732ebdbe1eaf4392272bc692e6d",
+    "sha256": "157wqyh9wv9kn8671l7dhnv3a4glmqpisqk0vdgnx19b6jdxymvj"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
diff --git a/pkgs/development/libraries/qt-5/modules/qtwayland.nix b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
index 851e4ad6966b0..10e18b3b98447 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
@@ -1,4 +1,4 @@
-{ qtModule, qtbase, qtquickcontrols, wayland, pkg-config }:
+{ lib, qtModule, qtbase, qtquickcontrols, wayland, pkg-config, fetchpatch }:
 
 qtModule {
   pname = "qtwayland";
@@ -11,5 +11,14 @@ qtModule {
     # wrapped executables from `wrapQtAppsHook` (see comment in patch for further
     # context).  Beware: shared among different Qt5 versions.
     ./qtwayland-app_id.patch
-  ];
+  ] ++ lib.optional (lib.versionAtLeast qtbase.version "5.15")
+    # Backport of https://codereview.qt-project.org/c/qt/qtwayland/+/388338
+    # Pulled from Fedora as they modified it to not apply to KDE as Plasma 5.x
+    # doesn't behave properly with the patch applied. See the discussion at
+    # https://invent.kde.org/qt/qt/qtwayland/-/merge_requests/39 for details
+    # This patch won't apply to versions before 5.15.
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/qt5-qtwayland/raw/46376bb00d4c3dd3db2e82ad7ca5301ce16ea4ab/f/0080-Client-set-constraint-adjustments-for-popups-in-xdg.patch";
+      sha256 = "sha256-XP+noYCk8fUdA0ItCqMjV7lSXDlNdB7Az9q7NRpupHc=";
+    });
 }
diff --git a/pkgs/development/lisp-modules-new/lisp-packages.nix b/pkgs/development/lisp-modules-new/lisp-packages.nix
index 513f72a985e0e..aebcfdb1878eb 100644
--- a/pkgs/development/lisp-modules-new/lisp-packages.nix
+++ b/pkgs/development/lisp-modules-new/lisp-packages.nix
@@ -133,10 +133,6 @@ let
     in stdenv.mkDerivation (rec {
       inherit pname version nativeLibs javaLibs lispLibs lisp systems asds;
 
-      src = if builtins.length patches > 0
-            then apply-patches args
-            else args.src;
-
       # When src is null, we are building a lispWithPackages and only
       # want to make use of the dependency environment variables
       # generated by build-asdf-system
@@ -201,7 +197,7 @@ let
         #
         # NOTE: It's important to read files from `src` instead of
         # from pwd to get go-to-definition working with SLIME
-        export CL_SOURCE_REGISTRY=$CL_SOURCE_REGISTRY:${src}//
+        export CL_SOURCE_REGISTRY=$CL_SOURCE_REGISTRY:$src//
 
         # Similiarily for native deps
         export LD_LIBRARY_PATH=${makeLibraryPath nativeLibs}:$LD_LIBRARY_PATH
@@ -209,7 +205,7 @@ let
 
         # Make asdf compile from `src` to pwd and load `lispLibs`
         # from storeDir. Otherwise it could try to recompile lisp deps.
-        export ASDF_OUTPUT_TRANSLATIONS="${src}:$(pwd):${storeDir}:${storeDir}"
+        export ASDF_OUTPUT_TRANSLATIONS="$src:$(pwd):${storeDir}:${storeDir}"
 
         # track lisp dependencies for graph generation
         # TODO: Do the propagation like for lisp, native and java like this:
@@ -248,24 +244,12 @@ let
       dontStrip = true;
       dontFixup = true;
 
-    } // args));
-
-  # Need to do that because we always want to compile straight from
-  # `src` for go-to-definition to work in SLIME.
-  apply-patches = { patches, src, ... }:
-    stdenv.mkDerivation {
-      inherit patches src;
-      pname = "source";
-      version = "patched";
-      dontConfigure = true;
-      dontBuild = true;
-      dontStrip = true;
-      dontFixup = true;
-      installPhase = ''
-        mkdir -pv $out
-        cp -r * $out
-      '';
-    };
+    } // (args // {
+      src = if builtins.length (args.patches or []) > 0
+            then pkgs.applyPatches { inherit (args) src patches; }
+            else args.src;
+      patches = [];
+    })));
 
   # Build the set of lisp packages using `lisp`
   # These packages are defined manually for one reason or another:
diff --git a/pkgs/development/lisp-modules-new/packages.nix b/pkgs/development/lisp-modules-new/packages.nix
index 1ad06f615b56e..244d2f4b5b5f0 100644
--- a/pkgs/development/lisp-modules-new/packages.nix
+++ b/pkgs/development/lisp-modules-new/packages.nix
@@ -102,6 +102,7 @@ let
       url = "https://github.com/cffi/cffi/archive/3f842b92ef808900bf20dae92c2d74232c2f6d3a.tar.gz";
       sha256 = "1jilvmbbfrmb23j07lwmkbffc6r35wnvas5s4zjc84i856ccclm2";
     };
+    patches = [ ./patches/cffi-libffi-darwin-ffi-h.patch ];
   });
 
   cl-unicode = build-with-compile-into-pwd {
@@ -423,6 +424,13 @@ let
     patches = [ ./patches/qtools-use-nix-libs.patch ];
   };
 
+  magicl = build-with-compile-into-pwd {
+    inherit (ql.magicl) pname version src lispLibs;
+    nativeBuildInputs = [ pkgs.gfortran ];
+    nativeLibs = [ pkgs.openblas ];
+    patches = [ ./patches/magicl-dont-build-fortran-twice.patch ];
+  };
+
   };
 
 in packages
diff --git a/pkgs/development/lisp-modules-new/patches/cffi-libffi-darwin-ffi-h.patch b/pkgs/development/lisp-modules-new/patches/cffi-libffi-darwin-ffi-h.patch
new file mode 100644
index 0000000000000..15c4a45887550
--- /dev/null
+++ b/pkgs/development/lisp-modules-new/patches/cffi-libffi-darwin-ffi-h.patch
@@ -0,0 +1,14 @@
+--- a/libffi/libffi-types.lisp
++++ b/libffi/libffi-types.lisp
+@@ -43,9 +43,6 @@
+ 
+ (pkg-config-cflags "libffi" :optional t)
+ 
+-#+darwin
+-(include "ffi/ffi.h")
+-#-darwin
+ (include "ffi.h")
+ 
+ (cenum status
+
+Diff finished.  Sun Nov 13 00:23:10 2022
\ No newline at end of file
diff --git a/pkgs/development/lisp-modules-new/patches/magicl-dont-build-fortran-twice.patch b/pkgs/development/lisp-modules-new/patches/magicl-dont-build-fortran-twice.patch
new file mode 100644
index 0000000000000..f63b6949b1fd5
--- /dev/null
+++ b/pkgs/development/lisp-modules-new/patches/magicl-dont-build-fortran-twice.patch
@@ -0,0 +1,21 @@
+--- a/magicl.asd
++++ b/magicl.asd
+@@ -143,6 +143,7 @@
+            (shared-object (make-pathname :type #+darwin "dylib" #-darwin "so"
+                                          :name "libexpokit"
+                                          :defaults fortran-file)))
++      (unless (probe-file (nn shared-object))
+       (uiop:run-program
+        (list "gfortran" "-fPIC" "-std=legacy"
+              "-c"
+@@ -155,7 +156,7 @@
+              (nn object-file)
+              #+darwin "-lblas"
+              #+darwin "-llapack"))
+-      (delete-file object-file))))
++      (delete-file object-file)))))
+ 
+ 
+ (asdf:defsystem #:magicl/ext-expokit
+
+Diff finished.  Mon Oct 10 22:03:54 2022
diff --git a/pkgs/development/python-modules/ansible-later/default.nix b/pkgs/development/python-modules/ansible-later/default.nix
index 964a008412911..b383453f7b925 100644
--- a/pkgs/development/python-modules/ansible-later/default.nix
+++ b/pkgs/development/python-modules/ansible-later/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-later";
-  version = "2.0.22";
+  version = "2.0.23";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-RFyQvg7CF5Fa+DnOo0PoDtGPJMOx0Md8I+gshMH2Fvs=";
+    hash = "sha256-FQnyWC7d9h8Ya2BlaTGTrNXkHtJJLdeNL7qXP7scLFA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index 5273069d019c6..eee9f58cc30d3 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -1,21 +1,20 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, pytz, pytestCheckHook, freezegun }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, pythonOlder, pytz, pytestCheckHook, freezegun }:
 
 buildPythonPackage rec {
   pname = "babel";
-  version = "2.10.3";
+  version = "2.11.0";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Babel";
     inherit version;
-    sha256 = "sha256-dhRVNxHul0kPcyEm3Ad/jQrghOvGqW4j2xSCr6vbLFE=";
+    sha256 = "sha256-XvSzImsBgN7d7UIpZRyLDho6aig31FoHMnLzE+TPl/Y=";
   };
 
   propagatedBuildInputs = [ pytz ];
 
   checkInputs = [ pytestCheckHook freezegun ];
 
-  doCheck = !stdenv.isDarwin;
-
   meta = with lib; {
     homepage = "https://babel.pocoo.org/";
     description = "Collection of internationalizing tools";
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 6006c30219e12..6d948889341d3 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -20,7 +20,7 @@
 
 let
   pname = "hatchling";
-  version = "1.9.0";
+  version = "1.11.1";
 in
 buildPythonPackage {
   inherit pname version;
@@ -28,7 +28,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-tXxzYvQ3uUJuS5QiiiHSrFgE+7KrywGt3iVEo1uzA80=";
+    hash = "sha256-n4Q2H3DPOnq5VDsMPsxkIR7SuopganHrakc8HJsI4dA=";
   };
 
   # listed in backend/src/hatchling/ouroboros.py
@@ -72,6 +72,7 @@ buildPythonPackage {
   meta = with lib; {
     description = "Modern, extensible Python build backend";
     homepage = "https://hatch.pypa.io/latest/";
+    changelog = "https://github.com/pypa/hatch/blob/hatchling-v${version}/docs/history.md#hatchling";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ofek ];
   };
diff --git a/pkgs/development/python-modules/incremental/default.nix b/pkgs/development/python-modules/incremental/default.nix
index 55123163dbf58..cf22ae79d8daf 100644
--- a/pkgs/development/python-modules/incremental/default.nix
+++ b/pkgs/development/python-modules/incremental/default.nix
@@ -7,11 +7,11 @@
 
 let incremental = buildPythonPackage rec {
   pname = "incremental";
-  version = "21.3.0";
+  version = "22.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "02f5de5aff48f6b9f665d99d48bfc7ec03b6e3943210de7cfc88856d755d6f57";
+    sha256 = "sha256-kS/uteD34BiOb0IkHS9FAALhG7wJN8ZYZQRYVMJMC9A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/invoke/default.nix b/pkgs/development/python-modules/invoke/default.nix
index a2180f5b964a6..65f4fe105f66f 100644
--- a/pkgs/development/python-modules/invoke/default.nix
+++ b/pkgs/development/python-modules/invoke/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "invoke";
-  version = "1.7.1";
+  version = "1.7.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e23q9YXu4KhIIF0LjAAUub9vKHqOt5iBimQt/x3xSxk=";
+    hash = "sha256-QbQoNC1GaoITXVqzcRloWpiXE3Qr5G5Co6OZ1oVXkxQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index 536389fb3b109..69dba8bd472ea 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "4.16.0";
+  version = "4.17.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FlBZ8Hbv9pcbrlt0L8App7TvP5vPBMFOR3anYF3hSyM=";
+    sha256 = "sha256-W/zyvKFqCHreF+ArKC00r3zNdJ73YkHn+b18DLipQk0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index d649d6ccbbace..98e3ede7fb925 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,20 +16,20 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.8.0";
+  version = "3.8.1";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ijl";
     repo = pname;
     rev = version;
-    hash = "sha256-P1n0r5181Wt4tml2SKMI7pDNh2YakCp1I+cvQM6RRWg=";
+    hash = "sha256-3U27JuKMsMla3BKbbpO0uXesGHYaVQs8MwtQvumkksY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-8k0DetamwLqkdcg8V/D2J5ja6IJSLi50CE+ZjFa7Hdc=";
+    hash = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY";
   };
 
   format = "pyproject";
@@ -52,6 +52,12 @@ buildPythonPackage rec {
     xxhash
   ];
 
+  disabledTests = lib.optionals (stdenv.is32bit) [
+    # integer overflow on 32bit
+    "test_numpy_array_d1_intp"
+    "test_numpy_array_d1_uintp"
+  ];
+
   pythonImportsCheck = [ pname ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index 0fe9ac5a73676..ff77f7526b808 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "5.10.0";
+  version = "5.11.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-z8xP+OaYJW/BfqP/eWR4sFCFJYWqW6557NBbKrezm5o=";
+    sha256 = "sha256-uXvGaVsq/wIUQTPC5zmdWIUiPUK3kS/67CyjiY5nO/4=";
   };
 
   # importlib-metadata could be added here if it wouldn't cause an infinite recursion
diff --git a/pkgs/development/python-modules/pbr/tests.nix b/pkgs/development/python-modules/pbr/tests.nix
index aacb726d6a1d1..b04751231872e 100644
--- a/pkgs/development/python-modules/pbr/tests.nix
+++ b/pkgs/development/python-modules/pbr/tests.nix
@@ -24,6 +24,9 @@ buildPythonPackage rec {
 
   dontBuild = true;
   dontInstall = true;
+  preConfigure = ''
+    pythonOutputDistPhase() { touch $dist; }
+  '';
 
   checkInputs = [
     pbr
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 1b847100a955a..2a81ebf40efe0 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -11,15 +11,20 @@
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "22.0.0";
+  version = "22.1.0";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchPypi {
     pname = "pyOpenSSL";
     inherit version;
-    sha256 = "sha256-ZgsbFCWqxKG+odlBaKhdmfCzFEyGndQ5DSdinQCH8b8=";
+    sha256 = "sha256-eoO3snLdWVIi1nL1zimqAw8fuDdjDvIp9i5y45XOiWg=";
   };
 
-  outputs = [ "out" "dev" ];
+  postPatch = ''
+    # remove cryptography pin
+    sed "/cryptography/ s/,<[0-9]*//g" setup.py
+  '';
 
   # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
   # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
diff --git a/pkgs/development/python-modules/python-ldap/default.nix b/pkgs/development/python-modules/python-ldap/default.nix
index 7b3c2bdbc0ba4..f8844c5eaec77 100644
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@@ -45,6 +45,11 @@ buildPythonPackage rec {
     export SCHEMA="${openldap}/etc/schema"
   '';
 
+  disabledTests = [
+    # https://github.com/python-ldap/python-ldap/issues/501
+    "test_tls_ext_noca"
+  ];
+
   doCheck = !stdenv.isDarwin;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pytz-deprecation-shim/default.nix b/pkgs/development/python-modules/pytz-deprecation-shim/default.nix
index 6ea1c2c8f2e03..76f0046a7e28b 100644
--- a/pkgs/development/python-modules/pytz-deprecation-shim/default.nix
+++ b/pkgs/development/python-modules/pytz-deprecation-shim/default.nix
@@ -43,8 +43,8 @@ buildPythonPackage rec {
   # https://github.com/pganssle/pytz-deprecation-shim/issues/27
   doCheck = pythonAtLeast "3.9";
 
-  disabledTests = [
-    "test_localize_explicit_is_dst"
+  disabledTestPaths = [
+    "tests/test_pytz_equivalent.py"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index f85121a39ac3e..457a9c622a121 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchPypi
+, fetchpatch
 , python
 , pythonOlder
 , buildPythonPackage
@@ -28,6 +29,13 @@ buildPythonPackage rec {
     sha256 = "sha256-JtKMRokA5tX9s30oEqtG2wzNIsY7qglQV4cfqjpJi8k=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/scipy/scipy/commit/318d8c6d16fdf000be8637e9917989729f2c8ce7.diff";
+      sha256 = "sha256-Zfb9GYP0r9MDJ91hSzMN1r4eNilajPThNIvZmDzFEXo=";
+    })
+  ];
+
   nativeBuildInputs = [ cython gfortran meson-python pythran pkg-config wheel ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/tzdata/default.nix b/pkgs/development/python-modules/tzdata/default.nix
index d1fed0b21fa96..2e3cdafc8a125 100644
--- a/pkgs/development/python-modules/tzdata/default.nix
+++ b/pkgs/development/python-modules/tzdata/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "tzdata";
-  version = "2022.2";
+  version = "2022.6";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IfTw1yQVcu+n96T9q7BS5htV3EgnTmhCaXzN9SU+VFE=";
+    hash = "sha256-kfEdtFAzhZKMFVmMmFc+OvB+cikYG+5Tdb0w8Wld3K4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index e773960730f6f..cdabed860c92c 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -9,14 +9,14 @@
 
 let zipp = buildPythonPackage rec {
   pname = "zipp";
-  version = "3.8.1";
+  version = "3.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-BbRfHuj4B9DMkoSFykCgfLSRzwkv9YfA35yx/RVISNI=";
+    sha256 = "sha256-enJi/ZML0+NsULmmSJeuw/r/89/e7JYjriK0DpP5m7g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 9d2edcb749c5b..5ba3503d98610 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.3.24";
-  source.sha256 = "sha256-6qLrjDiS6HD5eSUrIZa9d+tVHh2/PNxOsWS6AexEOMQ=";
+  version = "2.3.25";
+  source.sha256 = "sha256-/YHsRjXEGJtm/QeJU31cs4s4ELcHZfbh6C3aFbl1ka0=";
   dontPatchShebangs = true;
 
   passthru.updateScript = writeScript "gem-update-script" ''
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index d64b3bbe1a881..7f0d94a9f30ee 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
     + lib.optionalString isBootstrap "-boot"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.24.2";
+  version = "3.24.3";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
-    sha256 = "sha256-DZAg8G893xf7U33CKOGlbJJ+5Qa0hvVf4twZ9pvwyNs=";
+    sha256 = "sha256-tTqhD6gr/4TM21kGWSe3LTvuSfTYYmEkn8CYSzs2cpE=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/hatch/default.nix b/pkgs/development/tools/hatch/default.nix
index 777028a008f90..952a8ecb16cbc 100644
--- a/pkgs/development/tools/hatch/default.nix
+++ b/pkgs/development/tools/hatch/default.nix
@@ -7,22 +7,25 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hatch";
-  version = "1.3.1";
+  version = "1.6.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "hatch";
     rev = "hatch-v${version}";
-    sha256 = "sha256-ftT86HX5CVbiHe5yzXT2gNl8Rx+f+fmiAJRnOuDpvYI=";
+    hash = "sha256-3nPh6F+TmLoogz9FgaZMub7hPJIzANCY4oWk9Mq22Pc=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
     click
     hatchling
     httpx
+    hyperlink
     keyring
+    packaging
     pexpect
+    platformdirs
     pyperclip
     rich
     shellingham
@@ -36,6 +39,7 @@ python3.pkgs.buildPythonApplication rec {
     git
     pytestCheckHook
     pytest-mock
+    pytest-xdist
   ];
 
   preCheck = ''
@@ -54,6 +58,7 @@ python3.pkgs.buildPythonApplication rec {
     "test_editable_exact"
     "test_editable_exact_extra_dependencies"
     "test_editable_exact_force_include"
+    "test_editable_exact_force_include_option"
     "test_editable_exact_force_include_build_data_precedence"
     "test_editable_pth"
     # AssertionError: assert len(extract_installed_requirements(output.splitlines())) > 0
@@ -63,6 +68,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Modern, extensible Python project manager";
     homepage = "https://hatch.pypa.io/latest/";
+    changelog = "https://github.com/pypa/hatch/blob/${src.rev}/docs/history.md#hatch";
     license = licenses.mit;
     maintainers = with maintainers; [ onny ];
   };
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index 9cf752af5b8f0..ac80fc471e063 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -1,37 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, buildPackages, ncurses }:
+{ lib, stdenv, fetchFromGitHub, buildPackages, perl, which, ncurses }:
 
-let dialect = with lib; last (splitString "-" stdenv.hostPlatform.system); in
+let
+  dialect = with lib; last (splitString "-" stdenv.hostPlatform.system);
+in
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.95.0";
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  buildInputs = [ ncurses ];
+  version = "4.96.4";
 
   src = fetchFromGitHub {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    sha256 = "sha256-HgU7/HxLdUOfLU2E/dpusko6gBOoEKeWPJIFbBQGzFU=";
+    sha256 = "sha256-S+8KizjayqeiWsMySWjRoZQf7ODCjdMq5ULoetOdYiA=";
   };
 
   patches = [
     ./no-build-info.patch
-
-    # Pull upstream fix for -fno-common toolchains:
-    #   https://github.com/lsof-org/lsof/pull/226
-    #   https://github.com/lsof-org/lsof/pull/233
-    (fetchpatch {
-      name = "add-extern.patch";
-      url = "https://github.com/lsof-org/lsof/commit/180ffa29b0544f77cabbc54d7f77d50d33dd27d7.patch";
-      sha256 = "sha256-zzcN9HrFYMTBeEekeAwi2RIcVukymgaqtpvFIBV6njU=";
-    })
-    (fetchpatch {
-      name = "add-declaration.patch";
-      url = "https://github.com/lsof-org/lsof/commit/8e47e1491636e8cf41baf834554391be45177b00.patch";
-      sha256 = "sha256-kwkDQp7VApLenOLTPMY24Me+/xUhD56skHWRd4ZB1I4=";
-    })
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -40,9 +25,14 @@ stdenv.mkDerivation rec {
     sed -i 's|lcurses|lncurses|g' Configure
   '';
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ perl which ];
+  buildInputs = [ ncurses ];
+
   # Stop build scripts from searching global include paths
   LSOF_INCLUDE = "${lib.getDev stdenv.cc.libc}/include";
   configurePhase = "LINUX_CONF_CC=$CC_FOR_BUILD LSOF_CC=$CC LSOF_AR=\"$AR cr\" LSOF_RANLIB=$RANLIB ./Configure -n ${dialect}";
+
   preBuild = ''
     for filepath in $(find dialects/${dialect} -type f); do
       sed -i "s,/usr/include,$LSOF_INCLUDE,g" $filepath
@@ -67,8 +57,8 @@ stdenv.mkDerivation rec {
       socket (IPv6/IPv4/UNIX local), or partition (by opening a file
       from it).
     '';
-    maintainers = [ maintainers.dezgeg ];
-    platforms = platforms.unix;
     license = licenses.purdueBsd;
+    maintainers = with maintainers; [ dezgeg ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index 458b4a10c8d08..3a4cd640d9586 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, rustPlatform, clang, rustfmt
+{ lib, fetchCrate, rustPlatform, clang, rustfmt
 , runtimeShell
 , bash
 }:
@@ -7,18 +7,15 @@ let
   rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.59.2";
+  version = "0.61.0";
 
-  RUSTFLAGS = "--cap-lints warn"; # probably OK to remove after update
-
-  src = fetchFromGitHub {
-    owner = "rust-lang";
-    repo = "rust-bindgen";
-    rev = "v${version}";
-    sha256 = "sha256-bJYdyf5uZgWe7fQ80/3QsRV0qyExYn6P9UET3tzwPFs=";
+  src = fetchCrate {
+    pname = "bindgen-cli";
+    inherit version;
+    sha256 = "sha256-sKcKIAkUC2GfAZ4tJBNweXhoFzqO95iCpHgekpOyHzc=";
   };
 
-  cargoSha256 = "sha256-RKZY5vf6CSFaKweuuNkeFF0ZXlSUibAkcL/YhkE0MoQ=";
+  cargoSha256 = "sha256-P246tw5Kznpxav0LashIkLlmQGVB+aKbFUQQdmcASPw=";
 
   buildInputs = [ clang.cc.lib ];
 
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 933b4e176f762..2d1b57417e680 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  apparmor-version = "3.1.1";
+  apparmor-version = "3.1.2";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -36,7 +36,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-phEHfrza0EeX2HEM5ts8wVCFlSLlnEtZd2MwbG/XbFY=";
+    hash = "sha256-0csF6dPel1CxbvNkg7fIrdPpnCM+hqht2a5nwPlR58A=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
diff --git a/pkgs/os-specific/linux/bpftools/default.nix b/pkgs/os-specific/linux/bpftools/default.nix
index d3bb96afb3e78..287ad9d42264b 100644
--- a/pkgs/os-specific/linux/bpftools/default.nix
+++ b/pkgs/os-specific/linux/bpftools/default.nix
@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xDalSMcxLOb8WjRyy+rYle749ShB++fHH9jki9/isLo=";
   };
 
-  patches = [ ./strip-binary-name.patch ];
+  patches = [
+    ./strip-binary-name.patch
+    # fix unknown type name '__vector128' on ppc64le
+    ./include-asm-types-for-ppc64le.patch
+  ];
 
   nativeBuildInputs = [ python3 bison flex ];
   buildInputs = (if (lib.versionAtLeast version "5.20")
diff --git a/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch b/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch
new file mode 100644
index 0000000000000..47c8f8077a5a7
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch
@@ -0,0 +1,13 @@
+diff --git a/tools/include/uapi/linux/types.h b/tools/include/uapi/linux/types.h
+index 91fa51a9c31d..bfbd9b47277f 100644
+--- a/tools/include/uapi/linux/types.h
++++ b/tools/include/uapi/linux/types.h
+@@ -2,7 +2,7 @@
+ #ifndef _UAPI_LINUX_TYPES_H
+ #define _UAPI_LINUX_TYPES_H
+ 
+-#include <asm-generic/int-ll64.h>
++#include <asm/types.h>
+ 
+ /* copied from linux:include/uapi/linux/types.h */
+ #define __bitwise
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index fe789d51dbb50..c121ef6f6f539 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.360";
+  version = "0.363";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-dF1Yeb3xH4keQzcydZ3h3kyuSZ1knW/2YAJ8xvFSoMo=";
+    sha256 = "sha256-A6GNrHc/t2SVyAyJWmzQTa+pD9wGESsz7DNruW2kH4s=";
   };
 
   postPatch = ''
@@ -19,9 +19,6 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
 
-  outputHashMode = "recursive";
-  outputHash = "sha256-gkgnHy1XwP87qpQiAm31AIAkxgGm5JYxMBr60kvd+gE=";
-
   meta = {
     homepage = "https://github.com/vcrhonek/hwdata";
     description = "Hardware Database, including Monitors, pci.ids, usb.ids, and video cards";
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 975f486629ad0..1da94ceebd7d6 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -7,7 +7,7 @@ let
       , pkg-config, libxml2, tzdata, libkrb5
 
       # This is important to obtain a version of `libpq` that does not depend on systemd.
-      , enableSystemd ? (lib.versionAtLeast version "9.6" && !stdenv.isDarwin && !stdenv.hostPlatform.isStatic)
+      , enableSystemd ? !stdenv.isDarwin && !stdenv.hostPlatform.isStatic
       , gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic
 
       # for postgresql.pkgs
@@ -37,14 +37,22 @@ let
     outputs = [ "out" "lib" "doc" "man" ];
     setOutputFlags = false; # $out retains configureFlags :-/
 
-    buildInputs =
-      [ zlib readline openssl libxml2 icu ]
+    buildInputs = [
+      zlib
+      readline
+      openssl
+      libxml2
+      icu
+    ]
       ++ lib.optionals lz4Enabled [ lz4 ]
       ++ lib.optionals enableSystemd [ systemd ]
       ++ lib.optionals gssSupport [ libkrb5 ]
       ++ lib.optionals (!stdenv.isDarwin) [ libossp_uuid ];
 
-    nativeBuildInputs = [ makeWrapper pkg-config ];
+    nativeBuildInputs = [
+      makeWrapper
+      pkg-config
+    ];
 
     enableParallelBuilding = !stdenv.isDarwin;
 
@@ -71,25 +79,24 @@ let
       ++ lib.optionals gssSupport [ "--with-gssapi" ]
       ++ lib.optionals stdenv.hostPlatform.isRiscV [ "--disable-spinlocks" ];
 
-    patches =
-      [ (if atLeast "9.4" then ./patches/disable-resolve_symlinks-94.patch else ./patches/disable-resolve_symlinks.patch)
-        (if atLeast "9.6" then ./patches/less-is-more-96.patch             else ./patches/less-is-more.patch)
-        (if atLeast "9.6" then ./patches/hardcode-pgxs-path-96.patch       else ./patches/hardcode-pgxs-path.patch)
-        ./patches/specify_pkglibdir_at_runtime.patch
-        ./patches/findstring.patch
-      ]
-      ++ lib.optional stdenv.isLinux (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch);
+    patches = [
+      ./patches/disable-resolve_symlinks.patch
+      ./patches/less-is-more.patch
+      ./patches/hardcode-pgxs-path.patch
+      ./patches/specify_pkglibdir_at_runtime.patch
+      ./patches/findstring.patch
+    ] ++ lib.optionals stdenv.isLinux [
+      (if atLeast "13" then ./patches/socketdir-in-run-13.patch else ./patches/socketdir-in-run.patch)
+    ];
 
     installTargets = [ "install-world" ];
 
     LC_ALL = "C";
 
-    postConfigure =
-      let path = if atLeast "9.6" then "src/common/config_info.c" else "src/bin/pg_config/pg_config.c"; in
-        ''
-          # Hardcode the path to pgxs so pg_config returns the path in $out
-          substituteInPlace "${path}" --replace HARDCODED_PGXS_PATH $out/lib
-        '';
+    postPatch = ''
+      # Hardcode the path to pgxs so pg_config returns the path in $out
+      substituteInPlace "src/common/config_info.c" --replace HARDCODED_PGXS_PATH "$out/lib"
+    '';
 
     postInstall =
       ''
@@ -162,8 +169,6 @@ let
       license     = licenses.postgresql;
       maintainers = with maintainers; [ thoughtpolice danbst globin marsam ivan ];
       platforms   = platforms.unix;
-      knownVulnerabilities = optional (!atLeast "9.4")
-        "PostgreSQL versions older than 9.4 are not maintained anymore!";
     };
   };
 
@@ -199,45 +204,45 @@ let
 in self: {
 
   postgresql_11 = self.callPackage generic {
-    version = "11.17";
+    version = "11.18";
     psqlSchema = "11.1"; # should be 11, but changing it is invasive
-    hash = "sha256-bphJY64HZeYVd5lRA6fmWU2w8L0BUorBI+DeSmpMtMQ=";
+    hash = "sha256-0k8g78UukYrPvMoh6c6ijg4mO4RqDECPz6w7PEoPdQQ=";
     this = self.postgresql_11;
     thisAttr = "postgresql_11";
     inherit self;
   };
 
   postgresql_12 = self.callPackage generic {
-    version = "12.12";
+    version = "12.13";
     psqlSchema = "12";
-    hash = "sha256-NLPxxpQI4iBowMcbGCdpHxyJFTsK1XbBpE+JIKhYA5w=";
+    hash = "sha256-tsYjBGr0VI8RqEtAeTTWddEe0HDHk9FbBGg79fMi4C0=";
     this = self.postgresql_12;
     thisAttr = "postgresql_12";
     inherit self;
   };
 
   postgresql_13 = self.callPackage generic {
-    version = "13.8";
+    version = "13.9";
     psqlSchema = "13";
-    hash = "sha256-c4dv3TpRcIc0BFjcpM4VuNKk286zNMBEFCRVGubEze0=";
+    hash = "sha256-7xlmwKXkn77TNwrSgkkoy2sRZGF67q4WBtooP38zpBU=";
     this = self.postgresql_13;
     thisAttr = "postgresql_13";
     inherit self;
   };
 
   postgresql_14 = self.callPackage generic {
-    version = "14.5";
+    version = "14.6";
     psqlSchema = "14";
-    hash = "sha256-1PcstfuFfJqfdeyM8JGhdxJygC8hePCy5lt7b/ZPSjA=";
+    hash = "sha256-UIhA/BgJ05q3InTV8Tfau5/X+0+TPaQWiu67IAae3yI=";
     this = self.postgresql_14;
     thisAttr = "postgresql_14";
     inherit self;
   };
 
   postgresql_15 = self.callPackage generic {
-    version = "15.0";
+    version = "15.1";
     psqlSchema = "15";
-    hash = "sha256-cux09KfBbmhPQ+pC4hVJf81MVdAopo+3LpnmH/QNpNY=";
+    hash = "sha256-ZP3yPXNK+tDf5Ad9rKlqxR3NaX5ori09TKbEXLFOIa4=";
     this = self.postgresql_15;
     thisAttr = "postgresql_15";
     inherit self;
diff --git a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks-94.patch b/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks-94.patch
deleted file mode 100644
index fadeea90ac4b6..0000000000000
--- a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks-94.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/src/common/exec.c	2014-09-04 20:19:12.236057588 +0200
-+++ b/src/common/exec.c	2014-09-04 20:19:50.550251633 +0200
-@@ -218,6 +218,9 @@
- static int
- resolve_symlinks(char *path)
- {
-+	// On NixOS we *want* stuff relative to symlinks.
-+	return 0;
-+
- #ifdef HAVE_READLINK
- 	struct stat buf;
- 	char		orig_wd[MAXPGPATH],
diff --git a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch b/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch
index 3e6fd5e838a24..fadeea90ac4b6 100644
--- a/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch
+++ b/pkgs/servers/sql/postgresql/patches/disable-resolve_symlinks.patch
@@ -1,13 +1,11 @@
-diff --git a/src/port/exec.c b/src/port/exec.c
-index c79e8ba..42c4091 100644
---- a/src/port/exec.c
-+++ b/src/port/exec.c
-@@ -216,6 +216,9 @@ find_my_exec(const char *argv0, char *retpath)
+--- a/src/common/exec.c	2014-09-04 20:19:12.236057588 +0200
++++ b/src/common/exec.c	2014-09-04 20:19:50.550251633 +0200
+@@ -218,6 +218,9 @@
  static int
  resolve_symlinks(char *path)
  {
-+    // On NixOS we *want* stuff relative to symlinks.
-+    return 0;
++	// On NixOS we *want* stuff relative to symlinks.
++	return 0;
 +
  #ifdef HAVE_READLINK
  	struct stat buf;
diff --git a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path-96.patch b/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path-96.patch
deleted file mode 100644
index 6cd449769baac..0000000000000
--- a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path-96.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -Naur postgresql-9.6.1-orig/src/common/config_info.c postgresql-9.6.1/src/common/config_info.c
---- postgresql-9.6.1-orig/src/common/config_info.c	2016-11-22 21:39:29.231929261 +0100
-+++ postgresql-9.6.1/src/common/config_info.c	2016-11-22 23:36:53.685163543 +0100
-@@ -118,7 +118,10 @@
- 	i++;
-
- 	configdata[i].name = pstrdup("PGXS");
-+	strlcpy(path, "HARDCODED_PGXS_PATH", sizeof(path));
-+/* commented out to be able to point to nix $out path
- 	get_pkglib_path(my_exec_path, path);
-+*/
- 	strlcat(path, "/pgxs/src/makefiles/pgxs.mk", sizeof(path));
- 	cleanup_path(path);
- 	configdata[i].setting = pstrdup(path);
diff --git a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch b/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch
index 355813ffe20e2..6cd449769baac 100644
--- a/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch
+++ b/pkgs/servers/sql/postgresql/patches/hardcode-pgxs-path.patch
@@ -1,17 +1,14 @@
---- a/src/bin/pg_config/pg_config.c
-+++ b/src/bin/pg_config/pg_config.c
-@@ -220,11 +220,13 @@ show_sysconfdir(bool all)
- static void
- show_pgxs(bool all)
- {
--	char		path[MAXPGPATH];
-+	char		path[MAXPGPATH] = "HARDCODED_PGXS_PATH";
- 
- 	if (all)
- 		printf("PGXS = ");
-+  /* commented out to be able to point to nix $out path
- 	get_pkglib_path(mypath, path);
-+  */
+diff -Naur postgresql-9.6.1-orig/src/common/config_info.c postgresql-9.6.1/src/common/config_info.c
+--- postgresql-9.6.1-orig/src/common/config_info.c	2016-11-22 21:39:29.231929261 +0100
++++ postgresql-9.6.1/src/common/config_info.c	2016-11-22 23:36:53.685163543 +0100
+@@ -118,7 +118,10 @@
+ 	i++;
+
+ 	configdata[i].name = pstrdup("PGXS");
++	strlcpy(path, "HARDCODED_PGXS_PATH", sizeof(path));
++/* commented out to be able to point to nix $out path
+ 	get_pkglib_path(my_exec_path, path);
++*/
  	strlcat(path, "/pgxs/src/makefiles/pgxs.mk", sizeof(path));
  	cleanup_path(path);
- 	printf("%s\n", path);
+ 	configdata[i].setting = pstrdup(path);
diff --git a/pkgs/servers/sql/postgresql/patches/less-is-more-96.patch b/pkgs/servers/sql/postgresql/patches/less-is-more-96.patch
deleted file mode 100644
index f14af9dc22073..0000000000000
--- a/pkgs/servers/sql/postgresql/patches/less-is-more-96.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur postgresql-9.6.1-orig/src/include/fe_utils/print.h postgresql-9.6.1/src/include/fe_utils/print.h
---- postgresql-9.6.1-orig/src/include/fe_utils/print.h	2016-11-22 21:39:29.148932827 +0100
-+++ postgresql-9.6.1/src/include/fe_utils/print.h	2016-11-22 21:39:36.283626258 +0100
-@@ -18,7 +18,7 @@
- 
- /* This is not a particularly great place for this ... */
- #ifndef __CYGWIN__
--#define DEFAULT_PAGER "more"
-+#define DEFAULT_PAGER "less"
- #else
- #define DEFAULT_PAGER "less"
- #endif
diff --git a/pkgs/servers/sql/postgresql/patches/less-is-more.patch b/pkgs/servers/sql/postgresql/patches/less-is-more.patch
index d640d24bdaad6..f14af9dc22073 100644
--- a/pkgs/servers/sql/postgresql/patches/less-is-more.patch
+++ b/pkgs/servers/sql/postgresql/patches/less-is-more.patch
@@ -1,9 +1,9 @@
-diff -Naur postgresql-9.2.7-orig/src/bin/psql/print.h postgresql-9.2.7/src/bin/psql/print.h
---- postgresql-9.2.7-orig/src/bin/psql/print.h	2014-02-17 14:38:15.000000000 -0500
-+++ postgresql-9.2.7/src/bin/psql/print.h	2014-03-04 14:42:28.874014415 -0500
-@@ -178,7 +178,7 @@
- extern const printTextFormat *get_line_style(const printTableOpt *opt);
+diff -Naur postgresql-9.6.1-orig/src/include/fe_utils/print.h postgresql-9.6.1/src/include/fe_utils/print.h
+--- postgresql-9.6.1-orig/src/include/fe_utils/print.h	2016-11-22 21:39:29.148932827 +0100
++++ postgresql-9.6.1/src/include/fe_utils/print.h	2016-11-22 21:39:36.283626258 +0100
+@@ -18,7 +18,7 @@
  
+ /* This is not a particularly great place for this ... */
  #ifndef __CYGWIN__
 -#define DEFAULT_PAGER "more"
 +#define DEFAULT_PAGER "less"
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index a4ade683b1362..478cca8be0e2f 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     "--enable-confdir=/etc"
     # The OS should care on preparing the drivers into this location
     "--enable-usbdropdir=/var/lib/pcsc/drivers"
-    (lib.enableFeature stdenv.isLinux "systemd")
+    (lib.enableFeature stdenv.isLinux "libsystemd")
     (lib.enableFeature polkitSupport "polkit")
   ] ++ lib.optionals stdenv.isLinux [
     "--enable-ipcdir=/run/pcscd"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 41ff5fb69f599..e9b363da9b407 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18585,7 +18585,6 @@ with pkgs;
 
   cyrus_sasl = callPackage ../development/libraries/cyrus-sasl {
     libkrb5 = if stdenv.isFreeBSD then libheimdal else libkrb5;
-    openssl = openssl_1_1;
   };
 
   # Make bdb5 the default as it is the last release under the custom
@@ -19248,8 +19247,7 @@ with pkgs;
   gns3-gui = gns3Packages.guiStable;
   gns3-server = gns3Packages.serverStable;
 
-  gobject-introspection = if (!stdenv.hostPlatform.canExecute stdenv.targetPlatform) && stdenv.targetPlatform.emulatorAvailable buildPackages
-    then callPackage ../development/libraries/gobject-introspection/wrapper.nix { } else gobject-introspection-unwrapped;
+  gobject-introspection = callPackage ../development/libraries/gobject-introspection/wrapper.nix { };
 
   gobject-introspection-unwrapped = callPackage ../development/libraries/gobject-introspection {
     nixStoreDir = config.nix.storeDir or builtins.storeDir;
@@ -21678,9 +21676,7 @@ with pkgs;
 
   openexrid-unstable = callPackage ../development/libraries/openexrid-unstable { };
 
-  openldap = callPackage ../development/libraries/openldap {
-    openssl = openssl_1_1;
-  };
+  openldap = callPackage ../development/libraries/openldap { };
 
   opencolorio = darwin.apple_sdk_11_0.callPackage ../development/libraries/opencolorio {
     inherit (darwin.apple_sdk_11_0.frameworks) Carbon GLUT Cocoa;