summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/gnome.section.md18
-rw-r--r--nixos/modules/misc/locate.nix2
-rw-r--r--nixos/modules/services/misc/etebase-server.nix2
-rw-r--r--nixos/modules/services/misc/gitlab.nix4
-rw-r--r--pkgs/applications/audio/hivelytracker/default.nix2
-rw-r--r--pkgs/applications/audio/hqplayer-desktop/default.nix1
-rw-r--r--pkgs/applications/audio/losslessaudiochecker/default.nix2
-rw-r--r--pkgs/applications/audio/lyrebird/default.nix2
-rwxr-xr-xpkgs/applications/audio/soundwireserver/default.nix1
-rw-r--r--pkgs/applications/blockchains/wasabibackend/default.nix2
-rw-r--r--pkgs/applications/editors/pinegrow/default.nix2
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/graphics/awesomebump/default.nix2
-rw-r--r--pkgs/applications/graphics/foxotron/default.nix2
-rw-r--r--pkgs/applications/graphics/pixeluvo/default.nix1
-rw-r--r--pkgs/applications/graphics/unigine-valley/default.nix2
-rw-r--r--pkgs/applications/misc/foxitreader/default.nix1
-rw-r--r--pkgs/applications/misc/multibootusb/default.nix2
-rw-r--r--pkgs/applications/misc/tvbrowser/bin.nix2
-rw-r--r--pkgs/applications/misc/upwork/default.nix1
-rw-r--r--pkgs/applications/misc/xteddy/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/ripcord/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/torchat/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/zoom-us/default.nix2
-rw-r--r--pkgs/applications/networking/mailreaders/mailspring/default.nix2
-rw-r--r--pkgs/applications/networking/p2p/tribler/default.nix4
-rw-r--r--pkgs/applications/networking/remote/rustdesk/default.nix2
-rw-r--r--pkgs/applications/networking/seahub/default.nix17
-rw-r--r--pkgs/applications/networking/tetrd/default.nix2
-rw-r--r--pkgs/applications/office/jameica/default.nix2
-rw-r--r--pkgs/applications/science/astronomy/openspace/default.nix2
-rw-r--r--pkgs/applications/science/logic/tlaplus/toolbox.nix2
-rw-r--r--pkgs/applications/science/misc/netlogo/default.nix2
-rw-r--r--pkgs/applications/science/robotics/sumorobot-manager/default.nix2
-rw-r--r--pkgs/applications/terminal-emulators/syncterm/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix1
-rw-r--r--pkgs/applications/video/epgstation/default.nix2
-rw-r--r--pkgs/applications/video/mirakurun/default.nix4
-rw-r--r--pkgs/applications/window-managers/afterstep/default.nix14
-rw-r--r--pkgs/build-support/setup-hooks/make-wrapper.sh5
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh4
-rw-r--r--pkgs/build-support/trivial-builders.nix10
-rw-r--r--pkgs/data/misc/dns-root-data/default.nix3
-rw-r--r--pkgs/data/misc/freepats/default.nix5
-rw-r--r--pkgs/desktops/cdesktopenv/default.nix13
-rw-r--r--pkgs/desktops/gnome/core/mutter/3.38/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/mutter/default.nix4
-rw-r--r--pkgs/development/compilers/dmd/binary.nix5
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/mkGraal.nix3
-rw-r--r--pkgs/development/compilers/inklecate/default.nix2
-rw-r--r--pkgs/development/compilers/ldc/binary.nix5
-rw-r--r--pkgs/development/compilers/zulu/8.nix12
-rw-r--r--pkgs/development/compilers/zulu/default.nix8
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix2
-rw-r--r--pkgs/development/libraries/boost/1.78.nix15
-rw-r--r--pkgs/development/libraries/boost/default.nix1
-rw-r--r--pkgs/development/libraries/cutelyst/default.nix17
-rw-r--r--pkgs/development/libraries/glib/default.nix6
-rw-r--r--pkgs/development/libraries/glib/elementary-terminal-support.patch16
-rw-r--r--pkgs/development/libraries/glib/gnome-console-support.patch55
-rw-r--r--pkgs/development/libraries/glm/default.nix3
-rw-r--r--pkgs/development/libraries/glog/default.nix2
-rw-r--r--pkgs/development/libraries/gsettings-desktop-schemas/default.nix12
-rw-r--r--pkgs/development/libraries/hwloc/default.nix4
-rw-r--r--pkgs/development/libraries/libargon2/default.nix4
-rw-r--r--pkgs/development/libraries/libepoxy/default.nix5
-rw-r--r--pkgs/development/libraries/libevdev/default.nix4
-rw-r--r--pkgs/development/libraries/libunwind/default.nix10
-rw-r--r--pkgs/development/libraries/mesa/default.nix3
-rw-r--r--pkgs/development/libraries/openvino/default.nix2
-rw-r--r--pkgs/development/libraries/pmdk/default.nix6
-rw-r--r--pkgs/development/libraries/rlottie/default.nix17
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/talloc/default.nix3
-rw-r--r--pkgs/development/libraries/zlib/CVE-2018-25032-1.patch346
-rw-r--r--pkgs/development/libraries/zlib/CVE-2018-25032-2.patch27
-rw-r--r--pkgs/development/lua-modules/overrides.nix4
-rw-r--r--pkgs/development/misc/msp430/mspds/binary.nix3
-rw-r--r--pkgs/development/mobile/androidenv/build-tools.nix4
-rw-r--r--pkgs/development/mobile/androidenv/platform-tools.nix3
-rw-r--r--pkgs/development/python-modules/afdko/default.nix12
-rw-r--r--pkgs/development/python-modules/apprise/default.nix4
-rw-r--r--pkgs/development/python-modules/asana/default.nix42
-rw-r--r--pkgs/development/python-modules/asgiref/default.nix9
-rwxr-xr-xpkgs/development/python-modules/atlassian-python-api/default.nix4
-rw-r--r--pkgs/development/python-modules/black/default.nix4
-rw-r--r--pkgs/development/python-modules/blinker/default.nix11
-rw-r--r--pkgs/development/python-modules/cppy/default.nix19
-rw-r--r--pkgs/development/python-modules/cryptography/default.nix50
-rw-r--r--pkgs/development/python-modules/cryptography/vectors.nix15
-rw-r--r--pkgs/development/python-modules/django-allauth/default.nix36
-rw-r--r--pkgs/development/python-modules/exchangelib/default.nix6
-rw-r--r--pkgs/development/python-modules/fitbit/default.nix40
-rw-r--r--pkgs/development/python-modules/flickrapi/default.nix69
-rw-r--r--pkgs/development/python-modules/flit-core/default.nix4
-rw-r--r--pkgs/development/python-modules/flit/default.nix21
-rw-r--r--pkgs/development/python-modules/fontparts/default.nix8
-rw-r--r--pkgs/development/python-modules/fonttools/default.nix7
-rw-r--r--pkgs/development/python-modules/freezegun/default.nix31
-rw-r--r--pkgs/development/python-modules/google-auth-oauthlib/default.nix16
-rw-r--r--pkgs/development/python-modules/google-nest-sdm/default.nix4
-rw-r--r--pkgs/development/python-modules/h11/default.nix3
-rw-r--r--pkgs/development/python-modules/homeconnect/default.nix15
-rw-r--r--pkgs/development/python-modules/hpack/default.nix25
-rw-r--r--pkgs/development/python-modules/hyperframe/default.nix5
-rw-r--r--pkgs/development/python-modules/jira/default.nix31
-rw-r--r--pkgs/development/python-modules/kiwisolver/default.nix30
-rw-r--r--pkgs/development/python-modules/kubernetes/default.nix7
-rw-r--r--pkgs/development/python-modules/lmnotify/default.nix23
-rw-r--r--pkgs/development/python-modules/mezzanine/default.nix68
-rw-r--r--pkgs/development/python-modules/msrest/default.nix69
-rw-r--r--pkgs/development/python-modules/mwclient/default.nix38
-rw-r--r--pkgs/development/python-modules/mwoauth/default.nix23
-rw-r--r--pkgs/development/python-modules/ondilo/default.nix13
-rw-r--r--pkgs/development/python-modules/packaging/default.nix54
-rw-r--r--pkgs/development/python-modules/pleroma-bot/default.nix29
-rw-r--r--pkgs/development/python-modules/psautohint/default.nix16
-rw-r--r--pkgs/development/python-modules/pyasn1/default.nix10
-rw-r--r--pkgs/development/python-modules/pyatmo/default.nix4
-rw-r--r--pkgs/development/python-modules/pybotvac/default.nix14
-rw-r--r--pkgs/development/python-modules/pycep-parser/default.nix5
-rw-r--r--pkgs/development/python-modules/pycurl/default.nix7
-rw-r--r--pkgs/development/python-modules/pymfy/default.nix13
-rw-r--r--pkgs/development/python-modules/pynello/default.nix10
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix8
-rw-r--r--pkgs/development/python-modules/pyparsing/default.nix10
-rw-r--r--pkgs/development/python-modules/pysmappee/default.nix16
-rw-r--r--pkgs/development/python-modules/pysnow/default.nix58
-rw-r--r--pkgs/development/python-modules/python-google-nest/default.nix6
-rw-r--r--pkgs/development/python-modules/python-twitter/default.nix39
-rw-r--r--pkgs/development/python-modules/pyvicare/default.nix8
-rw-r--r--pkgs/development/python-modules/regex/default.nix4
-rw-r--r--pkgs/development/python-modules/requests/default.nix10
-rw-r--r--pkgs/development/python-modules/responses/default.nix12
-rw-r--r--pkgs/development/python-modules/ring-doorbell/default.nix18
-rw-r--r--pkgs/development/python-modules/setuptools-rust/default.nix6
-rw-r--r--pkgs/development/python-modules/social-auth-core/default.nix4
-rw-r--r--pkgs/development/python-modules/sortedcontainers/default.nix47
-rw-r--r--pkgs/development/python-modules/tellduslive/default.nix13
-rw-r--r--pkgs/development/python-modules/tornado/default.nix22
-rw-r--r--pkgs/development/python-modules/tweepy/default.nix10
-rw-r--r--pkgs/development/python-modules/twisted/default.nix6
-rw-r--r--pkgs/development/python-modules/twitterapi/default.nix6
-rw-r--r--pkgs/development/python-modules/vdirsyncer/default.nix10
-rw-r--r--pkgs/development/python-modules/weconnect-mqtt/default.nix4
-rw-r--r--pkgs/development/python-modules/weconnect/default.nix4
-rw-r--r--pkgs/development/python-modules/wsproto/default.nix19
-rw-r--r--pkgs/development/python-modules/wxPython/4.1.nix2
-rw-r--r--pkgs/development/python-modules/zopfli/default.nix11
-rw-r--r--pkgs/development/python2-modules/cryptography/default.nix15
-rw-r--r--pkgs/development/python2-modules/cryptography/vectors.nix (renamed from pkgs/development/python2-modules/cryptography-vectors/default.nix)5
-rw-r--r--pkgs/development/ruby-modules/bundler-app/default.nix2
-rw-r--r--pkgs/development/tools/analysis/codeql/default.nix1
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel_1/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel_3/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/bazel/bazel_4/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/bloop/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/scala-cli/default.nix7
-rw-r--r--pkgs/development/tools/ccloud-cli/default.nix2
-rw-r--r--pkgs/development/tools/confluent-cli/default.nix2
-rw-r--r--pkgs/development/tools/database/sqldeveloper/default.nix2
-rw-r--r--pkgs/development/tools/misc/binutils/0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch137
-rw-r--r--pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch47
-rw-r--r--pkgs/development/tools/misc/binutils/CVE-2020-35448.patch77
-rw-r--r--pkgs/development/tools/misc/binutils/CVE-2021-3487.patch73
-rw-r--r--pkgs/development/tools/misc/binutils/CVE-2021-45078.patch239
-rw-r--r--pkgs/development/tools/misc/binutils/bfd-elf-Dont-read-non-existing-secondary-relocs.patch26
-rw-r--r--pkgs/development/tools/misc/binutils/build-components-separately.patch67
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix208
-rw-r--r--pkgs/development/tools/misc/binutils/disambiguate-arm-targets.patch23
-rw-r--r--pkgs/development/tools/misc/binutils/gold-Update-GNU_PROPERTY_X86_XXX-macros.patch292
-rw-r--r--pkgs/development/tools/mold/default.nix4
-rw-r--r--pkgs/development/tools/rust/cbindgen/default.nix6
-rw-r--r--pkgs/games/airstrike/default.nix2
-rw-r--r--pkgs/games/assaultcube/default.nix4
-rw-r--r--pkgs/games/domination/default.nix4
-rw-r--r--pkgs/games/flare/default.nix2
-rw-r--r--pkgs/games/frogatto/default.nix2
-rw-r--r--pkgs/games/iortcw/default.nix2
-rw-r--r--pkgs/games/iortcw/sp.nix2
-rw-r--r--pkgs/games/minecraft/default.nix2
-rw-r--r--pkgs/games/mudlet/default.nix2
-rw-r--r--pkgs/games/nanosaur/default.nix2
-rw-r--r--pkgs/games/openjk/default.nix6
-rw-r--r--pkgs/games/openmw/tes3mp.nix4
-rw-r--r--pkgs/games/openra/common.nix2
-rw-r--r--pkgs/games/otto-matic/default.nix2
-rw-r--r--pkgs/games/runelite/default.nix2
-rw-r--r--pkgs/games/sauerbraten/default.nix4
-rw-r--r--pkgs/games/starsector/default.nix3
-rw-r--r--pkgs/games/tome4/default.nix2
-rw-r--r--pkgs/games/ut2004/wrapper.nix2
-rw-r--r--pkgs/games/warsow/default.nix2
-rw-r--r--pkgs/games/zod/default.nix4
-rw-r--r--pkgs/os-specific/linux/audit/default.nix7
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix4
-rw-r--r--pkgs/os-specific/linux/displaylink/default.nix2
-rw-r--r--pkgs/os-specific/linux/sgx/psw/default.nix2
-rw-r--r--pkgs/os-specific/linux/sgx/samples/default.nix4
-rw-r--r--pkgs/servers/hqplayerd/default.nix1
-rw-r--r--pkgs/servers/ombi/default.nix5
-rw-r--r--pkgs/servers/plik/default.nix2
-rw-r--r--pkgs/servers/roon-bridge/default.nix2
-rw-r--r--pkgs/servers/roon-server/default.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/6.x.nix5
-rw-r--r--pkgs/servers/search/elasticsearch/7.x.nix3
-rw-r--r--pkgs/servers/web-apps/discourse/default.nix2
-rw-r--r--pkgs/servers/web-apps/virtlyst/default.nix7
-rw-r--r--pkgs/servers/x11/xorg/default.nix22
-rwxr-xr-xpkgs/servers/x11/xorg/generate-expr-from-tarballs.pl6
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix31
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list6
-rw-r--r--pkgs/shells/powershell/default.nix3
-rw-r--r--pkgs/stdenv/generic/setup.sh3
-rw-r--r--pkgs/stdenv/linux/default.nix2
-rw-r--r--pkgs/stdenv/linux/make-bootstrap-tools.nix5
-rw-r--r--pkgs/tools/X11/nx-libs/default.nix6
-rw-r--r--pkgs/tools/audio/beets/default.nix2
-rw-r--r--pkgs/tools/backup/gphotos-sync/default.nix16
-rw-r--r--pkgs/tools/cd-dvd/ventoy-bin/default.nix4
-rw-r--r--pkgs/tools/filesystems/e2fsprogs/default.nix11
-rw-r--r--pkgs/tools/games/ajour/default.nix4
-rw-r--r--pkgs/tools/graphics/snapdragon-profiler/default.nix2
-rw-r--r--pkgs/tools/graphics/structure-synth/default.nix2
-rw-r--r--pkgs/tools/misc/archi/default.nix3
-rw-r--r--pkgs/tools/misc/coreutils/default.nix1
-rw-r--r--pkgs/tools/misc/findutils/default.nix19
-rw-r--r--pkgs/tools/misc/man-db/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix12
-rw-r--r--pkgs/top-level/python-aliases.nix2
-rw-r--r--pkgs/top-level/python-packages.nix5
-rw-r--r--pkgs/top-level/python2-packages.nix2
236 files changed, 2029 insertions, 1574 deletions
diff --git a/doc/languages-frameworks/gnome.section.md b/doc/languages-frameworks/gnome.section.md
index 29cb2e0e464a2..d5996cce13cfd 100644
--- a/doc/languages-frameworks/gnome.section.md
+++ b/doc/languages-frameworks/gnome.section.md
@@ -42,7 +42,21 @@ Unlike other libraries mentioned in this section, GdkPixbuf only supports a sing
 
 ### Icons {#ssec-gnome-icons}
 
-When an application uses icons, an icon theme should be available in `XDG_DATA_DIRS` during runtime. The package for the default, icon-less [hicolor-icon-theme](https://www.freedesktop.org/wiki/Software/icon-theme/) (should be propagated by every icon theme) contains [a setup hook](#ssec-gnome-hooks-hicolor-icon-theme) that will pick up icon themes from `buildInputs` and pass it to our wrapper. Unfortunately, relying on that would mean every user has to download the theme included in the package expression no matter their preference. For that reason, we leave the installation of icon theme on the user. If you use one of the desktop environments, you probably already have an icon theme installed.
+When an application uses icons, an icon theme should be available in `XDG_DATA_DIRS` during runtime. The package for the default, icon-less [hicolor-icon-theme](https://www.freedesktop.org/wiki/Software/icon-theme/) (should be propagated by every icon theme) contains [a setup hook](#ssec-gnome-hooks-hicolor-icon-theme) that will pick up icon themes from `buildInputs` and add their datadirs to `XDG_ICON_DIRS` environment variable (this is Nixpkgs specific, not actually a XDG standard variable). Unfortunately, relying on that would mean every user has to download the theme included in the package expression no matter their preference. For that reason, we leave the installation of icon theme on the user. If you use one of the desktop environments, you probably already have an icon theme installed.
+
+In the rare case you need to use icons from dependencies (e.g. when an app forces an icon theme), you can use the following to pick them up:
+
+```nix
+  buildInputs = [
+    pantheon.elementary-icon-theme
+  ];
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # The icon theme is hardcoded.
+      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS"
+    )
+  '';
+```
 
 To avoid costly file system access when locating icons, GTK, [as well as Qt](https://woboq.com/blog/qicon-reads-gtk-icon-cache-in-qt57.html), can rely on `icon-theme.cache` files from the themes' top-level directories. These files are generated using `gtk-update-icon-cache`, which is expected to be run whenever an icon is added or removed to an icon theme (typically an application icon into `hicolor` theme) and some programs do indeed run this after icon installation. However, since packages are installed into their own prefix by Nix, this would lead to conflicts. For that reason, `gtk3` provides a [setup hook](#ssec-gnome-hooks-gtk-drop-icon-theme-cache) that will clean the file from installation. Since most applications only ship their own icon that will be loaded on start-up, it should not affect them too much. On the other hand, icon themes are much larger and more widely used so we need to cache them. Because we recommend installing icon themes globally, we will generate the cache files from all packages in a profile using a NixOS module. You can enable the cache generation using `gtk.iconCache.enable` option if your desktop environment does not already do that.
 
@@ -98,7 +112,7 @@ For convenience, it also adds `dconf.lib` for a GIO module implementing a GSetti
 
 - []{#ssec-gnome-hooks-dconf} `dconf.lib` is a dependency of `wrapGAppsHook`, which then also adds it to the `GIO_EXTRA_MODULES` variable.
 
-- []{#ssec-gnome-hooks-hicolor-icon-theme} `hicolor-icon-theme`’s setup hook will add icon themes to `XDG_ICON_DIRS` which is prepended to `XDG_DATA_DIRS` by `wrapGAppsHook`.
+- []{#ssec-gnome-hooks-hicolor-icon-theme} `hicolor-icon-theme`’s setup hook will add icon themes to `XDG_ICON_DIRS`.
 
 - []{#ssec-gnome-hooks-gobject-introspection} `gobject-introspection` setup hook populates `GI_TYPELIB_PATH` variable with `lib/girepository-1.0` directories of dependencies, which is then added to wrapper by `wrapGAppsHook`. It also adds `share` directories of dependencies to `XDG_DATA_DIRS`, which is intended to promote GIR files but it also [pollutes the closures](https://github.com/NixOS/nixpkgs/issues/32790) of packages using `wrapGAppsHook`.
 
diff --git a/nixos/modules/misc/locate.nix b/nixos/modules/misc/locate.nix
index 204a891430082..192c9ec413cb6 100644
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@@ -27,7 +27,7 @@ in
 
     locate = mkOption {
       type = package;
-      default = pkgs.findutils;
+      default = pkgs.findutils.locate;
       defaultText = literalExpression "pkgs.findutils";
       example = literalExpression "pkgs.mlocate";
       description = ''
diff --git a/nixos/modules/services/misc/etebase-server.nix b/nixos/modules/services/misc/etebase-server.nix
index dd84ac37b0d5e..cb99364aa1a60 100644
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@@ -166,7 +166,7 @@ in
       } ''
         makeWrapper ${pythonEnv}/bin/etebase-server \
           $out/bin/etebase-server \
-          --run "cd ${cfg.dataDir}" \
+          --chdir ${escapeShellArg cfg.dataDir} \
           --prefix ETEBASE_EASY_CONFIG_PATH : "${configIni}"
       '')
     ];
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 488c3be7b653a..0811b34156e49 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -179,7 +179,7 @@ let
           ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
           --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar postgresqlPackage pkgs.coreutils pkgs.procps ]}:$PATH' \
           --set RAKEOPT '-f ${cfg.packages.gitlab}/share/gitlab/Rakefile' \
-          --run 'cd ${cfg.packages.gitlab}/share/gitlab'
+          --chdir '${cfg.packages.gitlab}/share/gitlab'
      '';
   };
 
@@ -193,7 +193,7 @@ let
       makeWrapper ${cfg.packages.gitlab.rubyEnv}/bin/rails $out/bin/gitlab-rails \
           ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
           --set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar postgresqlPackage pkgs.coreutils pkgs.procps ]}:$PATH' \
-          --run 'cd ${cfg.packages.gitlab}/share/gitlab'
+          --chdir '${cfg.packages.gitlab}/share/gitlab'
      '';
   };
 
diff --git a/pkgs/applications/audio/hivelytracker/default.nix b/pkgs/applications/audio/hivelytracker/default.nix
index 4cf20e3c89852..8f9e3809fd2de 100644
--- a/pkgs/applications/audio/hivelytracker/default.nix
+++ b/pkgs/applications/audio/hivelytracker/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     # files passed as arguments anyway, so this works well enough until the
     # issue is fixed.
     wrapProgram $out/bin/hivelytracker \
-      --run "cd $out/share/hivelytracker"
+      --chdir "$out/share/hivelytracker"
 
     # Also install the hvl2wav tool
     install -Dm755 hvl2wav/hvl2wav $out/bin/hvl2wav
diff --git a/pkgs/applications/audio/hqplayer-desktop/default.nix b/pkgs/applications/audio/hqplayer-desktop/default.nix
index 38b7e04060386..5cfd9c7cbe898 100644
--- a/pkgs/applications/audio/hqplayer-desktop/default.nix
+++ b/pkgs/applications/audio/hqplayer-desktop/default.nix
@@ -86,6 +86,7 @@ mkDerivation rec {
     homepage = "https://www.signalyst.com/custom.html";
     description = "High-end upsampling multichannel software HD-audio player";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ lovesegfault ];
   };
 }
diff --git a/pkgs/applications/audio/losslessaudiochecker/default.nix b/pkgs/applications/audio/losslessaudiochecker/default.nix
index 551f56a3ce145..9fecf7b9ba924 100644
--- a/pkgs/applications/audio/losslessaudiochecker/default.nix
+++ b/pkgs/applications/audio/losslessaudiochecker/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     description = "Utility to check whether audio is truly lossless or not";
     homepage = "https://losslessaudiochecker.com";
     license = lib.licenses.unfree;
-    platforms = lib.platforms.x86_64;
+    platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ p-h ];
   };
 }
diff --git a/pkgs/applications/audio/lyrebird/default.nix b/pkgs/applications/audio/lyrebird/default.nix
index 81c792d95e2dc..055662ce743f8 100644
--- a/pkgs/applications/audio/lyrebird/default.nix
+++ b/pkgs/applications/audio/lyrebird/default.nix
@@ -42,7 +42,7 @@ python3Packages.buildPythonApplication rec {
   makeWrapperArgs = [
     "--prefix 'PATH' ':' '${lib.makeBinPath [ sox pulseaudio ]}'"
     "--prefix 'PYTHONPATH' ':' '${placeholder "out"}/share/lyrebird'"
-    "--run 'cd ${placeholder "out"}/share/lyrebird'"
+    "--chdir '${placeholder "out"}/share/lyrebird'"
     ''"''${gappsWrapperArgs[@]}"''
   ];
 
diff --git a/pkgs/applications/audio/soundwireserver/default.nix b/pkgs/applications/audio/soundwireserver/default.nix
index 17660599b6890..db8d28989b27a 100755
--- a/pkgs/applications/audio/soundwireserver/default.nix
+++ b/pkgs/applications/audio/soundwireserver/default.nix
@@ -34,6 +34,7 @@ qt5.mkDerivation {
     description = "Turn your Android device into wireless headphones / wireless speaker";
     homepage = "https://georgielabs.net/";
     maintainers = with maintainers; [ mkg20001 ];
+    platforms = [ "x86_64-linux" ];
     license = licenses.unfree;
   };
 }
diff --git a/pkgs/applications/blockchains/wasabibackend/default.nix b/pkgs/applications/blockchains/wasabibackend/default.nix
index c7f594e31b490..784b01192f706 100644
--- a/pkgs/applications/blockchains/wasabibackend/default.nix
+++ b/pkgs/applications/blockchains/wasabibackend/default.nix
@@ -32,7 +32,7 @@ buildDotnetModule rec {
 
   preConfigure = ''
     makeWrapperArgs+=(
-      --run "cd $out/lib/${pname}"
+      --chdir "$out/lib/${pname}"
     )
   '';
 
diff --git a/pkgs/applications/editors/pinegrow/default.nix b/pkgs/applications/editors/pinegrow/default.nix
index dfcf8e4f787c2..65604926b8fda 100644
--- a/pkgs/applications/editors/pinegrow/default.nix
+++ b/pkgs/applications/editors/pinegrow/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://pinegrow.com";
     description = "UI Web Editor";
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
     license = with licenses; [ unfreeRedistributable ];
     maintainers = with maintainers; [ gador ];
   };
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 13c5c49db482b..fe5d5b85080da 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.4350";
+  version = "8.2.4609";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-+fCyLZi9+9r7tYoRQsVESkcoHHtM7vrVuOGdJi/9iF0=";
+    sha256 = "sha256-IiWZJ4zT+VbcxwKChl847pS9jU9AlxZ/yQUIL8I2MhQ=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/awesomebump/default.nix b/pkgs/applications/graphics/awesomebump/default.nix
index 4d79f10a9e10f..e7bc474e17d34 100644
--- a/pkgs/applications/graphics/awesomebump/default.nix
+++ b/pkgs/applications/graphics/awesomebump/default.nix
@@ -46,7 +46,7 @@ in mkDerivation {
 
     # AwesomeBump expects to find Core and Configs in its current directory.
     makeQtWrapper $d/AwesomeBump $out/bin/AwesomeBump \
-        --run "cd $d"
+        --chdir "$d"
   '';
 
   # $ cd Sources; qmake; make ../workdir/linux-g++-dgb-gl4/obj/glwidget.o
diff --git a/pkgs/applications/graphics/foxotron/default.nix b/pkgs/applications/graphics/foxotron/default.nix
index 39fb78b317f18..f60ea4ea90c8c 100644
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     cp -R ${lib.optionalString stdenv.hostPlatform.isDarwin "Foxotron.app/Contents/MacOS/"}Foxotron \
       ../{config.json,Shaders,Skyboxes} $out/lib/foxotron/
     wrapProgram $out/lib/foxotron/Foxotron \
-      --run "cd $out/lib/foxotron"
+      --chdir "$out/lib/foxotron"
     ln -s $out/{lib/foxotron,bin}/Foxotron
 
     runHook postInstall
diff --git a/pkgs/applications/graphics/pixeluvo/default.nix b/pkgs/applications/graphics/pixeluvo/default.nix
index d88be43698446..0c90b786baca9 100644
--- a/pkgs/applications/graphics/pixeluvo/default.nix
+++ b/pkgs/applications/graphics/pixeluvo/default.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
     description = "A Beautifully Designed Image and Photo Editor for Windows and Linux";
     homepage = "http://www.pixeluvo.com/";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ wolfangaukang ];
   };
 }
diff --git a/pkgs/applications/graphics/unigine-valley/default.nix b/pkgs/applications/graphics/unigine-valley/default.nix
index 3187f573de704..81ed98f9ad44f 100644
--- a/pkgs/applications/graphics/unigine-valley/default.nix
+++ b/pkgs/applications/graphics/unigine-valley/default.nix
@@ -97,7 +97,7 @@ in
       mkdir -p $out/bin
       install -m 0755 valley $out/bin/valley
       wrapProgram $out/bin/valley \
-        --run "cd $instdir" \
+        --chdir "$instdir" \
         --prefix LD_LIBRARY_PATH : /run/opengl-driver/lib:$instdir/bin:$libPath
 
       runHook postInstall
diff --git a/pkgs/applications/misc/foxitreader/default.nix b/pkgs/applications/misc/foxitreader/default.nix
index e69361dbd93e4..b206d14323b1c 100644
--- a/pkgs/applications/misc/foxitreader/default.nix
+++ b/pkgs/applications/misc/foxitreader/default.nix
@@ -74,6 +74,7 @@ mkDerivation rec {
     description = "A viewer for PDF documents";
     homepage = "https://www.foxitsoftware.com/";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ p-h rhoriguchi ];
   };
 }
diff --git a/pkgs/applications/misc/multibootusb/default.nix b/pkgs/applications/misc/multibootusb/default.nix
index 3890246a63d6a..403df853343c3 100644
--- a/pkgs/applications/misc/multibootusb/default.nix
+++ b/pkgs/applications/misc/multibootusb/default.nix
@@ -101,7 +101,7 @@ python3Packages.buildPythonApplication rec {
       --prefix "PATH" ":" "${lib.makeBinPath runTimeDeps}"
 
       # Finally, move to directory that contains data
-      --run "cd $out/share/${pname}"
+      --chdir "$out/share/${pname}"
     )
   '';
 
diff --git a/pkgs/applications/misc/tvbrowser/bin.nix b/pkgs/applications/misc/tvbrowser/bin.nix
index bd8fdf5e48c55..887a979219db2 100644
--- a/pkgs/applications/misc/tvbrowser/bin.nix
+++ b/pkgs/applications/misc/tvbrowser/bin.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/bin
     makeWrapper ${jre}/bin/java $out/bin/${pname} \
       --add-flags "-jar $out/share/java/${pname}/${pname}.jar" \
-      --run "cd $out/share/java/${pname}"
+      --chdir "$out/share/java/${pname}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/upwork/default.nix b/pkgs/applications/misc/upwork/default.nix
index dc50a3b95678b..6ed38175eba67 100644
--- a/pkgs/applications/misc/upwork/default.nix
+++ b/pkgs/applications/misc/upwork/default.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
     description = "Online freelancing platform desktop application for time tracking";
     homepage = "https://www.upwork.com/ab/downloads/";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ zakkor wolfangaukang ];
   };
 }
diff --git a/pkgs/applications/misc/xteddy/default.nix b/pkgs/applications/misc/xteddy/default.nix
index 717ba66feb86a..481255393472d 100644
--- a/pkgs/applications/misc/xteddy/default.nix
+++ b/pkgs/applications/misc/xteddy/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     # this is needed, because xteddy expects images to reside
     # in the current working directory
-    wrapProgram $out/bin/xteddy --run "cd $out/share/images/"
+    wrapProgram $out/bin/xteddy --chdir "$out/share/images/"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
index f7401d36b0ea6..2caa0dc228081 100644
--- a/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix
@@ -17,7 +17,12 @@ stdenv.mkDerivation rec {
 
   src = fetchurl source;
 
-  nativeBuildInputs = [ autoPatchelfHook ] ++ (if stdenv.isDarwin then [ unzip ] else [ dpkg ]);
+  nativeBuildInputs = lib.optionals stdenv.isLinux [
+    autoPatchelfHook
+    dpkg
+  ] ++ lib.optionals stdenv.isDarwin [
+    unzip
+  ];
 
   unpackPhase = if stdenv.isDarwin then "unzip $src" else "dpkg-deb -x $src .";
 
diff --git a/pkgs/applications/networking/instant-messengers/ripcord/default.nix b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
index 76f93d9d2173a..7379d769288bd 100644
--- a/pkgs/applications/networking/instant-messengers/ripcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
@@ -48,7 +48,7 @@ mkDerivation rec {
     install -Dm755 ${src}/Ripcord $out/Ripcord
     patchelf --replace-needed libsodium.so.18 libsodium.so $out/Ripcord
     makeQtWrapper $out/Ripcord $out/bin/ripcord \
-      --run "cd $out" \
+      --chdir "$out" \
       --set FONTCONFIG_FILE "${fontsConf}" \
       --prefix LD_LIBRARY_PATH ":" "${xorg.libXcursor}/lib" \
       --prefix QT_XKB_CONFIG_ROOT ":" "${xorg.xkeyboardconfig}/share/X11/xkb" \
diff --git a/pkgs/applications/networking/instant-messengers/torchat/default.nix b/pkgs/applications/networking/instant-messengers/torchat/default.nix
index 3278d68cd0b53..224a70ce9f723 100644
--- a/pkgs/applications/networking/instant-messengers/torchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/torchat/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     cp -rf * $out/lib/torchat
     makeWrapper ${python2}/bin/python $out/bin/torchat \
         --set PYTHONPATH $out/lib/torchat:$program_PYTHONPATH \
-        --run "cd $out/lib/torchat" \
+        --chdir "$out/lib/torchat" \
         --add-flags "-O $out/lib/torchat/torchat.py"
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 4aa9dbc9b10c9..b55eb6e36ede3 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
     # Clear Qt paths to prevent tripping over "foreign" Qt resources.
     # Clear Qt screen scaling settings to prevent over-scaling.
     makeWrapper $out/opt/zoom/ZoomLauncher $out/bin/zoom \
-      --run "cd $out/opt/zoom" \
+      --chdir "$out/opt/zoom" \
       --unset QML2_IMPORT_PATH \
       --unset QT_PLUGIN_PATH \
       --unset QT_SCREEN_SCALE_FACTORS \
diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index b37274d1e1bbf..04e9accbe14af 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -95,6 +95,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ toschmidt doronbehar ];
     homepage = "https://getmailspring.com";
     downloadPage = "https://github.com/Foundry376/Mailspring";
-    platforms = platforms.x86_64;
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/p2p/tribler/default.nix b/pkgs/applications/networking/p2p/tribler/default.nix
index d1df2fea444c0..e74db03b5332c 100644
--- a/pkgs/applications/networking/p2p/tribler/default.nix
+++ b/pkgs/applications/networking/p2p/tribler/default.nix
@@ -74,10 +74,10 @@ stdenv.mkDerivation rec {
     makeWrapper ${python3.pkgs.python}/bin/python $out/bin/tribler \
         --set QT_QPA_PLATFORM_PLUGIN_PATH ${qt5.qtbase.bin}/lib/qt-*/plugins/platforms \
         --set QT_PLUGIN_PATH "${qt5.qtsvg.bin}/${qt5.qtbase.qtPluginPrefix}" \
-        --set _TRIBLERPATH $out/src \
+        --set _TRIBLERPATH "$out/src" \
         --set PYTHONPATH $out/src/tribler-core:$out/src/tribler-common:$out/src/tribler-gui:$program_PYTHONPATH \
         --set NO_AT_BRIDGE 1 \
-        --run 'cd $_TRIBLERPATH' \
+        --chdir "$out/src" \
         --add-flags "-O $out/src/run_tribler.py"
 
     mkdir -p $out/share/applications $out/share/icons
diff --git a/pkgs/applications/networking/remote/rustdesk/default.nix b/pkgs/applications/networking/remote/rustdesk/default.nix
index 677629dbcfbaa..2850995bd13cb 100644
--- a/pkgs/applications/networking/remote/rustdesk/default.nix
+++ b/pkgs/applications/networking/remote/rustdesk/default.nix
@@ -86,7 +86,7 @@ rustPlatform.buildRustPackage rec {
     ln -s ${libsciter}/lib/libsciter-gtk.so $out/lib/rustdesk
 
     makeWrapper $out/lib/rustdesk/rustdesk $out/bin/rustdesk \
-      --run "cd $out/share"
+      --chdir "$out/share"
 
     cp -a $src/src/ui $out/share/src
 
diff --git a/pkgs/applications/networking/seahub/default.nix b/pkgs/applications/networking/seahub/default.nix
index 8c26b72908368..1338f3e56f8ef 100644
--- a/pkgs/applications/networking/seahub/default.nix
+++ b/pkgs/applications/networking/seahub/default.nix
@@ -1,4 +1,8 @@
-{ lib, fetchFromGitHub, python3, makeWrapper }:
+{ lib
+, fetchFromGitHub
+, python3
+, makeWrapper
+}:
 let
   # Seahub 8.x.x does not support django-webpack-loader >=1.x.x
   python = python3.override {
@@ -25,9 +29,12 @@ python.pkgs.buildPythonApplication rec {
   };
 
   dontBuild = true;
+
   doCheck = false; # disabled because it requires a ccnet environment
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+  ];
 
   propagatedBuildInputs = with python.pkgs; [
     django
@@ -44,7 +51,7 @@ python.pkgs.buildPythonApplication rec {
     djangorestframework
     openpyxl
     requests
-    requests_oauthlib
+    requests-oauthlib
     pyjwt
     pycryptodome
     qrcode
@@ -65,10 +72,10 @@ python.pkgs.buildPythonApplication rec {
   };
 
   meta = with lib; {
-    homepage = "https://github.com/haiwen/seahub";
     description = "The web end of seafile server";
+    homepage = "https://github.com/haiwen/seahub";
     license = licenses.asl20;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ greizgh schmittlauch ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/tetrd/default.nix b/pkgs/applications/networking/tetrd/default.nix
index 94e7950ecdbba..937992a63d718 100644
--- a/pkgs/applications/networking/tetrd/default.nix
+++ b/pkgs/applications/networking/tetrd/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     description = "Share your internet connection from your device to your PC and vice versa through a USB cable";
     homepage = "https://tetrd.app";
     license = licenses.unfree;
-    platforms = platforms.all;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ Madouura ];
   };
 }
diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index d5c4dcb65011c..6e7f0f3d517bd 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
         lib.optionalString stdenv.isDarwin ''-Xdock:name="Jameica" -XstartOnFirstThread''
       } de.willuhn.jameica.Main" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs} \
-      --run "cd $out/share/java/"
+      --chdir "$out/share/java/"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/science/astronomy/openspace/default.nix b/pkgs/applications/science/astronomy/openspace/default.nix
index 17c721ac86931..b6e5275d8b05a 100644
--- a/pkgs/applications/science/astronomy/openspace/default.nix
+++ b/pkgs/applications/science/astronomy/openspace/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
       patchelf --set-rpath $rpath:${bundle}/lib $bin
 
       name=$(basename $bin)
-      makeWrapper $bin $out/bin/$name --run "cd ${bundle}"
+      makeWrapper $bin $out/bin/$name --chdir "${bundle}"
     done
   '';
 
diff --git a/pkgs/applications/science/logic/tlaplus/toolbox.nix b/pkgs/applications/science/logic/tlaplus/toolbox.nix
index 7b1ee4384c9e8..e13fd578927d1 100644
--- a/pkgs/applications/science/logic/tlaplus/toolbox.nix
+++ b/pkgs/applications/science/logic/tlaplus/toolbox.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
       "$(find "$out/toolbox" -name jspawnhelper)"
 
     makeWrapper $out/toolbox/toolbox $out/bin/tla-toolbox \
-      --run "set -x; cd $out/toolbox" \
+      --chdir "$out/toolbox" \
       --add-flags "-data ~/.tla-toolbox" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ gtk3 libXtst glib zlib ]}"  \
       "''${gappsWrapperArgs[@]}"
diff --git a/pkgs/applications/science/misc/netlogo/default.nix b/pkgs/applications/science/misc/netlogo/default.nix
index ed92dfb90dabc..d32f4312047a3 100644
--- a/pkgs/applications/science/misc/netlogo/default.nix
+++ b/pkgs/applications/science/misc/netlogo/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
     # launcher with `cd` is required b/c otherwise the model library isn't usable
     makeWrapper "${jre}/bin/java" "$out/bin/netlogo" \
-      --run "cd $out/share/netlogo/app" \
+      --chdir "$out/share/netlogo/app" \
       --add-flags "-jar netlogo-${version}.jar"
 
     cp $src1 $out/share/icons/hicolor/256x256/apps/netlogo.png
diff --git a/pkgs/applications/science/robotics/sumorobot-manager/default.nix b/pkgs/applications/science/robotics/sumorobot-manager/default.nix
index c0f619b9592ce..343f9fad105b0 100644
--- a/pkgs/applications/science/robotics/sumorobot-manager/default.nix
+++ b/pkgs/applications/science/robotics/sumorobot-manager/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     mkdir $out/bin
     dos2unix $out/opt/sumorobot-manager/main.py
     makeQtWrapper $out/opt/sumorobot-manager/main.py $out/bin/sumorobot-manager \
-      --run "cd $out/opt/sumorobot-manager"
+      --chdir "$out/opt/sumorobot-manager"
   '';
 
   preFixup = ''
diff --git a/pkgs/applications/terminal-emulators/syncterm/default.nix b/pkgs/applications/terminal-emulators/syncterm/default.nix
index d1f0ab5e8cf1a..d56db734a8855 100644
--- a/pkgs/applications/terminal-emulators/syncterm/default.nix
+++ b/pkgs/applications/terminal-emulators/syncterm/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     homepage = "https://syncterm.bbsdev.net/";
     description = "BBS terminal emulator";
     maintainers = with maintainers; [ embr ];
+    platforms = platforms.unix;
     license = licenses.gpl2Plus;
+    broken = stdenv.isDarwin; # error: unsupported option '-fsanitize=safe-stack' for target 'x86_64-apple-darwin'
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 1f08cd26ef368..d835f25d9610d 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation {
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
+  separateDebugInfo = true;
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/video/epgstation/default.nix b/pkgs/applications/video/epgstation/default.nix
index 77510ae153deb..a8ec353d788a1 100644
--- a/pkgs/applications/video/epgstation/default.nix
+++ b/pkgs/applications/video/epgstation/default.nix
@@ -115,7 +115,7 @@ let
       ln -sfT /var/lib/epgstation/thumbnail thumbnail
 
       makeWrapper ${nodejs}/bin/npm $out/bin/epgstation \
-       --run "cd $out/lib/node_modules/epgstation" \
+       --chdir "$out/lib/node_modules/epgstation" \
        --prefix PATH : ${lib.makeBinPath runtimeDeps} \
        --set APP_ROOT_PATH "$out/lib/node_modules/epgstation"
 
diff --git a/pkgs/applications/video/mirakurun/default.nix b/pkgs/applications/video/mirakurun/default.nix
index 3987e12528444..53f1467ee8eb0 100644
--- a/pkgs/applications/video/mirakurun/default.nix
+++ b/pkgs/applications/video/mirakurun/default.nix
@@ -61,7 +61,7 @@ stdenvNoCC.mkDerivation rec {
       mkdir -p $out/bin
 
       makeWrapper ${mirakurun}/bin/mirakurun-epgdump $out/bin/mirakurun-epgdump \
-        --run "cd ${mirakurun}/libexec/mirakurun/node_modules/mirakurun" \
+        --chdir "${mirakurun}/libexec/mirakurun/node_modules/mirakurun" \
         --prefix PATH : ${lib.makeBinPath runtimeDeps}
 
       # XXX: The original mirakurun command uses PM2 to manage the Mirakurun
@@ -70,7 +70,7 @@ stdenvNoCC.mkDerivation rec {
       # unique to PM2 is currently being used.
       makeWrapper ${yarn}/bin/yarn $out/bin/mirakurun-start \
         --add-flags "start" \
-        --run "cd ${mirakurun}/libexec/mirakurun/node_modules/mirakurun" \
+        --chdir "${mirakurun}/libexec/mirakurun/node_modules/mirakurun" \
         --prefix PATH : ${lib.makeBinPath runtimeDeps}
     '';
 
diff --git a/pkgs/applications/window-managers/afterstep/default.nix b/pkgs/applications/window-managers/afterstep/default.nix
index a26f824cd1831..4bc757f27212f 100644
--- a/pkgs/applications/window-managers/afterstep/default.nix
+++ b/pkgs/applications/window-managers/afterstep/default.nix
@@ -45,7 +45,19 @@ stdenv.mkDerivation rec {
 
   # A strange type of bug: dbus is not immediately found by pkg-config
   preConfigure = ''
-     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config dbus-1 --cflags)"
+    # binutils 2.37 fix
+    # https://github.com/afterstep/afterstep/issues/2
+    fixupList=(
+      "autoconf/Makefile.defines.in"
+      "libAfterImage/aftershow/Makefile.in"
+      "libAfterImage/apps/Makefile.in"
+      "libAfterBase/Makefile.in"
+      "libAfterImage/Makefile.in"
+    )
+    for toFix in "''${fixupList[@]}"; do
+      substituteInPlace "$toFix" --replace "clq" "cq"
+    done
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config dbus-1 --cflags)"
   '';
 
   # Parallel build fails due to missing dependencies between private libaries:
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index fa60658328941..7d598956168c9 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -18,6 +18,7 @@ assertExecutable() {
 # --set-default VAR VAL : like --set, but only adds VAR if not already set in
 #                         the environment
 # --unset       VAR     : remove VAR from the environment
+# --chdir       DIR     : change working directory (use instead of --run "cd DIR")
 # --run         COMMAND : run command before the executable
 # --add-flags   FLAGS   : add FLAGS to invocation of executable
 
@@ -126,6 +127,10 @@ makeWrapper() {
             varName="${params[$((n + 1))]}"
             n=$((n + 1))
             echo "unset $varName" >> "$wrapper"
+        elif [[ "$p" == "--chdir" ]]; then
+            dir="${params[$((n + 1))]}"
+            n=$((n + 1))
+            echo "cd ${dir@Q}" >> "$wrapper"
         elif [[ "$p" == "--run" ]]; then
             command="${params[$((n + 1))]}"
             n=$((n + 1))
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index 1a46e075dbe76..0acf4a8e6f8d4 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -14,10 +14,6 @@ gappsWrapperArgsHook() {
         gappsWrapperArgs+=(--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE")
     fi
 
-    if [ -n "$XDG_ICON_DIRS" ]; then
-        gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS")
-    fi
-
     if [ -n "$GSETTINGS_SCHEMAS_PATH" ]; then
         gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH")
     fi
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index fc3a6b35dbcc8..d864eced28178 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -516,15 +516,19 @@ rec {
    * # setup hook that depends on the hello package and runs ./myscript.sh
    * myhellohook = makeSetupHook { deps = [ hello ]; } ./myscript.sh;
    *
-   * # wrotes a setup hook where @bash@ myscript.sh is substituted for the
+   * # writes a Linux-exclusive setup hook where @bash@ myscript.sh is substituted for the
    * # bash interpreter.
    * myhellohookSub = makeSetupHook {
    *                 deps = [ hello ];
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
+   *                 meta.platforms = lib.platforms.linux;
    *               } ./myscript.sh;
    */
-  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {} }: script:
-    runCommand name substitutions
+  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {} }: script:
+    runCommand name
+      (substitutions // {
+        inherit meta;
+      })
       (''
         mkdir -p $out/nix-support
         cp ${script} $out/nix-support/setup-hook
diff --git a/pkgs/data/misc/dns-root-data/default.nix b/pkgs/data/misc/dns-root-data/default.nix
index aad1fe61c4bf1..e09ff07a9e847 100644
--- a/pkgs/data/misc/dns-root-data/default.nix
+++ b/pkgs/data/misc/dns-root-data/default.nix
@@ -19,7 +19,8 @@ let
 in
 
 stdenv.mkDerivation {
-  name = "dns-root-data-2019-01-11";
+  pname = "dns-root-data";
+  version = "2019-01-11";
 
   buildCommand = ''
     mkdir $out
diff --git a/pkgs/data/misc/freepats/default.nix b/pkgs/data/misc/freepats/default.nix
index 4fe6a5c20fdef..bb8dae0cf6a5b 100644
--- a/pkgs/data/misc/freepats/default.nix
+++ b/pkgs/data/misc/freepats/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "freepats-20060219";
+  pname = "freepats";
+  version = "20060219";
 
   src = fetchurl {
-    url = "https://freepats.zenvoid.org/${name}.tar.bz2";
+    url = "https://freepats.zenvoid.org/freepats-${version}.tar.bz2";
     sha256 = "12iw36rd94zirll96cd5k0va7p5hxmf2shvjlhzihcmjaw8flq82";
   };
 
diff --git a/pkgs/desktops/cdesktopenv/default.nix b/pkgs/desktops/cdesktopenv/default.nix
index 77650e71ebe9b..b506ed3663b91 100644
--- a/pkgs/desktops/cdesktopenv/default.nix
+++ b/pkgs/desktops/cdesktopenv/default.nix
@@ -56,6 +56,19 @@ in stdenv.mkDerivation rec {
     "LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive"
   ];
 
+  preConfigure = ''
+    # binutils 2.37 fix
+    fixupList=(
+      "config/cf/Imake.tmpl"
+      "config/util/crayar.sh"
+      "config/util/crayar.sh"
+      "programs/dtwm/Makefile.tmpl"
+    )
+    for toFix in "''${fixupList[@]}"; do
+      substituteInPlace "$toFix" --replace "clq" "cq"
+    done
+  '';
+
   preBuild = ''
     while IFS= read -r -d ''$'\0' i; do
       substituteInPlace "$i" --replace /usr/dt $out/opt/dt
diff --git a/pkgs/desktops/gnome/core/mutter/3.38/default.nix b/pkgs/desktops/gnome/core/mutter/3.38/default.nix
index 3c2d30b813ba0..799f80917268b 100644
--- a/pkgs/desktops/gnome/core/mutter/3.38/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/3.38/default.nix
@@ -32,6 +32,7 @@
 , mesa
 , meson
 , gnome-settings-daemon
+, libxcvt
 , xorgserver
 , python3
 , wrapGAppsHook
@@ -99,7 +100,8 @@ let self = stdenv.mkDerivation rec {
     pkg-config
     python3
     wrapGAppsHook
-    xorgserver # for cvt command
+    libxcvt
+    xorgserver
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 9f3925d0ce50b..f92b162476ae4 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -33,6 +33,7 @@
 , mesa
 , meson
 , gnome-settings-daemon
+, libxcvt
 , xorgserver
 , python3
 , wrapGAppsHook
@@ -95,7 +96,8 @@ let self = stdenv.mkDerivation rec {
     pkg-config
     python3
     wrapGAppsHook
-    xorgserver # for cvt command
+    libxcvt
+    xorgserver
   ];
 
   buildInputs = [
diff --git a/pkgs/development/compilers/dmd/binary.nix b/pkgs/development/compilers/dmd/binary.nix
index f47e447334b41..fdea39db94be1 100644
--- a/pkgs/development/compilers/dmd/binary.nix
+++ b/pkgs/development/compilers/dmd/binary.nix
@@ -18,8 +18,9 @@ in stdenv.mkDerivation {
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ autoPatchelfHook ]
-    ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = lib.optionals hostPlatform.isLinux [
+    autoPatchelfHook
+  ] ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
   propagatedBuildInputs = [ curl tzdata ] ++ lib.optional hostPlatform.isLinux glibc;
 
   installPhase = ''
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index ee016e71d312f..6a86b7e814177 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -86,7 +86,8 @@ let
       zlib
     ];
 
-    nativeBuildInputs = [ unzip perl autoPatchelfHook makeWrapper ];
+    nativeBuildInputs = [ unzip perl makeWrapper ]
+      ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
 
     unpackPhase = ''
       unpack_jar() {
diff --git a/pkgs/development/compilers/inklecate/default.nix b/pkgs/development/compilers/inklecate/default.nix
index 32b91f5ddfecc..ecf5ed50ab3b5 100644
--- a/pkgs/development/compilers/inklecate/default.nix
+++ b/pkgs/development/compilers/inklecate/default.nix
@@ -17,7 +17,7 @@ buildDotnetModule rec {
     sha256 = "00lagmwsbxap5mgnw4gndpavmv3xsgincdaq1zvw7fkc3vn3pxqc";
   };
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
   buildInputs = [ stdenv.cc.cc.lib ];
 
   projectFile = "inklecate/inklecate.csproj";
diff --git a/pkgs/development/compilers/ldc/binary.nix b/pkgs/development/compilers/ldc/binary.nix
index 05928d396c861..dd4d51c81e3ab 100644
--- a/pkgs/development/compilers/ldc/binary.nix
+++ b/pkgs/development/compilers/ldc/binary.nix
@@ -18,8 +18,9 @@ in stdenv.mkDerivation {
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ autoPatchelfHook ]
-    ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
+  nativeBuildInputs = lib.optionals hostPlatform.isLinux [
+    autoPatchelfHook
+  ] ++ lib.optional hostPlatform.isDarwin fixDarwinDylibNames;
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxml2 stdenv.cc.cc ];
 
diff --git a/pkgs/development/compilers/zulu/8.nix b/pkgs/development/compilers/zulu/8.nix
index 48573c6724159..00f18f1238fe7 100644
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@@ -61,18 +61,22 @@ in stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [
-    autoPatchelfHook makeWrapper
+    makeWrapper
+  ] ++ lib.optionals stdenv.isLinux [
+    autoPatchelfHook
   ] ++ lib.optionals stdenv.isDarwin [
     unzip
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out
     cp -r ./* "$out/"
-
+  '' + lib.optionalString stdenv.isLinux ''
     # jni.h expects jni_md.h to be in the header search path.
     ln -s $out/include/linux/*_md.h $out/include/
-
+  '' + ''
     mkdir -p $out/nix-support
     printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
 
@@ -87,6 +91,8 @@ in stdenv.mkDerivation {
         wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
       fi
     done
+  '' + ''
+    runHook postInstall
   '';
 
   preFixup = ''
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index 662d997d88288..1b961c3f9e406 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -63,12 +63,16 @@ in stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [
-    autoPatchelfHook makeWrapper
+    makeWrapper
+  ] ++ lib.optionals stdenv.isLinux [
+    autoPatchelfHook
   ] ++ lib.optionals stdenv.isDarwin [
     unzip
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out
     cp -r ./* "$out/"
   '' + lib.optionalString stdenv.isLinux ''
@@ -90,6 +94,8 @@ in stdenv.mkDerivation {
     for bin in $( find "$out" -executable -type f -not -name jspawnhelper ); do
       wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
     done
+  '' + ''
+    runHook postInstall
   '';
 
   preFixup = ''
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 02ecf8d25b1ef..4dc95d9e1fd7e 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -282,7 +282,7 @@ in with passthru; stdenv.mkDerivation {
 
   CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
   LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
-  LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"} ${optionalString (ncurses != null) "-lncurses"}";
+  LIBS = "${optionalString (!stdenv.isDarwin) "-lcrypt"}";
   NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU ({
     "glibc" = "-lgcc_s";
     "musl" = "-lgcc_eh";
diff --git a/pkgs/development/libraries/boost/1.78.nix b/pkgs/development/libraries/boost/1.78.nix
new file mode 100644
index 0000000000000..a7ec9b0e04e49
--- /dev/null
+++ b/pkgs/development/libraries/boost/1.78.nix
@@ -0,0 +1,15 @@
+{ callPackage, fetchurl, fetchpatch, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "1.78.0";
+
+  src = fetchurl {
+    urls = [
+      "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
+      "https://dl.bintray.com/boostorg/release/${version}/source/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2"
+    ];
+    # SHA256 from http://www.boost.org/users/history/version_1_78_0.html
+    sha256 = "8681f175d4bdb26c52222665793eef08490d7758529330f98d3b29dd0735bccc";
+  };
+})
+
diff --git a/pkgs/development/libraries/boost/default.nix b/pkgs/development/libraries/boost/default.nix
index aeb0878a0d11f..60dbc00f67fcc 100644
--- a/pkgs/development/libraries/boost/default.nix
+++ b/pkgs/development/libraries/boost/default.nix
@@ -45,4 +45,5 @@ in {
   boost174 = makeBoost ./1.74.nix;
   boost175 = makeBoost ./1.75.nix;
   boost177 = makeBoost ./1.77.nix;
+  boost178 = makeBoost ./1.78.nix;
 }
diff --git a/pkgs/development/libraries/cutelyst/default.nix b/pkgs/development/libraries/cutelyst/default.nix
index 9f7d020feaf78..d7fe4e92802b2 100644
--- a/pkgs/development/libraries/cutelyst/default.nix
+++ b/pkgs/development/libraries/cutelyst/default.nix
@@ -14,20 +14,28 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
-  buildInputs = [ qtbase libuuid libcap uwsgi grantlee pcre ];
+  buildInputs = [
+    qtbase
+    grantlee
+  ] ++ lib.optionals stdenv.isLinux [
+    libuuid
+    libcap
+    uwsgi
+    pcre
+  ];
 
   cmakeFlags = [
-    "-DPLUGIN_UWSGI=ON"
+    "-DPLUGIN_UWSGI=${if stdenv.isLinux then "ON" else "OFF"}" # Missing uwsgi symbols on Darwin
     "-DPLUGIN_STATICCOMPRESSED=ON"
     "-DPLUGIN_CSRFPROTECTION=ON"
     "-DPLUGIN_VIEW_GRANTLEE=ON"
   ];
 
-  preBuild = ''
+  preBuild = lib.optionalString stdenv.isLinux ''
     export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}`pwd`/Cutelyst:`pwd`/EventLoopEPoll"
   '';
 
-  postBuild = ''
+  postBuild = lib.optionalString stdenv.isLinux ''
     unset LD_LIBRARY_PATH
   '';
 
@@ -35,6 +43,7 @@ stdenv.mkDerivation rec {
     description = "C++ Web Framework built on top of Qt";
     homepage = "https://cutelyst.org/";
     license = licenses.lgpl21Plus;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ fpletz ];
   };
 }
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index f057618e78803..22023fdded496 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -69,6 +69,12 @@ stdenv.mkDerivation rec {
     ./glib-appinfo-watch.patch
     ./schema-override-variable.patch
 
+    # Add support for the GNOME’s default terminal emulator.
+    # https://gitlab.gnome.org/GNOME/glib/-/issues/2618
+    ./gnome-console-support.patch
+    # Do the same for Pantheon’s terminal emulator.
+    ./elementary-terminal-support.patch
+
     # GLib contains many binaries used for different purposes;
     # we will install them to different outputs:
     # 1. Tools for desktop environment ($bin)
diff --git a/pkgs/development/libraries/glib/elementary-terminal-support.patch b/pkgs/development/libraries/glib/elementary-terminal-support.patch
new file mode 100644
index 0000000000000..0b8c8a70871cf
--- /dev/null
+++ b/pkgs/development/libraries/glib/elementary-terminal-support.patch
@@ -0,0 +1,16 @@
+diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
+index a441bfec9..6bcd3e690 100644
+--- a/gio/gdesktopappinfo.c
++++ b/gio/gdesktopappinfo.c
+@@ -2678,6 +2678,11 @@ prepend_terminal_to_vector (int    *argc,
+             if (check != NULL)
+               pass_cmd_as_single_arg = TRUE;
+           }
++          if (check == NULL) {
++            check = g_find_program_in_path ("io.elementary.terminal");
++            if (check != NULL)
++              pass_cmd_as_single_arg = TRUE;
++          }
+           if (check == NULL)
+             check = g_find_program_in_path ("tilix");
+           if (check == NULL)
diff --git a/pkgs/development/libraries/glib/gnome-console-support.patch b/pkgs/development/libraries/glib/gnome-console-support.patch
new file mode 100644
index 0000000000000..7f6894a5cec9f
--- /dev/null
+++ b/pkgs/development/libraries/glib/gnome-console-support.patch
@@ -0,0 +1,55 @@
+diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
+index 60d6debb2..a441bfec9 100644
+--- a/gio/gdesktopappinfo.c
++++ b/gio/gdesktopappinfo.c
+@@ -2627,6 +2627,7 @@ prepend_terminal_to_vector (int    *argc,
+   int i, j;
+   char **term_argv = NULL;
+   int term_argc = 0;
++  gboolean pass_cmd_as_single_arg = FALSE;
+   char *check;
+   char **the_argv;
+ 
+@@ -2672,6 +2673,11 @@ prepend_terminal_to_vector (int    *argc,
+         }
+       else
+         {
++          if (check == NULL) {
++            check = g_find_program_in_path ("kgx");
++            if (check != NULL)
++              pass_cmd_as_single_arg = TRUE;
++          }
+           if (check == NULL)
+             check = g_find_program_in_path ("tilix");
+           if (check == NULL)
+@@ -2697,14 +2703,27 @@ prepend_terminal_to_vector (int    *argc,
+         }
+     }
+ 
+-  real_argc = term_argc + *argc;
++  real_argc = term_argc + (pass_cmd_as_single_arg ? 1 : *argc);
+   real_argv = g_new (char *, real_argc + 1);
+ 
+   for (i = 0; i < term_argc; i++)
+     real_argv[i] = term_argv[i];
+ 
+-  for (j = 0; j < *argc; j++, i++)
+-    real_argv[i] = (char *)the_argv[j];
++  if (pass_cmd_as_single_arg) {
++    char **quoted_argv = g_new (char *, *argc + 1);
++
++    for (j = 0; j < *argc; j++) {
++      quoted_argv[j] = g_shell_quote (the_argv[j]);
++      g_free (the_argv[j]);
++    }
++    quoted_argv[j] = NULL;
++
++    real_argv[i++] = g_strjoinv (" ", quoted_argv);
++    g_strfreev (quoted_argv);
++  } else {
++    for (j = 0; j < *argc; j++, i++)
++      real_argv[i] = (char *)the_argv[j];
++  }
+ 
+   real_argv[i] = NULL;
+ 
diff --git a/pkgs/development/libraries/glm/default.nix b/pkgs/development/libraries/glm/default.nix
index 81b0b47d5ba8c..9957df4cdd40a 100644
--- a/pkgs/development/libraries/glm/default.nix
+++ b/pkgs/development/libraries/glm/default.nix
@@ -28,6 +28,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102823
+  NIX_CFLAGS_COMPILE = "-fno-ipa-modref";
+
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=OFF"
     "-DBUILD_STATIC_LIBS=OFF"
diff --git a/pkgs/development/libraries/glog/default.nix b/pkgs/development/libraries/glog/default.nix
index 72758a1b3e774..f66374f65a319 100644
--- a/pkgs/development/libraries/glog/default.nix
+++ b/pkgs/development/libraries/glog/default.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
 
   # TODO: Re-enable Darwin tests once we're on a release that has https://github.com/google/glog/issues/709#issuecomment-960381653 fixed
   doCheck = !stdenv.isDarwin;
+  # There are some non-thread safe tests that can fail
+  enableParallelChecking = false;
   checkInputs = [ perl ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
index 085544a36120e..acc143cd5566c 100644
--- a/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
+++ b/pkgs/development/libraries/gsettings-desktop-schemas/default.nix
@@ -39,14 +39,20 @@ stdenv.mkDerivation rec {
     patchShebangs build-aux/meson/post-install.py
   '';
 
-  # meson installs the schemas to share/glib-2.0/schemas
-  # We add the override file there too so it will be compiled and later moved by
-  # glib's setup hook.
   preInstall = ''
+    # Meson installs the schemas to share/glib-2.0/schemas
+    # We add the override file there too so it will be compiled and later moved by
+    # glib's setup hook.
     mkdir -p $out/share/glib-2.0/schemas
     cat - > $out/share/glib-2.0/schemas/remove-backgrounds.gschema.override <<- EOF
+      # These paths are supposed to refer to gnome-backgrounds
+      # but since we do not use FHS, they are broken.
+      # And we do not want to hardcode the correct paths
+      # since then every GTK app would pull in gnome-backgrounds.
+      # Let’s just override the broken paths so that people are not confused.
       [org.gnome.desktop.background]
       picture-uri='''
+      picture-uri-dark='''
 
       [org.gnome.desktop.screensaver]
       picture-uri='''
diff --git a/pkgs/development/libraries/hwloc/default.nix b/pkgs/development/libraries/hwloc/default.nix
index a1119f4be2c6e..1544bb946ea5f 100644
--- a/pkgs/development/libraries/hwloc/default.nix
+++ b/pkgs/development/libraries/hwloc/default.nix
@@ -8,11 +8,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "hwloc";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchurl {
     url = "https://www.open-mpi.org/software/hwloc/v${versions.majorMinor version}/downloads/hwloc-${version}.tar.bz2";
-    sha256 = "1q440fwvhnxz6j8k5bn3bxj86b3lzbr8fgib78l4iq6gxd9yx302";
+    sha256 = "sha256-DU4dNsOnLF1hkBv9R3M39aTH4Kl12lcWUjfQDjXvUo0=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libargon2/default.nix b/pkgs/development/libraries/libargon2/default.nix
index 2003c8957ffa4..eb8e6333d419d 100644
--- a/pkgs/development/libraries/libargon2/default.nix
+++ b/pkgs/development/libraries/libargon2/default.nix
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "0p4ry9dn0mi9js0byijxdyiwx74p1nr8zj7wjpd1fjgqva4sk23i";
   };
 
-  nativeBuildInputs = [ fixDarwinDylibNames ];
+  nativeBuildInputs = lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
+  ];
 
   patches = [
     # TODO: remove when https://github.com/P-H-C/phc-winner-argon2/pull/277 is merged + released
diff --git a/pkgs/development/libraries/libepoxy/default.nix b/pkgs/development/libraries/libepoxy/default.nix
index c54c3c86d232b..348fbfee7b844 100644
--- a/pkgs/development/libraries/libepoxy/default.nix
+++ b/pkgs/development/libraries/libepoxy/default.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libepoxy";
-  version = "1.5.9";
+  version = "1.5.10";
 
   src = fetchFromGitHub {
     owner = "anholt";
     repo = pname;
     rev = version;
-    sha256 = "sha256-8rdmC8FZUkKkEvWPJIdfrBQHiwa81vl5tmVqRdU4UIY=";
+    sha256 = "sha256-gZiyPOW2PeTMILcPiUTqPUGRNlMM5mI1z9563v4SgEs=";
   };
 
   patches = [ ./libgl-path.patch ];
@@ -62,7 +62,6 @@ stdenv.mkDerivation rec {
       --replace "[ 'cgl_epoxy_api', [ 'cgl_epoxy_api.c' ] ]," ""
   '';
 
-  # tests are running from version 1.5.9
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index cca5abef4fc72..b757e516573e0 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-L3KeNIBpV5H5SC6DiL1yNAK4nw6vEYBXu96jzs7psjc=";
+    sha256 = "sha256-HbukG8UW08p6vA2luGLv4+qKcBj6bpuXzp05QBsiQmw=";
   };
 
   nativeBuildInputs = [ python3 ];
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 4bce1341c7d8c..bda9001f913fa 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, autoreconfHook, xz, buildPackages }:
+{ stdenv, lib, fetchurl, fetchpatch, autoreconfHook, xz, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-SmrsZmmR+0XQiJxErt6K1usQgHHDVU/N/2cfnJR5SXY=";
   };
 
+  patches = [
+    # Fix for aarch64 and non-4K pages. Remove once upgraded past 1.6.2.
+    (fetchpatch {
+      url = "https://github.com/libunwind/libunwind/commit/e85b65cec757ef589f28957d0c6c21c498a03bdf.patch";
+      sha256 = "1lnlygvhqrdrjgw303pg2k2k4ms4gaghpjsgmhk47q83vy1yjwfg";
+    })
+  ];
+
   postPatch = if stdenv.cc.isClang then ''
     substituteInPlace configure.ac --replace "-lgcc_s" ""
   '' else lib.optionalString stdenv.hostPlatform.isMusl ''
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index a48f4b42e453b..a8711a3eff5db 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -154,6 +154,7 @@ self = stdenv.mkDerivation {
     meson pkg-config ninja
     intltool bison flex file
     python3Packages.python python3Packages.Mako
+    jdupes
   ] ++ lib.optionals (elem "wayland" eglPlatforms) [
     wayland-scanner
   ];
@@ -230,7 +231,7 @@ self = stdenv.mkDerivation {
     done
 
     # NAR doesn't support hard links, so convert them to symlinks to save space.
-    ${jdupes}/bin/jdupes --hard-links --link-soft --recurse "$drivers"
+    jdupes --hard-links --link-soft --recurse "$drivers"
 
     # add RPATH so the drivers can find the moved libgallium and libdricore9
     # moved here to avoid problems with stripping patchelfed files
diff --git a/pkgs/development/libraries/openvino/default.nix b/pkgs/development/libraries/openvino/default.nix
index 86bc3b0d009c3..b6f4a0f1bb17b 100644
--- a/pkgs/development/libraries/openvino/default.nix
+++ b/pkgs/development/libraries/openvino/default.nix
@@ -129,6 +129,8 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://docs.openvinotoolkit.org/";
     license = with licenses; [ asl20 ];
+    platforms = platforms.all;
+    broken = stdenv.isDarwin; # Cannot find macos sdk
     maintainers = with maintainers; [ tfmoraes ];
   };
 }
diff --git a/pkgs/development/libraries/pmdk/default.nix b/pkgs/development/libraries/pmdk/default.nix
index 6e0b6ab6722bd..1f02bfa0dab30 100644
--- a/pkgs/development/libraries/pmdk/default.nix
+++ b/pkgs/development/libraries/pmdk/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pmdk";
-  version = "1.9.2";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner  = "pmem";
     repo   = "pmdk";
     rev    = "refs/tags/${version}";
-    sha256 = "0awmkj6j9y2pbqqmp9ql00s7qa3mnpppa82dfy5324lindq0z8a1";
+    hash = "sha256-8bnyLtgkKfgIjJkfY/ZS1I9aCYcrz0nrdY7m/TUVWAk=";
   };
 
   nativeBuildInputs = [ autoconf pkg-config gnum4 pandoc ];
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
 
   patchPhase = "patchShebangs utils";
 
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
   installPhase = ''
     make install prefix=$out
 
diff --git a/pkgs/development/libraries/rlottie/default.nix b/pkgs/development/libraries/rlottie/default.nix
index f1d3ffd02124e..6f641bd6a6006 100644
--- a/pkgs/development/libraries/rlottie/default.nix
+++ b/pkgs/development/libraries/rlottie/default.nix
@@ -1,4 +1,11 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, meson
+, ninja
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
   pname = "rlottie";
@@ -11,6 +18,14 @@ stdenv.mkDerivation rec {
     sha256 = "10bxr1zf9wxl55d4cw2j02r6sgqln7mbxplhhfvhw0z92fi40kr3";
   };
 
+  patches = [
+    # Fixed build with GCC 11
+    (fetchpatch {
+       url = "https://github.com/Samsung/rlottie/commit/2d7b1fa2b005bba3d4b45e8ebfa632060e8a157a.patch";
+       hash = "sha256-2JPsj0WiBMMu0N3NUYDrHumvPN2YS8nPq5Zwagx6UWE=";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja pkg-config ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 6cb2eb4b2d104..0d80a83e8ed7f 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -12,13 +12,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${optionalString interactive "-interactive"}";
-  version = "3.38.1";
+  version = "3.38.2";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-jjqM65eU2Wg5lZDS3fnVwESpfdg9OLlhM2SiReyKL8Q=";
+    sha256 = "sha256-55dKoUMLrWkKXp95pu5chJKtqCadxnWHWtD7dH18raQ=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 6b07c762881ee..ebb887ffa0177 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.38.1";
+    version = "3.38.2";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-F3rv2oF/qfUoJeF0hYf3wnqbXmtTpIHNQ0YfJ0bZMdg=";
+      sha256 = "sha256-x8DwcKM4yS6wiAWQXAXyVPpG0cTdo1SKAkdPb7VnMpo=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/talloc/default.nix b/pkgs/development/libraries/talloc/default.nix
index 07d830f00ce78..cb7af61a63ed2 100644
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@@ -21,11 +21,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    fixDarwinDylibNames
     python3
     wafHook
     docbook-xsl-nons
     docbook_xml_dtd_42
+  ] ++ lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch b/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch
new file mode 100644
index 0000000000000..1ade02654e58f
--- /dev/null
+++ b/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch
@@ -0,0 +1,346 @@
+From 5c44459c3b28a9bd3283aaceab7c615f8020c531 Mon Sep 17 00:00:00 2001
+From: Mark Adler <madler@alumni.caltech.edu>
+Date: Tue, 17 Apr 2018 22:09:22 -0700
+Subject: [PATCH 1/2] Fix a bug that can crash deflate on some input when using
+ Z_FIXED.
+
+This bug was reported by Danilo Ramos of Eideticom, Inc. It has
+lain in wait 13 years before being found! The bug was introduced
+in zlib 1.2.2.2, with the addition of the Z_FIXED option. That
+option forces the use of fixed Huffman codes. For rare inputs with
+a large number of distant matches, the pending buffer into which
+the compressed data is written can overwrite the distance symbol
+table which it overlays. That results in corrupted output due to
+invalid distances, and can result in out-of-bound accesses,
+crashing the application.
+
+The fix here combines the distance buffer and literal/length
+buffers into a single symbol buffer. Now three bytes of pending
+buffer space are opened up for each literal or length/distance
+pair consumed, instead of the previous two bytes. This assures
+that the pending buffer cannot overwrite the symbol table, since
+the maximum fixed code compressed length/distance is 31 bits, and
+since there are four bytes of pending space for every three bytes
+of symbol space.
+---
+ deflate.c | 74 ++++++++++++++++++++++++++++++++++++++++---------------
+ deflate.h | 25 +++++++++----------
+ trees.c   | 50 +++++++++++--------------------------
+ 3 files changed, 79 insertions(+), 70 deletions(-)
+
+diff --git a/deflate.c b/deflate.c
+index 425babc..19cba87 100644
+--- a/deflate.c
++++ b/deflate.c
+@@ -255,11 +255,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+     int wrap = 1;
+     static const char my_version[] = ZLIB_VERSION;
+ 
+-    ushf *overlay;
+-    /* We overlay pending_buf and d_buf+l_buf. This works since the average
+-     * output size for (length,distance) codes is <= 24 bits.
+-     */
+-
+     if (version == Z_NULL || version[0] != my_version[0] ||
+         stream_size != sizeof(z_stream)) {
+         return Z_VERSION_ERROR;
+@@ -329,9 +324,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+ 
+     s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */
+ 
+-    overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2);
+-    s->pending_buf = (uchf *) overlay;
+-    s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L);
++    /* We overlay pending_buf and sym_buf. This works since the average size
++     * for length/distance pairs over any compressed block is assured to be 31
++     * bits or less.
++     *
++     * Analysis: The longest fixed codes are a length code of 8 bits plus 5
++     * extra bits, for lengths 131 to 257. The longest fixed distance codes are
++     * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
++     * possible fixed-codes length/distance pair is then 31 bits total.
++     *
++     * sym_buf starts one-fourth of the way into pending_buf. So there are
++     * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
++     * in sym_buf is three bytes -- two for the distance and one for the
++     * literal/length. As each symbol is consumed, the pointer to the next
++     * sym_buf value to read moves forward three bytes. From that symbol, up to
++     * 31 bits are written to pending_buf. The closest the written pending_buf
++     * bits gets to the next sym_buf symbol to read is just before the last
++     * code is written. At that time, 31*(n-2) bits have been written, just
++     * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
++     * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
++     * symbols are written.) The closest the writing gets to what is unread is
++     * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
++     * can range from 128 to 32768.
++     *
++     * Therefore, at a minimum, there are 142 bits of space between what is
++     * written and what is read in the overlain buffers, so the symbols cannot
++     * be overwritten by the compressed data. That space is actually 139 bits,
++     * due to the three-bit fixed-code block header.
++     *
++     * That covers the case where either Z_FIXED is specified, forcing fixed
++     * codes, or when the use of fixed codes is chosen, because that choice
++     * results in a smaller compressed block than dynamic codes. That latter
++     * condition then assures that the above analysis also covers all dynamic
++     * blocks. A dynamic-code block will only be chosen to be emitted if it has
++     * fewer bits than a fixed-code block would for the same set of symbols.
++     * Therefore its average symbol length is assured to be less than 31. So
++     * the compressed data for a dynamic block also cannot overwrite the
++     * symbols from which it is being constructed.
++     */
++
++    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
++    s->pending_buf_size = (ulg)s->lit_bufsize * 4;
+ 
+     if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
+         s->pending_buf == Z_NULL) {
+@@ -340,8 +373,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
+         deflateEnd (strm);
+         return Z_MEM_ERROR;
+     }
+-    s->d_buf = overlay + s->lit_bufsize/sizeof(ush);
+-    s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize;
++    s->sym_buf = s->pending_buf + s->lit_bufsize;
++    s->sym_end = (s->lit_bufsize - 1) * 3;
++    /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
++     * on 16 bit machines and because stored blocks are restricted to
++     * 64K-1 bytes.
++     */
+ 
+     s->level = level;
+     s->strategy = strategy;
+@@ -552,7 +589,7 @@ int ZEXPORT deflatePrime (strm, bits, value)
+ 
+     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
+     s = strm->state;
+-    if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3))
++    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+         return Z_BUF_ERROR;
+     do {
+         put = Buf_size - s->bi_valid;
+@@ -1113,7 +1150,6 @@ int ZEXPORT deflateCopy (dest, source)
+ #else
+     deflate_state *ds;
+     deflate_state *ss;
+-    ushf *overlay;
+ 
+ 
+     if (deflateStateCheck(source) || dest == Z_NULL) {
+@@ -1133,8 +1169,7 @@ int ZEXPORT deflateCopy (dest, source)
+     ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
+     ds->prev   = (Posf *)  ZALLOC(dest, ds->w_size, sizeof(Pos));
+     ds->head   = (Posf *)  ZALLOC(dest, ds->hash_size, sizeof(Pos));
+-    overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2);
+-    ds->pending_buf = (uchf *) overlay;
++    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
+ 
+     if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
+         ds->pending_buf == Z_NULL) {
+@@ -1148,8 +1183,7 @@ int ZEXPORT deflateCopy (dest, source)
+     zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
+ 
+     ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
+-    ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush);
+-    ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize;
++    ds->sym_buf = ds->pending_buf + ds->lit_bufsize;
+ 
+     ds->l_desc.dyn_tree = ds->dyn_ltree;
+     ds->d_desc.dyn_tree = ds->dyn_dtree;
+@@ -1925,7 +1959,7 @@ local block_state deflate_fast(s, flush)
+         FLUSH_BLOCK(s, 1);
+         return finish_done;
+     }
+-    if (s->last_lit)
++    if (s->sym_next)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
+@@ -2056,7 +2090,7 @@ local block_state deflate_slow(s, flush)
+         FLUSH_BLOCK(s, 1);
+         return finish_done;
+     }
+-    if (s->last_lit)
++    if (s->sym_next)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
+@@ -2131,7 +2165,7 @@ local block_state deflate_rle(s, flush)
+         FLUSH_BLOCK(s, 1);
+         return finish_done;
+     }
+-    if (s->last_lit)
++    if (s->sym_next)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
+@@ -2170,7 +2204,7 @@ local block_state deflate_huff(s, flush)
+         FLUSH_BLOCK(s, 1);
+         return finish_done;
+     }
+-    if (s->last_lit)
++    if (s->sym_next)
+         FLUSH_BLOCK(s, 0);
+     return block_done;
+ }
+diff --git a/deflate.h b/deflate.h
+index 23ecdd3..d4cf1a9 100644
+--- a/deflate.h
++++ b/deflate.h
+@@ -217,7 +217,7 @@ typedef struct internal_state {
+     /* Depth of each subtree used as tie breaker for trees of equal frequency
+      */
+ 
+-    uchf *l_buf;          /* buffer for literals or lengths */
++    uchf *sym_buf;        /* buffer for distances and literals/lengths */
+ 
+     uInt  lit_bufsize;
+     /* Size of match buffer for literals/lengths.  There are 4 reasons for
+@@ -239,13 +239,8 @@ typedef struct internal_state {
+      *   - I can't count above 4
+      */
+ 
+-    uInt last_lit;      /* running index in l_buf */
+-
+-    ushf *d_buf;
+-    /* Buffer for distances. To simplify the code, d_buf and l_buf have
+-     * the same number of elements. To use different lengths, an extra flag
+-     * array would be necessary.
+-     */
++    uInt sym_next;      /* running index in sym_buf */
++    uInt sym_end;       /* symbol table full when sym_next reaches this */
+ 
+     ulg opt_len;        /* bit length of current block with optimal trees */
+     ulg static_len;     /* bit length of current block with static trees */
+@@ -325,20 +320,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
+ 
+ # define _tr_tally_lit(s, c, flush) \
+   { uch cc = (c); \
+-    s->d_buf[s->last_lit] = 0; \
+-    s->l_buf[s->last_lit++] = cc; \
++    s->sym_buf[s->sym_next++] = 0; \
++    s->sym_buf[s->sym_next++] = 0; \
++    s->sym_buf[s->sym_next++] = cc; \
+     s->dyn_ltree[cc].Freq++; \
+-    flush = (s->last_lit == s->lit_bufsize-1); \
++    flush = (s->sym_next == s->sym_end); \
+    }
+ # define _tr_tally_dist(s, distance, length, flush) \
+   { uch len = (uch)(length); \
+     ush dist = (ush)(distance); \
+-    s->d_buf[s->last_lit] = dist; \
+-    s->l_buf[s->last_lit++] = len; \
++    s->sym_buf[s->sym_next++] = dist; \
++    s->sym_buf[s->sym_next++] = dist >> 8; \
++    s->sym_buf[s->sym_next++] = len; \
+     dist--; \
+     s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \
+     s->dyn_dtree[d_code(dist)].Freq++; \
+-    flush = (s->last_lit == s->lit_bufsize-1); \
++    flush = (s->sym_next == s->sym_end); \
+   }
+ #else
+ # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c)
+diff --git a/trees.c b/trees.c
+index 4f4a650..decaeb7 100644
+--- a/trees.c
++++ b/trees.c
+@@ -416,7 +416,7 @@ local void init_block(s)
+ 
+     s->dyn_ltree[END_BLOCK].Freq = 1;
+     s->opt_len = s->static_len = 0L;
+-    s->last_lit = s->matches = 0;
++    s->sym_next = s->matches = 0;
+ }
+ 
+ #define SMALLEST 1
+@@ -948,7 +948,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last)
+ 
+         Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ",
+                 opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len,
+-                s->last_lit));
++                s->sym_next / 3));
+ 
+         if (static_lenb <= opt_lenb) opt_lenb = static_lenb;
+ 
+@@ -1017,8 +1017,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
+     unsigned dist;  /* distance of matched string */
+     unsigned lc;    /* match length-MIN_MATCH or unmatched char (if dist==0) */
+ {
+-    s->d_buf[s->last_lit] = (ush)dist;
+-    s->l_buf[s->last_lit++] = (uch)lc;
++    s->sym_buf[s->sym_next++] = dist;
++    s->sym_buf[s->sym_next++] = dist >> 8;
++    s->sym_buf[s->sym_next++] = lc;
+     if (dist == 0) {
+         /* lc is the unmatched char */
+         s->dyn_ltree[lc].Freq++;
+@@ -1033,30 +1034,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
+         s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++;
+         s->dyn_dtree[d_code(dist)].Freq++;
+     }
+-
+-#ifdef TRUNCATE_BLOCK
+-    /* Try to guess if it is profitable to stop the current block here */
+-    if ((s->last_lit & 0x1fff) == 0 && s->level > 2) {
+-        /* Compute an upper bound for the compressed length */
+-        ulg out_length = (ulg)s->last_lit*8L;
+-        ulg in_length = (ulg)((long)s->strstart - s->block_start);
+-        int dcode;
+-        for (dcode = 0; dcode < D_CODES; dcode++) {
+-            out_length += (ulg)s->dyn_dtree[dcode].Freq *
+-                (5L+extra_dbits[dcode]);
+-        }
+-        out_length >>= 3;
+-        Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ",
+-               s->last_lit, in_length, out_length,
+-               100L - out_length*100L/in_length));
+-        if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1;
+-    }
+-#endif
+-    return (s->last_lit == s->lit_bufsize-1);
+-    /* We avoid equality with lit_bufsize because of wraparound at 64K
+-     * on 16 bit machines and because stored blocks are restricted to
+-     * 64K-1 bytes.
+-     */
++    return (s->sym_next == s->sym_end);
+ }
+ 
+ /* ===========================================================================
+@@ -1069,13 +1047,14 @@ local void compress_block(s, ltree, dtree)
+ {
+     unsigned dist;      /* distance of matched string */
+     int lc;             /* match length or unmatched char (if dist == 0) */
+-    unsigned lx = 0;    /* running index in l_buf */
++    unsigned sx = 0;    /* running index in sym_buf */
+     unsigned code;      /* the code to send */
+     int extra;          /* number of extra bits to send */
+ 
+-    if (s->last_lit != 0) do {
+-        dist = s->d_buf[lx];
+-        lc = s->l_buf[lx++];
++    if (s->sym_next != 0) do {
++        dist = s->sym_buf[sx++] & 0xff;
++        dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8;
++        lc = s->sym_buf[sx++];
+         if (dist == 0) {
+             send_code(s, lc, ltree); /* send a literal byte */
+             Tracecv(isgraph(lc), (stderr," '%c' ", lc));
+@@ -1100,11 +1079,10 @@ local void compress_block(s, ltree, dtree)
+             }
+         } /* literal or match pair ? */
+ 
+-        /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */
+-        Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx,
+-               "pendingBuf overflow");
++        /* Check that the overlay between pending_buf and sym_buf is ok: */
++        Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
+ 
+-    } while (lx < s->last_lit);
++    } while (sx < s->sym_next);
+ 
+     send_code(s, END_BLOCK, ltree);
+ }
+-- 
+2.33.1
+
diff --git a/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch b/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch
new file mode 100644
index 0000000000000..dadc904a07fbb
--- /dev/null
+++ b/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch
@@ -0,0 +1,27 @@
+From 4346a16853e19b45787ce933666026903fb8f3f8 Mon Sep 17 00:00:00 2001
+From: Mark Adler <madler@alumni.caltech.edu>
+Date: Tue, 17 Apr 2018 22:44:41 -0700
+Subject: [PATCH 2/2] Assure that the number of bits for deflatePrime() is
+ valid.
+
+---
+ deflate.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/deflate.c b/deflate.c
+index 19cba87..23aef18 100644
+--- a/deflate.c
++++ b/deflate.c
+@@ -589,7 +589,8 @@ int ZEXPORT deflatePrime (strm, bits, value)
+ 
+     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
+     s = strm->state;
+-    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
++    if (bits < 0 || bits > 16 ||
++        s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+         return Z_BUF_ERROR;
+     do {
+         put = Buf_size - s->bi_valid;
+-- 
+2.33.1
+
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 7f85ddb783a5f..106675a4d28e5 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -295,7 +295,9 @@ with prev;
 
       buildInputs = [ pkgs.libuv ];
 
-      nativeBuildInputs = [ pkgs.pkg-config pkgs.fixDarwinDylibNames pkgs.cmake ];
+      nativeBuildInputs = [ pkgs.pkg-config pkgs.cmake ]
+        ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [ pkgs.fixDarwinDylibNames ];
+
       # Fixup linking libluv.dylib, for some reason it's not linked against lua correctly.
       NIX_LDFLAGS = pkgs.lib.optionalString pkgs.stdenv.isDarwin
         (if isLuaJIT then "-lluajit-${lua.luaversion}" else "-llua");
diff --git a/pkgs/development/misc/msp430/mspds/binary.nix b/pkgs/development/misc/msp430/mspds/binary.nix
index 2fc306f8e5ffa..967562580c67f 100644
--- a/pkgs/development/misc/msp430/mspds/binary.nix
+++ b/pkgs/development/misc/msp430/mspds/binary.nix
@@ -17,7 +17,8 @@ in stdenv.mkDerivation rec {
     if stdenv.hostPlatform.isWindows then "MSP430${archPostfix}.dll"
     else "libmsp430${archPostfix}${stdenv.hostPlatform.extensions.sharedLibrary}";
 
-  nativeBuildInputs = [ unzip autoPatchelfHook ];
+  nativeBuildInputs = [ unzip ]
+    ++ lib.optional stdenv.isLinux autoPatchelfHook;
   buildInputs = [ stdenv.cc.cc ];
 
   installPhase = ''
diff --git a/pkgs/development/mobile/androidenv/build-tools.nix b/pkgs/development/mobile/androidenv/build-tools.nix
index 536a025d15b42..641560f199285 100644
--- a/pkgs/development/mobile/androidenv/build-tools.nix
+++ b/pkgs/development/mobile/androidenv/build-tools.nix
@@ -2,8 +2,8 @@
 
 deployAndroidPackage {
   inherit package os;
-  buildInputs = [ autoPatchelfHook makeWrapper ] ++
-    lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 pkgs_i686.glibc pkgs_i686.zlib pkgs_i686.ncurses5 pkgs.libcxx ];
+  buildInputs = [ makeWrapper ] ++
+    lib.optionals (os == "linux") [ autoPatchelfHook pkgs.glibc pkgs.zlib pkgs.ncurses5 pkgs_i686.glibc pkgs_i686.zlib pkgs_i686.ncurses5 pkgs.libcxx ];
   patchInstructions = ''
     ${lib.optionalString (os == "linux") ''
       addAutoPatchelfSearchPath $packageBaseDir/lib
diff --git a/pkgs/development/mobile/androidenv/platform-tools.nix b/pkgs/development/mobile/androidenv/platform-tools.nix
index c39d966959a3d..52443486bbb68 100644
--- a/pkgs/development/mobile/androidenv/platform-tools.nix
+++ b/pkgs/development/mobile/androidenv/platform-tools.nix
@@ -2,8 +2,7 @@
 
 deployAndroidPackage {
   inherit package os;
-  buildInputs = [ autoPatchelfHook ]
-    ++ lib.optionals (os == "linux") [ pkgs.glibc pkgs.zlib pkgs.ncurses5 ];
+  buildInputs = lib.optionals (os == "linux") [ autoPatchelfHook pkgs.glibc pkgs.zlib pkgs.ncurses5 ];
   patchInstructions = lib.optionalString (os == "linux") ''
     addAutoPatchelfSearchPath $packageBaseDir/lib64
     autoPatchelf --no-recurse $packageBaseDir/lib64
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index 66f12ffd54b0b..55c7f56ea43c3 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "afdko";
-  version = "3.7.1";
+  version = "3.8.0";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05hj2mw3ppfjaig5zdk5db9vfrbbq5gmv5rzggmvvrj0yyfpr0pd";
+    sha256 = "1404jdwyv16mri5jh6qly63nli2iw9yq2nn37h8iqvlbawfbjj0p";
   };
 
   format = "pyproject";
@@ -40,12 +40,6 @@ buildPythonPackage rec {
 
     # Use antlr4 runtime from nixpkgs and link it dynamically
     ./use-dynamic-system-antlr4-runtime.patch
-
-    # Fix compatibility with latest fonttools.
-    (fetchpatch {
-      url = "https://github.com/adobe-type-tools/afdko/commit/120752c50a562e4f6c12ff4be1e3bd96ed664e82.patch";
-      sha256 = "RDGIpNAuCmK+zqZOeOK7ddCjr9BuqPpcnbnxdtoE48M=";
-    })
   ];
 
   # setup.py will always (re-)execute cmake in buildPhase
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 11990e7d39965..e0b5c696e3181 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -13,7 +13,7 @@
 , pythonOlder
 , pyyaml
 , requests
-, requests_oauthlib
+, requests-oauthlib
 , six
 , slixmpp
 }:
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     markdown
     pyyaml
     requests
-    requests_oauthlib
+    requests-oauthlib
     six
   ];
 
diff --git a/pkgs/development/python-modules/asana/default.nix b/pkgs/development/python-modules/asana/default.nix
index c7839f051478e..d179f3f94902d 100644
--- a/pkgs/development/python-modules/asana/default.nix
+++ b/pkgs/development/python-modules/asana/default.nix
@@ -1,37 +1,47 @@
-{ buildPythonPackage, pythonAtLeast, pytest, requests, requests_oauthlib, six
-, fetchFromGitHub, responses, lib
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-oauthlib
+, responses
+, six
 }:
 
 buildPythonPackage rec {
   pname = "asana";
-  version = "0.10.3";
+  version = "0.10.9";
+  format = "setuptools";
 
-  # upstream reportedly doesn't support 3.7 yet, blocked on
-  # https://bugs.python.org/issue34226
-  disabled = pythonAtLeast "3.7";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "asana";
     repo = "python-asana";
     rev = "v${version}";
-    sha256 = "11nsfygcfpc2qb2gy4npi9w00cqfh88g7k3rsfq7xambz1zjdz1n";
+    sha256 = "sha256-9gOkCMY15ChdhiFdzS0TjvWpVTKKEGt7XIcK6EhkSK8=";
   };
 
-  checkInputs = [ pytest responses ];
-  propagatedBuildInputs = [ requests requests_oauthlib six ];
+  propagatedBuildInputs = [
+    requests
+    requests-oauthlib
+    six
+  ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "requests_oauthlib >= 0.8.0, == 0.8.*" "requests_oauthlib>=0.8.0<2.0"
-  '';
+  checkInputs = [
+    pytestCheckHook
+    responses
+  ];
 
-  checkPhase = ''
-    py.test tests
-  '';
+  pythonImportsCheck = [
+    "asana"
+  ];
 
   meta = with lib; {
     description = "Python client library for Asana";
     homepage = "https://github.com/asana/python-asana";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index 5eea9a5579a19..d0d32168574eb 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -9,16 +9,17 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.4.1";
+  version = "3.5.0";
   pname = "asgiref";
+  format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "django";
     repo = pname;
     rev = version;
-    sha256 = "sha256-aXD46qH5sTTmp0rlzQGLAN+MfIz1u6obCwtfqoIYgBA=";
+    sha256 = "sha256-eWDsd8iWK1C/X3t/fKAM1i4hyTM/daGTd8CDSgDTL/U=";
   };
 
   propagatedBuildInputs = [
@@ -40,6 +41,6 @@ buildPythonPackage rec {
     description = "Reference ASGI adapters and channel layers";
     homepage = "https://github.com/django/asgiref";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index 468dac5566144..4ecf893c1b941 100755
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -4,7 +4,7 @@
 , deprecated
 , oauthlib
 , requests
-, requests_oauthlib
+, requests-oauthlib
 , six
 , pytestCheckHook
 , pythonOlder
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     deprecated
     oauthlib
     requests
-    requests_oauthlib
+    requests-oauthlib
     six
   ];
 
diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index 064fe8187edcc..884629da0ffe5 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -23,13 +23,13 @@
 
 buildPythonPackage rec {
   pname = "black";
-  version = "22.1.0";
+  version = "22.3.0";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-p8AZLTVjX2/BF0vldct5FekuXdYp7nn9rw3PpBqAr7U=";
+    hash = "sha256-NQILiIbAIs7ZKCtRtah1ttGrDDh7MaBluE23wzCFynk=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/blinker/default.nix b/pkgs/development/python-modules/blinker/default.nix
index ca59a0d710aba..53aaacbdf820a 100644
--- a/pkgs/development/python-modules/blinker/default.nix
+++ b/pkgs/development/python-modules/blinker/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, nose, pytestCheckHook }:
+{ lib, buildPythonPackage, fetchPypi, nose }:
 
 buildPythonPackage rec {
   pname = "blinker";
@@ -9,13 +9,18 @@ buildPythonPackage rec {
     sha256 = "1dpq0vb01p36jjwbhhd08ylvrnyvcc82yxx3mwjx6awrycjyw6j7";
   };
 
-  checkInputs = [ nose pytestCheckHook ];
+  checkInputs = [ nose ];
+
+  checkPhase = ''
+    nosetests
+  '';
+
   pythonImportsCheck = [ "blinker" ];
 
   meta = with lib; {
     homepage = "https://pythonhosted.org/blinker/";
     description = "Fast, simple object-to-object and broadcast signaling";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/cppy/default.nix b/pkgs/development/python-modules/cppy/default.nix
index fffa91744248e..ceb30a2c235fb 100644
--- a/pkgs/development/python-modules/cppy/default.nix
+++ b/pkgs/development/python-modules/cppy/default.nix
@@ -1,23 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, pythonOlder
+, pytestCheckHook
+, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "cppy";
-  version = "1.1.0";
+  version = "1.2.0";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4eda6f1952054a270f32dc11df7c5e24b259a09fddf7bfaa5f33df9fb4a29642";
+    sha256 = "sha256-leiGLk+CbD8qa3tlgzOxYvgMvp+UOqDQp6ay74UK7/w=";
   };
 
-  # Headers-only library, no tests
-  doCheck = false;
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
-  # Not supported
-  disabled = !isPy3k;
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "cppy" ];
 
   meta = {
     description = "C++ headers for C extension development";
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index b4a79137d59bf..607e431b39c88 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -1,16 +1,17 @@
-{ lib, stdenv
+{ lib
+, stdenv
+, callPackage
 , buildPythonPackage
 , fetchPypi
 , rustPlatform
 , setuptools-rust
 , openssl
-, cryptography_vectors
-, darwin
+, Security
 , packaging
 , six
 , isPyPy
 , cffi
-, pytest
+, pytestCheckHook
 , pytest-subtests
 , pretend
 , libiconv
@@ -19,20 +20,23 @@
 , hypothesis
 }:
 
+let
+  cryptography-vectors = callPackage ./vectors.nix { };
+in
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "36.0.0"; # Also update the hash in vectors.nix
+  version = "36.0.2"; # Also update the hash in vectors.nix
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0zshc1jaavykdnic5ns8zax6gqganys6gp5f35bqcfggnkn6kxsj";
+    sha256 = "sha256-cPj097sqyfNAZVy6yJ1oxSevW7Q4dSKoQT6EHj5mKMk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    sha256 = "1nbw4cfshyc125jwdivg9gxy52qcd1iz31lypl95ij9bn1dyx933";
+    sha256 = "sha256-6C4N445h4Xf2nCc9rJWpSZaNPilR9GfgbmKvNlSIFqg=";
   };
 
   cargoRoot = "src/rust";
@@ -47,37 +51,31 @@ buildPythonPackage rec {
   ] ++ (with rustPlatform; [ rust.cargo rust.rustc ]);
 
   buildInputs = [ openssl ]
-             ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security libiconv ];
-  propagatedBuildInputs = [
-    packaging
-    six
-  ] ++ lib.optionals (!isPyPy) [
+    ++ lib.optionals stdenv.isDarwin [ Security libiconv ];
+
+  propagatedBuildInputs = lib.optionals (!isPyPy) [
     cffi
   ];
 
   checkInputs = [
-    cryptography_vectors
+    cryptography-vectors
     hypothesis
     iso8601
     pretend
-    pytest
+    pytestCheckHook
     pytest-subtests
     pytz
   ];
 
-  pytestFlags = lib.concatStringsSep " " ([
+  pytestFlagsArray = [
     "--disable-pytest-warnings"
-  ] ++
-    lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
-      # aarch64-darwin forbids W+X memory, but this tests depends on it:
-      # * https://cffi.readthedocs.io/en/latest/using.html#callbacks
-      "--ignore=tests/hazmat/backends/test_openssl_memleak.py"
-    ]
-  );
+  ];
 
-  checkPhase = ''
-    py.test ${pytestFlags} tests
-  '';
+  disabledTestPaths = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    # aarch64-darwin forbids W+X memory, but this tests depends on it:
+    # * https://cffi.readthedocs.io/en/latest/using.html#callbacks
+    "--ignore=tests/hazmat/backends/test_openssl_memleak.py"
+  ];
 
   meta = with lib; {
     description = "A package which provides cryptographic recipes and primitives";
@@ -92,6 +90,6 @@ buildPythonPackage rec {
     changelog = "https://cryptography.io/en/latest/changelog/#v"
       + replaceStrings [ "." ] [ "-" ] version;
     license = with licenses; [ asl20 bsd3 psfl ];
-    maintainers = with maintainers; [ primeos ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 577c2c870910b..9937209072653 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -1,23 +1,26 @@
 { buildPythonPackage, fetchPypi, lib, cryptography }:
 
 buildPythonPackage rec {
-  pname = "cryptography_vectors";
-  # The test vectors must have the same version as the cryptography package:
-  version = cryptography.version;
+  pname = "cryptography-vectors";
+  # The test vectors must have the same version as the cryptography package
+  inherit (cryptography) version;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "19gs051jbsixxwhlfs4xdxpzg8w1vypzpz3w56bp9x01qwzfbdy6";
+    pname = "cryptography_vectors";
+    inherit version;
+    sha256 = "sha256-KnkkRJoDAl+vf4dUpvQgAAHKshBzSmzmrB9r2s06aOQ=";
   };
 
   # No tests included
   doCheck = false;
 
+  pythonImportsCheck = [ "cryptography_vectors" ];
+
   meta = with lib; {
     description = "Test vectors for the cryptography package";
     homepage = "https://cryptography.io/en/latest/development/test-vectors/";
     # Source: https://github.com/pyca/cryptography/tree/master/vectors;
     license = with licenses; [ asl20 bsd3 ];
-    maintainers = with maintainers; [ primeos ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index a68cfd6d9cdfe..591d41a960ccd 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -1,31 +1,45 @@
-{ lib, buildPythonPackage, fetchFromGitHub, requests, requests_oauthlib
-, django, python3-openid, mock, coverage }:
+{ lib
+, buildPythonPackage
+, django
+, fetchFromGitHub
+, python3-openid
+, pythonOlder
+, requests
+, requests-oauthlib
+}:
 
 buildPythonPackage rec {
   pname = "django-allauth";
   version = "0.47.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # no tests on PyPI
   src = fetchFromGitHub {
     owner = "pennersr";
     repo = pname;
     rev = version;
-    sha256 = "sha256-wKrsute6TCl331UrxNEBf/zTtGnyGHsOZQwdiicbg2o=";
+    hash = "sha256-wKrsute6TCl331UrxNEBf/zTtGnyGHsOZQwdiicbg2o=";
   };
 
-  propagatedBuildInputs = [ requests requests_oauthlib django python3-openid ];
-
-  checkInputs = [ coverage mock ];
+  propagatedBuildInputs = [
+    requests
+    requests-oauthlib
+    django
+    python3-openid
+  ];
 
+  # Tests requires a Django instance
   doCheck = false;
-  checkPhase = ''
-    cd $NIX_BUILD_TOP/$sourceRoot
-    coverage run manage.py test allauth
-  '';
+
+  pythonImportsCheck = [
+    "allauth"
+  ];
 
   meta = with lib; {
     description = "Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication";
     homepage = "https://www.intenct.nl/projects/django-allauth";
     license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/exchangelib/default.nix b/pkgs/development/python-modules/exchangelib/default.nix
index 3550f1e17361c..2f3f5fe16abbc 100644
--- a/pkgs/development/python-modules/exchangelib/default.nix
+++ b/pkgs/development/python-modules/exchangelib/default.nix
@@ -17,7 +17,7 @@
 , pyyaml
 , requests
 , requests_ntlm
-, requests_oauthlib
+, requests-oauthlib
 , requests-kerberos
 , requests-mock
 , tzdata
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "ecederstrand";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fdYc+fJEePgCzAkUWz7pmL/CI/O9zm5G9xh1f4bhrH4=";
+    hash = "sha256-fdYc+fJEePgCzAkUWz7pmL/CI/O9zm5G9xh1f4bhrH4=";
   };
 
   propagatedBuildInputs = [
@@ -48,7 +48,7 @@ buildPythonPackage rec {
     pygments
     requests
     requests_ntlm
-    requests_oauthlib
+    requests-oauthlib
     requests-kerberos
     tzdata
     tzlocal
diff --git a/pkgs/development/python-modules/fitbit/default.nix b/pkgs/development/python-modules/fitbit/default.nix
index b41ac0a4983a1..3a1c76776774a 100644
--- a/pkgs/development/python-modules/fitbit/default.nix
+++ b/pkgs/development/python-modules/fitbit/default.nix
@@ -1,41 +1,49 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, coverage
-, python-dateutil
 , freezegun
 , mock
+, pytestCheckHook
+, python-dateutil
+, pythonOlder
 , requests-mock
-, requests_oauthlib
-, sphinx
+, requests-oauthlib
 }:
 
 buildPythonPackage rec {
   pname = "fitbit";
   version = "0.3.1";
+  format = "setuptools";
 
-  checkInputs = [ coverage freezegun mock requests-mock sphinx ];
-  propagatedBuildInputs = [ python-dateutil requests_oauthlib ];
+  disabled = pythonOlder "3.7";
 
-  # The source package on PyPi is missing files required for unit testing.
-  # https://github.com/orcasgit/python-fitbit/issues/148
   src = fetchFromGitHub {
-    rev = version;
     owner = "orcasgit";
     repo = "python-fitbit";
-    sha256 = "1w2lpgf6bs5nbnmslppaf4lbhr9cj6grg0a525xv41jip7iy3vfn";
+    rev = version;
+    hash = "sha256-1u3h47lRBrJ7EUWBl5+RLGW4KHHqXqqrXbboZdy7VPA=";
   };
 
-  postPatch = ''
-    substituteInPlace requirements/test.txt \
-      --replace 'Sphinx>=1.2,<1.4' 'Sphinx' \
-      --replace 'coverage>=3.7,<4.0' 'coverage'
-  '';
+  propagatedBuildInputs = [
+    python-dateutil
+    requests-oauthlib
+  ];
+
+  checkInputs = [
+    freezegun
+    mock
+    pytestCheckHook
+    requests-mock
+  ];
+
+  pythonImportsCheck = [
+    "fitbit"
+  ];
 
   meta = with lib; {
     description = "Fitbit API Python Client Implementation";
-    license = licenses.asl20;
     homepage = "https://github.com/orcasgit/python-fitbit";
+    license = licenses.asl20;
     maintainers = with maintainers; [ delroth ];
   };
 }
diff --git a/pkgs/development/python-modules/flickrapi/default.nix b/pkgs/development/python-modules/flickrapi/default.nix
index d7d20f19ea7be..8ad1071cd241a 100644
--- a/pkgs/development/python-modules/flickrapi/default.nix
+++ b/pkgs/development/python-modules/flickrapi/default.nix
@@ -1,35 +1,66 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , requests
 , requests-toolbelt
-, requests_oauthlib
-, pytest
-, pytest-runner
-, pytest-cov
+, requests-oauthlib
+, pytestCheckHook
 , responses
+, pythonOlder
 }:
 
 buildPythonPackage rec {
-  pname   = "flickrapi";
-  version = "2.4.0";
+  pname = "flickrapi";
+  version = "2.4";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "03g2z21k6nhxgwysjrgnxj9m1yg25mnnkr10gpyfhfkd9w77pcpz";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "sybrenstuvel";
+    repo = pname;
+    rev = "version-${version}";
+    hash = "sha256-vRZrlXKI0UDdmDevh3XUngH4X8G3VlOCSP0z/rxhIgw=";
   };
 
-  propagatedBuildInputs = [ requests requests-toolbelt requests_oauthlib ];
+  propagatedBuildInputs = [
+    requests
+    requests-toolbelt
+    requests-oauthlib
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    responses
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d);
+  '';
+
+  disabledTests = [
+    # Tests require network access
+    "test_default_format"
+    "test_etree_default_format"
+    "test_etree_format_error"
+    "test_etree_format_happy"
+    "test_explicit_format"
+    "test_json_callback_format"
+    "test_json_format"
+    "test_parsed_json_format"
+    "test_walk"
+    "test_xmlnode_format"
+    "test_xmlnode_format_error"
+  ];
 
-  checkInputs = [ pytest pytest-runner pytest-cov responses ];
-  doCheck = false; # Otherwise:
-  # ========================= no tests ran in 0.01 seconds =========================
-  # builder for '/nix/store/c8a58v6aa18zci08q2l53s12ywn8jqhq-python3.6-flickrapi-2.4.0.drv' failed with exit code 5
+  pythonImportsCheck = [
+    "flickrapi"
+  ];
 
-  meta = {
+  meta = with lib; {
     description = "A Python interface to the Flickr API";
-    homepage    = "https://stuvel.eu/flickrapi";
-    license     = lib.licenses.psfl;
-    maintainers = with lib.maintainers; [ obadz ];
+    homepage = "https://stuvel.eu/flickrapi";
+    license = licenses.psfl;
+    maintainers = with maintainers; [ obadz ];
   };
 }
diff --git a/pkgs/development/python-modules/flit-core/default.nix b/pkgs/development/python-modules/flit-core/default.nix
index 35bba06f1f36e..d0b83d30ea270 100644
--- a/pkgs/development/python-modules/flit-core/default.nix
+++ b/pkgs/development/python-modules/flit-core/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "flit-core";
-  version = "3.6.0";
+  inherit (flit) version;
   format = "pyproject";
 
   outputs = [
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Distribution-building parts of Flit. See flit package for more information";
-    homepage = "https://github.com/takluyver/flit";
+    homepage = "https://github.com/pypa/flit";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fridh SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/flit/default.nix b/pkgs/development/python-modules/flit/default.nix
index 830ed2702b898..598905d97ffaf 100644
--- a/pkgs/development/python-modules/flit/default.nix
+++ b/pkgs/development/python-modules/flit/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , docutils
 , requests
-, pytest
+, pytestCheckHook
 , testpath
 , responses
 , flit-core
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "flit";
-  version = "3.6.0";
+  version = "3.7.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "takluyver";
     repo = "flit";
     rev = version;
-    sha256 = "sha256-D3q/1g6njrrmizooGmzNd9g2nKs00dMGj9jrrv3Y6HQ=";
+    sha256 = "sha256-zKgaeK3fskz2TuHvIWlxBrdZIWfIJHhaqopZ3+V36wY=";
   };
 
   nativeBuildInputs = [
@@ -40,18 +40,17 @@ buildPythonPackage rec {
     tomli-w
   ];
 
-  checkInputs = [ pytest testpath responses ];
+  checkInputs = [ pytestCheckHook testpath responses ];
 
-  # Disable test that needs some ini file.
-  # Disable test that wants hg
-  checkPhase = ''
-    HOME=$(mktemp -d) pytest -k "not test_invalid_classifier and not test_build_sdist"
-  '';
+  disabledTests = [
+    # needs some ini file.
+    "test_invalid_classifier"
+  ];
 
   meta = with lib; {
     description = "A simple packaging tool for simple packages";
-    homepage = "https://github.com/takluyver/flit";
+    homepage = "https://github.com/pypa/flit";
     license = licenses.bsd3;
-    maintainers = [ maintainers.fridh ];
+    maintainers = with maintainers; [ fridh SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/fontparts/default.nix b/pkgs/development/python-modules/fontparts/default.nix
index 7830cb1171285..16d594eab04f6 100644
--- a/pkgs/development/python-modules/fontparts/default.nix
+++ b/pkgs/development/python-modules/fontparts/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, python
+{ lib, buildPythonPackage, fetchPypi, python, pythonOlder
 , fonttools, lxml, fs, unicodedata2
 , defcon, fontpens, fontmath, booleanoperations
 , pytest, setuptools-scm
@@ -6,11 +6,13 @@
 
 buildPythonPackage rec {
   pname = "fontParts";
-  version = "0.10.3";
+  version = "0.10.4";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-aHtjLHdc2/s3ppF8fz8qFAqxwEKMZJJAFNlBaZ7FAb4=";
+    sha256 = "1ic453q86s5hsw8mxnclk1vr4qp69fd67gywhv23zqwz9a7kb7lh";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index 84f2edb721020..a70dfef00541b 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -17,16 +17,15 @@
 
 buildPythonPackage rec {
   pname = "fonttools";
-  version = "4.29.1";
+  version = "4.30.0";
 
-  # Bump to 3.7 when https://github.com/fonttools/fonttools/pull/2417 is merged
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner  = pname;
     repo   = pname;
     rev    = version;
-    sha256 = "sha256-xviNGFcb1wj5WuA6UxHpw3BkpdjSJL3fbsBytJacp8w=";
+    sha256 = "1y9f071bdl66rsx42j16j5v53h85xra5qlg860rz3m054s2rmin9";
   };
 
   # all dependencies are optional, but
diff --git a/pkgs/development/python-modules/freezegun/default.nix b/pkgs/development/python-modules/freezegun/default.nix
index 2ffefa1a4e095..171d2b0556aba 100644
--- a/pkgs/development/python-modules/freezegun/default.nix
+++ b/pkgs/development/python-modules/freezegun/default.nix
@@ -1,21 +1,23 @@
 { lib
 , buildPythonPackage
-, pythonOlder
-, pythonAtLeast
 , fetchpatch
 , fetchPypi
-, python-dateutil
 , pytestCheckHook
+, python-dateutil
+, pythonAtLeast
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "freezegun";
-  version = "1.1.0";
-  disabled = pythonOlder "3.5";
+  version = "1.2.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "177f9dd59861d871e27a484c3332f35a6e3f5d14626f2bf91be37891f18927f3";
+    hash = "sha256-tMZO+ydea8aNxudxsX/+D/D5C4GipRiQQ1ULZRmSa6Q=";
   };
 
   patches = lib.optionals (pythonAtLeast "3.10") [
@@ -26,13 +28,22 @@ buildPythonPackage rec {
     })
   ];
 
-  propagatedBuildInputs = [ python-dateutil ];
-  checkInputs = [ pytestCheckHook ];
+  propagatedBuildInputs = [
+    python-dateutil
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "freezegun"
+  ];
 
   meta = with lib; {
-    description = "FreezeGun: Let your Python tests travel through time";
+    description = "Library that allows your Python tests to travel through time";
     homepage = "https://github.com/spulec/freezegun";
     license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
   };
-
 }
diff --git a/pkgs/development/python-modules/google-auth-oauthlib/default.nix b/pkgs/development/python-modules/google-auth-oauthlib/default.nix
index 6ee0cb0654010..449a07ea40cbd 100644
--- a/pkgs/development/python-modules/google-auth-oauthlib/default.nix
+++ b/pkgs/development/python-modules/google-auth-oauthlib/default.nix
@@ -6,12 +6,16 @@
 , mock
 , pytestCheckHook
 , google-auth
-, requests_oauthlib
+, requests-oauthlib
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "google-auth-oauthlib";
   version = "0.5.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
@@ -20,7 +24,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     google-auth
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   checkInputs = [
@@ -29,7 +33,13 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.isDarwin [ "test_run_local_server" ];
+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_run_local_server"
+  ];
+
+  pythonImportsCheck = [
+    "google_auth_oauthlib"
+  ];
 
   meta = with lib; {
     description = "Google Authentication Library: oauthlib integration";
diff --git a/pkgs/development/python-modules/google-nest-sdm/default.nix b/pkgs/development/python-modules/google-nest-sdm/default.nix
index acf2e734f8c35..99f5bebbc6796 100644
--- a/pkgs/development/python-modules/google-nest-sdm/default.nix
+++ b/pkgs/development/python-modules/google-nest-sdm/default.nix
@@ -11,7 +11,7 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
-, requests_oauthlib
+, requests-oauthlib
 }:
 
 buildPythonPackage rec {
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     google-auth
     google-auth-oauthlib
     google-cloud-pubsub
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/h11/default.nix b/pkgs/development/python-modules/h11/default.nix
index be4802566f75d..98dd8eef6cbdc 100644
--- a/pkgs/development/python-modules/h11/default.nix
+++ b/pkgs/development/python-modules/h11/default.nix
@@ -2,11 +2,13 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "h11";
   version = "0.13.0";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
@@ -22,5 +24,6 @@ buildPythonPackage rec {
     description = "Pure-Python, bring-your-own-I/O implementation of HTTP/1.1";
     homepage = "https://github.com/python-hyper/h11";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/homeconnect/default.nix b/pkgs/development/python-modules/homeconnect/default.nix
index b6fca4201ad7f..b615274416abc 100644
--- a/pkgs/development/python-modules/homeconnect/default.nix
+++ b/pkgs/development/python-modules/homeconnect/default.nix
@@ -2,26 +2,33 @@
 , buildPythonPackage
 , fetchPypi
 , requests
-, requests_oauthlib
+, requests-oauthlib
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "homeconnect";
   version = "0.7.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/h0dEVmP0R9tVt56mvu72Ksrvnuox1FA7BgrZMOhV6Q=";
+    hash = "sha256-/h0dEVmP0R9tVt56mvu72Ksrvnuox1FA7BgrZMOhV6Q=";
   };
 
   propagatedBuildInputs = [
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "homeconnect" ];
+
+  pythonImportsCheck = [
+    "homeconnect"
+  ];
 
   meta = with lib; {
     description = "Python client for the BSH Home Connect REST API";
diff --git a/pkgs/development/python-modules/hpack/default.nix b/pkgs/development/python-modules/hpack/default.nix
index a5140a216cfd3..842c6d5f8bfcb 100644
--- a/pkgs/development/python-modules/hpack/default.nix
+++ b/pkgs/development/python-modules/hpack/default.nix
@@ -1,21 +1,34 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pythonOlder
+, hypothesis
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "hpack";
   version = "4.0.0";
+  disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "fc41de0c63e687ebffde81187a948221294896f6bdc0ae2312708df339430095";
+  src = fetchFromGitHub {
+    owner = "python-hyper";
+    repo = "hpack";
+    rev = "v${version}";
+    sha256 = "sha256-2CehGy3K5fKbkB1J8+8x1D4XvnBn1Mbapx+p8rdXDYc=";
   };
 
+  checkInputs = [
+    hypothesis
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "hpack" ];
+
   meta = with lib; {
     description = "Pure-Python HPACK header compression";
-    homepage = "http://hyper.rtfd.org";
+    homepage = "https://github.com/python-hyper/hpack";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
-
 }
diff --git a/pkgs/development/python-modules/hyperframe/default.nix b/pkgs/development/python-modules/hyperframe/default.nix
index d10ecc6c07522..e22dc0761a785 100644
--- a/pkgs/development/python-modules/hyperframe/default.nix
+++ b/pkgs/development/python-modules/hyperframe/default.nix
@@ -11,9 +11,12 @@ buildPythonPackage rec {
 
   checkInputs = [ pytestCheckHook ];
 
+  pythonImportsCheck = [ "hyperframe" ];
+
   meta = with lib; {
     description = "HTTP/2 framing layer for Python";
-    homepage = "http://hyper.rtfd.org/";
+    homepage = "https://github.com/python-hyper/hyperframe/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/jira/default.nix b/pkgs/development/python-modules/jira/default.nix
index b22f5ccd73a4d..c6b1386adec00 100644
--- a/pkgs/development/python-modules/jira/default.nix
+++ b/pkgs/development/python-modules/jira/default.nix
@@ -5,37 +5,39 @@
 , flaky
 , keyring
 , requests-mock
-, requests_oauthlib
+, requests-oauthlib
 , requests-toolbelt
 , setuptools-scm
 , setuptools-scm-git-archive
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "jira";
   version = "3.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pycontribs";
     repo = pname;
     rev = version;
-    sha256 = "04s2zgwxip54g894hps2cm081cp07mbi7qipmsv4dvailhsg43nn";
+    hash = "sha256-1g7yNKRR7Ua2rjfiE1c94LKAQGVCX0gSeqTc2Pn7QhM=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov-report=xml --cov jira" ""
-  '';
-
-  nativeBuildInputs = [ setuptools-scm setuptools-scm-git-archive ];
+  nativeBuildInputs = [
+    setuptools-scm
+    setuptools-scm-git-archive
+  ];
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   propagatedBuildInputs = [
     defusedxml
     keyring
-    requests_oauthlib
+    requests-oauthlib
     requests-toolbelt
   ];
 
@@ -45,11 +47,20 @@ buildPythonPackage rec {
     requests-mock
   ];
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "--cov-report=xml --cov jira" ""
+  '';
+
+  pythonImportsCheck = [
+    "jira"
+  ];
+
   # impure tests because of connectivity attempts to jira servers
   doCheck = false;
 
   meta = with lib; {
-    description = "This library eases the use of the JIRA REST API from Python.";
+    description = "Library to interact with the JIRA REST API";
     homepage = "https://github.com/pycontribs/jira";
     license = licenses.bsd2;
     maintainers = with maintainers; [ globin ];
diff --git a/pkgs/development/python-modules/kiwisolver/default.nix b/pkgs/development/python-modules/kiwisolver/default.nix
index e5649c58e465a..b968fa3a50aa6 100644
--- a/pkgs/development/python-modules/kiwisolver/default.nix
+++ b/pkgs/development/python-modules/kiwisolver/default.nix
@@ -4,30 +4,42 @@
 , stdenv
 , libcxx
 , cppy
+, setuptools-scm
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "kiwisolver";
-  version = "1.3.2";
+  version = "1.4.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fc4453705b81d03568d5b808ad8f09c77c47534f6ac2e72e733f9ca4714aa75c";
+    hash = "sha256-f2BtkbiogWvkdlE6d/0wq+ZiJwOb1vi0BsNIywJH3Mk=";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin [
+    "-I${lib.getDev libcxx}/include/c++/v1"
+  ];
 
   nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  buildInputs = [
     cppy
   ];
 
-  # Does not include tests
-  doCheck = false;
+  pythonImportsCheck = [
+    "kiwisolver"
+  ];
 
-  meta = {
-    description = "A fast implementation of the Cassowary constraint solver";
+  meta = with lib; {
+    description = "Implementation of the Cassowary constraint solver";
     homepage = "https://github.com/nucleic/kiwi";
-    license = lib.licenses.bsd3;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/kubernetes/default.nix b/pkgs/development/python-modules/kubernetes/default.nix
index 2342ec5bde4a8..10dccf684077d 100644
--- a/pkgs/development/python-modules/kubernetes/default.nix
+++ b/pkgs/development/python-modules/kubernetes/default.nix
@@ -11,7 +11,7 @@
 , python-dateutil
 , pyyaml
 , requests
-, requests_oauthlib
+, requests-oauthlib
 , urllib3
 , websocket-client
 
@@ -24,6 +24,7 @@ buildPythonPackage rec {
   pname = "kubernetes";
   version = "20.13.0";
   format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
@@ -41,7 +42,7 @@ buildPythonPackage rec {
     python-dateutil
     pyyaml
     requests
-    requests_oauthlib
+    requests-oauthlib
     urllib3
     websocket-client
   ];
@@ -61,7 +62,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Kubernetes python client";
+    description = "Kubernetes Python client";
     homepage = "https://github.com/kubernetes-client/python";
     license = licenses.asl20;
     maintainers = with maintainers; [ lsix ];
diff --git a/pkgs/development/python-modules/lmnotify/default.nix b/pkgs/development/python-modules/lmnotify/default.nix
index 4e5526a424dae..bf9d857dc74d2 100644
--- a/pkgs/development/python-modules/lmnotify/default.nix
+++ b/pkgs/development/python-modules/lmnotify/default.nix
@@ -3,28 +3,39 @@
 , fetchPypi
 , oauthlib
 , requests
-, requests_oauthlib
+, requests-oauthlib
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "lmnotify";
   version = "0.0.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-cCP7BU2f7QJe9gAI298cvkp3OGijvBv8G1RN7qfZ5PE=";
+    hash = "sha256-cCP7BU2f7QJe9gAI298cvkp3OGijvBv8G1RN7qfZ5PE=";
   };
 
-  propagatedBuildInputs = [ oauthlib requests requests_oauthlib ];
+  propagatedBuildInputs = [
+    oauthlib
+    requests
+    requests-oauthlib
+  ];
 
-  doCheck = false; # no tests exist
+  # Module has no tests
+  doCheck = false;
 
-  pythonImportsCheck = [ "lmnotify" ];
+  pythonImportsCheck = [
+    "lmnotify"
+  ];
 
   meta = with lib; {
     description = "Python package for sending notifications to LaMetric Time";
     homepage = "https://github.com/keans/lmnotify";
-    maintainers = with maintainers; [ rhoriguchi ];
     license = licenses.mit;
+    maintainers = with maintainers; [ rhoriguchi ];
   };
 }
diff --git a/pkgs/development/python-modules/mezzanine/default.nix b/pkgs/development/python-modules/mezzanine/default.nix
index 83085d76a367d..6607dc0739dec 100644
--- a/pkgs/development/python-modules/mezzanine/default.nix
+++ b/pkgs/development/python-modules/mezzanine/default.nix
@@ -1,38 +1,56 @@
 { lib
-
+, beautifulsoup4
+, bleach
 , buildPythonPackage
-, fetchPypi
-, isPyPy
-, pyflakes
-, pep8
+, chardet
 , django
 , django_contrib_comments
+, fetchPypi
 , filebrowser_safe
-, grappelli_safe
-, bleach
-, tzlocal
-, beautifulsoup4
-, requests
-, requests_oauthlib
 , future
+, grappelli_safe
+, isPyPy
+, pep8
 , pillow
-, chardet
+, pyflakes
+, pythonOlder
+, requests
+, requests-oauthlib
+, tzlocal
 }:
 
 buildPythonPackage rec {
+  pname = "mezzanine";
   version = "5.1.3";
-  pname = "Mezzanine";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6" || isPyPy;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-G/Oj5g70tFUhnbSVElVk0s9Ka+MEuPsEgj6blcFBOoY=";
+    pname = "Mezzanine";
+    inherit version;
+    hash = "sha256-G/Oj5g70tFUhnbSVElVk0s9Ka+MEuPsEgj6blcFBOoY=";
   };
 
-  disabled = isPyPy || lib.versionOlder django.version "1.11"
-    || lib.versionAtLeast django.version "2.0";
+  buildInputs = [
+    pyflakes
+    pep8
+  ];
 
-  buildInputs = [ pyflakes pep8 ];
-  propagatedBuildInputs = [ django django_contrib_comments filebrowser_safe grappelli_safe bleach tzlocal beautifulsoup4 requests requests_oauthlib future pillow chardet ];
+  propagatedBuildInputs = [
+    beautifulsoup4
+    bleach
+    chardet
+    django
+    django_contrib_comments
+    filebrowser_safe
+    future
+    grappelli_safe
+    pillow
+    requests
+    requests-oauthlib
+    tzlocal
+  ];
 
   # Tests Fail Due to Syntax Warning, Fixed for v3.1.11+
   doCheck = false;
@@ -41,12 +59,10 @@ buildPythonPackage rec {
     sed -i 's/==/>=/' setup.py
   '';
 
-  LC_ALL="en_US.UTF-8";
+  LC_ALL = "en_US.UTF-8";
 
   meta = with lib; {
-    description = ''
-      A content management platform built using the Django framework
-    '';
+    description = "Content management platform built using the Django framework";
     longDescription = ''
       Mezzanine is a powerful, consistent, and flexible content
       management platform. Built using the Django framework, Mezzanine
@@ -64,11 +80,9 @@ buildPythonPackage rec {
     '';
     homepage = "http://mezzanine.jupo.org/";
     downloadPage = "https://github.com/stephenmcd/mezzanine/releases";
-    license = licenses.free;
+    license = licenses.bsd2;
     maintainers = with maintainers; [ prikhi ];
     platforms = platforms.unix;
-    # mezzanine requires django-1.11. Consider overriding python package set to use django_1_11"
-    broken = versionOlder django.version "1.11" || versionAtLeast django.version "2.0";
   };
-
 }
+
diff --git a/pkgs/development/python-modules/msrest/default.nix b/pkgs/development/python-modules/msrest/default.nix
index 6eb6e49cdddae..da130f289fda6 100644
--- a/pkgs/development/python-modules/msrest/default.nix
+++ b/pkgs/development/python-modules/msrest/default.nix
@@ -1,51 +1,66 @@
 { lib
+, aiodns
+, aiohttp
 , buildPythonPackage
-, fetchFromGitHub
-, isPy3k
-, requests
-, requests_oauthlib
-, isodate
 , certifi
-, enum34 ? null
-, typing
-, aiohttp
-, aiodns
-, pytest
+, fetchFromGitHub
 , httpretty
-, mock
-, futures ? null
+, isodate
+, pytest-aiohttp
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-oauthlib
 , trio
 }:
 
 buildPythonPackage rec {
-  version = "0.6.21";
   pname = "msrest";
+  version = "0.6.21";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # no tests in PyPI tarball
-  # see https://github.com/Azure/msrest-for-python/pull/152
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "msrest-for-python";
     rev = "v${version}";
-    sha256 = "sha256-IlBwlVQ/v+vJmCWNbFZKGL6a9K09z4AYrPm3kwaA/nI=";
+    hash = "sha256-IlBwlVQ/v+vJmCWNbFZKGL6a9K09z4AYrPm3kwaA/nI=";
   };
 
   propagatedBuildInputs = [
-    requests requests_oauthlib isodate certifi
-  ] ++ lib.optionals (!isPy3k) [ enum34 typing ]
-    ++ lib.optionals isPy3k [ aiohttp aiodns ];
+    aiodns
+    aiohttp
+    certifi
+    isodate
+    requests
+    requests-oauthlib
+  ];
+
+  checkInputs = [
+    httpretty
+    pytest-aiohttp
+    pytestCheckHook
+    trio
+  ];
 
-  checkInputs = [ pytest httpretty ]
-    ++ lib.optionals (!isPy3k) [ mock futures ]
-    ++ lib.optional isPy3k trio;
+  disabledTests = [
+    # Test require network access
+    "test_basic_aiohttp"
+    "test_basic_aiohttp"
+    "test_basic_async_requests"
+    "test_basic_async_requests"
+    "test_conf_async_requests"
+    "test_conf_async_requests"
+    "test_conf_async_trio_requests"
+  ];
 
-  # Deselected tests require network access
-  checkPhase = ''
-    pytest tests/ -k "not test_conf_async_trio_requests"
-  '';
+  pythonImportsCheck = [
+    "msrest"
+  ];
 
   meta = with lib; {
-    description = "The runtime library 'msrest' for AutoRest generated Python clients.";
+    description = "The runtime library for AutoRest generated Python clients";
     homepage = "https://github.com/Azure/msrest-for-python";
     license = licenses.mit;
     maintainers = with maintainers; [ bendlas jonringer maxwilson ];
diff --git a/pkgs/development/python-modules/mwclient/default.nix b/pkgs/development/python-modules/mwclient/default.nix
index bffc4247632d7..da260251e9f2b 100644
--- a/pkgs/development/python-modules/mwclient/default.nix
+++ b/pkgs/development/python-modules/mwclient/default.nix
@@ -1,11 +1,21 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, requests, requests_oauthlib, six
-, pytest, pytestcache, pytest-cov, responses, mock
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, mock
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-oauthlib
+, responses
+, six
 }:
 
 buildPythonPackage rec {
   version = "0.10.1";
   pname = "mwclient";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "mwclient";
@@ -14,17 +24,31 @@ buildPythonPackage rec {
     sha256 = "120snnsh9n5svfwkyj1w9jrxf99jnqm0jk282yypd3lpyca1l9hj";
   };
 
-  checkInputs = [ pytest pytestcache pytest-cov responses mock ];
+  propagatedBuildInputs = [
+    requests
+    requests-oauthlib
+    six
+  ];
 
-  propagatedBuildInputs = [ requests requests_oauthlib six ];
+  checkInputs = [
+    mock
+    pytestCheckHook
+    responses
+  ];
 
-  checkPhase = ''
-    py.test
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace " --cov mwclient test" ""
   '';
 
+  pythonImportsCheck = [
+    "mwclient"
+  ];
+
   meta = with lib; {
     description = "Python client library to the MediaWiki API";
     license = licenses.mit;
     homepage = "https://github.com/mwclient/mwclient";
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/mwoauth/default.nix b/pkgs/development/python-modules/mwoauth/default.nix
index 8743329917e72..0a12052abc7e0 100644
--- a/pkgs/development/python-modules/mwoauth/default.nix
+++ b/pkgs/development/python-modules/mwoauth/default.nix
@@ -1,40 +1,47 @@
 { lib
 , buildPythonPackage
-, six
+, fetchPypi
+, oauthlib
 , pyjwt
+, pythonOlder
 , requests
-, oauthlib
-, requests_oauthlib
-, fetchPypi
+, requests-oauthlib
+, six
 }:
 
 buildPythonPackage rec {
   pname = "mwoauth";
   version = "0.3.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9e0d70a1fa6f452584de1cb853ae6c11f41233549f7839cfb879f99410f6ad46";
+    hash = "sha256-ng1wofpvRSWE3hy4U65sEfQSM1SfeDnPuHn5lBD2rUY=";
   };
 
   propagatedBuildInputs = [
     oauthlib
     pyjwt
     requests
-    requests_oauthlib
+    requests-oauthlib
     six
   ];
 
   postPatch = ''
     # https://github.com/mediawiki-utilities/python-mwoauth/pull/43
-    substituteInPlace setup.py --replace "PyJWT>=1.0.1,<2.0.0" "PyJWT>=1.0.1"
+    substituteInPlace setup.py \
+      --replace "PyJWT>=1.0.1,<2.0.0" "PyJWT>=1.0.1"
   '';
 
   # PyPI source has no tests included
   # https://github.com/mediawiki-utilities/python-mwoauth/issues/44
   doCheck = false;
 
-  pythonImportsCheck = [ "mwoauth" ];
+  pythonImportsCheck = [
+    "mwoauth"
+  ];
 
   meta = with lib; {
     description = "Python library to perform OAuth handshakes with a MediaWiki installation";
diff --git a/pkgs/development/python-modules/ondilo/default.nix b/pkgs/development/python-modules/ondilo/default.nix
index 271243ab791e1..c766e2cb158d9 100644
--- a/pkgs/development/python-modules/ondilo/default.nix
+++ b/pkgs/development/python-modules/ondilo/default.nix
@@ -4,30 +4,35 @@
 , oauthlib
 , pythonOlder
 , requests
-, requests_oauthlib
+, requests-oauthlib
 }:
 
 buildPythonPackage rec {
   pname = "ondilo";
   version = "0.3.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "JeromeHXP";
     repo = pname;
     rev = version;
-    sha256 = "sha256-MI6K+41I/IVi+GRBdmRIHbljULDFLAwpo3W8tdxCOBM=";
+    hash = "sha256-MI6K+41I/IVi+GRBdmRIHbljULDFLAwpo3W8tdxCOBM=";
   };
 
   propagatedBuildInputs = [
     oauthlib
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "ondilo" ];
+
+  pythonImportsCheck = [
+    "ondilo"
+  ];
 
   meta = with lib; {
     description = "Python package to access Ondilo ICO APIs";
diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index 648a548e521b5..69457e2a5569e 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -2,40 +2,44 @@
 , buildPythonPackage
 , fetchPypi
 , pyparsing
-, six
 , pytestCheckHook
 , pretend
 , setuptools
 }:
 
-buildPythonPackage rec {
-  pname = "packaging";
-  version = "21.3";
-  format = "pyproject";
+let
+  packaging = buildPythonPackage rec {
+    pname = "packaging";
+    version = "21.3";
+    format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-3UfEKSfYmrkR5gZRiQfMLTofOLvQJjhZcGQ/nFuOz+s=";
-  };
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "sha256-3UfEKSfYmrkR5gZRiQfMLTofOLvQJjhZcGQ/nFuOz+s=";
+    };
+
+    nativeBuildInputs = [
+      setuptools
+    ];
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+    propagatedBuildInputs = [ pyparsing ];
 
-  propagatedBuildInputs = [ pyparsing six ];
+    checkInputs = [
+      pytestCheckHook
+      pretend
+    ];
 
-  checkInputs = [
-    pytestCheckHook
-    pretend
-  ];
+    # Prevent circular dependency
+    doCheck = false;
 
-  # Prevent circular dependency
-  doCheck = false;
+    passthru.tests = packaging.overridePythonAttrs (_: { doCheck = true; });
 
-  meta = with lib; {
-    description = "Core utilities for Python packages";
-    homepage = "https://github.com/pypa/packaging";
-    license = [ licenses.bsd2 licenses.asl20 ];
-    maintainers = with maintainers; [ bennofs ];
+    meta = with lib; {
+      description = "Core utilities for Python packages";
+      homepage = "https://github.com/pypa/packaging";
+      license = with licenses; [ bsd2 asl20 ];
+      maintainers = with maintainers; [ bennofs ];
+    };
   };
-}
+in
+packaging
diff --git a/pkgs/development/python-modules/pleroma-bot/default.nix b/pkgs/development/python-modules/pleroma-bot/default.nix
index 1dca45eca762b..ed586a4474b8b 100644
--- a/pkgs/development/python-modules/pleroma-bot/default.nix
+++ b/pkgs/development/python-modules/pleroma-bot/default.nix
@@ -4,30 +4,45 @@
 , pytestCheckHook
 , requests-mock
 , oauthlib
-, requests_oauthlib
+, requests-oauthlib
 , requests
 , pyaml
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pleroma-bot";
   version = "0.8.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "robertoszek";
-    repo = "pleroma-bot";
+    repo = pname;
     rev = version;
-    sha256 = "1q0xhgqq41zbqiawpd4kbdx41zhwxxp5ipn1c2rc8d7pjyb5p75w";
+    hash = "sha256-vJxblpf3NMSyYMHeWG7vHP5AeluTtMtVxOsHgvGDHeA=";
   };
 
-  propagatedBuildInputs = [ pyaml requests requests_oauthlib oauthlib ];
-  checkInputs = [ pytestCheckHook requests-mock ];
+  propagatedBuildInputs = [
+    pyaml
+    requests
+    requests-oauthlib
+    oauthlib
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    requests-mock
+  ];
 
-  pythonImportsCheck = [ "pleroma_bot" ];
+  pythonImportsCheck = [
+    "pleroma_bot"
+  ];
 
   meta = with lib; {
-    homepage = "https://robertoszek.github.io/pleroma-bot/";
     description = "Bot for mirroring one or multiple Twitter accounts in Pleroma/Mastodon";
+    homepage = "https://robertoszek.github.io/pleroma-bot/";
     license = licenses.mit;
     maintainers = with maintainers; [ robertoszek ];
   };
diff --git a/pkgs/development/python-modules/psautohint/default.nix b/pkgs/development/python-modules/psautohint/default.nix
index 3004d5f7a9b92..b9fb5f3aa146a 100644
--- a/pkgs/development/python-modules/psautohint/default.nix
+++ b/pkgs/development/python-modules/psautohint/default.nix
@@ -3,19 +3,20 @@
 , lxml, fs # for fonttools extras
 , setuptools-scm
 , pytestCheckHook, pytest-cov, pytest-xdist
+, runAllTests ? false, psautohint # for passthru.tests
 }:
 
 buildPythonPackage rec {
   pname = "psautohint";
-  version = "2.3.1";
+  version = "2.4.0";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "adobe-type-tools";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1knh428af0lvzijvd72i30jcvx9n6ga0hai69kxg8386jdpmmvkg";
+    sha256 = "125nx7accvbk626qlfar90va1995kp9qfrz6a978q4kv2kk37xai";
     fetchSubmodules = true; # data dir for tests
   };
 
@@ -34,10 +35,7 @@ buildPythonPackage rec {
     pytest-cov
     pytest-xdist
   ];
-  disabledTests = [
-    # Test that fails on pytest >= v6
-    # https://github.com/adobe-type-tools/psautohint/issues/284#issuecomment-742800965
-    "test_hashmap_old_version"
+  disabledTests = lib.optionals (!runAllTests) [
     # Slow tests, reduces test time from ~5 mins to ~30s
     "test_mmufo"
     "test_flex_ufo"
@@ -48,6 +46,10 @@ buildPythonPackage rec {
     "test_otf"
   ];
 
+  passthru.tests = {
+    fullTestsuite = psautohint.override { runAllTests = true; };
+  };
+
   meta = with lib; {
     description = "Script to normalize the XML and other data inside of a UFO";
     homepage = "https://github.com/adobe-type-tools/psautohint";
diff --git a/pkgs/development/python-modules/pyasn1/default.nix b/pkgs/development/python-modules/pyasn1/default.nix
index a0037d6468353..a3dbc7396b0d3 100644
--- a/pkgs/development/python-modules/pyasn1/default.nix
+++ b/pkgs/development/python-modules/pyasn1/default.nix
@@ -9,10 +9,12 @@ buildPythonPackage rec {
     sha256 = "aef77c9fb94a3ac588e87841208bdec464471d9871bd5050a287cc9a475cd0ba";
   };
 
+  pythonImportsCheck = [ "pyasn1" ];
+
   meta = with lib; {
-    description = "ASN.1 tools for Python";
-    homepage = "http://pyasn1.sourceforge.net/";
-    license = "mBSD";
-    platforms = platforms.unix;  # arbitrary choice
+    description = "Generic ASN.1 library for Python";
+    homepage = "https://github.com/etingof/pyasn1";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 5cd314b6cb993..9d75c2b01d85f 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -9,7 +9,7 @@
 , pytestCheckHook
 , pythonOlder
 , requests
-, requests_oauthlib
+, requests-oauthlib
 , requests-mock
 , setuptools-scm
 }:
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     aiohttp
     oauthlib
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pybotvac/default.nix b/pkgs/development/python-modules/pybotvac/default.nix
index dff1374087a5b..2feee74d319f8 100644
--- a/pkgs/development/python-modules/pybotvac/default.nix
+++ b/pkgs/development/python-modules/pybotvac/default.nix
@@ -2,29 +2,35 @@
 , buildPythonPackage
 , fetchPypi
 , requests
-, requests_oauthlib
+, requests-oauthlib
 , voluptuous
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pybotvac";
   version = "0.0.23";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "54b4fe565c10000c54d5644d081e2de1f850daefbac39cea74cea649b47bfb12";
+    hash = "sha256-VLT+VlwQAAxU1WRNCB4t4fhQ2u+6w5zqdM6mSbR7+xI=";
   };
 
   propagatedBuildInputs = [
     requests
-    requests_oauthlib
+    requests-oauthlib
     voluptuous
   ];
 
   # no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "pybotvac" ];
+  pythonImportsCheck = [
+    "pybotvac"
+  ];
 
   meta = with lib; {
     description = "Python module for interacting with Neato Botvac Connected vacuum robots";
diff --git a/pkgs/development/python-modules/pycep-parser/default.nix b/pkgs/development/python-modules/pycep-parser/default.nix
index d76f72630a6ba..4d18066ed8c2e 100644
--- a/pkgs/development/python-modules/pycep-parser/default.nix
+++ b/pkgs/development/python-modules/pycep-parser/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pycep-parser";
-  version = "0.3.2";
+  version = "0.3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "gruebel";
     repo = "pycep";
     rev = version;
-    hash = "sha256-ud26xJQWdu7wtv75/K16HSSw0MvaSr3H1hDZBPjSzYE=";
+    hash = "sha256-7WnAP2NU923fBN1wy44OAiLA1UxKkM8jc/rLHwutAas=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,6 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'version = "0.3.2-alpha.4"' 'version = "${version}"' \
       --replace 'regex = "^2022.3.2"' 'regex = "*"'
   '';
 
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 3585148b31c02..1bdd4f3398857 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -71,12 +71,17 @@ buildPythonPackage rec {
     "test_libcurl_ssl_gnutls"
     # AssertionError: assert 'crypto' in ['curl']
     "test_ssl_in_static_libs"
+    # pycurl.error: (27, '')
+    "test_getinfo_raw_certinfo"
+    "test_request_with_certinfo"
+    "test_request_with_verifypeer"
+    "test_request_without_certinfo"
   ];
 
   meta = with lib; {
     homepage = "http://pycurl.io/";
     description = "Python Interface To The cURL library";
     license = with licenses; [ lgpl2Only mit ];
-    maintainers = with maintainers; [];
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/pymfy/default.nix b/pkgs/development/python-modules/pymfy/default.nix
index ab5b21e8881d8..e48966e9da064 100644
--- a/pkgs/development/python-modules/pymfy/default.nix
+++ b/pkgs/development/python-modules/pymfy/default.nix
@@ -6,13 +6,14 @@
 , pytestCheckHook
 , pythonOlder
 , requests
-, requests_oauthlib
+, requests-oauthlib
 }:
 
 buildPythonPackage rec {
   pname = "pymfy";
   version = "0.11.0";
   format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
@@ -22,11 +23,13 @@ buildPythonPackage rec {
     sha256 = "0wpjwjmywfyqgwvfa5kwcjpaljc32qa088kk88nl9nqdvc31mzhv";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   propagatedBuildInputs = [
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   checkInputs = [
@@ -34,7 +37,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pymfy" ];
+  pythonImportsCheck = [
+    "pymfy"
+  ];
 
   meta = with lib; {
     description = "Python client for the Somfy Open API";
diff --git a/pkgs/development/python-modules/pynello/default.nix b/pkgs/development/python-modules/pynello/default.nix
index 43852cbcd4c24..a7a75d7c5ddd3 100644
--- a/pkgs/development/python-modules/pynello/default.nix
+++ b/pkgs/development/python-modules/pynello/default.nix
@@ -4,7 +4,7 @@
 , python-dateutil
 , pythonOlder
 , requests
-, requests_oauthlib
+, requests-oauthlib
 }:
 
 buildPythonPackage rec {
@@ -18,19 +18,21 @@ buildPythonPackage rec {
     owner = "pschmitt";
     repo = pname;
     rev = version;
-    sha256 = "015rlccsn2vff9if82rjj2fza3bjbmawqhamc22wq40gq7pbfk5i";
+    hash = "sha256-sUy37sEPEMyFYFVBzFVdcg31nZAyC+Ricm4LqxmjuQQ=";
   };
 
   propagatedBuildInputs = [
     python-dateutil
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "pynello" ];
+  pythonImportsCheck = [
+    "pynello"
+  ];
 
   meta = with lib; {
     description = "Python library for nello.io intercoms";
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index e4655082af92b..d629d97637fa7 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -4,13 +4,9 @@
 , fetchPypi
 , openssl
 , cryptography
-, pyasn1
-, idna
 , pytestCheckHook
 , pretend
 , flaky
-, glibcLocales
-, six
 }:
 
 buildPythonPackage rec {
@@ -30,9 +26,9 @@ buildPythonPackage rec {
   doCheck = !stdenv.isDarwin;
 
   nativeBuildInputs = [ openssl ];
-  propagatedBuildInputs = [ cryptography pyasn1 idna six ];
+  propagatedBuildInputs = [ cryptography ];
 
-  checkInputs = [ pytestCheckHook pretend flaky glibcLocales ];
+  checkInputs = [ pytestCheckHook pretend flaky ];
 
   preCheck = ''
     export LANG="en_US.UTF-8"
diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
index 449c5334e6640..fb5abc5c3522b 100644
--- a/pkgs/development/python-modules/pyparsing/default.nix
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -5,6 +5,7 @@
 # since this is a dependency of pytest, we need to avoid
 # circular dependencies
 , jinja2
+, pytestCheckHook
 , railroad-diagrams
 }:
 
@@ -24,12 +25,11 @@ let
     doCheck = false;
     checkInputs = [
       jinja2
+      pytestCheckHook
       railroad-diagrams
     ];
 
-    checkPhase = ''
-      python -m unittest
-    '';
+    pythonImportsCheck = [ "pyparsing" ];
 
     passthru.tests = {
       check = pyparsing.overridePythonAttrs (_: { doCheck = true; });
@@ -39,9 +39,7 @@ let
       homepage = "https://github.com/pyparsing/pyparsing";
       description = "An alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions";
       license = licenses.mit;
-      maintainers = with maintainers; [
-        kamadorueda
-      ];
+      maintainers = with maintainers; [ kamadorueda ];
     };
   };
 in
diff --git a/pkgs/development/python-modules/pysmappee/default.nix b/pkgs/development/python-modules/pysmappee/default.nix
index c2322819ae459..ae9d5fa983040 100644
--- a/pkgs/development/python-modules/pysmappee/default.nix
+++ b/pkgs/development/python-modules/pysmappee/default.nix
@@ -1,25 +1,27 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
 , cachetools
+, fetchFromGitHub
 , paho-mqtt
+, pythonOlder
 , pytz
 , requests
-, requests_oauthlib
+, requests-oauthlib
 , schedule
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pysmappee";
   version = "0.2.29";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "smappee";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ffi55FZsZUKDcS4qV46NpRK3VP6axzrL2BO+hYW7J9E=";
+    hash = "sha256-Ffi55FZsZUKDcS4qV46NpRK3VP6axzrL2BO+hYW7J9E=";
   };
 
   propagatedBuildInputs = [
@@ -27,14 +29,16 @@ buildPythonPackage rec {
     paho-mqtt
     pytz
     requests
-    requests_oauthlib
+    requests-oauthlib
     schedule
   ];
 
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "pysmappee" ];
+  pythonImportsCheck = [
+    "pysmappee"
+  ];
 
   meta = with lib; {
     description = "Python Library for the Smappee dev API";
diff --git a/pkgs/development/python-modules/pysnow/default.nix b/pkgs/development/python-modules/pysnow/default.nix
index 1c9fccb706875..5baa9e9032159 100644
--- a/pkgs/development/python-modules/pysnow/default.nix
+++ b/pkgs/development/python-modules/pysnow/default.nix
@@ -1,56 +1,72 @@
 { lib
+, brotli
 , buildPythonPackage
 , fetchFromGitHub
-, poetry
-, brotli
-, ijson
-, nose
+, fetchpatch
 , httpretty
-, requests_oauthlib
+, ijson
+, poetry-core
 , python_magic
 , pytz
+, pytestCheckHook
+, requests-oauthlib
 }:
 
 buildPythonPackage rec {
   pname = "pysnow";
   version = "0.7.16";
+  format = "pyproject";
+
 
-  # tests not included in pypi tarball
   src = fetchFromGitHub {
     owner = "rbw";
     repo = pname;
     rev = version;
-    sha256 = "0dj90w742klfcjnx7yhp0nzki2mzafqzzr0rk2dp6vxn8h58z8ww";
+    hash = "sha256-nKOPCkS2b3ObmBnk/7FTv4o4vwUX+tOtZI5OQQ4HSTY=";
   };
-  format = "pyproject";
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'ijson = "^2.5.1"' 'ijson = "*"' \
-      --replace 'pytz = "^2019.3"' 'pytz = "*"' \
-      --replace 'oauthlib = "^3.1.0"' 'oauthlib = "*"'
-  '';
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
-  nativeBuildInputs = [ poetry ];
   propagatedBuildInputs = [
     brotli
     ijson
     python_magic
     pytz
-    requests_oauthlib
+    requests-oauthlib
+  ];
+
+  checkInputs = [
+    httpretty
+    pytestCheckHook
   ];
 
-  checkInputs = [ nose httpretty ];
-  checkPhase = ''
-    nosetests --cover-package=pysnow --with-coverage --cover-erase
+  patches = [
+    # Switch to peotry-core, https://github.com/rbw/pysnow/pull/183
+    (fetchpatch {
+      name = "switch-to-poetry-core.patch";
+      url = "https://github.com/rbw/pysnow/commit/f214a203432b329df5317f3a25b2c0d9b55a9029.patch";
+      sha256 = "sha256-ViRR+9WStlaQwyrLGk/tMOUAcEMY+kB61ZEKGMQJ30o=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'ijson = "^2.5.1"' 'ijson = "*"' \
+      --replace 'pytz = "^2019.3"' 'pytz = "*"' \
+      --replace 'oauthlib = "^3.1.0"' 'oauthlib = "*"'
   '';
-  pythonImportsCheck = [ "pysnow" ];
+
+  pythonImportsCheck = [
+    "pysnow"
+  ];
 
   meta = with lib; {
     description = "ServiceNow HTTP client library written in Python";
     homepage = "https://github.com/rbw/pysnow";
     license = licenses.mit;
-    maintainers = [ maintainers.almac ];
+    maintainers = with maintainers; [ almac ];
   };
 
 }
diff --git a/pkgs/development/python-modules/python-google-nest/default.nix b/pkgs/development/python-modules/python-google-nest/default.nix
index a1e612e1f74e4..3d086fa2684e9 100644
--- a/pkgs/development/python-modules/python-google-nest/default.nix
+++ b/pkgs/development/python-modules/python-google-nest/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, requests_oauthlib
+, requests-oauthlib
 }:
 
 buildPythonPackage rec {
@@ -14,11 +14,11 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "y3BOhorVkJ3rFPifNOopLMqk6y1fHX5vxHGiqWvWHhE=";
+    hash = "sha256-y3BOhorVkJ3rFPifNOopLMqk6y1fHX5vxHGiqWvWHhE=";
   };
 
   propagatedBuildInputs = [
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   # Project has no tests
diff --git a/pkgs/development/python-modules/python-twitter/default.nix b/pkgs/development/python-modules/python-twitter/default.nix
index f6814a8d0fda7..79d262a8b02a9 100644
--- a/pkgs/development/python-modules/python-twitter/default.nix
+++ b/pkgs/development/python-modules/python-twitter/default.nix
@@ -2,20 +2,23 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
-, pytest-runner
+, filetype
 , future
+, hypothesis
+, pytestCheckHook
+, pythonOlder
 , requests
+, requests-oauthlib
 , responses
-, requests_oauthlib
-, pytest
-, hypothesis
 }:
 
 buildPythonPackage rec {
   pname = "python-twitter";
   version = "3.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
-  # No tests in PyPi Tarball
   src = fetchFromGitHub {
     owner = "bear";
     repo = pname;
@@ -31,12 +34,30 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = [ pytest-runner ];
-  propagatedBuildInputs = [ future requests requests_oauthlib ];
-  checkInputs = [ pytest responses hypothesis ];
+  propagatedBuildInputs = [
+    filetype
+    future
+    requests
+    requests-oauthlib
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    responses
+    hypothesis
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pytest-runner'" ""
+  '';
+
+  pythonImportsCheck = [
+    "twitter"
+  ];
 
   meta = with lib; {
-    description = "A Python wrapper around the Twitter API";
+    description = "Python wrapper around the Twitter API";
     homepage = "https://github.com/bear/python-twitter";
     license = licenses.asl20;
     maintainers = [ maintainers.marsam ];
diff --git a/pkgs/development/python-modules/pyvicare/default.nix b/pkgs/development/python-modules/pyvicare/default.nix
index bd3daf7bfb0e2..379481953ee9c 100644
--- a/pkgs/development/python-modules/pyvicare/default.nix
+++ b/pkgs/development/python-modules/pyvicare/default.nix
@@ -1,11 +1,11 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
-, requests_oauthlib
-, simplejson
 , pkce
 , pytestCheckHook
+, pythonOlder
+, requests-oauthlib
+, simplejson
 }:
 
 buildPythonPackage rec {
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   propagatedBuildInputs = [
-    requests_oauthlib
+    requests-oauthlib
     simplejson
     pkce
   ];
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index 512a7162f0e3c..829dd9e7e6a1c 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2022.3.2";
+  version = "2022.3.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eeWvH/JYvA/gvdb2m8SuM5NaiY48vvu8zyLoiif6BTs=";
+    hash = "sha256-Cnt1zHu0zAM0OABT5GccVg4xJyydLVpsS46a4sm9D4I=";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 86b2c2ffc3902..0e823536f5415 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -30,21 +30,15 @@ buildPythonPackage rec {
     ./0001-Prefer-NixOS-Nix-default-CA-bundles-over-certifi.patch
   ];
 
-  postPatch = ''
-    # Use latest idna
-    substituteInPlace setup.py \
-      --replace ",<3" ""
-  '';
-
   propagatedBuildInputs = [
     certifi
     idna
     urllib3
     chardet
-  ] ++ lib.optionals (isPy3k) [
+  ] ++ lib.optionals isPy3k [
     brotlicffi
     charset-normalizer
-  ] ++ lib.optionals (isPy27) [
+  ] ++ lib.optionals isPy27 [
     brotli
   ];
 
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index 95861bda181c9..7f9372dcdb719 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pytest-localserver
 , pytestCheckHook
 , pythonOlder
@@ -10,14 +10,16 @@
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.18.0";
+  version = "0.20.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-OAytTBwdyULl6KjqrgtNTt9wj08BDbi3vPr60fzSVP8=";
+  src = fetchFromGitHub {
+    owner = "getsentry";
+    repo = pname;
+    rev = version;
+    hash = "sha256-dhIKMQXBJfZGIanJN1bFmlr/FYL1UYgYKGYaSznKhZs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ring-doorbell/default.nix b/pkgs/development/python-modules/ring-doorbell/default.nix
index 968182f8535fd..bffa6fed7d122 100644
--- a/pkgs/development/python-modules/ring-doorbell/default.nix
+++ b/pkgs/development/python-modules/ring-doorbell/default.nix
@@ -1,31 +1,33 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
 , oauthlib
 , pytestCheckHook
+, pythonOlder
 , pytz
 , requests
 , requests-mock
-, requests_oauthlib
+, requests-oauthlib
 }:
 
 buildPythonPackage rec {
   pname = "ring-doorbell";
   version = "0.7.2";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "ring_doorbell";
     inherit version;
-    sha256 = "0a7e82abf27086843eb39c0279f5dfccea6751ff848560e67154ca6fbfa4ef2b";
+    hash = "sha256-Cn6Cq/JwhoQ+s5wCefXfzOpnUf+EhWDmcVTKb7+k7ys=";
   };
 
   propagatedBuildInputs = [
     oauthlib
     pytz
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   checkInputs = [
@@ -33,11 +35,13 @@ buildPythonPackage rec {
     requests-mock
   ];
 
-  pythonImportsCheck = [ "ring_doorbell" ];
+  pythonImportsCheck = [
+    "ring_doorbell"
+  ];
 
   meta = with lib; {
+    description = "Python library to communicate with Ring Door Bell";
     homepage = "https://github.com/tchellomello/python-ring-doorbell";
-    description = "A Python library to communicate with Ring Door Bell (https://ring.com/)";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ graham33 ];
   };
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index 2ab609c7d0c1e..24c60839fe0bd 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -12,17 +12,17 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.1.2";
+  version = "1.2.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a0adb9b503c0ffc4e8fe80b7c617898cefa78049983aaaea7f747e153a3e65d1";
+    sha256 = "sha256-CkraR56Mfj2L18tW4aKazCsruYwjJQUbDNy1fX8Fbeg=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  propagatedBuildInputs = [ semantic-version setuptools toml typing-extensions ];
+  propagatedBuildInputs = [ semantic-version setuptools typing-extensions ];
 
   doCheck = false;
   pythonImportsCheck = [ "setuptools_rust" ];
diff --git a/pkgs/development/python-modules/social-auth-core/default.nix b/pkgs/development/python-modules/social-auth-core/default.nix
index ede138218e010..667c4ec4245a9 100644
--- a/pkgs/development/python-modules/social-auth-core/default.nix
+++ b/pkgs/development/python-modules/social-auth-core/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , requests
 , oauthlib
-, requests_oauthlib
+, requests-oauthlib
 , pyjwt
 , cryptography
 , defusedxml
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     requests
     oauthlib
-    requests_oauthlib
+    requests-oauthlib
     pyjwt
     cryptography
     defusedxml
diff --git a/pkgs/development/python-modules/sortedcontainers/default.nix b/pkgs/development/python-modules/sortedcontainers/default.nix
index 8920336f8db81..4edd68f1f07db 100644
--- a/pkgs/development/python-modules/sortedcontainers/default.nix
+++ b/pkgs/development/python-modules/sortedcontainers/default.nix
@@ -1,24 +1,39 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pytestCheckHook
 }:
 
-buildPythonPackage rec {
-  pname = "sortedcontainers";
-  version = "2.4.0";
+let
+  sortedcontainers = buildPythonPackage rec {
+    pname = "sortedcontainers";
+    version = "2.4.0";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88";
-  };
+    src = fetchFromGitHub {
+      owner = "grantjenks";
+      repo = "python-sortedcontainers";
+      rev = "v${version}";
+      sha256 = "sha256-YRbSM2isWi7AzfquFvuZBlpEMNUnBJTBLBn0/XYVHKQ=";
+    };
+
+    doCheck = false;
+
+    checkInputs = [
+      pytestCheckHook
+    ];
+
+    pythonImportsCheck = [ "sortedcontainers" ];
 
-  # pypi tarball does not come with tests
-  doCheck = false;
+    passthru.tests = {
+      pytest = sortedcontainers.overridePythonAttrs (_: { doCheck = true; });
+    };
 
-  meta = {
-    description = "Python Sorted Container Types: SortedList, SortedDict, and SortedSet";
-    homepage = "http://www.grantjenks.com/docs/sortedcontainers/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ costrouc ];
+    meta = with lib; {
+      description = "Python Sorted Container Types: SortedList, SortedDict, and SortedSet";
+      homepage = "https://grantjenks.com/docs/sortedcontainers/";
+      license = licenses.asl20;
+      maintainers = with maintainers; [ SuperSandro2000 ];
+    };
   };
-}
+in
+sortedcontainers
diff --git a/pkgs/development/python-modules/tellduslive/default.nix b/pkgs/development/python-modules/tellduslive/default.nix
index 5a6a84af8392b..f933553dcdbe7 100644
--- a/pkgs/development/python-modules/tellduslive/default.nix
+++ b/pkgs/development/python-modules/tellduslive/default.nix
@@ -3,12 +3,16 @@
 , docopt
 , fetchFromGitHub
 , requests
-, requests_oauthlib
+, requests-oauthlib
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "tellduslive";
   version = "0.10.11";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "molobrakos";
@@ -20,12 +24,15 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     docopt
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "tellduslive" ];
+
+  pythonImportsCheck = [
+    "tellduslive"
+  ];
 
   meta = with lib; {
     description = "Python module to communicate with Telldus Live";
diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index 893943cbc7201..4519641c4820e 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -2,28 +2,34 @@
 , python
 , buildPythonPackage
 , fetchPypi
+, pycares
+, pycurl
+, twisted
 }:
 
 buildPythonPackage rec {
   pname = "tornado";
   version = "6.1";
 
-  # We specify the name of the test files to prevent
-  # https://github.com/NixOS/nixpkgs/issues/14634
-  checkPhase = ''
-    ${python.interpreter} -m unittest discover *_test.py
-  '';
-
   src = fetchPypi {
     inherit pname version;
     sha256 = "33c6e81d7bd55b468d2e793517c909b139960b6c790a60b7991b9b6b76fb9791";
   };
 
+  checkInputs = [
+    pycares
+    pycurl
+    twisted
+  ];
+
+  pythonImportsCheck = [ "tornado" ];
+
   __darwinAllowLocalNetworking = true;
 
-  meta = {
+  meta = with lib; {
     description = "A web framework and asynchronous networking library";
     homepage = "https://www.tornadoweb.org/";
-    license = lib.licenses.asl20;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/tweepy/default.nix b/pkgs/development/python-modules/tweepy/default.nix
index c97fd85a8be48..518aa8c043566 100644
--- a/pkgs/development/python-modules/tweepy/default.nix
+++ b/pkgs/development/python-modules/tweepy/default.nix
@@ -3,11 +3,11 @@
 , buildPythonPackage
 , fetchFromGitHub
 , oauthlib
-, requests
+, pytestCheckHook
 , pythonOlder
+, requests
+, requests-oauthlib
 , vcrpy
-, pytestCheckHook
-, requests_oauthlib
 }:
 
 buildPythonPackage rec {
@@ -21,14 +21,14 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7ogsocRTMTO5yegyY7BADu9NrHK7zMMbihBu8oF4UlQ=";
+    hash = "sha256-GUo8uvShyIOWWcO5T1JvV7DMC1W70YILx/hvHIGQg0o=";
   };
 
   propagatedBuildInputs = [
     aiohttp
     oauthlib
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 4641e4af40464..e78d06eb7bacf 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   # Patch t.p._inotify to point to libc. Without this,
   # twisted.python.runtime.platform.supportsINotify() == False
-  patchPhase = lib.optionalString stdenv.isLinux ''
+  postPatch = lib.optionalString stdenv.isLinux ''
     substituteInPlace src/twisted/python/_inotify.py --replace \
       "ctypes.util.find_library(\"c\")" "'${stdenv.glibc.out}/lib/libc.so.6'"
   '';
@@ -45,13 +45,13 @@ buildPythonPackage rec {
   '';
 
   checkPhase = ''
-    ${python.interpreter} -m unittest discover -s twisted/test
+    ${python.interpreter} -m unittest discover -s src/twisted/test
   '';
   # Tests require network
   doCheck = false;
 
   meta = with lib; {
-    homepage = "https://twistedmatrix.com/";
+    homepage = "https://github.com/twisted/twisted";
     description = "Twisted, an event-driven networking engine written in Python";
     longDescription = ''
       Twisted is an event-driven networking engine written in Python
diff --git a/pkgs/development/python-modules/twitterapi/default.nix b/pkgs/development/python-modules/twitterapi/default.nix
index acaf3bf640e5f..313249e50d9cf 100644
--- a/pkgs/development/python-modules/twitterapi/default.nix
+++ b/pkgs/development/python-modules/twitterapi/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , requests
-, requests_oauthlib
+, requests-oauthlib
 , pythonOlder
 }:
 
@@ -17,12 +17,12 @@ buildPythonPackage rec {
     owner = "geduldig";
     repo = "TwitterAPI";
     rev = "v${version}";
-    sha256 = "sha256-WqeoIZt2OGDXKPAbjm3cHI1kgiCEJC6+ROXXx4TR4b4=";
+    hash = "sha256-WqeoIZt2OGDXKPAbjm3cHI1kgiCEJC6+ROXXx4TR4b4=";
   };
 
   propagatedBuildInputs = [
     requests
-    requests_oauthlib
+    requests-oauthlib
   ];
 
   # Tests are interacting with the Twitter API
diff --git a/pkgs/development/python-modules/vdirsyncer/default.nix b/pkgs/development/python-modules/vdirsyncer/default.nix
index edb61ccb70341..52418b8fd24eb 100644
--- a/pkgs/development/python-modules/vdirsyncer/default.nix
+++ b/pkgs/development/python-modules/vdirsyncer/default.nix
@@ -7,7 +7,7 @@
 , click-threading
 , requests-toolbelt
 , requests
-, requests_oauthlib # required for google oauth sync
+, requests-oauthlib
 , atomicwrites
 , hypothesis
 , pytestCheckHook
@@ -17,13 +17,15 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.18.0";
   pname = "vdirsyncer";
+  version = "0.18.0";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-J7w+1R93STX7ujkpFcjI1M9jmuUaRLZ0aGtJoQJfwgE=";
+    hash = "sha256-J7w+1R93STX7ujkpFcjI1M9jmuUaRLZ0aGtJoQJfwgE=";
   };
 
   propagatedBuildInputs = [
@@ -32,7 +34,7 @@ buildPythonPackage rec {
     click-log
     click-threading
     requests
-    requests_oauthlib # required for google oauth sync
+    requests-oauthlib
     requests-toolbelt
   ];
 
diff --git a/pkgs/development/python-modules/weconnect-mqtt/default.nix b/pkgs/development/python-modules/weconnect-mqtt/default.nix
index 0bb0a8f7999d1..b49d6c358210c 100644
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "weconnect-mqtt";
-  version = "0.30.2";
+  version = "0.32.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tillsteinbach";
     repo = "WeConnect-mqtt";
     rev = "v${version}";
-    sha256 = "sha256-e8dDdtabEHQKNx3c63Ou3T3ygsj4763C9Pd8usFrSCE=";
+    sha256 = "sha256-XuWiWL3cszC8aM+CJcAk359VaBCZNUOu4mAfmbdpoGg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/weconnect/default.nix b/pkgs/development/python-modules/weconnect/default.nix
index 096f1b0e99b07..db3cc1b8f82f6 100644
--- a/pkgs/development/python-modules/weconnect/default.nix
+++ b/pkgs/development/python-modules/weconnect/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "weconnect";
-  version = "0.37.2";
+  version = "0.38.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "tillsteinbach";
     repo = "WeConnect-python";
     rev = "v${version}";
-    sha256 = "sha256-54T4L1MzF2rkKM0AXz+bPBdVL7Izdho6c3AVSXBho2E=";
+    sha256 = "sha256-n9MqJ+npdHYpQJ8m6V8Oop+VuQ3EOCRrfIlU5qAc/Y8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/wsproto/default.nix b/pkgs/development/python-modules/wsproto/default.nix
index 803ddd51d9fa8..bcc9428b460bd 100644
--- a/pkgs/development/python-modules/wsproto/default.nix
+++ b/pkgs/development/python-modules/wsproto/default.nix
@@ -1,30 +1,31 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy36
-, dataclasses
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
 , h11
-, pytest
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "wsproto";
   version = "1.1.0";
-  disabled = pythonOlder "3.6"; # python versions <3.6
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-ouVr/Vx82DwTadg7X+zNbTd5i3SHKGbmJhbg7PERvag=";
   };
 
-  propagatedBuildInputs = [ h11 ] ++ lib.optional isPy36 dataclasses;
+  propagatedBuildInputs = [ h11 ];
 
-  checkInputs = [ pytest ];
+  checkInputs = [ pytestCheckHook ];
 
-  checkPhase = ''
-    py.test
-  '';
+  pythonImportsCheck = [ "wsproto" ];
 
   meta = with lib; {
     description = "Pure Python, pure state-machine WebSocket implementation";
     homepage = "https://github.com/python-hyper/wsproto/";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/wxPython/4.1.nix b/pkgs/development/python-modules/wxPython/4.1.nix
index 71f8b2847e3be..e5942c17d4c24 100644
--- a/pkgs/development/python-modules/wxPython/4.1.nix
+++ b/pkgs/development/python-modules/wxPython/4.1.nix
@@ -48,12 +48,14 @@ buildPythonPackage rec {
     doxygen
     wxGTK.gtk
     pkg-config
+  ] ++ lib.optionals stdenv.isLinux [
     autoPatchelfHook
   ];
 
   buildInputs = [
     wxGTK.gtk
     ncurses
+  ] ++ lib.optionals stdenv.isLinux [
     libXinerama
     libSM
     libXxf86vm
diff --git a/pkgs/development/python-modules/zopfli/default.nix b/pkgs/development/python-modules/zopfli/default.nix
index 1bc880456b6e1..dc2b14bdc62be 100644
--- a/pkgs/development/python-modules/zopfli/default.nix
+++ b/pkgs/development/python-modules/zopfli/default.nix
@@ -1,12 +1,14 @@
-{ lib, buildPythonPackage, fetchPypi, setuptools-scm, zopfli, pytest }:
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, setuptools-scm, zopfli, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "zopfli";
-  version = "0.2.0";
+  version = "0.2.1";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-x9PzVcSR84TkNNsuYmheq269pmuWTonhdUuxFLLTjOo=";
+    sha256 = "1ipjkcgdbplsrhr31ypk48px8cax4cm9gcjj7yrcrhg20ql3s9p5";
     extension = "zip";
   };
 
@@ -15,8 +17,7 @@ buildPythonPackage rec {
   buildInputs = [ zopfli ];
   USE_SYSTEM_ZOPFLI = "True";
 
-  # doesn't work with pytestCheckHook
-  checkInputs = [ pytest ];
+  checkInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "cPython bindings for zopfli";
diff --git a/pkgs/development/python2-modules/cryptography/default.nix b/pkgs/development/python2-modules/cryptography/default.nix
index 357bb35dacf76..0b4e2ae394cdb 100644
--- a/pkgs/development/python2-modules/cryptography/default.nix
+++ b/pkgs/development/python2-modules/cryptography/default.nix
@@ -1,10 +1,11 @@
-{ lib, stdenv
+{ lib
+, stdenv
+, callPackage
 , buildPythonPackage
 , fetchPypi
 , isPy27
 , ipaddress
 , openssl
-, cryptography_vectors
 , darwin
 , packaging
 , six
@@ -18,6 +19,9 @@
 , enum34
 }:
 
+let
+  cryptography-vectors = callPackage ./vectors.nix { };
+in
 buildPythonPackage rec {
   pname = "cryptography";
   version = "3.3.2"; # Also update the hash in vectors-3.3.nix
@@ -36,18 +40,19 @@ buildPythonPackage rec {
   ];
 
   buildInputs = [ openssl ]
-             ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
   propagatedBuildInputs = [
     packaging
     six
   ] ++ lib.optionals (!isPyPy) [
     cffi
   ] ++ lib.optionals isPy27 [
-    ipaddress enum34
+    ipaddress
+    enum34
   ];
 
   checkInputs = [
-    cryptography_vectors
+    cryptography-vectors
     hypothesis
     iso8601
     pretend
diff --git a/pkgs/development/python2-modules/cryptography-vectors/default.nix b/pkgs/development/python2-modules/cryptography/vectors.nix
index f9b7c525237ab..4d6214807e73e 100644
--- a/pkgs/development/python2-modules/cryptography-vectors/default.nix
+++ b/pkgs/development/python2-modules/cryptography/vectors.nix
@@ -1,12 +1,13 @@
 { buildPythonPackage, fetchPypi, lib, cryptography }:
 
 buildPythonPackage rec {
-  pname = "cryptography_vectors";
+  pname = "cryptography-vectors";
   # The test vectors must have the same version as the cryptography package:
   version = cryptography.version;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "cryptography_vectors";
+    inherit version;
     sha256 = "1yhaps0f3h2yjb6lmz953z1l1d84y9swk4k3gj9nqyk4vbx5m7cc";
   };
 
diff --git a/pkgs/development/ruby-modules/bundler-app/default.nix b/pkgs/development/ruby-modules/bundler-app/default.nix
index 03bf7275cc719..e3c430cc923bd 100644
--- a/pkgs/development/ruby-modules/bundler-app/default.nix
+++ b/pkgs/development/ruby-modules/bundler-app/default.nix
@@ -57,7 +57,7 @@ in
                                 "--set BUNDLE_FROZEN 1 "+
                                 "--set GEM_HOME ${basicEnv}/${ruby.gemPath} "+
                                 "--set GEM_PATH ${basicEnv}/${ruby.gemPath} "+
-                                "--run \"cd $srcdir\";\n") scripts)}
+                                "--chdir \"$srcdir\";\n") scripts)}
 
     ${lib.optionalString installManpages ''
     for section in {1..9}; do
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index a6a95e74e4a18..3f22bd7c30b3d 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
     description = "Semantic code analysis engine";
     homepage = "https://codeql.github.com";
     maintainers = [ maintainers.dump_stack ];
+    platforms = [ "x86_64-linux" ];
     license = licenses.unfree;
   };
 }
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix
index 0ecf6300eb233..9f2fb8b40f410 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix
@@ -112,7 +112,8 @@ let
 
     src = srcDepsSet."java_tools_javac11_${system}-v4.0.zip";
 
-    nativeBuildInputs = [ autoPatchelfHook unzip ];
+    nativeBuildInputs = [ unzip ]
+      ++ lib.optional stdenv.isLinux autoPatchelfHook;
     buildInputs = [ gcc-unwrapped ];
 
     sourceRoot = ".";
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_1/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_1/default.nix
index 3adf52ec905ea..0402fb85f26d0 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_1/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_1/default.nix
@@ -112,7 +112,8 @@ let
 
     src = srcDepsSet."java_tools_javac11_${system}-v6.1.zip";
 
-    nativeBuildInputs = [ autoPatchelfHook unzip ];
+    nativeBuildInputs = [ unzip ]
+      ++ lib.optional stdenv.isLinux autoPatchelfHook;
     buildInputs = [ gcc-unwrapped ];
 
     sourceRoot = ".";
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
index 3c71c8cc08919..3a5c9e2e76fd7 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
@@ -117,7 +117,8 @@ let
 
     src = srcDepsSet."java_tools_javac11_${system}-v10.0.zip";
 
-    nativeBuildInputs = [ autoPatchelfHook unzip ];
+    nativeBuildInputs = [ unzip ]
+      ++ lib.optional stdenv.isLinux autoPatchelfHook;
     buildInputs = [ gcc-unwrapped ];
 
     sourceRoot = ".";
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
index 72c971d1334d0..79bb378534bd0 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
@@ -142,7 +142,8 @@ let
 
     src = srcDepsSet."java_tools_javac11_${system}-v10.6.zip";
 
-    nativeBuildInputs = [ autoPatchelfHook unzip ];
+    nativeBuildInputs = [ unzip ]
+      ++ lib.optional stdenv.isLinux autoPatchelfHook;
     buildInputs = [ gcc-unwrapped ];
 
     sourceRoot = ".";
diff --git a/pkgs/development/tools/build-managers/bloop/default.nix b/pkgs/development/tools/build-managers/bloop/default.nix
index 11b25bec3816d..94e6fc70f7d76 100644
--- a/pkgs/development/tools/build-managers/bloop/default.nix
+++ b/pkgs/development/tools/build-managers/bloop/default.nix
@@ -66,7 +66,8 @@ stdenv.mkDerivation rec {
   };
 
   dontUnpack = true;
-  nativeBuildInputs = [ autoPatchelfHook installShellFiles makeWrapper ];
+  nativeBuildInputs = [ installShellFiles makeWrapper ]
+    ++ lib.optional stdenv.isLinux autoPatchelfHook;
   buildInputs = [ stdenv.cc.cc.lib zlib ];
   propagatedBuildInputs = [ jre ];
 
diff --git a/pkgs/development/tools/build-managers/scala-cli/default.nix b/pkgs/development/tools/build-managers/scala-cli/default.nix
index c045944b77374..30fa7f3c658c3 100644
--- a/pkgs/development/tools/build-managers/scala-cli/default.nix
+++ b/pkgs/development/tools/build-managers/scala-cli/default.nix
@@ -16,7 +16,8 @@ in
 stdenv.mkDerivation {
   pname = "scala-cli";
   inherit version;
-  nativeBuildInputs = [ autoPatchelfHook installShellFiles ];
+  nativeBuildInputs = [ installShellFiles ]
+    ++ lib.optional stdenv.isLinux autoPatchelfHook;
   buildInputs = [ coreutils zlib stdenv.cc.cc ];
   src =
     let
@@ -42,9 +43,9 @@ stdenv.mkDerivation {
   # We need to call autopatchelf before generating completions
   dontAutoPatchelf = true;
 
-  postFixup = ''
+  postFixup = lib.optionalString stdenv.isLinux ''
     autoPatchelf $out
-
+  '' + ''
     # hack to ensure the completion function looks right
     # as $0 is used to generate the compdef directive
     PATH="$out/bin:$PATH"
diff --git a/pkgs/development/tools/ccloud-cli/default.nix b/pkgs/development/tools/ccloud-cli/default.nix
index 5814ab90e6d90..2a3d1de41a11a 100644
--- a/pkgs/development/tools/ccloud-cli/default.nix
+++ b/pkgs/development/tools/ccloud-cli/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
       sha256 = "0936hipcl37w4mzzsnjlz4q1z4j9094i4irigzqwg14gdbs7p11s";
     });
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   dontStrip = stdenv.isDarwin;
 
diff --git a/pkgs/development/tools/confluent-cli/default.nix b/pkgs/development/tools/confluent-cli/default.nix
index 9664a75703a27..059a3272038fe 100644
--- a/pkgs/development/tools/confluent-cli/default.nix
+++ b/pkgs/development/tools/confluent-cli/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
       sha256 = "1wvy7x56cc7imycf0d83mxcqzdvv56cc0zbp913xgghjn9dl2z7a";
     });
 
-  nativeBuildInputs = [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   dontStrip = stdenv.isDarwin;
 
diff --git a/pkgs/development/tools/database/sqldeveloper/default.nix b/pkgs/development/tools/database/sqldeveloper/default.nix
index da43a4daf7d12..655156c176c6b 100644
--- a/pkgs/development/tools/database/sqldeveloper/default.nix
+++ b/pkgs/development/tools/database/sqldeveloper/default.nix
@@ -62,7 +62,7 @@ in
 
     makeWrapper $out/libexec/sqldeveloper/bin/sqldeveloper $out/bin/sqldeveloper \
       --set JAVA_HOME ${jdk.home} \
-      --run "cd $out/libexec/sqldeveloper/bin"
+      --chdir "$out/libexec/sqldeveloper/bin"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/misc/binutils/0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch b/pkgs/development/tools/misc/binutils/0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch
new file mode 100644
index 0000000000000..f9c6e88d97b45
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch
@@ -0,0 +1,137 @@
+From beca4a2c25ee86e4020f8b8bddc4d8e0ed3430b3 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 22 Feb 2022 11:28:04 +0900
+Subject: [PATCH] Revert "libtool.m4: fix nm BSD flag detection"
+
+This reverts commit bef9ef8ca0f941d743c77cc55b5fe7985990b2a7.
+---
+ ChangeLog  |  9 ------
+ libtool.m4 | 88 ++++++++++++++++++++++++++----------------------------
+ 2 files changed, 43 insertions(+), 54 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 18e8b6835da..c12f07403c3 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -375,15 +375,6 @@
+ 
+ 	* src-release.sh (GDB_SUPPPORT_DIRS): Add libbacktrace.
+ 
+-2021-09-27  Nick Alcock  <nick.alcock@oracle.com>
+-
+-	PR libctf/27967
+-	* libtool.m4 (LT_PATH_NM): Try BSDization flags with a user-provided
+-	NM, if there is one.  Run nm on itself, not on /dev/null, to avoid
+-	errors from nms that refuse to work on non-regular files.  Remove
+-	other workarounds for this problem.  Strip out blank lines from the
+-	nm output.
+-
+ 2021-09-27  Nick Alcock  <nick.alcock@oracle.com>
+ 
+ 	PR libctf/27967
+diff --git a/libtool.m4 b/libtool.m4
+index a216bb14e99..7a711249304 100644
+--- a/libtool.m4
++++ b/libtool.m4
+@@ -3200,55 +3200,53 @@ _LT_DECL([], [file_magic_cmd], [1],
+ 
+ # LT_PATH_NM
+ # ----------
+-# find the pathname to a BSD- or MS-compatible name lister, and any flags
+-# needed to make it compatible
++# find the pathname to a BSD- or MS-compatible name lister
+ AC_DEFUN([LT_PATH_NM],
+ [AC_REQUIRE([AC_PROG_CC])dnl
+ AC_CACHE_CHECK([for BSD- or MS-compatible name lister (nm)], lt_cv_path_NM,
+ [if test -n "$NM"; then
+-   # Let the user override the nm to test.
+-   lt_nm_to_check="$NM"
+- else
+-   lt_nm_to_check="${ac_tool_prefix}nm"
+-   if test -n "$ac_tool_prefix" && test "$build" = "$host"; then
+-     lt_nm_to_check="$lt_nm_to_check nm"
+-   fi
+- fi
+- for lt_tmp_nm in $lt_nm_to_check; do
+-   lt_save_ifs="$IFS"; IFS=$PATH_SEPARATOR
+-   for ac_dir in $PATH /usr/ccs/bin/elf /usr/ccs/bin /usr/ucb /bin; do
+-     IFS="$lt_save_ifs"
+-     test -z "$ac_dir" && ac_dir=.
+-     case "$lt_tmp_nm" in
+-     */*|*\\*) tmp_nm="$lt_tmp_nm";;
+-     *) tmp_nm="$ac_dir/$lt_tmp_nm";;
+-     esac
+-     if test -f "$tmp_nm" || test -f "$tmp_nm$ac_exeext" ; then
+-       # Check to see if the nm accepts a BSD-compat flag.
+-       # Adding the `sed 1q' prevents false positives on HP-UX, which says:
+-       #   nm: unknown option "B" ignored
+-       case `"$tmp_nm" -B "$tmp_nm" 2>&1 | grep -v '^ *$' | sed '1q'` in
+-       *$tmp_nm*) lt_cv_path_NM="$tmp_nm -B"
+-	 break
+-	 ;;
+-       *)
+-	 case `"$tmp_nm" -p "$tmp_nm" 2>&1 | grep -v '^ *$' | sed '1q'` in
+-	 *$tmp_nm*)
+-	   lt_cv_path_NM="$tmp_nm -p"
+-	   break
+-	   ;;
+-	 *)
+-	   lt_cv_path_NM=${lt_cv_path_NM="$tmp_nm"} # keep the first match, but
+-	   continue # so that we can try to find one that supports BSD flags
+-	   ;;
+-	 esac
+-	 ;;
+-       esac
+-     fi
+-   done
+-   IFS="$lt_save_ifs"
+- done
+- : ${lt_cv_path_NM=no}])
++  # Let the user override the test.
++  lt_cv_path_NM="$NM"
++else
++  lt_nm_to_check="${ac_tool_prefix}nm"
++  if test -n "$ac_tool_prefix" && test "$build" = "$host"; then
++    lt_nm_to_check="$lt_nm_to_check nm"
++  fi
++  for lt_tmp_nm in $lt_nm_to_check; do
++    lt_save_ifs="$IFS"; IFS=$PATH_SEPARATOR
++    for ac_dir in $PATH /usr/ccs/bin/elf /usr/ccs/bin /usr/ucb /bin; do
++      IFS="$lt_save_ifs"
++      test -z "$ac_dir" && ac_dir=.
++      tmp_nm="$ac_dir/$lt_tmp_nm"
++      if test -f "$tmp_nm" || test -f "$tmp_nm$ac_exeext" ; then
++	# Check to see if the nm accepts a BSD-compat flag.
++	# Adding the `sed 1q' prevents false positives on HP-UX, which says:
++	#   nm: unknown option "B" ignored
++	# Tru64's nm complains that /dev/null is an invalid object file
++	case `"$tmp_nm" -B /dev/null 2>&1 | sed '1q'` in
++	*/dev/null* | *'Invalid file or object type'*)
++	  lt_cv_path_NM="$tmp_nm -B"
++	  break
++	  ;;
++	*)
++	  case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in
++	  */dev/null*)
++	    lt_cv_path_NM="$tmp_nm -p"
++	    break
++	    ;;
++	  *)
++	    lt_cv_path_NM=${lt_cv_path_NM="$tmp_nm"} # keep the first match, but
++	    continue # so that we can try to find one that supports BSD flags
++	    ;;
++	  esac
++	  ;;
++	esac
++      fi
++    done
++    IFS="$lt_save_ifs"
++  done
++  : ${lt_cv_path_NM=no}
++fi])
+ if test "$lt_cv_path_NM" != "no"; then
+   NM="$lt_cv_path_NM"
+ else
+-- 
+2.34.1
+
diff --git a/pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch b/pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch
new file mode 100644
index 0000000000000..e601be3a33082
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/0001-libtool.m4-update-macos-version-detection-block.patch
@@ -0,0 +1,47 @@
+From 33a8dc728eb5da3e1d3439c96810d1f6b2660b89 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 22 Feb 2022 12:24:46 +0900
+Subject: [PATCH] libtool.m4: update macos version detection block
+
+Includes upstream change
+9e8c882517082fe5755f2524d23efb02f1522490
+---
+ libtool.m4 | 21 ++++++++-------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/libtool.m4 b/libtool.m4
+index 7a711249304..f452efb4300 100644
+--- a/libtool.m4
++++ b/libtool.m4
+@@ -996,20 +996,15 @@ _LT_EOF
+     ])
+     case $host_os in
+     rhapsody* | darwin1.[[012]])
+-      _lt_dar_allow_undefined='${wl}-undefined ${wl}suppress' ;;
++      _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
+     darwin1.*)
+-      _lt_dar_allow_undefined='${wl}-flat_namespace ${wl}-undefined ${wl}suppress' ;;
+-    darwin*) # darwin 5.x on
+-      # if running on 10.5 or later, the deployment target defaults
+-      # to the OS version, if on x86, and 10.4, the deployment
+-      # target defaults to 10.4. Don't you love it?
+-      case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
+-	10.0,*86*-darwin8*|10.0,*-darwin[[91]]*)
+-	  _lt_dar_allow_undefined='${wl}-undefined ${wl}dynamic_lookup' ;;
+-	10.[[012]][[,.]]*)
+-	  _lt_dar_allow_undefined='${wl}-flat_namespace ${wl}-undefined ${wl}suppress' ;;
+-	10.*)
+-	  _lt_dar_allow_undefined='${wl}-undefined ${wl}dynamic_lookup' ;;
++      _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
++    darwin*)
++      case $MACOSX_DEPLOYMENT_TARGET,$host in
++        10.[[012]],*|,*powerpc*-darwin[[5-8]]*)
++          _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
++        *)
++          _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+       esac
+     ;;
+   esac
+-- 
+2.34.1
+
diff --git a/pkgs/development/tools/misc/binutils/CVE-2020-35448.patch b/pkgs/development/tools/misc/binutils/CVE-2020-35448.patch
deleted file mode 100644
index 2eba7b51849f5..0000000000000
--- a/pkgs/development/tools/misc/binutils/CVE-2020-35448.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 8642dafaef21aa6747cec01df1977e9c52eb4679 Mon Sep 17 00:00:00 2001
-From: Alan Modra <amodra@gmail.com>
-Date: Fri, 4 Sep 2020 19:19:18 +0930
-Subject: [PATCH] PR26574, heap buffer overflow in
- _bfd_elf_slurp_secondary_reloc_section
-
-A horribly fuzzed object with section headers inside the ELF header.
-Disallow that, and crazy reloc sizes.
-
-	PR 26574
-	* elfcode.h (elf_object_p): Sanity check section header offset.
-	* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
-	sh_entsize.
----
- bfd/elf.c     | 4 +++-
- bfd/elfcode.h | 8 ++++----
- 3 files changed, 14 insertions(+), 5 deletions(-)
-
-diff --git a/bfd/elf.c b/bfd/elf.c
-index ac2095f787d..5a02f8dc309 100644
---- a/bfd/elf.c
-+++ b/bfd/elf.c
-@@ -12576,7 +12576,9 @@ _bfd_elf_slurp_secondary_reloc_section (bfd *      abfd,
-       Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr;
- 
-       if (hdr->sh_type == SHT_SECONDARY_RELOC
--	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx)
-+	  && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx
-+	  && (hdr->sh_entsize == ebd->s->sizeof_rel
-+	      || hdr->sh_entsize == ebd->s->sizeof_rela))
- 	{
- 	  bfd_byte * native_relocs;
- 	  bfd_byte * native_reloc;
-diff --git a/bfd/elfcode.h b/bfd/elfcode.h
-index 2ed2f135c34..606ff64fd4d 100644
---- a/bfd/elfcode.h
-+++ b/bfd/elfcode.h
-@@ -571,7 +571,7 @@ elf_object_p (bfd *abfd)
- 
-   /* If this is a relocatable file and there is no section header
-      table, then we're hosed.  */
--  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL)
-+  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL)
-     goto got_wrong_format_error;
- 
-   /* As a simple sanity check, verify that what BFD thinks is the
-@@ -581,7 +581,7 @@ elf_object_p (bfd *abfd)
-     goto got_wrong_format_error;
- 
-   /* Further sanity check.  */
--  if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0)
-+  if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0)
-     goto got_wrong_format_error;
- 
-   ebd = get_elf_backend_data (abfd);
-@@ -618,7 +618,7 @@ elf_object_p (bfd *abfd)
-       && ebd->elf_osabi != ELFOSABI_NONE)
-     goto got_wrong_format_error;
- 
--  if (i_ehdrp->e_shoff != 0)
-+  if (i_ehdrp->e_shoff >= sizeof (x_ehdr))
-     {
-       file_ptr where = (file_ptr) i_ehdrp->e_shoff;
- 
-@@ -819,7 +819,7 @@ elf_object_p (bfd *abfd)
- 	}
-     }
- 
--  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0)
-+  if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr))
-     {
-       unsigned int num_sec;
- 
--- 
-2.27.0
-
-
diff --git a/pkgs/development/tools/misc/binutils/CVE-2021-3487.patch b/pkgs/development/tools/misc/binutils/CVE-2021-3487.patch
deleted file mode 100644
index 004271bd45abe..0000000000000
--- a/pkgs/development/tools/misc/binutils/CVE-2021-3487.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From: Nick Clifton <nickc@redhat.com>
-Date: Thu, 26 Nov 2020 17:08:33 +0000 (+0000)
-Subject: Prevent a memory allocation failure when parsing corrupt DWARF debug sections.
-X-Git-Tag: binutils-2_36~485
-X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff_plain;h=647cebce12a6b0a26960220caff96ff38978cf24;hp=239ca5e497dda2c151009d664d500086a5c2173a
-
-Prevent a memory allocation failure when parsing corrupt DWARF debug sections.
-
-	PR 26946
-	* dwarf2.c (read_section): Check for debug sections with excessive
-	sizes.
----
-
-diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
-index 977bf43a6a1..8bbfc81d3e7 100644
---- a/bfd/dwarf2.c
-+++ b/bfd/dwarf2.c
-@@ -531,22 +531,24 @@ read_section (bfd *	      abfd,
- 	      bfd_byte **     section_buffer,
- 	      bfd_size_type * section_size)
- {
--  asection *msec;
-   const char *section_name = sec->uncompressed_name;
-   bfd_byte *contents = *section_buffer;
--  bfd_size_type amt;
- 
-   /* The section may have already been read.  */
-   if (contents == NULL)
-     {
-+      bfd_size_type amt;
-+      asection *msec;
-+      ufile_ptr filesize;
-+
-       msec = bfd_get_section_by_name (abfd, section_name);
--      if (! msec)
-+      if (msec == NULL)
- 	{
- 	  section_name = sec->compressed_name;
- 	  if (section_name != NULL)
- 	    msec = bfd_get_section_by_name (abfd, section_name);
- 	}
--      if (! msec)
-+      if (msec == NULL)
- 	{
- 	  _bfd_error_handler (_("DWARF error: can't find %s section."),
- 			      sec->uncompressed_name);
-@@ -554,12 +556,23 @@ read_section (bfd *	      abfd,
- 	  return FALSE;
- 	}
- 
--      *section_size = msec->rawsize ? msec->rawsize : msec->size;
-+      amt = bfd_get_section_limit_octets (abfd, msec);
-+      filesize = bfd_get_file_size (abfd);
-+      if (amt >= filesize)
-+	{
-+	  /* PR 26946 */
-+	  _bfd_error_handler (_("DWARF error: section %s is larger than its filesize! (0x%lx vs 0x%lx)"),
-+			      section_name, (long) amt, (long) filesize);
-+	  bfd_set_error (bfd_error_bad_value);
-+	  return FALSE;
-+	}
-+      *section_size = amt;
-       /* Paranoia - alloc one extra so that we can make sure a string
- 	 section is NUL terminated.  */
--      amt = *section_size + 1;
-+      amt += 1;
-       if (amt == 0)
- 	{
-+	  /* Paranoia - this should never happen.  */
- 	  bfd_set_error (bfd_error_no_memory);
- 	  return FALSE;
- 	}
-
diff --git a/pkgs/development/tools/misc/binutils/CVE-2021-45078.patch b/pkgs/development/tools/misc/binutils/CVE-2021-45078.patch
deleted file mode 100644
index af1c95fac8066..0000000000000
--- a/pkgs/development/tools/misc/binutils/CVE-2021-45078.patch
+++ /dev/null
@@ -1,239 +0,0 @@
-based on upstream https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=161e87d12167b1e36193385485c1f6ce92f74f02;hp=d5c94731766bf4f276146fd29c1df8eebc2aaf69
-
-adapted by ris to apply to 2.35.2 (simply capitalizing booleans)
-
-diff --git a/binutils/stabs.c b/binutils/stabs.c
-index 274bfb0e7fa..83ee3ea5fa4 100644
---- a/binutils/stabs.c
-+++ b/binutils/stabs.c
-@@ -202,7 +202,7 @@ static debug_type stab_find_type (void *, struct stab_handle *, const int *);
- static bool stab_record_type
-   (void *, struct stab_handle *, const int *, debug_type);
- static debug_type stab_xcoff_builtin_type
--  (void *, struct stab_handle *, int);
-+  (void *, struct stab_handle *, unsigned int);
- static debug_type stab_find_tagged_type
-   (void *, struct stab_handle *, const char *, int, enum debug_type_kind);
- static debug_type *stab_demangle_argtypes
-@@ -3496,166 +3496,167 @@ stab_record_type (void *dhandle ATTRIBUTE_UNUSED, struct stab_handle *info,
- 
- static debug_type
- stab_xcoff_builtin_type (void *dhandle, struct stab_handle *info,
--			 int typenum)
-+			 unsigned int typenum)
- {
-   debug_type rettype;
-   const char *name;
- 
--  if (typenum >= 0 || typenum < -XCOFF_TYPE_COUNT)
-+  typenum = -typenum - 1;
-+  if (typenum >= XCOFF_TYPE_COUNT)
-     {
--      fprintf (stderr, _("Unrecognized XCOFF type %d\n"), typenum);
-+      fprintf (stderr, _("Unrecognized XCOFF type %d\n"), -typenum - 1);
-       return DEBUG_TYPE_NULL;
-     }
--  if (info->xcoff_types[-typenum] != NULL)
--    return info->xcoff_types[-typenum];
-+  if (info->xcoff_types[typenum] != NULL)
-+    return info->xcoff_types[typenum];
- 
--  switch (-typenum)
-+  switch (typenum)
-     {
--    case 1:
-+    case 0:
-       /* The size of this and all the other types are fixed, defined
- 	 by the debugging format.  */
-       name = "int";
-       rettype = debug_make_int_type (dhandle, 4, FALSE);
-       break;
--    case 2:
-+    case 1:
-       name = "char";
-       rettype = debug_make_int_type (dhandle, 1, FALSE);
-       break;
--    case 3:
-+    case 2:
-       name = "short";
-       rettype = debug_make_int_type (dhandle, 2, FALSE);
-       break;
--    case 4:
-+    case 3:
-       name = "long";
-       rettype = debug_make_int_type (dhandle, 4, FALSE);
-       break;
--    case 5:
-+    case 4:
-       name = "unsigned char";
-       rettype = debug_make_int_type (dhandle, 1, TRUE);
-       break;
--    case 6:
-+    case 5:
-       name = "signed char";
-       rettype = debug_make_int_type (dhandle, 1, FALSE);
-       break;
--    case 7:
-+    case 6:
-       name = "unsigned short";
-       rettype = debug_make_int_type (dhandle, 2, TRUE);
-       break;
--    case 8:
-+    case 7:
-       name = "unsigned int";
-       rettype = debug_make_int_type (dhandle, 4, TRUE);
-       break;
--    case 9:
-+    case 8:
-       name = "unsigned";
-       rettype = debug_make_int_type (dhandle, 4, TRUE);
-       break;
--    case 10:
-+    case 9:
-       name = "unsigned long";
-       rettype = debug_make_int_type (dhandle, 4, TRUE);
-       break;
--    case 11:
-+    case 10:
-       name = "void";
-       rettype = debug_make_void_type (dhandle);
-       break;
--    case 12:
-+    case 11:
-       /* IEEE single precision (32 bit).  */
-       name = "float";
-       rettype = debug_make_float_type (dhandle, 4);
-       break;
--    case 13:
-+    case 12:
-       /* IEEE double precision (64 bit).  */
-       name = "double";
-       rettype = debug_make_float_type (dhandle, 8);
-       break;
--    case 14:
-+    case 13:
-       /* This is an IEEE double on the RS/6000, and different machines
- 	 with different sizes for "long double" should use different
- 	 negative type numbers.  See stabs.texinfo.  */
-       name = "long double";
-       rettype = debug_make_float_type (dhandle, 8);
-       break;
--    case 15:
-+    case 14:
-       name = "integer";
-       rettype = debug_make_int_type (dhandle, 4, FALSE);
-       break;
--    case 16:
-+    case 15:
-       name = "boolean";
-       rettype = debug_make_bool_type (dhandle, 4);
-       break;
--    case 17:
-+    case 16:
-       name = "short real";
-       rettype = debug_make_float_type (dhandle, 4);
-       break;
--    case 18:
-+    case 17:
-       name = "real";
-       rettype = debug_make_float_type (dhandle, 8);
-       break;
--    case 19:
-+    case 18:
-       /* FIXME */
-       name = "stringptr";
-       rettype = NULL;
-       break;
--    case 20:
-+    case 19:
-       /* FIXME */
-       name = "character";
-       rettype = debug_make_int_type (dhandle, 1, TRUE);
-       break;
--    case 21:
-+    case 20:
-       name = "logical*1";
-       rettype = debug_make_bool_type (dhandle, 1);
-       break;
--    case 22:
-+    case 21:
-       name = "logical*2";
-       rettype = debug_make_bool_type (dhandle, 2);
-       break;
--    case 23:
-+    case 22:
-       name = "logical*4";
-       rettype = debug_make_bool_type (dhandle, 4);
-       break;
--    case 24:
-+    case 23:
-       name = "logical";
-       rettype = debug_make_bool_type (dhandle, 4);
-       break;
--    case 25:
-+    case 24:
-       /* Complex type consisting of two IEEE single precision values.  */
-       name = "complex";
-       rettype = debug_make_complex_type (dhandle, 8);
-       break;
--    case 26:
-+    case 25:
-       /* Complex type consisting of two IEEE double precision values.  */
-       name = "double complex";
-       rettype = debug_make_complex_type (dhandle, 16);
-       break;
--    case 27:
-+    case 26:
-       name = "integer*1";
-       rettype = debug_make_int_type (dhandle, 1, FALSE);
-       break;
--    case 28:
-+    case 27:
-       name = "integer*2";
-       rettype = debug_make_int_type (dhandle, 2, FALSE);
-       break;
--    case 29:
-+    case 28:
-       name = "integer*4";
-       rettype = debug_make_int_type (dhandle, 4, FALSE);
-       break;
--    case 30:
-+    case 29:
-       /* FIXME */
-       name = "wchar";
-       rettype = debug_make_int_type (dhandle, 2, FALSE);
-       break;
--    case 31:
-+    case 30:
-       name = "long long";
-       rettype = debug_make_int_type (dhandle, 8, FALSE);
-       break;
--    case 32:
-+    case 31:
-       name = "unsigned long long";
-       rettype = debug_make_int_type (dhandle, 8, TRUE);
-       break;
--    case 33:
-+    case 32:
-       name = "logical*8";
-       rettype = debug_make_bool_type (dhandle, 8);
-       break;
--    case 34:
-+    case 33:
-       name = "integer*8";
-       rettype = debug_make_int_type (dhandle, 8, FALSE);
-       break;
-@@ -3664,9 +3665,7 @@ stab_xcoff_builtin_type (void *dhandle, struct stab_handle *info,
-     }
- 
-   rettype = debug_name_type (dhandle, name, rettype);
--
--  info->xcoff_types[-typenum] = rettype;
--
-+  info->xcoff_types[typenum] = rettype;
-   return rettype;
- }
- 
--- 
-2.27.0
-
diff --git a/pkgs/development/tools/misc/binutils/bfd-elf-Dont-read-non-existing-secondary-relocs.patch b/pkgs/development/tools/misc/binutils/bfd-elf-Dont-read-non-existing-secondary-relocs.patch
deleted file mode 100644
index c166066c9803c..0000000000000
--- a/pkgs/development/tools/misc/binutils/bfd-elf-Dont-read-non-existing-secondary-relocs.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-X-Git-Url: https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff_plain;f=bfd%2Felf.c;h=af62aadc3d446cd5b1f0201b207c90c22e7809b1;hp=36733e080dd9d9be28b576b246aaf5bd8c8569c7;hb=84fd26d8209e99fc3a432dd0b09b6c053de1ce65;hpb=abe2a28aaa7a2bfd0f3061c72a98eb898976b721
-
-diff --git a/bfd/elf.c b/bfd/elf.c
-index 36733e080dd..af62aadc3d4 100644
---- a/bfd/elf.c
-+++ b/bfd/elf.c
-@@ -2454,6 +2454,8 @@ bfd_section_from_shdr (bfd *abfd, unsigned int shindex)
- 		     "for section %pA found - ignoring"),
- 		   abfd, name, target_sect);
- 	      }
-+	    else
-+	      esdt->has_secondary_relocs = TRUE;
- 	    goto success;
- 	  }
- 
-@@ -12587,6 +12589,9 @@ _bfd_elf_slurp_secondary_reloc_section (bfd *       abfd,
- #endif
-     r_sym = elf32_r_sym;
-   
-+  if (!elf_section_data (sec)->has_secondary_relocs)
-+    return TRUE;
-+
-   /* Discover if there are any secondary reloc sections
-      associated with SEC.  */
-   for (relsec = abfd->sections; relsec != NULL; relsec = relsec->next)
-
diff --git a/pkgs/development/tools/misc/binutils/build-components-separately.patch b/pkgs/development/tools/misc/binutils/build-components-separately.patch
index 38fa4934a28a6..0b4162d848803 100644
--- a/pkgs/development/tools/misc/binutils/build-components-separately.patch
+++ b/pkgs/development/tools/misc/binutils/build-components-separately.patch
@@ -1,8 +1,8 @@
 diff --git a/bfd/configure.ac b/bfd/configure.ac
-index c5bfbd5d..45ad4c26 100644
+index fec067b2135..377e1f5443f 100644
 --- a/bfd/configure.ac
 +++ b/bfd/configure.ac
-@@ -278,31 +278,19 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
+@@ -292,30 +292,16 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
  
  LT_LIB_M
  
@@ -21,24 +21,22 @@ index c5bfbd5d..45ad4c26 100644
 -  if test -n "$x"; then
 -    SHARED_LIBADD="-L`pwd`/../libiberty/pic -liberty"
 -  fi
+-fi
 -
+ SHARED_LIBADD="$SHARED_LIBADD $LIBINTL"
+ 
+-if test "$enable_shared" = "yes"; then
    case "${host}" in
    # More hacks to build DLLs on Windows.
    *-*-cygwin*)
      SHARED_LDFLAGS="-no-undefined"
--    SHARED_LIBADD="-L`pwd`/../libiberty -liberty -L`pwd`/../intl -lintl -lcygwin -lkernel32"
-+    SHARED_LIBADD="-liberty -lintl -lcygwin -lkernel32"
-   ;;
- 
-   # Use built-in libintl on macOS, since it is not provided by libc.
-   *-*-darwin*)
--    SHARED_LIBADD="-L`pwd`/../libiberty/pic -L`pwd`/../intl -liberty -lintl"
-+    SHARED_LIBADD="-liberty -lintl"
+-    SHARED_LIBADD="-L`pwd`/../libiberty -liberty $SHARED_LIBADD -lcygwin -lkernel32"
++    SHARED_LIBADD="-liberty $SHARED_LIBADD -lcygwin -lkernel32"
    ;;
    esac
  
 diff --git a/opcodes/Makefile.am b/opcodes/Makefile.am
-index 4f06074a..6836c589 100644
+index 0e04b4c05c4..848a02662e7 100644
 --- a/opcodes/Makefile.am
 +++ b/opcodes/Makefile.am
 @@ -51,7 +51,7 @@ libopcodes_la_LDFLAGS += -rpath $(rpath_bfdlibdir)
@@ -50,7 +48,7 @@ index 4f06074a..6836c589 100644
  
  BUILD_LIBS = @BUILD_LIBS@
  BUILD_LIB_DEPS = @BUILD_LIB_DEPS@
-@@ -301,7 +301,7 @@ OFILES = @BFD_MACHINES@
+@@ -303,7 +303,7 @@ OFILES = @BFD_MACHINES@
  # development.sh is used to determine -Werror default.
  CONFIG_STATUS_DEPENDENCIES = $(BFDDIR)/development.sh
  
@@ -59,10 +57,7 @@ index 4f06074a..6836c589 100644
  
  disassemble.lo: disassemble.c
  if am__fastdepCC
-@@ -322,12 +322,21 @@ libopcodes_la_SOURCES =  dis-buf.c disassemble.c dis-init.c
- # old version of libbfd, or to pick up libbfd for the wrong architecture
- # if host != build. So for building with shared libraries we use a
- # hardcoded path to libbfd.so instead of relying on the entries in libbfd.la.
+@@ -327,9 +327,18 @@ libopcodes_la_SOURCES =  dis-buf.c disassemble.c dis-init.c
 -libopcodes_la_DEPENDENCIES = $(OFILES) @SHARED_DEPENDENCIES@
 +libopcodes_la_DEPENDENCIES = $(OFILES) @SHARED_DEPENDENCIES@ libtool-soversion
  libopcodes_la_LIBADD = $(OFILES) @SHARED_LIBADD@
@@ -84,18 +79,19 @@ index 4f06074a..6836c589 100644
  # the build directory so that we don't have to convert all the
  # programs that use libopcodes.a simultaneously.  This is a hack which
 diff --git a/opcodes/configure.ac b/opcodes/configure.ac
-index 00be9c88..6e589ae4 100644
+index e564f067334..5da62a3d58b 100644
 --- a/opcodes/configure.ac
 +++ b/opcodes/configure.ac
-@@ -86,6 +86,7 @@ AC_PROG_INSTALL
+@@ -98,6 +98,8 @@ BFD_64_BIT
+ AC_SUBST(HDEFINES)
+ AC_PROG_INSTALL
  
- AC_CHECK_HEADERS(string.h strings.h stdlib.h limits.h)
- ACX_HEADER_STRING
 +GCC_HEADER_STDINT(bfd_stdint.h)
- 
++
  AC_CHECK_DECLS([basename, stpcpy])
  
-@@ -137,61 +138,27 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
+ # Check if sigsetjmp is available.  Using AC_CHECK_FUNCS won't do
+@@ -148,44 +150,21 @@ AC_CACHE_CHECK(linker --as-needed support, bfd_cv_ld_as_needed,
  
  LT_LIB_M
  
@@ -122,7 +118,7 @@ index 00be9c88..6e589ae4 100644
 -SHARED_LIBADD=
 +SHARED_LIBADD=-liberty
  SHARED_DEPENDENCIES=
- if test "$enable_shared" = "yes"; then
+-if test "$enable_shared" = "yes"; then
 -# When building a shared libopcodes, link against the pic version of libiberty
 -# so that apps that use libopcodes won't need libiberty just to satisfy any
 -# libopcodes references.
@@ -131,32 +127,27 @@ index 00be9c88..6e589ae4 100644
  # Note that linking against libbfd as we do here, which is itself linked
  # against libiberty, may not satisfy all the libopcodes libiberty references
  # since libbfd may not pull in the entirety of libiberty.
+ # Also, jam libintl into the right place in all of this: after libiberty,
+ # which uses it, but before -lcygwin, which it uses.
 -changequote(,)dnl
 -  x=`sed -n -e 's/^[ 	]*PICFLAG[ 	]*=[ 	]*//p' < ../libiberty/Makefile | sed -n '$p'`
 -changequote([,])dnl
 -  if test -n "$x"; then
 -    SHARED_LIBADD="-L`pwd`/../libiberty/pic -liberty"
 -  fi
--
+-fi
+ 
+ SHARED_LIBADD="$SHARED_LIBADD $LIBINTL"
+ 
+@@ -193,11 +172,10 @@ if test "$enable_shared" = "yes"; then
    case "${host}" in
      *-*-cygwin*)
        SHARED_LDFLAGS="-no-undefined"
--      SHARED_LIBADD="-L`pwd`/../bfd -lbfd -L`pwd`/../libiberty -liberty -L`pwd`/../intl -lintl -lcygwin"
-+      SHARED_LIBADD="-lbfd -liberty -lintl -lcygwin"
+-      SHARED_LIBADD="-L`pwd`/../bfd -lbfd -L`pwd`/../libiberty -liberty $SHARED_LIBADD"
++      SHARED_LIBADD="-lbfd -liberty $SHARED_LIBADD"
        ;;
--   *-*-darwin*)
--     SHARED_LIBADD="-Wl,`pwd`/../bfd/.libs/libbfd.dylib ${SHARED_LIBADD}"
--     SHARED_DEPENDENCIES="../bfd/libbfd.la"
--     ;;
      *)
--      case "$host_vendor" in
--        hp)
--          SHARED_LIBADD="-Wl,`pwd`/../bfd/.libs/libbfd.sl ${SHARED_LIBADD}"
--	  ;;
--	*)
--          SHARED_LIBADD="-Wl,`pwd`/../bfd/.libs/libbfd.so ${SHARED_LIBADD}"
--	  ;;
--      esac
+-      SHARED_LIBADD="../bfd/libbfd.la ${SHARED_LIBADD}"
 -      SHARED_DEPENDENCIES="../bfd/libbfd.la"
 +      SHARED_LIBADD="-lbfd ${SHARED_LIBADD}"
        ;;
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 8d759457fa111..67a5568ee64a4 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -2,64 +2,77 @@ let
   execFormatIsELF = platform: platform.parsed.kernel.execFormat.name == "elf";
 in
 
-{ stdenv, lib, buildPackages
-, fetchFromGitHub, fetchurl, zlib, autoreconfHook, gettext
-# Enabling all targets increases output size to a multiple.
-, withAllTargets ? false, libbfd, libopcodes
-, enableShared ? !stdenv.hostPlatform.isStatic
-, noSysDirs
-, gold ? execFormatIsELF stdenv.targetPlatform
-, bison ? null
+{ stdenv
+, autoreconfHook
+, autoconf269, automake, libtool
+, bison
+, buildPackages
+, fetchFromGitHub
+, fetchurl
 , flex
-, texinfo
+, gettext
+, lib
+, noSysDirs
 , perl
+, texinfo
+, zlib
+
+, enableGold ? execFormatIsELF stdenv.targetPlatform
+, enableShared ? !stdenv.hostPlatform.isStatic
+  # WARN: Enabling all targets increases output size to a multiple.
+, withAllTargets ? false, libbfd, libopcodes
 }:
 
-# configure silently disables ld.gold if it's unsupported,
-# so we need to make sure that intent matches result ourselves.
-assert gold -> execFormatIsELF stdenv.targetPlatform;
+# WARN: configure silently disables ld.gold if it's unsupported, so we need to
+# make sure that intent matches result ourselves.
+assert enableGold -> execFormatIsELF stdenv.targetPlatform;
 
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
 
 let
-  reuseLibs = enableShared && withAllTargets;
-
-  version = "2.35.2";
-  basename = "binutils";
-  # The targetPrefix prepended to binary names to allow multiple binuntils on the
-  # PATH to both be usable.
-  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
-                  "${stdenv.targetPlatform.config}-";
-  vc4-binutils-src = fetchFromGitHub {
-    owner = "itszor";
-    repo = "binutils-vc4";
-    rev = "708acc851880dbeda1dd18aca4fd0a95b2573b36";
-    sha256 = "1kdrz6fki55lm15rwwamn74fnqpy0zlafsida2zymk76n3656c63";
+  inherit (stdenv) buildPlatform hostPlatform targetPlatform;
+
+  version = "2.38";
+
+  srcs = {
+    normal = fetchurl {
+      url = "mirror://gnu/binutils/binutils-${version}.tar.bz2";
+      sha256 = "sha256-Bw7HHPB3pqWOC5WfBaCaNQFTeMLYpR6Q866r/jBZDvg=";
+    };
+    vc4-none = fetchFromGitHub {
+      owner = "itszor";
+      repo = "binutils-vc4";
+      rev = "708acc851880dbeda1dd18aca4fd0a95b2573b36";
+      sha256 = "1kdrz6fki55lm15rwwamn74fnqpy0zlafsida2zymk76n3656c63";
+    };
   };
-  # HACK to ensure that we preserve source from bootstrap binutils to not rebuild LLVM
-  normal-src = stdenv.__bootPackages.binutils-unwrapped.src or (fetchurl {
-    url = "mirror://gnu/binutils/${basename}-${version}.tar.bz2";
-    sha256 = "sha256-z6dkTb7PRZHhNutAfBwdoWV4vSsD8MLorNzroZS7nWE=";
-  });
+
+  #INFO: The targetPrefix prepended to binary names to allow multiple binuntils
+  # on the PATH to both be usable.
+  targetPrefix = lib.optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-";
 in
 
 stdenv.mkDerivation {
-  pname = targetPrefix + basename;
+  pname = targetPrefix + "binutils";
   inherit version;
 
-  src = if stdenv.targetPlatform.isVc4 then vc4-binutils-src else normal-src;
+  # HACK: Ensure that we preserve source from bootstrap binutils to not rebuild LLVM
+  src = stdenv.__bootPackages.binutils-unwrapped.src
+    or srcs.${targetPlatform.system}
+    or srcs.normal;
 
+  # WARN: this package is used for bootstrapping fetchurl, and thus cannot use
+  # fetchpatch! All mutable patches (generated by GitHub or cgit) that are
+  # needed here should be included directly in Nixpkgs as files.
   patches = [
     # Make binutils output deterministic by default.
     ./deterministic.patch
 
-    # Help bfd choose between elf32-littlearm, elf32-littlearm-symbian, and
-    # elf32-littlearm-vxworks in favor of the first.
-    # https://github.com/NixOS/nixpkgs/pull/30484#issuecomment-345472766
-    ./disambiguate-arm-targets.patch
+
+    # Breaks nm BSD flag detection
+    ./0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch
+
+    # Required for newer macos versions
+    ./0001-libtool.m4-update-macos-version-detection-block.patch
 
     # For some reason bfd ld doesn't search DT_RPATH when cross-compiling. It's
     # not clear why this behavior was decided upon but it has the unfortunate
@@ -68,34 +81,17 @@ stdenv.mkDerivation {
     # override this behavior, forcing ld to search DT_RPATH even when
     # cross-compiling.
     ./always-search-rpath.patch
-
-    # Fix quadratic slowdown in `strip` performance.
-    # See #129467 and https://sourceware.org/bugzilla/show_bug.cgi?id=28058
-    # Remove when we're on binutils > 2.36.1.
-    # The patch is downloaded from
-    #     https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff_plain;f=bfd/elf.c;h=af62aadc3d446cd5b1f0201b207c90c22e7809b1;hp=36733e080dd9d9be28b576b246aaf5bd8c8569c7;hb=84fd26d8209e99fc3a432dd0b09b6c053de1ce65;hpb=abe2a28aaa7a2bfd0f3061c72a98eb898976b721
-    # which is the 2.36 backport (using `TRUE` instead of `true` of binutils master commit:
-    #     https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=956ea65cd707707c0f725930214cbc781367a831
-    ./bfd-elf-Dont-read-non-existing-secondary-relocs.patch
-
-    # Fix building plv8’s v8.
-    # https://github.com/NixOS/nixpkgs/issues/134190
-    # Obtained from: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=586e30940e640f67bd55bd72e1d1355a4faf8079
-    ./gold-Update-GNU_PROPERTY_X86_XXX-macros.patch
-
-    ./CVE-2020-35448.patch
-    ./CVE-2021-3487.patch
-    ./CVE-2021-45078.patch
-  ] ++ lib.optional stdenv.targetPlatform.isiOS ./support-ios.patch
-    ++ # This patch was suggested by Nick Clifton to fix
-       # https://sourceware.org/bugzilla/show_bug.cgi?id=16177
-       # It can be removed when that 7-year-old bug is closed.
-       # This binutils bug causes GHC to emit broken binaries on armv7, and
-       # indeed GHC will refuse to compile with a binutils suffering from it. See
-       # this comment for more information:
-       # https://gitlab.haskell.org/ghc/ghc/issues/4210#note_78333
-       lib.optional (stdenv.targetPlatform.isAarch32 && stdenv.hostPlatform.system != stdenv.targetPlatform.system) ./R_ARM_COPY.patch
-    ++ lib.optional stdenv.targetPlatform.isWindows ./windres-locate-gcc.patch;
+  ]
+  ++ lib.optional targetPlatform.isiOS ./support-ios.patch
+  # This patch was suggested by Nick Clifton to fix
+  # https://sourceware.org/bugzilla/show_bug.cgi?id=16177
+  # It can be removed when that 7-year-old bug is closed.
+  # This binutils bug causes GHC to emit broken binaries on armv7, and indeed
+  # GHC will refuse to compile with a binutils suffering from it. See this
+  # comment for more information:
+  # https://gitlab.haskell.org/ghc/ghc/issues/4210#note_78333
+  ++ lib.optional (targetPlatform.isAarch32 && hostPlatform.system != targetPlatform.system) ./R_ARM_COPY.patch
+  ++ lib.optional targetPlatform.isWindows ./windres-locate-gcc.patch;
 
   outputs = [ "out" "info" "man" ];
 
@@ -104,14 +100,26 @@ stdenv.mkDerivation {
     bison
     perl
     texinfo
-  ] ++ (lib.optionals stdenv.targetPlatform.isiOS [
-    autoreconfHook
-  ]) ++ lib.optionals stdenv.targetPlatform.isVc4 [ flex ];
+  ]
+  ++ lib.optionals targetPlatform.isiOS [ autoreconfHook ]
+  ++ lib.optionals targetPlatform.isDarwin [ autoconf269 automake gettext libtool ]
+  ++ lib.optionals targetPlatform.isVc4 [ flex ]
+  ;
+
   buildInputs = [ zlib gettext ];
 
   inherit noSysDirs;
 
-  preConfigure = ''
+  preConfigure = (lib.optionalString targetPlatform.isDarwin ''
+    for i in */configure.ac; do
+      pushd "$(dirname "$i")"
+      echo "Running autoreconf in $PWD"
+      # autoreconf doesn't work, don't know why
+      # autoreconf ''${autoreconfFlags:---install --force --verbose}
+      autoconf
+      popd
+    done
+  '') + ''
     # Clear the default library search path.
     if test "$noSysDirs" = "1"; then
         echo 'NATIVE_LIB_DIRS=' >> ld/configure.tgt
@@ -126,7 +134,8 @@ stdenv.mkDerivation {
 
   # As binutils takes part in the stdenv building, we don't want references
   # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-  NIX_CFLAGS_COMPILE = if stdenv.hostPlatform.isDarwin
+  NIX_CFLAGS_COMPILE =
+    if hostPlatform.isDarwin
     then "-Wno-string-plus-int -Wno-deprecated-declarations"
     else "-static-libgcc";
 
@@ -134,11 +143,7 @@ stdenv.mkDerivation {
 
   configurePlatforms = [ "build" "host" "target" ];
 
-  configureFlags =
-    (if enableShared then [ "--enable-shared" "--disable-static" ]
-                     else [ "--disable-shared" "--enable-static" ])
-  ++ lib.optional withAllTargets "--enable-targets=all"
-  ++ [
+  configureFlags = [
     "--enable-64-bit-bfd"
     "--with-system-zlib"
 
@@ -151,35 +156,40 @@ stdenv.mkDerivation {
     # RUNPATH can be overriden using LD_LIBRARY_PATH at runtime.
     "--enable-new-dtags"
 
-    # force target prefix. Some versions of binutils will make it empty
-    # if `--host` and `--target` are too close, even if Nixpkgs thinks
-    # the platforms are different (e.g. because not all the info makes
-    # the `config`). Other versions of binutils will always prefix if
-    # `--target` is passed, even if `--host` and `--target` are the same.
-    # The easiest thing for us to do is not leave it to chance, and force
-    # the program prefix to be what we want it to be.
+    # force target prefix. Some versions of binutils will make it empty if
+    # `--host` and `--target` are too close, even if Nixpkgs thinks the
+    # platforms are different (e.g. because not all the info makes the
+    # `config`). Other versions of binutils will always prefix if `--target` is
+    # passed, even if `--host` and `--target` are the same. The easiest thing
+    # for us to do is not leave it to chance, and force the program prefix to be
+    # what we want it to be.
     "--program-prefix=${targetPrefix}"
-  ] ++ lib.optionals gold [
-    "--enable-gold"
-    "--enable-plugins"
-  ];
-
-  doCheck = false; # fails
-
-  postFixup = lib.optionalString reuseLibs ''
+  ]
+  ++ lib.optionals withAllTargets [ "--enable-targets=all" ]
+  ++ lib.optionals enableGold [ "--enable-gold" "--enable-plugins" ]
+  ++ (if enableShared
+      then [ "--enable-shared" "--disable-static" ]
+      else [ "--disable-shared" "--enable-static" ])
+  ;
+
+  # Fails
+  doCheck = false;
+
+  postFixup = lib.optionalString (enableShared && withAllTargets) ''
     rm "$out"/lib/lib{bfd,opcodes}-${version}.so
     ln -s '${lib.getLib libbfd}/lib/libbfd-${version}.so' "$out/lib/"
     ln -s '${lib.getLib libopcodes}/lib/libopcodes-${version}.so' "$out/lib/"
   '';
 
-  # else fails with "./sanity.sh: line 36: $out/bin/size: not found"
-  doInstallCheck = stdenv.buildPlatform == stdenv.hostPlatform && stdenv.hostPlatform == stdenv.targetPlatform;
+  # INFO: Otherwise it fails with:
+  # `./sanity.sh: line 36: $out/bin/size: not found`
+  doInstallCheck = (buildPlatform == hostPlatform) && (hostPlatform == targetPlatform);
 
   enableParallelBuilding = true;
 
   passthru = {
     inherit targetPrefix;
-    hasGold = gold;
+    hasGold = enableGold;
     isGNU = true;
   };
 
@@ -193,11 +203,11 @@ stdenv.mkDerivation {
     '';
     homepage = "https://www.gnu.org/software/binutils/";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ericson2314 ];
+    maintainers = with maintainers; [ ericson2314 lovesegfault ];
     platforms = platforms.unix;
 
-    /* Give binutils a lower priority than gcc-wrapper to prevent a
-       collision due to the ld/as wrappers/symlinks in the latter. */
+    # INFO: Give binutils a lower priority than gcc-wrapper to prevent a
+    # collision due to the ld/as wrappers/symlinks in the latter.
     priority = 10;
   };
 }
diff --git a/pkgs/development/tools/misc/binutils/disambiguate-arm-targets.patch b/pkgs/development/tools/misc/binutils/disambiguate-arm-targets.patch
deleted file mode 100644
index abbfa73da05dc..0000000000000
--- a/pkgs/development/tools/misc/binutils/disambiguate-arm-targets.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-diff --git a/bfd/elf32-arm.c b/bfd/elf32-arm.c
-index 9f956d3..f5b61f1 100644
---- a/bfd/elf32-arm.c
-+++ b/bfd/elf32-arm.c
-@@ -19585,7 +19585,10 @@ elf32_arm_vxworks_final_write_processing (bfd *abfd, bfd_boolean linker)
- #undef  ELF_MAXPAGESIZE
- #define ELF_MAXPAGESIZE			0x1000
- 
-+/* Prioritize elf32-*arm (priority 1) over elf32-*arm-vxworks (priority 2) */
-+#define elf_match_priority 2
- #include "elf32-target.h"
-+#undef  elf_match_priority
- 
- 
- /* Merge backend specific data from an object file to the output
-@@ -19974,4 +19977,7 @@ elf32_arm_symbian_plt_sym_val (bfd_vma i, const asection *plt,
- #undef  ELF_MAXPAGESIZE
- #define ELF_MAXPAGESIZE			0x8000
- 
-+/* Prioritize elf32-*arm (priority 1) over elf32-*arm-symbian (priority 2) */
-+#define elf_match_priority 2
- #include "elf32-target.h"
-+#undef  elf_match_priority
diff --git a/pkgs/development/tools/misc/binutils/gold-Update-GNU_PROPERTY_X86_XXX-macros.patch b/pkgs/development/tools/misc/binutils/gold-Update-GNU_PROPERTY_X86_XXX-macros.patch
deleted file mode 100644
index c4eef87a0c8d7..0000000000000
--- a/pkgs/development/tools/misc/binutils/gold-Update-GNU_PROPERTY_X86_XXX-macros.patch
+++ /dev/null
@@ -1,292 +0,0 @@
-From 586e30940e640f67bd55bd72e1d1355a4faf8079 Mon Sep 17 00:00:00 2001
-From: "H.J. Lu" <hjl.tools@gmail.com>
-Date: Tue, 13 Oct 2020 05:20:49 -0700
-Subject: [PATCH] gold: Update GNU_PROPERTY_X86_XXX macros
-
-This patch updates GNU_PROPERTY_X86_XXX macros for gold:
-
-1. GNU_PROPERTY_X86_UINT32_AND_XXX: A 4-byte unsigned integer property.
-A bit is set if it is set in all relocatable inputs:
-
- #define GNU_PROPERTY_X86_UINT32_AND_LO      0xc0000002
- #define GNU_PROPERTY_X86_UINT32_AND_HI      0xc0007fff
-
-2. GNU_PROPERTY_X86_UINT32_OR_XXX: A 4-byte unsigned integer property.
-A bit is set if it is set in any relocatable inputs:
-
- #define GNU_PROPERTY_X86_UINT32_OR_LO    0xc0008000
- #define GNU_PROPERTY_X86_UINT32_OR_HI    0xc000ffff
-
-3. GNU_PROPERTY_X86_UINT32_OR_AND_XXX: A 4-byte unsigned integer property.
-A bit is set if it is set in any relocatable inputs and the property is
-present in all relocatable inputs:
-
- #define GNU_PROPERTY_X86_UINT32_OR_AND_LO   0xc0010000
- #define GNU_PROPERTY_X86_UINT32_OR_AND_HI   0xc0017fff
-
-4. GNU_PROPERTY_X86_FEATURE_2_NEEDED, GNU_PROPERTY_X86_FEATURE_2_USED
-and GNU_PROPERTY_X86_FEATURE_2_XXX bits.
-
-GNU_PROPERTY_X86_FEATURE_1_AND is unchanged.  GNU_PROPERTY_X86_ISA_1_USED
-and GNU_PROPERTY_X86_ISA_1_NEEDED are updated to better support targeted
-processors since GNU_PROPERTY_X86_ISA_1_?86 aren't isn't very useful.
-A new set of GNU_PROPERTY_X86_ISA_1_XXX bits are defined.  The previous
-GNU_PROPERTY_X86_ISA_1_XXX macros are deprecated and renamed to
-GNU_PROPERTY_X86_COMPAT_ISA_1_XXX and GNU_PROPERTY_X86_COMPAT_2_ISA_1_XXX.
-
-elfcpp/
-
-	* elfcpp.h (GNU_PROPERTY_X86_ISA_1_USED): Renamed to ...
-	(GNU_PROPERTY_X86_COMPAT_ISA_1_USED): This.
-	(GNU_PROPERTY_X86_ISA_1_NEEDED): Renamed to ...
-	(GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED): This.
-	(GNU_PROPERTY_X86_UINT32_AND_LO): New.
-	(GNU_PROPERTY_X86_UINT32_AND_HI): Likewise.
-	(GNU_PROPERTY_X86_UINT32_OR_LO): Likewise.
-	(GNU_PROPERTY_X86_UINT32_OR_HI): Likewise.
-	(GNU_PROPERTY_X86_UINT32_OR_AND_LO): Likewise.
-	(GNU_PROPERTY_X86_UINT32_OR_AND_HI): Likewise.
-	(GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED): New.
-	(GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED): Likewise.
-	(GNU_PROPERTY_X86_FEATURE_1_AND): Updated to
-	(GNU_PROPERTY_X86_UINT32_AND_LO + 0).
-	(GNU_PROPERTY_X86_ISA_1_NEEDED): New.  Defined to
-	GNU_PROPERTY_X86_UINT32_OR_LO + 2.
-	(GNU_PROPERTY_X86_FEATURE_2_NEEDED): New.  Defined to
-	(GNU_PROPERTY_X86_UINT32_OR_LO + 1).
-	(GNU_PROPERTY_X86_ISA_1_USED): New.  Defined to
-	GNU_PROPERTY_X86_UINT32_OR_AND_LO + 2.
-	(GNU_PROPERTY_X86_FEATURE_2_USED): New.  Defined to
-	(GNU_PROPERTY_X86_UINT32_OR_AND_LO + 1).
-
-gold/
-
-	* x86_64.cc (Target_x86_64::Target_x86_64): Initialize
-	feature_2_used_, feature_2_needed_ and object_feature_2_used_.
-	(Target_x86_64::feature_2_used_): New data member.
-	(Target_x86_64::feature_2_needed_): Likewise.
-	(Target_x86_64::object_isa_1_used_): Likewise.
-	(Target_x86_64::record_gnu_property): Support
-	GNU_PROPERTY_X86_COMPAT_ISA_1_USED,
-	GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED,
-	GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED,
-	GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED,
-	GNU_PROPERTY_X86_FEATURE_2_USED and
-	GNU_PROPERTY_X86_FEATURE_2_NEEDED.
-	(Target_x86_64::merge_gnu_properties): Merge FEATURE_2_USED bits.
-	Initialize object_feature_2_used_.
-	(Target_x86_64::do_finalize_gnu_properties): Support
-	GNU_PROPERTY_X86_FEATURE_2_USED and
-	GNU_PROPERTY_X86_FEATURE_2_NEEDED.
-	* testsuite/gnu_property_a.S (GNU_PROPERTY_X86_ISA_1_USED): Set
-	to 0xc0010002.
-	(GNU_PROPERTY_X86_ISA_1_NEEDED): Set to 0xc0008002.
-	* testsuite/gnu_property_b.S (GNU_PROPERTY_X86_ISA_1_USED): Set
-	to 0xc0010002.
-	(GNU_PROPERTY_X86_ISA_1_NEEDED): Set to 0xc0008002.
-	* testsuite/gnu_property_c.S (GNU_PROPERTY_X86_ISA_1_USED): Set
-	to 0xc0010002.
-	(GNU_PROPERTY_X86_ISA_1_NEEDED): Set to 0xc0008002.
-	* testsuite/gnu_property_test.sh: Updated.
----
- elfcpp/ChangeLog                    | [omitted]
- elfcpp/elfcpp.h                     | 18 ++++++++++++---
- gold/ChangeLog                      | [omitted]
- gold/testsuite/gnu_property_a.S     |  4 ++--
- gold/testsuite/gnu_property_b.S     |  4 ++--
- gold/testsuite/gnu_property_c.S     |  4 ++--
- gold/testsuite/gnu_property_test.sh |  4 ++--
- gold/x86_64.cc                      | 34 +++++++++++++++++++++++++++--
- 8 files changed, 110 insertions(+), 13 deletions(-)
-
-diff --git a/elfcpp/elfcpp.h b/elfcpp/elfcpp.h
-index 65d803c00e2..4b6ff94a654 100644
---- a/elfcpp/elfcpp.h
-+++ b/elfcpp/elfcpp.h
-@@ -1013,9 +1013,21 @@ enum
-   GNU_PROPERTY_STACK_SIZE = 1,
-   GNU_PROPERTY_NO_COPY_ON_PROTECTED = 2,
-   GNU_PROPERTY_LOPROC = 0xc0000000,
--  GNU_PROPERTY_X86_ISA_1_USED = 0xc0000000,
--  GNU_PROPERTY_X86_ISA_1_NEEDED = 0xc0000001,
--  GNU_PROPERTY_X86_FEATURE_1_AND = 0xc0000002,
-+  GNU_PROPERTY_X86_COMPAT_ISA_1_USED = 0xc0000000,
-+  GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED = 0xc0000001,
-+  GNU_PROPERTY_X86_UINT32_AND_LO = 0xc0000002,
-+  GNU_PROPERTY_X86_UINT32_AND_HI = 0xc0007fff,
-+  GNU_PROPERTY_X86_UINT32_OR_LO = 0xc0008000,
-+  GNU_PROPERTY_X86_UINT32_OR_HI = 0xc000ffff,
-+  GNU_PROPERTY_X86_UINT32_OR_AND_LO = 0xc0010000,
-+  GNU_PROPERTY_X86_UINT32_OR_AND_HI = 0xc0017fff,
-+  GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 0,
-+  GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 0,
-+  GNU_PROPERTY_X86_FEATURE_1_AND = GNU_PROPERTY_X86_UINT32_AND_LO + 0,
-+  GNU_PROPERTY_X86_ISA_1_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 2,
-+  GNU_PROPERTY_X86_FEATURE_2_NEEDED = GNU_PROPERTY_X86_UINT32_OR_LO + 1,
-+  GNU_PROPERTY_X86_ISA_1_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 2,
-+  GNU_PROPERTY_X86_FEATURE_2_USED = GNU_PROPERTY_X86_UINT32_OR_AND_LO + 1,
-   GNU_PROPERTY_HIPROC = 0xdfffffff,
-   GNU_PROPERTY_LOUSER = 0xe0000000,
-   GNU_PROPERTY_HIUSER = 0xffffffff
-diff --git a/gold/testsuite/gnu_property_a.S b/gold/testsuite/gnu_property_a.S
-index 463bc8e52fe..5fbbbc9c4bb 100644
---- a/gold/testsuite/gnu_property_a.S
-+++ b/gold/testsuite/gnu_property_a.S
-@@ -1,8 +1,8 @@
- #define NT_GNU_PROPERTY_TYPE_0 5
- 
- #define GNU_PROPERTY_STACK_SIZE 1
--#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
--#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
-+#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
-+#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
- #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
- 
- #if __SIZEOF_PTRDIFF_T__  == 8
-diff --git a/gold/testsuite/gnu_property_b.S b/gold/testsuite/gnu_property_b.S
-index 0c0c038ead1..7028f73d7ab 100644
---- a/gold/testsuite/gnu_property_b.S
-+++ b/gold/testsuite/gnu_property_b.S
-@@ -2,8 +2,8 @@
- 
- #define GNU_PROPERTY_STACK_SIZE 1
- #define GNU_PROPERTY_NO_COPY_ON_PROTECTED 2
--#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
--#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
-+#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
-+#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
- #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
- 
- #if __SIZEOF_PTRDIFF_T__  == 8
-diff --git a/gold/testsuite/gnu_property_c.S b/gold/testsuite/gnu_property_c.S
-index ace159a9a9d..c8cbd8bce28 100644
---- a/gold/testsuite/gnu_property_c.S
-+++ b/gold/testsuite/gnu_property_c.S
-@@ -2,8 +2,8 @@
- 
- #define GNU_PROPERTY_STACK_SIZE 1
- #define GNU_PROPERTY_NO_COPY_ON_PROTECTED 2
--#define GNU_PROPERTY_X86_ISA_1_USED 0xc0000000
--#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0000001
-+#define GNU_PROPERTY_X86_ISA_1_USED 0xc0010002
-+#define GNU_PROPERTY_X86_ISA_1_NEEDED 0xc0008002
- #define GNU_PROPERTY_X86_FEATURE_1_AND 0xc0000002
- 
- #if __SIZEOF_PTRDIFF_T__  == 8
-diff --git a/gold/testsuite/gnu_property_test.sh b/gold/testsuite/gnu_property_test.sh
-index 1806d3474cc..a4096005b78 100755
---- a/gold/testsuite/gnu_property_test.sh
-+++ b/gold/testsuite/gnu_property_test.sh
-@@ -77,8 +77,8 @@ check_count gnu_property_test.stdout "^  NOTE" 2
- 
- check gnu_property_test.stdout "stack size: 0x111100"
- check gnu_property_test.stdout "no copy on protected"
--check gnu_property_test.stdout "x86 ISA used: i486, SSE2, SSE4_2, AVX512CD"
--check gnu_property_test.stdout "x86 ISA needed: i486, SSE2, SSE4_2, AVX512CD"
-+check gnu_property_test.stdout "x86 ISA used: x86-64-v2, <unknown: 10>, <unknown: 100>, <unknown: 1000>"
-+check gnu_property_test.stdout "x86 ISA needed: x86-64-v2, <unknown: 10>, <unknown: 100>, <unknown: 1000>"
- check gnu_property_test.stdout "x86 feature: IBT"
- 
- exit 0
-diff --git a/gold/x86_64.cc b/gold/x86_64.cc
-index 9cb2cf0a322..378bac16f78 100644
---- a/gold/x86_64.cc
-+++ b/gold/x86_64.cc
-@@ -706,8 +706,9 @@ class Target_x86_64 : public Sized_target<size, false>
-       rela_irelative_(NULL), copy_relocs_(elfcpp::R_X86_64_COPY),
-       got_mod_index_offset_(-1U), tlsdesc_reloc_info_(),
-       tls_base_symbol_defined_(false), isa_1_used_(0), isa_1_needed_(0),
--      feature_1_(0), object_isa_1_used_(0), object_feature_1_(0),
--      seen_first_object_(false)
-+      feature_1_(0), feature_2_used_(0), feature_2_needed_(0),
-+      object_isa_1_used_(0), object_feature_1_(0),
-+      object_feature_2_used_(0), seen_first_object_(false)
-   { }
- 
-   // Hook for a new output section.
-@@ -1382,6 +1383,8 @@ class Target_x86_64 : public Sized_target<size, false>
-   uint32_t isa_1_used_;
-   uint32_t isa_1_needed_;
-   uint32_t feature_1_;
-+  uint32_t feature_2_used_;
-+  uint32_t feature_2_needed_;
-   // Target-specific properties from the current object.
-   // These bits get ORed into ISA_1_USED_ after all properties for the object
-   // have been processed. But if either is all zeroes (as when the property
-@@ -1391,6 +1394,7 @@ class Target_x86_64 : public Sized_target<size, false>
-   // These bits get ANDed into FEATURE_1_ after all properties for the object
-   // have been processed.
-   uint32_t object_feature_1_;
-+  uint32_t object_feature_2_used_;
-   // Whether we have seen our first object, for use in initializing FEATURE_1_.
-   bool seen_first_object_;
- };
-@@ -1594,9 +1598,15 @@ Target_x86_64<size>::record_gnu_property(
- 
-   switch (pr_type)
-     {
-+    case elfcpp::GNU_PROPERTY_X86_COMPAT_ISA_1_USED:
-+    case elfcpp::GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED:
-+    case elfcpp::GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED:
-+    case elfcpp::GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED:
-     case elfcpp::GNU_PROPERTY_X86_ISA_1_USED:
-     case elfcpp::GNU_PROPERTY_X86_ISA_1_NEEDED:
-     case elfcpp::GNU_PROPERTY_X86_FEATURE_1_AND:
-+    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED:
-+    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED:
-       if (pr_datasz != 4)
- 	{
- 	  gold_warning(_("%s: corrupt .note.gnu.property section "
-@@ -1625,6 +1635,12 @@ Target_x86_64<size>::record_gnu_property(
-       // If we see multiple feature props in one object, OR them together.
-       this->object_feature_1_ |= val;
-       break;
-+    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED:
-+      this->object_feature_2_used_ |= val;
-+      break;
-+    case elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED:
-+      this->feature_2_needed_ |= val;
-+      break;
-     }
- }
- 
-@@ -1642,15 +1658,23 @@ Target_x86_64<size>::merge_gnu_properties(const Object*)
-       else if (this->isa_1_used_ != 0)
- 	this->isa_1_used_ |= this->object_isa_1_used_;
-       this->feature_1_ &= this->object_feature_1_;
-+      // If any object is missing the FEATURE_2_USED property, we must
-+      // omit it from the output file.
-+      if (this->object_feature_2_used_ == 0)
-+	this->feature_2_used_ = 0;
-+      else if (this->feature_2_used_ != 0)
-+	this->feature_2_used_ |= this->object_feature_2_used_;
-     }
-   else
-     {
-       this->isa_1_used_ = this->object_isa_1_used_;
-       this->feature_1_ = this->object_feature_1_;
-+      this->feature_2_used_ = this->object_feature_2_used_;
-       this->seen_first_object_ = true;
-     }
-   this->object_isa_1_used_ = 0;
-   this->object_feature_1_ = 0;
-+  this->object_feature_2_used_ = 0;
- }
- 
- static inline void
-@@ -1676,6 +1700,12 @@ Target_x86_64<size>::do_finalize_gnu_properties(Layout* layout) const
-   if (this->feature_1_ != 0)
-     add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_1_AND,
- 		 this->feature_1_);
-+  if (this->feature_2_used_ != 0)
-+    add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_2_USED,
-+		 this->feature_2_used_);
-+  if (this->feature_2_needed_ != 0)
-+    add_property(layout, elfcpp::GNU_PROPERTY_X86_FEATURE_2_NEEDED,
-+		 this->feature_2_needed_);
- }
- 
- // Write the first three reserved words of the .got.plt section.
--- 
-2.27.0
-
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index db1c13da2f987..491afd68bbb94 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/rui314/mold";
     license = lib.licenses.agpl3Plus;
     maintainers = with maintainers; [ nitsky ];
-    broken = stdenv.isAarch64;
+    platforms = platforms.unix;
+    # error: aligned deallocation function of type 'void (void *, std::align_val_t) noexcept' is only available on macOS 10.14 or newer
+    broken = stdenv.isAarch64 || stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index 6e8f67bd0a544..a4f02023bb059 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-cbindgen";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "eqrion";
     repo = "cbindgen";
     rev = "v${version}";
-    sha256 = "sha256-BLiAFYkqVJSpeNPW7UF2PpAttd6ADGeQ9yneiVfNi4g=";
+    sha256 = "sha256-WvCGAjFxjaql/y35QfHyHvwbEL4pKtlc3JO2NecqQCM=";
   };
 
-  cargoSha256 = "sha256-P58qANcl0mYqJDP1QnSx560y8BLH+ePTZ+uHuix89R4=";
+  cargoSha256 = "sha256-Kl2/u+ttPn1k7f3+XRCord4u+c4QZ80/Okb40XeyeIk=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
diff --git a/pkgs/games/airstrike/default.nix b/pkgs/games/airstrike/default.nix
index 12b485764a5b1..8441ac7a2feef 100644
--- a/pkgs/games/airstrike/default.nix
+++ b/pkgs/games/airstrike/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     cp -r data airstrikerc $out/share
 
     wrapProgram $out/bin/airstrike \
-      --run "cd $out/share"
+      --chdir "$out/share"
   '';
 
   meta = with lib; {
diff --git a/pkgs/games/assaultcube/default.nix b/pkgs/games/assaultcube/default.nix
index 1013be2694e93..4a0951d0964cc 100644
--- a/pkgs/games/assaultcube/default.nix
+++ b/pkgs/games/assaultcube/default.nix
@@ -52,13 +52,13 @@ stdenv.mkDerivation rec {
       install -Dpm644 packages/misc/icon.png $out/share/pixmaps/assaultcube.png
 
       makeWrapper $out/bin/ac_client $out/bin/${pname} \
-        --run "cd $out/$gamedatadir" --add-flags "--home=\$HOME/.assaultcube/v1.2next --init"
+        --chdir "$out/$gamedatadir" --add-flags "--home=\$HOME/.assaultcube/v1.2next --init"
     fi
 
     if (test -e source/src/ac_server) then
       cp source/src/ac_server $bindir
       makeWrapper $out/bin/ac_server $out/bin/${pname}-server \
-        --run "cd $out/$gamedatadir" --add-flags "-Cconfig/servercmdline.txt"
+        --chdir "$out/$gamedatadir" --add-flags "-Cconfig/servercmdline.txt"
     fi
     '';
 
diff --git a/pkgs/games/domination/default.nix b/pkgs/games/domination/default.nix
index b7eae5e5acd63..8ef45b8501982 100644
--- a/pkgs/games/domination/default.nix
+++ b/pkgs/games/domination/default.nix
@@ -63,10 +63,10 @@ in stdenv.mkDerivation {
     # Reimplement the two launchers mentioned in Unix_shortcutSpec.xml with makeWrapper
     mkdir -p $out/bin
     makeWrapper ${jre}/bin/java $out/bin/domination \
-      --run "cd $out/share/domination" \
+      --chdir "$out/share/domination" \
       --add-flags "-jar $out/share/domination/Domination.jar"
     makeWrapper ${jre}/bin/java $out/bin/domination-map-editor \
-      --run "cd $out/share/domination" \
+      --chdir "$out/share/domination" \
       --add-flags "-cp $out/share/domination/Domination.jar net.yura.domination.ui.swinggui.SwingGUIFrame"
 
     install -Dm644 \
diff --git a/pkgs/games/flare/default.nix b/pkgs/games/flare/default.nix
index 3567a5886055d..c849b879ea32e 100644
--- a/pkgs/games/flare/default.nix
+++ b/pkgs/games/flare/default.nix
@@ -11,7 +11,7 @@ buildEnv {
   nativeBuildInputs = [ makeWrapper ];
   postBuild = ''
     mkdir -p $out/bin
-    makeWrapper $out/games/flare $out/bin/flare --run "cd $out/share/games/flare"
+    makeWrapper $out/games/flare $out/bin/flare --chdir "$out/share/games/flare"
   '';
 
   meta = with lib; {
diff --git a/pkgs/games/frogatto/default.nix b/pkgs/games/frogatto/default.nix
index f987992858da9..fa6b46e0751fb 100644
--- a/pkgs/games/frogatto/default.nix
+++ b/pkgs/games/frogatto/default.nix
@@ -30,7 +30,7 @@ in buildEnv {
 
   postBuild = ''
     wrapProgram $out/bin/frogatto \
-      --run "cd $out/share/frogatto"
+      --chdir "$out/share/frogatto"
   '';
 
   meta = with lib; {
diff --git a/pkgs/games/iortcw/default.nix b/pkgs/games/iortcw/default.nix
index 8af3dfe31f68a..9da055acc2184 100644
--- a/pkgs/games/iortcw/default.nix
+++ b/pkgs/games/iortcw/default.nix
@@ -17,7 +17,7 @@ in buildEnv {
   # so we can launch sp from mp game and vice versa
   postBuild = ''
     for i in `find -L $out/opt/iortcw -maxdepth 1 -type f -executable`; do
-      makeWrapper $i $out/bin/`basename $i` --run "cd $out/opt/iortcw"
+      makeWrapper $i $out/bin/`basename $i` --chdir "$out/opt/iortcw"
     done
   '';
 
diff --git a/pkgs/games/iortcw/sp.nix b/pkgs/games/iortcw/sp.nix
index fa6f73a177b20..d9faa177c17da 100644
--- a/pkgs/games/iortcw/sp.nix
+++ b/pkgs/games/iortcw/sp.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     for i in `find $out/opt/iortcw -maxdepth 1 -type f -executable`; do
-      makeWrapper $i $out/bin/`basename $i` --run "cd $out/opt/iortcw"
+      makeWrapper $i $out/bin/`basename $i` --chdir "$out/opt/iortcw"
     done
   '';
 
diff --git a/pkgs/games/minecraft/default.nix b/pkgs/games/minecraft/default.nix
index 08104310faa3d..dc4cd9087fc2c 100644
--- a/pkgs/games/minecraft/default.nix
+++ b/pkgs/games/minecraft/default.nix
@@ -139,7 +139,7 @@ stdenv.mkDerivation rec {
       --prefix LD_LIBRARY_PATH : ${envLibPath} \
       --prefix PATH : ${lib.makeBinPath [ jre ]} \
       --set JAVA_HOME ${lib.getBin jre} \
-      --run "cd /tmp" \
+      --chdir /tmp \
       "''${gappsWrapperArgs[@]}"
   '';
 
diff --git a/pkgs/games/mudlet/default.nix b/pkgs/games/mudlet/default.nix
index 46ae45b2202b3..f4ca916aa4997 100644
--- a/pkgs/games/mudlet/default.nix
+++ b/pkgs/games/mudlet/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
       --set LUA_CPATH "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \
       --prefix LUA_PATH : "$NIX_LUA_PATH" \
       --prefix LD_LIBRARY_PATH : "${libsForQt5.qtkeychain}/lib/" \
-      --run "cd $out";
+      --chdir "$out";
 
     runHook postInstall
   '';
diff --git a/pkgs/games/nanosaur/default.nix b/pkgs/games/nanosaur/default.nix
index 75e47fa179b9b..0d5ea528a92da 100644
--- a/pkgs/games/nanosaur/default.nix
+++ b/pkgs/games/nanosaur/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mv build $out
-    makeWrapper $out/Nanosaur $out/bin/Nanosaur --run "cd $out"
+    makeWrapper $out/Nanosaur $out/bin/Nanosaur --chdir "$out"
   '';
 
   meta = with lib; {
diff --git a/pkgs/games/openjk/default.nix b/pkgs/games/openjk/default.nix
index d2844809eea87..1e38b37a71532 100644
--- a/pkgs/games/openjk/default.nix
+++ b/pkgs/games/openjk/default.nix
@@ -44,9 +44,9 @@ in stdenv.mkDerivation {
     mkdir -p $out/bin $out/share/applications $out/share/icons/hicolor/128x128/apps
     prefix=$out/opt/JediAcademy
 
-    makeWrapper $prefix/openjk.* $out/bin/jamp --run "cd $prefix"
-    makeWrapper $prefix/openjk_sp.* $out/bin/jasp --run "cd $prefix"
-    makeWrapper $prefix/openjkded.* $out/bin/openjkded --run "cd $prefix"
+    makeWrapper $prefix/openjk.* $out/bin/jamp --chdir "$prefix"
+    makeWrapper $prefix/openjk_sp.* $out/bin/jasp --chdir "$prefix"
+    makeWrapper $prefix/openjkded.* $out/bin/openjkded --chdir "$prefix"
 
     cp $src/shared/icons/OpenJK_Icon_128.png $out/share/icons/hicolor/128x128/apps
     ln -s ${jamp}/share/applications/* $out/share/applications
diff --git a/pkgs/games/openmw/tes3mp.nix b/pkgs/games/openmw/tes3mp.nix
index 37ad603d7cf53..b92c31663fc60 100644
--- a/pkgs/games/openmw/tes3mp.nix
+++ b/pkgs/games/openmw/tes3mp.nix
@@ -131,11 +131,11 @@ symlinkJoin rec {
     dir=\''${XDG_CONFIG_HOME:-\$HOME/.config}/openmw
 
     makeWrapper ${unwrapped}/libexec/tes3mp-browser $out/bin/tes3mp-browser \
-      --run "cd $out/bin"
+      --chdir "$out/bin"
 
     makeWrapper ${unwrapped}/libexec/tes3mp-server $out/bin/tes3mp-server \
       --run "mkdir -p $dir" \
       --run "${crudini}/bin/crudini --merge $dir/${cfgFile.name} < ${cfgFile}" \
-      --run "cd $out/bin"
+      --chdir "$out/bin"
   '';
 }
diff --git a/pkgs/games/openra/common.nix b/pkgs/games/openra/common.nix
index 01bd44ee244ab..67060f9ef3883 100644
--- a/pkgs/games/openra/common.nix
+++ b/pkgs/games/openra/common.nix
@@ -34,7 +34,7 @@ in {
       --set TERM xterm
 
     makeWrapper $out/lib/openra${openraSuffix}/launch-game.sh $(mkdirp $out/bin)/openra${openraSuffix} \
-      --run "cd $out/lib/openra${openraSuffix}"
+      --chdir "$out/lib/openra${openraSuffix}"
   '';
 
   packageAttrs = {
diff --git a/pkgs/games/otto-matic/default.nix b/pkgs/games/otto-matic/default.nix
index e213deabe8593..5dd7f98e4569f 100644
--- a/pkgs/games/otto-matic/default.nix
+++ b/pkgs/games/otto-matic/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/OttoMatic
     mv Data $out/share/OttoMatic
     install -Dm755 {.,$out/bin}/OttoMatic
-    wrapProgram $out/bin/OttoMatic --run "cd $out/share/OttoMatic"
+    wrapProgram $out/bin/OttoMatic --chdir "$out/share/OttoMatic"
 
     runHook postInstall
   '';
diff --git a/pkgs/games/runelite/default.nix b/pkgs/games/runelite/default.nix
index d342d543e2fca..39ff9c137dfb8 100644
--- a/pkgs/games/runelite/default.nix
+++ b/pkgs/games/runelite/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
 
     # RuneLite looks for `.so` files in $PWD/natives, so ensure that we set the PWD to the right place
     makeWrapper ${jre}/bin/java $out/bin/runelite \
-      --run "cd $out" \
+      --chdir "$out" \
       --prefix LD_LIBRARY_PATH : "${xorg.libXxf86vm}/lib" \
       --add-flags "-jar $out/share/runelite/RuneLite.jar"
   '';
diff --git a/pkgs/games/sauerbraten/default.nix b/pkgs/games/sauerbraten/default.nix
index 1d2e39d4164ec..934c590138d9e 100644
--- a/pkgs/games/sauerbraten/default.nix
+++ b/pkgs/games/sauerbraten/default.nix
@@ -56,9 +56,9 @@ stdenv.mkDerivation rec {
     ln -s $out/share/sauerbraten/cube.png $out/share/icon/sauerbraten.png
 
     makeWrapper $out/share/sauerbraten/sauer_server $out/bin/sauerbraten_server \
-      --run "cd $out/share/sauerbraten"
+      --chdir "$out/share/sauerbraten"
     makeWrapper $out/share/sauerbraten/sauer_client $out/bin/sauerbraten_client \
-      --run "cd $out/share/sauerbraten" \
+      --chdir "$out/share/sauerbraten" \
       --add-flags "-q\''${HOME}/.config/sauerbraten"
 
     runHook postInstall
diff --git a/pkgs/games/starsector/default.nix b/pkgs/games/starsector/default.nix
index 95fb3988f28e7..efba43e92dd4f 100644
--- a/pkgs/games/starsector/default.nix
+++ b/pkgs/games/starsector/default.nix
@@ -57,7 +57,8 @@ stdenv.mkDerivation rec {
     wrapProgram $out/starsector.sh \
       --prefix PATH : ${lib.makeBinPath [ openjdk ]} \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs} \
-      --run 'mkdir -p ''${XDG_DATA_HOME:-~/.local/share}/starsector; cd '"$out"
+      --run 'mkdir -p ''${XDG_DATA_HOME:-~/.local/share}/starsector' \
+      --chdir "$out"
     ln -s $out/starsector.sh $out/bin/starsector
 
     runHook postInstall
diff --git a/pkgs/games/tome4/default.nix b/pkgs/games/tome4/default.nix
index 70fbebe084c78..1f148feb9320a 100644
--- a/pkgs/games/tome4/default.nix
+++ b/pkgs/games/tome4/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     install -Dm755 t-engine $dir/t-engine
     cp -r bootstrap game $dir
     makeWrapper $dir/t-engine $out/bin/${pname} \
-      --run "cd $dir"
+      --chdir "$dir"
 
     install -Dm755 ${desktop}/share/applications/${pname}.desktop $out/share/applications/${pname}.desktop
     substituteInPlace $out/share/applications/${pname}.desktop \
diff --git a/pkgs/games/ut2004/wrapper.nix b/pkgs/games/ut2004/wrapper.nix
index bf344372933d4..cc5b0e400bc18 100644
--- a/pkgs/games/ut2004/wrapper.nix
+++ b/pkgs/games/ut2004/wrapper.nix
@@ -38,7 +38,7 @@ in runCommand "ut2004" {
   for i in ${game}/System/*-bin; do
     name="$(basename "$i")"
     makeWrapper $i $out/bin/''${name%-bin} \
-      --run "cd ${game}/System"
+      --chdir "${game}/System"
   done
 
   mkdir -p $out/share/applications
diff --git a/pkgs/games/warsow/default.nix b/pkgs/games/warsow/default.nix
index 81c467dd9db74..007b124ba58ce 100644
--- a/pkgs/games/warsow/default.nix
+++ b/pkgs/games/warsow/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
     mkdir -p $out/bin
     for i in ${warsow-engine}/bin/*; do
-      makeWrapper "$i" "$out/bin/$(basename "$i")" --run "cd $out/share/warsow"
+      makeWrapper "$i" "$out/bin/$(basename "$i")" --chdir "$out/share/warsow"
     done
   '';
 
diff --git a/pkgs/games/zod/default.nix b/pkgs/games/zod/default.nix
index 6bf24ed6cb9fa..ad576b4642436 100644
--- a/pkgs/games/zod/default.nix
+++ b/pkgs/games/zod/default.nix
@@ -44,7 +44,7 @@ let
     installPhase = ''
       mkdir -p $out/bin
       install -m755 zod $out/bin/
-      wrapProgram $out/bin/zod --run "cd ${zod_assets}/usr/lib/commander-zod"
+      wrapProgram $out/bin/zod --chdir "${zod_assets}/usr/lib/commander-zod"
     '';
   };
   zod_map_editor = stdenv.mkDerivation {
@@ -56,7 +56,7 @@ let
     installPhase = ''
       mkdir -p $out/bin
       install -m755 zod_map_editor $out/bin
-      wrapProgram $out/bin/zod_map_editor --run "cd ${zod_assets}/usr/lib/commander-zod"
+      wrapProgram $out/bin/zod_map_editor --chdir "${zod_assets}/usr/lib/commander-zod"
     '';
   };
   zod_launcher = stdenv.mkDerivation {
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index e9762f44dcdca..6d14a3293fca4 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -69,6 +69,13 @@ stdenv.mkDerivation rec {
       sha256 = "0qjq41ridyamajz9v9nyplgq7f8nn3fxw375s9sa5a0igsrx9pm0";
       excludes = [ "ChangeLog" ];
     })
+    # Fix pending upstream inclusion for linux-headers-5.17 support:
+    #  https://github.com/linux-audit/audit-userspace/pull/253
+    (fetchpatch {
+      name = "ignore-flexible-array.patch";
+      url = "https://github.com/linux-audit/audit-userspace/commit/beed138222421a2eb4212d83cb889404bd7efc49.patch";
+      sha256 = "1hf02zaxv6x0wmn4ca9fj48y2shks7vfna43i1zz58xw9jq7sza0";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index ab9b7055fdda4..1f6fb31d93db7 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -22,11 +22,11 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.63";
+  version = "5.64";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-k0nhHoFguz1yCDXScSUNinQk02kPUonm22/gfMZsbXY=";
+    sha256 = "sha256-rkN+ZbazBwwZi8WwEJ/pzeueqjhzgOIHL53mX+ih3jQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/displaylink/default.nix b/pkgs/os-specific/linux/displaylink/default.nix
index e7e572ce18e14..1823613a58a48 100644
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
       --set-rpath ${libPath} \
       $out/bin/DisplayLinkManager
     wrapProgram $out/bin/DisplayLinkManager \
-      --run "cd $out/lib/displaylink"
+      --chdir "$out/lib/displaylink"
 
     # We introduce a dependency on the source file so that it need not be redownloaded everytime
     echo $src >> "$out/share/workspace_dependencies.pin"
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index b418d5c18225c..f6564f1560c1e 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -135,7 +135,7 @@ stdenv.mkDerivation rec {
     mkdir $out/bin
     makeWrapper $out/aesm/aesm_service $out/bin/aesm_service \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
-      --run "cd $out/aesm"
+      --chdir "$out/aesm"
 
     # Make sure we didn't forget to handle any files
     rmdir $sgxPswDir || (echo "Error: The directory $installDir still contains unhandled files: $(ls -A $installDir)" >&2 && exit 1)
diff --git a/pkgs/os-specific/linux/sgx/samples/default.nix b/pkgs/os-specific/linux/sgx/samples/default.nix
index f9c5ae4505450..2afd62de75d49 100644
--- a/pkgs/os-specific/linux/sgx/samples/default.nix
+++ b/pkgs/os-specific/linux/sgx/samples/default.nix
@@ -41,7 +41,7 @@ let
       install *.so $out/lib
 
       wrapProgram "$out/bin/app" \
-        --run "cd $out/lib" \
+        --chdir "$out/lib" \
         ${lib.optionalString (!isSimulation)
         ''--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"''}
 
@@ -76,7 +76,7 @@ in
 
       for bin in $out/bin/*; do
         wrapProgram $bin \
-          --run "cd $out/lib" \
+          --chdir "$out/lib" \
           ${lib.optionalString (!isSimulation)
           ''--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"''}
       done
diff --git a/pkgs/servers/hqplayerd/default.nix b/pkgs/servers/hqplayerd/default.nix
index 7b65a789af893..64a5fd183813b 100644
--- a/pkgs/servers/hqplayerd/default.nix
+++ b/pkgs/servers/hqplayerd/default.nix
@@ -130,6 +130,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.signalyst.com/custom.html";
     description = "High-end upsampling multichannel software embedded HD-audio player";
     license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ lovesegfault ];
   };
 }
diff --git a/pkgs/servers/ombi/default.nix b/pkgs/servers/ombi/default.nix
index a99349d8c0db6..e0eac1b8c04cf 100644
--- a/pkgs/servers/ombi/default.nix
+++ b/pkgs/servers/ombi/default.nix
@@ -26,7 +26,8 @@ in stdenv.mkDerivation rec {
     sha256 = hash;
   };
 
-  nativeBuildInputs = [ makeWrapper autoPatchelfHook ]
+  nativeBuildInputs = [ makeWrapper ]
+    ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   propagatedBuildInputs = [ stdenv.cc.cc zlib krb5 ];
@@ -37,7 +38,7 @@ in stdenv.mkDerivation rec {
 
     makeWrapper $out/share/${pname}-${version}/Ombi $out/bin/Ombi \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ openssl icu ]} \
-      --run "cd $out/share/${pname}-${version}"
+      --chdir "$out/share/${pname}-${version}"
   '';
 
   passthru = {
diff --git a/pkgs/servers/plik/default.nix b/pkgs/servers/plik/default.nix
index 7c9cd7d00eb13..4572573d16f2e 100644
--- a/pkgs/servers/plik/default.nix
+++ b/pkgs/servers/plik/default.nix
@@ -21,6 +21,6 @@ in
     mv plik-*/webapp/dist $out/libexec/plikd/webapp
     cp ${programs.plikd-unwrapped}/bin/plikd $out/libexec/plikd/bin/plikd
     makeWrapper $out/libexec/plikd/bin/plikd $out/bin/plikd \
-      --run "cd $out/libexec/plikd/bin"
+      --chdir "$out/libexec/plikd/bin"
   '';
 }
diff --git a/pkgs/servers/roon-bridge/default.nix b/pkgs/servers/roon-bridge/default.nix
index 2607ade99310a..4e590dd981867 100644
--- a/pkgs/servers/roon-bridge/default.nix
+++ b/pkgs/servers/roon-bridge/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
       ${fixBin "${placeholder "out"}/Bridge/RoonBridgeHelper"}
 
       mkdir -p $out/bin
-      makeWrapper "$out/Bridge/RoonBridge" "$out/bin/RoonBridge" --run "cd $out"
+      makeWrapper "$out/Bridge/RoonBridge" "$out/bin/RoonBridge" --chdir "$out"
 
       runHook postInstall
     '';
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 8decbf1341b62..32d0a1310eff3 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
             --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ alsa-lib icu66 ffmpeg openssl ]}" \
             --prefix PATH : "$dotnetDir" \
             --prefix PATH : "${lib.makeBinPath [ alsa-utils cifs-utils ffmpeg ]}" \
-            --run "cd $binDir" \
+            --chdir "$binDir" \
             --set DOTNET_ROOT "$dotnetDir"
         )
       '';
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
       ${wrapBin "$out/Server/RoonServer"}
 
       mkdir -p $out/bin
-      makeWrapper "$out/Server/RoonServer" "$out/bin/RoonServer" --run "cd $out"
+      makeWrapper "$out/Server/RoonServer" "$out/bin/RoonServer" --chdir "$out"
 
       runHook postInstall
     '';
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index 56f0779c833a7..798fa83e6d588 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -62,9 +62,10 @@ stdenv.mkDerivation (rec {
   };
 } // optionalAttrs enableUnfree {
   dontPatchELF = true;
-  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
+  nativeBuildInputs = [ makeWrapper ]
+    ++ optional stdenv.isLinux autoPatchelfHook;
   runtimeDependencies = [ zlib ];
-  postFixup = ''
+  postFixup = lib.optionalString stdenv.isLinux ''
     for exe in $(find $out/modules/x-pack-ml/platform/linux-x86_64/bin -executable -type f); do
       echo "patching $exe..."
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$exe"
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index 592cc947a42e3..b93c9da593fa8 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -44,7 +44,8 @@ stdenv.mkDerivation rec {
       "ES_CLASSPATH=\"\$ES_CLASSPATH:$out/\$additional_classpath_directory/*\""
   '';
 
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ]
+    ++ optional stdenv.isLinux autoPatchelfHook;
 
   buildInputs = [ jre_headless util-linux zlib ];
 
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 693e638dec6e3..bc5be50caeb60 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -99,7 +99,7 @@ let
         ${lib.concatStrings (lib.mapAttrsToList (name: value: "--set ${name} '${value}' ") runtimeEnv)} \
         --prefix PATH : ${lib.makeBinPath runtimeDeps} \
         --set RAKEOPT '-f ${discourse}/share/discourse/Rakefile' \
-        --run 'cd ${discourse}/share/discourse'
+        --chdir '${discourse}/share/discourse'
   '';
 
   rubyEnv = bundlerEnv {
diff --git a/pkgs/servers/web-apps/virtlyst/default.nix b/pkgs/servers/web-apps/virtlyst/default.nix
index 3ff42050eb2d0..d6a72916fae30 100644
--- a/pkgs/servers/web-apps/virtlyst/default.nix
+++ b/pkgs/servers/web-apps/virtlyst/default.nix
@@ -18,9 +18,13 @@ stdenv.mkDerivation rec {
   dontWrapQtApps = true;
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/lib
-    cp src/libVirtlyst.so $out/lib
+    cp src/libVirtlyst${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib
     cp -r ../root $out
+
+    runHook postInstall
   '';
 
   patches = [ ./add-admin-password-env.patch ];
@@ -29,6 +33,7 @@ stdenv.mkDerivation rec {
     description = "Web interface to manage virtual machines with libvirt";
     homepage = "https://github.com/cutelyst/Virtlyst";
     license = licenses.agpl3Plus;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ fpletz ];
   };
 }
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 932372d2b3dce..0b11138ec237f 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -2127,11 +2127,11 @@ lib.makeScope newScope (self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoati = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, mesa, libGL, libdrm, udev, libpciaccess, xorgserver }: stdenv.mkDerivation {
     pname = "xf86-video-ati";
-    version = "19.1.0";
+    version = "5eba006e4129e8015b822f9e1d2f1e613e252cda";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-video-ati-19.1.0.tar.bz2";
-      sha256 = "0j9w4axsqlycv4v14g53xyhkm9h7d27b2fcv9lrzb9gf54b5m7v5";
+      url = "https://gitlab.freedesktop.org/xorg/driver/xf86-video-ati/-/archive/5eba006e4129e8015b822f9e1d2f1e613e252cda/xf86-video-ati-5eba006e4129e8015b822f9e1d2f1e613e252cda.tar.bz2";
+      sha256 = "0gmymk8207fd9rjliq05l2gvx220h432rj3h75hv2ylr3k9vmp2b";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
@@ -2337,11 +2337,11 @@ lib.makeScope newScope (self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videonouveau = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libdrm, udev, libpciaccess, xorgserver }: stdenv.mkDerivation {
     pname = "xf86-video-nouveau";
-    version = "1.0.17";
+    version = "3ee7cbca8f9144a3bb5be7f71ce70558f548d268";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/driver/xf86-video-nouveau-1.0.17.tar.bz2";
-      sha256 = "0sqm1jwjg15sp8v7039y2hsbhph8gpjd2bdzcqqiij2mgbi254s9";
+      url = "https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/-/archive/3ee7cbca8f9144a3bb5be7f71ce70558f548d268/xf86-video-nouveau-3ee7cbca8f9144a3bb5be7f71ce70558f548d268.tar.bz2";
+      sha256 = "0rhs3z274jdzd82pcsl25xn8hmw6i4cxs2kwfnphpfhxbbkiq7wl";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
@@ -3100,17 +3100,17 @@ lib.makeScope newScope (self: with self; {
   }) {};
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xorgserver = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
+  xorgserver = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, openssl, libX11, libXau, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile }: stdenv.mkDerivation {
     pname = "xorg-server";
-    version = "1.20.13";
+    version = "21.1.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/xserver/xorg-server-1.20.13.tar.xz";
-      sha256 = "003371ad64bz7i2hx7idnh90yw12dbh116ssy40s70balnb4xaj0";
+      url = "mirror://xorg/individual/xserver/xorg-server-21.1.3.tar.xz";
+      sha256 = "1rgbrld7spg7plkv3c3bbnlnszpflk5z1mqbjrmi2ymlnvasmmk1";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ xorgproto openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ];
+    buildInputs = [ xorgproto openssl libX11 libXau libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile ];
     meta.platforms = lib.platforms.unix;
   }) {};
 
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index bd81f7fa513be..69ff9a70155a4 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -57,7 +57,7 @@ while (<>) {
       $tarball =~ /\/((?:(?:[A-Za-z0-9]|(?:-[^0-9])|(?:-[0-9]*[a-z]))+))[^\/]*$/;
       die unless defined $1;
       $pkg = $1;
-      $pkg =~ s/-//g;
+      $pkg =~ s/(-|[a-f0-9]{40})//g; # Remove hyphen-minus and SHA-1
       #next unless $pkg eq "xcbutil";
     }
 
@@ -71,8 +71,8 @@ while (<>) {
         next;
     }
 
-    # split by first occurence of hyphen followd by only numbers ends line or another hyphen follows
-    my ($name, $version) = split(/-(?=[.0-9]+(?:$|-))/, $pkgName, 2);
+    # Split by first occurrence of hyphen followed by only numbers, ends line, another hyphen follows, or SHA-1
+    my ($name, $version) = split(/-(?=[.0-9]+(?:$|-)|[a-f0-9]{40})/, $pkgName, 2);
 
     $pkgURLs{$pkg} = $tarball;
     $pkgNames{$pkg} = $name;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 3ec0360c0638f..c210070b8ac4f 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -442,6 +442,17 @@ self: super:
 
   xf86videoati = super.xf86videoati.overrideAttrs (attrs: {
     NIX_CFLAGS_COMPILE = "-I${self.xorgserver.dev or self.xorgserver}/include/xorg";
+    nativeBuildInputs = with self; attrs.nativeBuildInputs ++ [ autoreconfHook utilmacros ];
+    patches = [
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/xorg/driver/xf86-video-ati/-/commit/e0511968d04b42abf11bc0ffb387f143582bc144.patch";
+        sha256 = "sha256-79nqKuJRgMYXDEMB8IWxdmbxtI/m+Oca1wSLYeGMuEk=";
+      })
+    ];
+  });
+
+  xf86videonouveau = super.xf86videonouveau.overrideAttrs (attrs: {
+    nativeBuildInputs = with self; attrs.nativeBuildInputs ++ [ autoreconfHook utilmacros ];
   });
 
   xf86videovmware = super.xf86videovmware.overrideAttrs (attrs: {
@@ -620,7 +631,7 @@ self: super:
     in attrs //
     (let
       version = lib.getVersion attrs;
-      commonBuildInputs = attrs.buildInputs ++ [ xtrans ];
+      commonBuildInputs = attrs.buildInputs ++ [ libxcvt xtrans ];
       commonPropagatedBuildInputs = [
         zlib libGL libGLU dbus
         xorgproto
@@ -653,28 +664,10 @@ self: super:
       then {
         outputs = [ "out" "dev" ];
         patches = [
-          # https://lists.x.org/archives/xorg-announce/2021-December/003122.html
-          (fpgit "ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60"
-            "sNi16FqN4rS4s8j5+PUVeOQBasccCkB5KvywP7xl28M=" "CVE-2021-4008")
-          (fpgit "b5196750099ae6ae582e1f46bd0a6dad29550e02"
-            "5hgzQXBBaJfhSTa9hs8K2N1fQ6+Vp8TTkertmQhkw8Y=" "CVE-2021-4009")
-          (fpgit "6c4c53010772e3cb4cb8acd54950c8eec9c00d21"
-            "1gGG9RpjLMi7Emwh13/z5CN1+ISLsPL3hJXP5gQcNkE=" "CVE-2021-4010")
-          (fpgit "e56f61c79fc3cee26d83cda0f84ae56d5979f768"
-            "e1KgSXGwwI3GgcYeWaF3KHPmkE4tf9VTqvfTYqRpysY=" "CVE-2021-4011")
-
           # The build process tries to create the specified logdir when building.
           #
           # We set it to /var/log which can't be touched from inside the sandbox causing the build to hard-fail
           ./dont-create-logdir-during-build.patch
-
-          # Fix e.g. xorg.xf86videovmware with libdrm 2.4.108
-          # TODO: remove with xorgserver >= 1.21
-          (fetchpatch {
-            name = "stdbool.patch";
-            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/454b3a826edb5fc6d0fea3a9cfd1a5e8fc568747.diff";
-            sha256 = "1l9qg905jvlw3r0kx4xfw5m12pbs0782v2g3267d1m6q4m6fj1zy";
-          })
         ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
         propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 96a5ac712f46d..3a0cce1ee0521 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -90,7 +90,7 @@ mirror://xorg/individual/driver/xf86-video-amdgpu-21.0.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-apm-1.3.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ark-0.7.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ast-1.1.5.tar.bz2
-mirror://xorg/individual/driver/xf86-video-ati-19.1.0.tar.bz2
+https://gitlab.freedesktop.org/xorg/driver/xf86-video-ati/-/archive/5eba006e4129e8015b822f9e1d2f1e613e252cda/xf86-video-ati-5eba006e4129e8015b822f9e1d2f1e613e252cda.tar.bz2
 mirror://xorg/individual/driver/xf86-video-chips-1.4.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-cirrus-1.5.3.tar.bz2
 mirror://xorg/individual/driver/xf86-video-dummy-0.3.8.tar.bz2
@@ -104,7 +104,7 @@ mirror://xorg/individual/driver/xf86-video-intel-2.99.917.tar.bz2
 mirror://xorg/individual/driver/xf86-video-mga-2.0.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-neomagic-1.3.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-newport-0.2.4.tar.bz2
-mirror://xorg/individual/driver/xf86-video-nouveau-1.0.17.tar.bz2
+https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/-/archive/3ee7cbca8f9144a3bb5be7f71ce70558f548d268/xf86-video-nouveau-3ee7cbca8f9144a3bb5be7f71ce70558f548d268.tar.bz2
 mirror://xorg/individual/driver/xf86-video-nv-2.1.21.tar.bz2
 mirror://xorg/individual/driver/xf86-video-omap-0.4.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-openchrome-0.6.0.tar.bz2
@@ -218,4 +218,4 @@ mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
 mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2
 mirror://xorg/individual/util/util-macros-1.19.3.tar.bz2
 mirror://xorg/individual/util/xorg-cf-files-1.0.7.tar.bz2
-mirror://xorg/individual/xserver/xorg-server-1.20.13.tar.xz
+mirror://xorg/individual/xserver/xorg-server-21.1.3.tar.xz
diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index 4efa2cd88a728..1233b23f3ca2b 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -29,7 +29,8 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ less ] ++ libraries;
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ]
+    ++ lib.optional stdenv.isLinux autoPatchelfHook;
 
   installPhase =
   let
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 350fff482528f..620244d6e10df 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1345,6 +1345,9 @@ genericBuild() {
         eval "${!curPhase:-$curPhase}"
 
         if [ "$curPhase" = unpackPhase ]; then
+            # make sure we can cd into the directory
+            [ -z "${sourceRoot}" ] || chmod +x "${sourceRoot}"
+
             cd "${sourceRoot:-.}"
         fi
     done
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index d2c28b97ff939..2b613d118c5af 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -204,7 +204,7 @@ in
     # Rebuild binutils to use from stage2 onwards.
     overrides = self: super: {
       binutils-unwrapped = super.binutils-unwrapped.override {
-        gold = false;
+        enableGold = false;
       };
       inherit (prevStage)
         ccWrapperStdenv
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index 84b63e7b8fd0e..6384107ec471b 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -37,7 +37,7 @@ in with pkgs; rec {
   bootBinutils = binutils.bintools.override {
     withAllTargets = false;
     # Don't need two linkers, disable whatever's not primary/default.
-    gold = false;
+    enableGold = false;
     # bootstrap is easier w/static
     enableShared = false;
   };
@@ -172,7 +172,7 @@ in with pkgs; rec {
         for i in as ld ar ranlib nm strip readelf objdump; do
           cp ${bootBinutils.out}/bin/$i $out/bin
         done
-        cp '${lib.getLib binutils.bintools}'/lib/* "$out/lib/"
+        cp -r '${lib.getLib binutils.bintools}'/lib/* "$out/lib/"
 
         chmod -R u+w $out
 
@@ -186,6 +186,7 @@ in with pkgs; rec {
 
         nuke-refs $out/bin/*
         nuke-refs $out/lib/*
+        nuke-refs $out/lib/*/*
         nuke-refs $out/libexec/gcc/*/*/*
         nuke-refs $out/lib/gcc/*/*/*
         nuke-refs $out/lib/gcc/*/*/include-fixed/*{,/*}
diff --git a/pkgs/tools/X11/nx-libs/default.nix b/pkgs/tools/X11/nx-libs/default.nix
index ed28cfbb8d871..64fa84ba4a19f 100644
--- a/pkgs/tools/X11/nx-libs/default.nix
+++ b/pkgs/tools/X11/nx-libs/default.nix
@@ -38,6 +38,12 @@ stdenv.mkDerivation rec {
     ln -s libNX_X11.so.6.3.0
   '';
 
+  preConfigure = ''
+    # binutils 2.37 fix
+    # https://github.com/ArcticaProject/nx-libs/issues/1003
+    substituteInPlace nx-X11/config/cf/Imake.tmpl --replace "clq" "cq"
+  '';
+
   PREFIX=""; # Don't install to $out/usr/local
   installPhase = ''
     make DESTDIR="$out" install
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 6789bd5f96223..0bdbe9d345db8 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -129,7 +129,7 @@ in pythonPackages.buildPythonApplication rec {
     gobject-introspection
   ] ++ lib.optional enableAbsubmit         essentia-extractor
     ++ lib.optional enableAcoustid         pythonPackages.pyacoustid
-    ++ lib.optional enableBeatport         pythonPackages.requests_oauthlib
+    ++ lib.optional enableBeatport         pythonPackages.requests-oauthlib
     ++ lib.optional enableConvert          ffmpeg
     ++ lib.optional enableDiscogs          pythonPackages.discogs-client
     ++ lib.optional (enableFetchart
diff --git a/pkgs/tools/backup/gphotos-sync/default.nix b/pkgs/tools/backup/gphotos-sync/default.nix
index cce9c5b77b7b6..515bfc31cf291 100644
--- a/pkgs/tools/backup/gphotos-sync/default.nix
+++ b/pkgs/tools/backup/gphotos-sync/default.nix
@@ -1,4 +1,8 @@
-{ lib, fetchFromGitHub, python3Packages, ffmpeg }:
+{ lib
+, fetchFromGitHub
+, python3Packages
+, ffmpeg
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "gphotos-sync";
@@ -17,10 +21,12 @@ python3Packages.buildPythonApplication rec {
     exif
     psutil
     pyyaml
-    requests_oauthlib
+    requests-oauthlib
   ];
 
-  buildInputs = [ ffmpeg ];
+  buildInputs = [
+    ffmpeg
+  ];
 
   checkInputs = with python3Packages; [
     pytestCheckHook
@@ -41,8 +47,8 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Google Photos and Albums backup with Google Photos Library API";
-    homepage    = "https://github.com/gilesknap/gphotos-sync";
-    license     = licenses.mit;
+    homepage = "https://github.com/gilesknap/gphotos-sync";
+    license = licenses.mit;
     maintainers = with maintainers; [ dnr ];
   };
 }
diff --git a/pkgs/tools/cd-dvd/ventoy-bin/default.nix b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
index cf573472307c8..5aeaffdb50406 100644
--- a/pkgs/tools/cd-dvd/ventoy-bin/default.nix
+++ b/pkgs/tools/cd-dvd/ventoy-bin/default.nix
@@ -97,7 +97,7 @@ in stdenv.mkDerivation rec {
         local bin="''${f%_*}" wrapper="''${f#*_}"
         makeWrapper "$VENTOY_PATH/$bin" "$out/bin/$wrapper" \
                     --prefix PATH : "${lib.makeBinPath buildInputs}" \
-                    --run "cd '$VENTOY_PATH' || exit 1"
+                    --chdir "$VENTOY_PATH"
     done
   '' + lib.optionalString (withGtk3 || withQt5) ''
     # VentoGUI uses the `ventoy_gui_type` file to determine the type of GUI.
@@ -105,7 +105,7 @@ in stdenv.mkDerivation rec {
     echo "${defaultGuiType}" > "$VENTOY_PATH/ventoy_gui_type"
     makeWrapper "$VENTOY_PATH/VentoyGUI.$ARCH" "$out/bin/ventoy-gui" \
                 --prefix PATH : "${lib.makeBinPath buildInputs}" \
-                --run "cd '$VENTOY_PATH' || exit 1"
+                --chdir "$VENTOY_PATH"
   '' + lib.optionalString (!withGtk3) ''
     rm "$VENTOY_PATH/tool/$ARCH/Ventoy2Disk.gtk3"
   '' + lib.optionalString (!withQt5) ''
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index 6fbc0b9b45f28..d4c4738be7514 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, buildPackages, fetchurl, fetchpatch, pkg-config, libuuid, gettext, texinfo
+, fuse
 , shared ? !stdenv.hostPlatform.isStatic
 , e2fsprogs, runCommand
 }:
@@ -12,11 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "1fgvwbj9ihz5svzrd2l0s18k16r4qg3wimrniv71fn3vdcg0shxp";
   };
 
-  outputs = [ "bin" "dev" "out" "man" "info" ];
+  # fuse2fs adds 14mb of dependencies
+  outputs = [ "bin" "dev" "out" "man" "info" ]
+    ++ lib.optionals stdenv.isLinux [ "fuse2fs" ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkg-config texinfo ];
-  buildInputs = [ libuuid gettext ];
+  buildInputs = [ libuuid gettext ]
+    ++ lib.optionals stdenv.isLinux [ fuse ];
 
   # Only use glibc's __GNUC_PREREQ(X,Y) (checks if compiler is gcc version >= X.Y) when using glibc
   patches = if stdenv.hostPlatform.libc == "glibc" then null
@@ -62,6 +66,9 @@ stdenv.mkDerivation rec {
     if [ -f $out/lib/${pname}/e2scrub_all_cron ]; then
       mv $out/lib/${pname}/e2scrub_all_cron $bin/bin/
     fi
+  '' + lib.optionalString stdenv.isLinux ''
+    mkdir -p $fuse2fs/bin
+    mv $bin/bin/fuse2fs $fuse2fs/bin/fuse2fs
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/games/ajour/default.nix b/pkgs/tools/games/ajour/default.nix
index 49fef3edca9f4..11df34256d43e 100644
--- a/pkgs/tools/games/ajour/default.nix
+++ b/pkgs/tools/games/ajour/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , fetchFromGitHub
 , rustPlatform
 , autoPatchelfHook
@@ -79,6 +80,7 @@ in rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/casperstorm/ajour";
     changelog = "https://github.com/casperstorm/ajour/blob/master/CHANGELOG.md";
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     maintainers = with maintainers; [ hexa ];
   };
 }
diff --git a/pkgs/tools/graphics/snapdragon-profiler/default.nix b/pkgs/tools/graphics/snapdragon-profiler/default.nix
index 7486a885a5481..caf187cb4c1ff 100644
--- a/pkgs/tools/graphics/snapdragon-profiler/default.nix
+++ b/pkgs/tools/graphics/snapdragon-profiler/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
       --suffix PATH : ${lib.makeBinPath [ jre androidenv.androidPkgs_9_0.platform-tools coreutils ]} \
       --prefix MONO_GAC_PREFIX : ${gtk-sharp-2_0} \
       --suffix LD_LIBRARY_PATH : $(echo $NIX_LDFLAGS | sed 's/ -L/:/g;s/ -rpath /:/g;s/-rpath //') \
-      --run "cd $out/lib/snapdragon-profiler" # Fixes themes not loading correctly
+      --chdir "$out/lib/snapdragon-profiler" # Fixes themes not loading correctly
 
     wrestool -x -t 14 SnapdragonProfiler.exe > snapdragon-profiler.ico
     icotool -x -i 1 -o $out/share/icons/hicolor/16x16/apps/snapdragon-profiler.png snapdragon-profiler.ico
diff --git a/pkgs/tools/graphics/structure-synth/default.nix b/pkgs/tools/graphics/structure-synth/default.nix
index ab32657236abc..ce97f1c703488 100644
--- a/pkgs/tools/graphics/structure-synth/default.nix
+++ b/pkgs/tools/graphics/structure-synth/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   # either $HOME or $PWD - so help it along by moving $PWD to 'share',
   # where we just copied those two directories:
   preFixup = ''
-    wrapProgram "$out/bin/structure-synth" --run "cd $out/share"
+    wrapProgram "$out/bin/structure-synth" --chdir "$out/share"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/archi/default.nix b/pkgs/tools/misc/archi/default.nix
index d0beb7d40d75f..e6f16b93f7d2f 100644
--- a/pkgs/tools/misc/archi/default.nix
+++ b/pkgs/tools/misc/archi/default.nix
@@ -30,9 +30,8 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    autoPatchelfHook
     makeWrapper
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
 
   installPhase =
     if stdenv.hostPlatform.system == "x86_64-linux" then
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index befe53b9d907a..86a91a09c3ebe 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -82,6 +82,7 @@ stdenv.mkDerivation (rec {
   '');
 
   outputs = [ "out" "info" ];
+  separateDebugInfo = true;
 
   nativeBuildInputs = [ perl xz.bin autoreconfHook ] # autoreconfHook is due to patch, normally only needed for cygwin
     ++ optionals stdenv.hostPlatform.isCygwin [ texinfo ];  # due to patch
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 56d710c854549..3c3b15962a7be 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     && (stdenv.hostPlatform.libc != "musl")
     && stdenv.hostPlatform == stdenv.buildPlatform;
 
-  outputs = [ "out" "info" ];
+  outputs = [ "out" "info" "locate"];
 
   configureFlags = [
     # "sort" need not be on the PATH as a run-time dep, so we need to tell
@@ -46,6 +46,18 @@ stdenv.mkDerivation rec {
     "-D__nonnull\\(params\\)="
   ];
 
+  postInstall = ''
+    moveToOutput bin/locate $locate
+    moveToOutput bin/updatedb $locate
+  '';
+
+  # can't move man pages in postInstall because the multi-output hook will move them back to $out
+  postFixup = ''
+    moveToOutput share/man/man5 $locate
+    moveToOutput share/man/man1/locate.1.gz $locate
+    moveToOutput share/man/man1/updatedb.1.gz $locate
+  '';
+
   enableParallelBuilding = true;
 
   meta = {
@@ -62,9 +74,12 @@ stdenv.mkDerivation rec {
       The tools supplied with this package are:
 
           * find - search for files in a directory hierarchy;
+          * xargs - build and execute command lines from standard input.
+
+      The following are available in the locate output:
+
           * locate - list files in databases that match a pattern;
           * updatedb - update a file name database;
-          * xargs - build and execute command lines from standard input.
     '';
 
     platforms = lib.platforms.all;
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 7263e4de336ba..6a3bca4047124 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-db";
-  version = "2.10.1";
+  version = "2.10.2";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/man-db-${version}.tar.xz";
-    sha256 = "sha256-L/2PLoASL+cuYMdAyFHmo+FcmnkhGF60dSwcZygkvtY=";
+    sha256 = "sha256-7peVTUkqE3MZA8nQcnubAeUIntvWlfDNtY1AWlr1UU0=";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5210cf820f278..6440c76166d21 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -362,6 +362,7 @@ mapAliases ({
   fslint = throw "fslint has been removed: end of life. Upstream recommends using czkawka (https://qarmin.github.io/czkawka/) instead"; # Added 2022-01-15
   fuse_exfat = throw "'fuse_exfat' has been renamed to/replaced by 'exfat'"; # Converted to throw 2022-02-22
   fuseki = throw "'fuseki' has been renamed to/replaced by 'apache-jena-fuseki'"; # Converted to throw 2022-02-22
+  fuse2fs = if stdenv.isLinux then e2fsprogs.fuse2fs else null; # Added 2022-03-27 preserve, reason: convenience, arch has a package named fuse2fs too.
   fwupdate = throw "fwupdate was merged into fwupd"; # Added 2020-05-19
 
   ### G ###
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6de516ef2e1ae..62f1ede87ffdf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -154,6 +154,7 @@ with pkgs;
       pythonInterpreter = "${python3.withPackages (ps: [ ps.pyelftools ])}/bin/python";
       autoPatchelfScript = ../build-support/setup-hooks/auto-patchelf.py;
     };
+    meta.platforms = lib.platforms.linux;
   } ../build-support/setup-hooks/auto-patchelf.sh;
 
   appflowy = callPackage ../applications/office/appflowy { };
@@ -848,7 +849,9 @@ with pkgs;
   setJavaClassPath = makeSetupHook { } ../build-support/setup-hooks/set-java-classpath.sh;
 
   fixDarwinDylibNames = makeSetupHook {
+    name = "fix-darwin-dylib-names-hook";
     substitutions = { inherit (binutils) targetPrefix; };
+    meta.platforms = lib.platforms.darwin;
   } ../build-support/setup-hooks/fix-darwin-dylib-names.sh;
 
   writeDarwinBundle = callPackage ../build-support/make-darwin-bundle/write-darwin-bundle.nix { };
@@ -5354,7 +5357,8 @@ with pkgs;
   };
 
   exempi = callPackage ../development/libraries/exempi {
-    stdenv = if stdenv.isi686 then gcc6Stdenv else stdenv;
+    stdenv = if stdenv.isi686 then gcc6Stdenv else gcc9Stdenv;
+    boost  = boost15x;
   };
 
   execline = skawarePackages.execline;
@@ -12203,6 +12207,7 @@ with pkgs;
       num =
         if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
         else if (stdenv.targetPlatform.isAarch64 && stdenv.isDarwin) then 11
+        else if (stdenv.targetPlatform.isx86_64 && stdenv.isLinux) then 11
         else if stdenv.targetPlatform.isAarch64 then 9
         else 10;
       numS = toString num;
@@ -14667,7 +14672,7 @@ with pkgs;
   bingrep = callPackage ../development/tools/analysis/bingrep { };
 
   binutils-unwrapped = callPackage ../development/tools/misc/binutils {
-    autoreconfHook = if targetPlatform.isiOS then autoreconfHook269 else autoreconfHook;
+    autoreconfHook = autoreconfHook269;
     # FHS sys dirs presumably only have stuff for the build platform
     noSysDirs = (stdenv.targetPlatform != stdenv.hostPlatform) || noSysDirs;
   };
@@ -14676,7 +14681,7 @@ with pkgs;
   };
   binutils_nogold = lowPrio (wrapBintoolsWith {
     bintools = binutils-unwrapped.override {
-      gold = false;
+      enableGold = false;
     };
   });
   binutilsNoLibc = wrapBintoolsWith {
@@ -16384,6 +16389,7 @@ with pkgs;
     boost174
     boost175
     boost177
+    boost178
   ;
 
   boost15x = boost159;
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index db0b456d905dd..c2e89155a07cb 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -42,6 +42,7 @@ mapAliases ({
   class-registry = phx-class-registry; # added 2021-10-05
   ConfigArgParse = configargparse; # added 2021-03-18
   cozy = throw "cozy was removed because it was not actually https://pypi.org/project/Cozy/."; # added 2022-01-14
+  cryptography_vectors = "cryptography_vectors is no longer exposed in python*Packages because it is used for testing cryptography only."; # Added 2022-03-23
   dateutil = python-dateutil; # added 2021-07-03
   demjson = throw "demjson has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-01-18
   detox = throw "detox is no longer maintained, and was broken since may 2019"; # added 2020-07-04
@@ -106,6 +107,7 @@ mapAliases ({
   qiskit-aqua = throw "qiskit-aqua has been removed due to deprecation, with its functionality moved to different qiskit packages";
   rdflib-jsonld = throw "rdflib-jsonld is not compatible with rdflib 6"; # added 2021-11-05
   repeated_test = throw "repeated_test is no longer maintained"; # added 2022-01-11
+  requests_oauthlib = requests-oauthlib; # added 2022-02-12
   requests_toolbelt = requests-toolbelt; # added 2017-09-26
   roboschool = throw "roboschool is deprecated in favor of PyBullet and has been removed"; # added 2022-01-15
   rotate-backups = throw "rotate-backups was removed in favor of the top-level rotate-backups"; # added 2021-07-01
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 11c32e0849564..b18afebdc15f6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1929,10 +1929,9 @@ in {
 
   cryptography = callPackage ../development/python-modules/cryptography {
     inherit (pkgs.darwin) libiconv;
+    inherit (pkgs.darwin.apple_sdk.frameworks) Security;
   };
 
-  cryptography_vectors = callPackage ../development/python-modules/cryptography/vectors.nix { };
-
   crytic-compile = callPackage ../development/python-modules/crytic-compile { };
 
   csrmesh  = callPackage ../development/python-modules/csrmesh { };
@@ -8772,7 +8771,7 @@ in {
 
   requests_ntlm = callPackage ../development/python-modules/requests_ntlm { };
 
-  requests_oauthlib = callPackage ../development/python-modules/requests-oauthlib { };
+  requests-oauthlib = callPackage ../development/python-modules/requests-oauthlib { };
 
   requests-pkcs12 = callPackage ../development/python-modules/requests-pkcs12 { };
 
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index 224acec1625f1..c915fc5c8c506 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -30,8 +30,6 @@ with self; with super; {
 
   cryptography = callPackage ../development/python2-modules/cryptography { };
 
-  cryptography_vectors = callPackage ../development/python2-modules/cryptography-vectors { };
-
   decorator = callPackage ../development/python2-modules/decorator { };
 
   enum = callPackage ../development/python2-modules/enum { };