about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json3
-rw-r--r--pkgs/applications/audio/cdparanoia/configure.patch22
-rw-r--r--pkgs/applications/audio/cdparanoia/default.nix25
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix4
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/editors/vim/configurable.nix6
-rw-r--r--pkgs/applications/graphics/sane/backends/default.nix11
-rw-r--r--pkgs/applications/misc/archivy/default.nix18
-rw-r--r--pkgs/applications/version-management/gitless/default.nix7
-rw-r--r--pkgs/build-support/setup-hooks/make-binary-wrapper.sh2
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix20
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix13
-rw-r--r--pkgs/desktops/gnome/apps/cheese/default.nix2
-rw-r--r--pkgs/desktops/gnome/apps/gnome-maps/default.nix2
-rw-r--r--pkgs/desktops/gnome/apps/gnome-music/default.nix2
-rw-r--r--pkgs/desktops/gnome/core/gnome-shell/default.nix2
-rw-r--r--pkgs/desktops/gnome/core/totem/default.nix2
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix11
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix13
-rw-r--r--pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh83
-rw-r--r--pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh4
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix4
-rw-r--r--pkgs/development/libraries/expat/default.nix4
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix12
-rw-r--r--pkgs/development/libraries/icu/71.nix4
-rw-r--r--pkgs/development/libraries/imlib2/default.nix13
-rw-r--r--pkgs/development/libraries/libarchive/default.nix17
-rw-r--r--pkgs/development/libraries/libnotify/default.nix4
-rw-r--r--pkgs/development/libraries/librsvg/default.nix4
-rw-r--r--pkgs/development/libraries/libseccomp/default.nix6
-rw-r--r--pkgs/development/libraries/libsndfile/default.nix4
-rw-r--r--pkgs/development/libraries/libxml2/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/default.nix11
-rw-r--r--pkgs/development/libraries/protobuf/3.19.nix4
-rw-r--r--pkgs/development/libraries/signond/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/webrtc-audio-processing/0.3.nix5
-rw-r--r--pkgs/development/libraries/webrtc-audio-processing/enable-powerpc.patch37
-rw-r--r--pkgs/development/libraries/zimg/default.nix4
-rw-r--r--pkgs/development/python-modules/curio/default.nix3
-rw-r--r--pkgs/development/python-modules/flask-restful/default.nix30
-rw-r--r--pkgs/development/python-modules/limits/default.nix70
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix4
-rw-r--r--pkgs/development/python-modules/pkgconfig/default.nix40
-rw-r--r--pkgs/development/python-modules/pycurl/default.nix11
-rw-r--r--pkgs/development/python-modules/rich/default.nix4
-rw-r--r--pkgs/development/python-modules/setuptools-rust/default.nix4
-rw-r--r--pkgs/development/python-modules/testtools/default.nix7
-rw-r--r--pkgs/development/tools/misc/elfutils/default.nix2
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix8
-rw-r--r--pkgs/development/tools/pandoc/default.nix5
-rw-r--r--pkgs/misc/ghostscript/default.nix16
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix12
-rw-r--r--pkgs/os-specific/linux/kbd/default.nix1
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix14
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix2
-rw-r--r--pkgs/servers/pulseaudio/default.nix4
-rw-r--r--pkgs/stdenv/darwin/default.nix75
-rw-r--r--pkgs/tools/networking/curl/7.82.0-openssl-fix-CN-check.patch30
-rw-r--r--pkgs/tools/networking/curl/default.nix5
-rw-r--r--pkgs/tools/wayland/wlogout/default.nix8
-rw-r--r--pkgs/top-level/all-packages.nix7
-rw-r--r--pkgs/top-level/python-packages.nix1
65 files changed, 511 insertions, 261 deletions
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
index b19fb33ec1788..114afbfb0ea46 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
@@ -62,6 +62,9 @@
           "application.process.binary": "teams"
         },
         {
+          "application.process.binary": "teams-insiders"
+        },
+        {
           "application.process.binary": "skypeforlinux"
         }
       ],
diff --git a/pkgs/applications/audio/cdparanoia/configure.patch b/pkgs/applications/audio/cdparanoia/configure.patch
new file mode 100644
index 0000000000000..81c50cec814ab
--- /dev/null
+++ b/pkgs/applications/audio/cdparanoia/configure.patch
@@ -0,0 +1,22 @@
+diff --git a/configure.in b/configure.ac
+similarity index 90%
+rename from configure.in
+rename to configure.ac
+index 3ad98ca11da..8fad378faf4 100644
+--- a/configure.in
++++ b/configure.ac
+@@ -1,13 +1,8 @@
+ AC_INIT(interface/interface.c)
+ 
+-cp $srcdir/configure.guess $srcdir/config.guess
+-cp $srcdir/configure.sub $srcdir/config.sub
+-
+ AC_CANONICAL_HOST
+ 
+-if test -z "$CC"; then
+-	AC_PROG_CC	
+-fi
++AC_PROG_CC
+ AC_PROG_RANLIB
+ AC_CHECK_PROG(AR,ar,ar)
+ AC_CHECK_PROG(INSTALL,install,install)
diff --git a/pkgs/applications/audio/cdparanoia/default.nix b/pkgs/applications/audio/cdparanoia/default.nix
index 10ff66de77ed4..2c13631624e77 100644
--- a/pkgs/applications/audio/cdparanoia/default.nix
+++ b/pkgs/applications/audio/cdparanoia/default.nix
@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, gnu-config, IOKit, Carbon }:
+{ lib, stdenv, fetchurl
+, updateAutotoolsGnuConfigScriptsHook, autoreconfHook
+, IOKit, Carbon
+}:
 
 stdenv.mkDerivation rec {
   pname = "cdparanoia-III";
@@ -9,7 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "1pv4zrajm46za0f6lv162iqffih57a8ly4pc69f7y0gfyigb8p80";
   };
 
-  patches = lib.optionals stdenv.isDarwin [
+  patches = [
+    ./fix_private_keyword.patch
+    ./configure.patch
+  ] ++ lib.optionals stdenv.isDarwin [
     (fetchurl {
       url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/osx_interface.patch";
       sha256 = "1n86kzm2ssl8fdf5wlhp6ncb2bf6b9xlb5vg0mhc85r69prqzjiy";
@@ -18,8 +24,12 @@ stdenv.mkDerivation rec {
       url = "https://trac.macports.org/export/70964/trunk/dports/audio/cdparanoia/files/patch-paranoia_paranoia.c.10.4.diff";
       sha256 = "17l2qhn8sh4jy6ryy5si6ll6dndcm0r537rlmk4a6a8vkn852vad";
     })
-    ] ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
-    ++ [./fix_private_keyword.patch];
+  ] ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch;
+
+  nativeBuildInputs = [
+    updateAutotoolsGnuConfigScriptsHook
+    autoreconfHook
+  ];
 
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [
     Carbon
@@ -28,13 +38,6 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  preConfigure = ''
-    unset CC
-  '' + lib.optionalString (!stdenv.hostPlatform.isx86) ''
-    cp ${gnu-config}/config.sub configure.sub
-    cp ${gnu-config}/config.guess configure.guess
-  '';
-
   # Build system reuses the same object file names for shared and static
   # library. Occasionally fails in the middle:
   #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index 828c415ac5fb0..1e55dbe8f87fa 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
 
-  buildInputs = [ glib libsndfile libpulseaudio libjack2 ]
-    ++ lib.optionals stdenv.isLinux [ alsa-lib ]
+  buildInputs = [ glib libsndfile libjack2 ]
+    ++ lib.optionals stdenv.isLinux [ alsa-lib libpulseaudio ]
     ++ lib.optionals stdenv.isDarwin [ AudioUnit CoreAudio CoreMIDI CoreServices ];
 
   cmakeFlags = [ "-Denable-framework=off" ];
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index fe5d5b85080da..8c50586584955 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.4609";
+  version = "8.2.4816";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-IiWZJ4zT+VbcxwKChl847pS9jU9AlxZ/yQUIL8I2MhQ=";
+    sha256 = "1lgqr3ki50hwkz4vhdyaryirrs99qq4kgkhmpx7ygvn6aj2wapg5";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/vim/configurable.nix b/pkgs/applications/editors/vim/configurable.nix
index bc317b91597e4..d5dd00b4aa603 100644
--- a/pkgs/applications/editors/vim/configurable.nix
+++ b/pkgs/applications/editors/vim/configurable.nix
@@ -3,7 +3,7 @@
 , libX11, libXext, libSM, libXpm, libXt, libXaw, libXau, libXmu
 , libICE
 , vimPlugins
-, makeWrapper, makeBinaryWrapper
+, makeWrapper
 , wrapGAppsHook
 , runtimeShell
 
@@ -133,9 +133,7 @@ in stdenv.mkDerivation rec {
   ++ lib.optional wrapPythonDrv makeWrapper
   ++ lib.optional nlsSupport gettext
   ++ lib.optional perlSupport perl
-  # Make the inner wrapper binary to avoid double wrapping issues with wrapPythonDrv
-  # (https://github.com/NixOS/nixpkgs/pull/164163)
-  ++ lib.optional (guiSupport == "gtk3") (wrapGAppsHook.override { makeWrapper = makeBinaryWrapper; })
+  ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook
   ;
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/sane/backends/default.nix b/pkgs/applications/graphics/sane/backends/default.nix
index 93a7d75ce45a5..d3c5b1c0b75f2 100644
--- a/pkgs/applications/graphics/sane/backends/default.nix
+++ b/pkgs/applications/graphics/sane/backends/default.nix
@@ -40,18 +40,19 @@ stdenv.mkDerivation {
   buildInputs = [
     avahi
     libgphoto2
-    libieee1284
     libjpeg
     libpng
     libtiff
     libusb1
-    libv4l
-    net-snmp
     curl
-    systemd
     libxml2
     poppler
     gawk
+  ] ++ lib.optionals stdenv.isLinux [
+    libieee1284
+    libv4l
+    net-snmp
+    systemd
   ];
 
   enableParallelBuilding = true;
@@ -113,6 +114,6 @@ stdenv.mkDerivation {
     '';
     homepage = "http://www.sane-project.org/";
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/applications/misc/archivy/default.nix b/pkgs/applications/misc/archivy/default.nix
index e7146052702b7..c2cf561524fe0 100644
--- a/pkgs/applications/misc/archivy/default.nix
+++ b/pkgs/applications/misc/archivy/default.nix
@@ -49,21 +49,9 @@ buildPythonApplication rec {
     hash = "sha256-o5dVJDbdKgo6hMMU9mKzoouSgVWl7xSAp+Aq61VcfeU=";
   };
 
-  # Relax some dependencies
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace 'WTForms ==' 'WTForms >=' \
-      --replace 'attrs == 20.2.0' 'attrs' \
-      --replace 'elasticsearch ==' 'elasticsearch >=' \
-      --replace 'python_dotenv ==' 'python_dotenv >=' \
-      --replace 'python_frontmatter == 0.5.0' 'python_frontmatter' \
-      --replace 'requests ==' 'requests >=' \
-      --replace 'validators ==' 'validators >=' \
-      --replace 'flask-login == ' 'flask-login >= ' \
-      --replace 'tinydb ==' 'tinydb >=' \
-      --replace 'Flask_WTF == 0.14.3' 'Flask_WTF' \
-      --replace 'Flask ==' 'Flask >='
-  '';
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  pythonRelaxDeps = true;
 
   propagatedBuildInputs = [
     appdirs
diff --git a/pkgs/applications/version-management/gitless/default.nix b/pkgs/applications/version-management/gitless/default.nix
index a721834725889..31ab40d79478f 100644
--- a/pkgs/applications/version-management/gitless/default.nix
+++ b/pkgs/applications/version-management/gitless/default.nix
@@ -15,16 +15,15 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-xo5EWtP2aN8YzP8ro3bnxZwUGUp0PHD0g8hk+Y+gExE=";
   };
 
+  nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
+
   propagatedBuildInputs = with python3.pkgs; [
     sh
     pygit2
     clint
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pygit2==0.28.2" "pygit2>=0.28.2"
-  '';
+  pythonRelaxDeps = [ "pygit2" ];
 
   doCheck = false;
 
diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper.sh b/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
index 986be5b9e1137..7123f100c1755 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
@@ -33,6 +33,8 @@ assertExecutable() {
 # To troubleshoot a binary wrapper after you compiled it,
 # use the `strings` command or open the binary file in a text editor.
 makeWrapper() {
+    local NIX_CFLAGS_COMPILE NIX_CFLAGS_LINK
+    unset NIX_CFLAGS_COMPILE NIX_CFLAGS_LINK
     local original="$1"
     local wrapper="$2"
     shift 2
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
index d0ea088bf71e8..8c10f67c152ce 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , makeSetupHook
-, makeWrapper
+, makeBinaryWrapper
 , gobject-introspection
 , isGraphical ? true
 , gtk3
@@ -34,7 +34,7 @@ makeSetupHook {
   ] ++ [
 
     # We use the wrapProgram function.
-    makeWrapper
+    makeBinaryWrapper
   ];
   substitutions = {
     passthru.tests = let
@@ -59,8 +59,8 @@ makeSetupHook {
         tested = basic;
       in testLib.runTest "basic-contains-dconf" (
         testLib.skip stdenv.isDarwin ''
-          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES=" "${dconf.lib}/lib/gio/modules"}
-          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GIO_EXTRA_MODULES=" "${dconf.lib}/lib/gio/modules"}
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES" "${dconf.lib}/lib/gio/modules"}
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GIO_EXTRA_MODULES" "${dconf.lib}/lib/gio/modules"}
         ''
       );
 
@@ -98,8 +98,8 @@ makeSetupHook {
       typelib-user-has-gi-typelib-path = let
         tested = typelib-user;
       in testLib.runTest "typelib-user-has-gi-typelib-path" ''
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-Mahjong}/lib/girepository-1.0"}
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-Mahjong}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH" "${typelib-Mahjong}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH" "${typelib-Mahjong}/lib/girepository-1.0"}
       '';
 
       # Simple derivation containing a gobject-introspection typelib in lib output.
@@ -143,8 +143,8 @@ makeSetupHook {
       typelib-multiout-user-has-gi-typelib-path = let
         tested = typelib-multiout-user;
       in testLib.runTest "typelib-multiout-user-has-gi-typelib-path" ''
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH" "${typelib-Bechamel.lib}/lib/girepository-1.0"}
       '';
 
       # Simple derivation that contains a typelib as well as a program using it.
@@ -169,8 +169,8 @@ makeSetupHook {
       typelib-self-user-has-gi-typelib-path = let
         tested = typelib-self-user;
       in testLib.runTest "typelib-self-user-has-gi-typelib-path" ''
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH=" "${typelib-self-user}/lib/girepository-1.0"}
-        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH=" "${typelib-self-user}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GI_TYPELIB_PATH" "${typelib-self-user}/lib/girepository-1.0"}
+        ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GI_TYPELIB_PATH" "${typelib-self-user}/lib/girepository-1.0"}
       '';
     };
   };
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
index 1757bdbbe2500..42866c3419ddf 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
@@ -1,5 +1,4 @@
-{ runCommand
-}:
+{ lib, runCommand }:
 
 rec {
   runTest = name: body: runCommand name { } ''
@@ -19,12 +18,14 @@ rec {
   '';
 
   expectSomeLineContainingYInFileXToMentionZ = file: filter: expected: ''
-    if ! cat "${file}" | grep "${filter}"; then
-        ${fail "The file “${file}” should include a line containing “${filter}”."}
+    file=${lib.escapeShellArg file} filter=${lib.escapeShellArg filter} expected=${lib.escapeShellArg expected}
+
+    if ! grep --text --quiet "$filter" "$file"; then
+        ${fail "The file “$file” should include a line containing “$filter”."}
     fi
 
-    if ! cat "${file}" | grep "${filter}" | grep ${expected}; then
-        ${fail "The file “${file}” should include a line containing “${filter}” that also contains “${expected}”."}
+    if ! grep --text "$filter" "$file" | grep --text --quiet "$expected"; then
+        ${fail "The file “$file” should include a line containing “$filter” that also contains “$expected”."}
     fi
   '';
 }
diff --git a/pkgs/desktops/gnome/apps/cheese/default.nix b/pkgs/desktops/gnome/apps/cheese/default.nix
index a6d70d162c08d..308a30dde29b9 100644
--- a/pkgs/desktops/gnome/apps/cheese/default.nix
+++ b/pkgs/desktops/gnome/apps/cheese/default.nix
@@ -80,6 +80,8 @@ stdenv.mkDerivation rec {
     pipewire # PipeWire provides a gstreamer plugin for using PipeWire for video
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=overlength-strings";
+
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py
diff --git a/pkgs/desktops/gnome/apps/gnome-maps/default.nix b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
index a0d566c7ef9e4..1280c15f21308 100644
--- a/pkgs/desktops/gnome/apps/gnome-maps/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-maps/default.nix
@@ -69,6 +69,8 @@ stdenv.mkDerivation rec {
     webkitgtk
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=overlength-strings";
+
   postPatch = ''
     chmod +x meson_post_install.py # patchShebangs requires executable file
     patchShebangs meson_post_install.py
diff --git a/pkgs/desktops/gnome/apps/gnome-music/default.nix b/pkgs/desktops/gnome/apps/gnome-music/default.nix
index 8d5f5e5f28dda..40f85b8a59c1f 100644
--- a/pkgs/desktops/gnome/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-music/default.nix
@@ -76,6 +76,8 @@ python3.pkgs.buildPythonApplication rec {
     gst-plugins-ugly
   ]);
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=overlength-strings";
+
   pythonPath = with python3.pkgs; [
     pycairo
     dbus-python
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index 1ad36f7e96b74..9d7e14898e281 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -175,6 +175,8 @@ stdenv.mkDerivation rec {
     pythonEnv
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=overlength-strings";
+
   mesonFlags = [
     "-Dgtk_doc=true"
   ];
diff --git a/pkgs/desktops/gnome/core/totem/default.nix b/pkgs/desktops/gnome/core/totem/default.nix
index 44e1319f8d4ae..af64e40a65316 100644
--- a/pkgs/desktops/gnome/core/totem/default.nix
+++ b/pkgs/desktops/gnome/core/totem/default.nix
@@ -77,6 +77,8 @@ stdenv.mkDerivation rec {
     xvfb-run
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=overlength-strings";
+
   mesonFlags = [
     # TODO: https://github.com/NixOS/nixpkgs/issues/36468
     "-Dc_args=-I${glib.dev}/include/gio-unix-2.0"
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 79e682e88c4eb..ba4b10cf73ea8 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -52,7 +52,12 @@ with lib;
 with builtins;
 
 let majorVersion = "11";
-    version = "${majorVersion}.2.0";
+    # The patch below for aarch64-darwin does not apply to 11.3.0 and an
+    # updated version is not available. Keep aarch64-darwin on 11.2.0 so the
+    # large body of packages which depend on gfortran are still functional
+    # until GCC 12 is the default.
+    version = if (stdenv.isDarwin && stdenv.isAarch64) then
+      "${majorVersion}.2.0" else "${majorVersion}.3.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -91,7 +96,9 @@ stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os=";
+    sha256 = if (stdenv.isDarwin && stdenv.isAarch64)
+      then "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os="
+      else "sha256-tHzygYaR9bHiHfK7OMeV+sLPvWQO3i0KXhyJ4zijrDk=";
   };
 
   inherit patches;
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index cb5ef87826a9c..34c6a72662d71 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -124,6 +124,15 @@ in rec {
       };
     } ./python-recompile-bytecode-hook.sh ) {};
 
+  pythonRelaxDepsHook = callPackage ({ wheel }:
+    makeSetupHook {
+      name = "python-relax-deps-hook";
+      deps = [ wheel ];
+      substitutions = {
+        inherit pythonInterpreter;
+      };
+    } ./python-relax-deps-hook.sh) {};
+
   pythonRemoveBinBytecodeHook = callPackage ({ }:
     makeSetupHook {
       name = "python-remove-bin-bytecode-hook";
@@ -161,8 +170,8 @@ in rec {
       deps = [ ensureNewerSourcesForZipFilesHook ];
       substitutions = {
         inherit pythonInterpreter;
-    };
-  } ./venv-shell-hook.sh) {});
+      };
+    } ./venv-shell-hook.sh) {});
 
   wheelUnpackHook = callPackage ({ wheel }:
     makeSetupHook {
diff --git a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
new file mode 100644
index 0000000000000..7e1cfe51724b6
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@@ -0,0 +1,83 @@
+# shellcheck shell=bash
+
+# Setup hook that modifies Python dependencies versions.
+#
+# Example usage in a derivation:
+#
+#   { …, pythonPackages, … }:
+#
+#   pythonPackages.buildPythonPackage {
+#     …
+#     nativeBuildInputs = [ pythonPackages.pythonRelaxDepsHook ];
+#
+#     # This will relax the dependency restrictions
+#     # e.g.: abc>1,<=2 -> abc
+#     pythonRelaxDeps = [ "abc" ];
+#     # This will relax all dependencies restrictions instead
+#     # pythonRelaxDeps = true;
+#     # This will remove the dependency
+#     # e.g.: cde>1,<=2 -> <nothing>
+#     pythonRemoveDeps = [ "cde" ];
+#     # This will remove all dependencies from the project
+#     # pythonRemoveDeps = true;
+#     …
+#   }
+
+_pythonRelaxDeps() {
+    local -r metadata_file="$1"
+
+    if [[ -z "${pythonRelaxDeps:-}" ]] || [[ "$pythonRelaxDeps" == 0 ]]; then
+        return
+    elif [[ "$pythonRelaxDeps" == 1 ]]; then
+        sed -i "$metadata_file" -r \
+            -e 's/(Requires-Dist: \S*) \(.*\)/\1/'
+    else
+        for dep in $pythonRelaxDeps; do
+            sed -i "$metadata_file" -r \
+                -e "s/(Requires-Dist: $dep) \(.*\)/\1/"
+        done
+    fi
+}
+
+_pythonRemoveDeps() {
+    local -r metadata_file="$1"
+
+    if [[ -z "${pythonRemoveDeps:-}" ]] || [[ "$pythonRemoveDeps" == 0 ]]; then
+        return
+    elif [[ "$pythonRemoveDeps" == 1 ]]; then
+        sed -i "$metadata_file" \
+            -e '/Requires-Dist:.*/d'
+    else
+        for dep in $pythonRemoveDeps; do
+            sed -i "$metadata_file" \
+                -e "/Requires-Dist: $dep/d"
+        done
+    fi
+
+}
+
+pythonRelaxDepsHook() {
+    pushd dist
+
+    local -r package="$pname-$version"
+    local -r unpack_dir="unpacked"
+    local -r metadata_file="$unpack_dir/$package/$package.dist-info/METADATA"
+    local -r wheel=$(echo "$package"*".whl")
+
+    @pythonInterpreter@ -m wheel unpack --dest "$unpack_dir" "$wheel"
+    rm -rf "$wheel"
+
+    _pythonRelaxDeps "$metadata_file"
+    _pythonRemoveDeps "$metadata_file"
+
+    if (( "${NIX_DEBUG:-0}" >= 1 )); then
+        echo "pythonRelaxDepsHook: resulting METADATA:"
+        cat "$unpack_dir/$package/$package.dist-info/METADATA"
+    fi
+
+    @pythonInterpreter@ -m wheel pack "$unpack_dir/$package"
+
+    popd
+}
+
+postBuild+=" pythonRelaxDepsHook"
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
index 89a95e9821975..958a9378ef14a 100644
--- a/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh
@@ -12,10 +12,10 @@ setuptoolsBuildPhase() {
         args+="$setupPyGlobalFlags"
     fi
     if [ -n "$enableParallelBuilding" ]; then
-        setupPyBuildFlags+="--parallel $NIX_BUILD_CORES"
+        setupPyBuildFlags+=" --parallel $NIX_BUILD_CORES"
     fi
     if [ -n "$setupPyBuildFlags" ]; then
-        args+="build_ext $setupPyBuildFlags"
+        args+=" build_ext $setupPyBuildFlags"
     fi
     eval "@pythonInterpreter@ nix_run_setup $args bdist_wheel"
 
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 35a79e3b358bb..2cca0078aff2d 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.2";
+  version = "0.6.3";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "1dp645gg6d3pzjh82srq1d7qvyxi5h22k7yfdjiyzbyry8pxdh2h";
+    sha256 = "pBCv63zVlwsWuabOfazPSVsaXpEhqdZELeDAKP1Uols=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index a05f3b71fb46e..da20ac59ec97a 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "expat";
-  version = "2.4.7";
+  version = "2.4.8";
 
   src = fetchurl {
     url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "0zbss0dssn17mjmvk17qfi5cmvm0lcyzs62cwvqr219hhl864xcq";
+    sha256 = "sha256-95uPkEt0nj4NIK/q3s+CScVbLjLU67CJrjeN9HncryU=";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index c736c5cc76171..5e0dcf6ce03c2 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -30,7 +30,7 @@
 , gnome
 , gsettings-desktop-schemas
 , sassc
-, trackerSupport ? stdenv.isLinux
+, trackerSupport ? stdenv.isLinux && (stdenv.buildPlatform == stdenv.hostPlatform)
 , tracker
 , x11Support ? stdenv.isLinux
 , waylandSupport ? stdenv.isLinux
@@ -39,12 +39,13 @@
 , wayland-protocols
 , xineramaSupport ? stdenv.isLinux
 , cupsSupport ? stdenv.isLinux
-, withGtkDoc ? stdenv.isLinux
+, withGtkDoc ? stdenv.isLinux && (stdenv.buildPlatform == stdenv.hostPlatform)
 , cups
 , AppKit
 , Cocoa
 , QuartzCore
 , broadwaySupport ? true
+, wayland-scanner
 }:
 
 let
@@ -85,6 +86,9 @@ stdenv.mkDerivation rec {
     ./patches/3.0-darwin-x11.patch
   ];
 
+  depsBuildBuild = [
+    pkg-config
+  ];
   nativeBuildInputs = [
     gettext
     gobject-introspection
@@ -94,12 +98,15 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     sassc
+    gdk-pixbuf
   ] ++ setupHooks ++ lib.optionals withGtkDoc [
     docbook_xml_dtd_43
     docbook-xsl-nons
     gtk-doc
     # For xmllint
     libxml2
+  ] ++ lib.optionals waylandSupport [
+    wayland-scanner
   ];
 
   buildInputs = [
@@ -151,6 +158,7 @@ stdenv.mkDerivation rec {
     "-Dbroadway_backend=${lib.boolToString broadwaySupport}"
     "-Dx11_backend=${lib.boolToString x11Support}"
     "-Dquartz_backend=${lib.boolToString (stdenv.isDarwin && !x11Support)}"
+    "-Dintrospection=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
   ];
 
   doCheck = false; # needs X11
diff --git a/pkgs/development/libraries/icu/71.nix b/pkgs/development/libraries/icu/71.nix
new file mode 100644
index 0000000000000..456dffc322a43
--- /dev/null
+++ b/pkgs/development/libraries/icu/71.nix
@@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "71.1";
+  sha256 = "sha256-Z6fm5R9h+vEwa2k1Mz4TssSKvY2m0vRs5q3KJLHiHr8=";
+}
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 1447a327e0dfc..a882a6608335c 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -2,7 +2,7 @@
 # Image file formats
 , libjpeg, libtiff, giflib, libpng, libwebp
 # imlib2 can load images from ID3 tags.
-, libid3tag
+, libid3tag, librsvg, libheif
 , freetype , bzip2, pkg-config
 , x11Support ? true, xlibsWrapper ? null
 }:
@@ -12,17 +12,20 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "imlib2";
-  version = "1.7.5";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.xz";
-    hash = "sha256-RY2DAKp6bUzjU1GDi7pdn9+wiES9WxU8WTjs/kP/Ngo=";
+    hash = "sha256-Ui4ecOZbwO3f4gdhfRXJo5VmKnwJBmHaqiwpT7fZ/ao=";
   };
 
   buildInputs = [
     libjpeg libtiff giflib libpng libwebp
-    bzip2 freetype libid3tag
-  ] ++ optional x11Support xlibsWrapper;
+    bzip2 freetype libid3tag libheif
+  ] ++ optional x11Support xlibsWrapper
+  # Compilation error on Darwin with librsvg. For more information see:
+  # https://github.com/NixOS/nixpkgs/pull/166452#issuecomment-1090725613
+  ++ optional (!stdenv.isDarwin) librsvg;
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 76e5a32316d89..066ea8b60ddcf 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -40,18 +40,21 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace Makefile.am --replace '/bin/pwd' "$(type -P pwd)"
 
-    declare -a skip_tests=(
+    declare -a skip_test_paths=(
       # test won't work in nix sandbox
-      'test_write_disk_perms'
+      'libarchive/test/test_write_disk_perms.c'
       # can't be sure builder will have sparse-capable fs
-      'test_sparse_basic'
+      'libarchive/test/test_sparse_basic.c'
       # can't even be sure builder will have hardlink-capable fs
-      'test_write_disk_hardlink'
+      'libarchive/test/test_write_disk_hardlink.c'
+      # access-time-related tests flakey on some systems
+      'cpio/test/test_option_a.c'
+      'cpio/test/test_option_t.c'
     )
 
-    for test_name in "''${skip_tests[@]}" ; do
-      sed -i "/$test_name/d" Makefile.am
-      rm "libarchive/test/$test_name.c"
+    for test_path in "''${skip_test_paths[@]}" ; do
+      substituteInPlace Makefile.am --replace "$test_path" ""
+      rm "$test_path"
     done
   '';
 
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index eb89fa124c419..de3f2141c2e49 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnotify";
-  version = "0.7.9";
+  version = "0.7.11";
 
   outputs = [ "out" "man" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0qa7cx6ra5hwqnxw95b9svgjg5q6ynm8y843iqjszxvds5z53h36";
+    sha256 = "3VaC7GgiAznhHFFZt+ASIEoxjdGzaDoJxILKQhqwc3U=";
   };
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 6ef67af4b1946..c442c14b5179f 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation rec {
   pname = "librsvg";
-  version = "2.54.0";
+  version = "2.54.1";
 
   outputs = [ "out" "dev" "installedTests" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "uvjrwUfxRrQmG7PQzQ+slEv427Sx8jR9IzQfl03MMIU=";
+    sha256 = "1VV++9zEFaQYDhEWt/c2y3EbJT0RDZX6huyDD3ACZiU=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index d0e8bd163ddde..fbc8a026af593 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, getopt, util-linux, gperf, nix-update-script }:
+{ lib, stdenv, fetchurl, getopt, util-linuxMinimal, which, gperf, nix-update-script }:
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  checkInputs = [ util-linux ];
-  doCheck = false; # dependency cycle
+  checkInputs = [ util-linuxMinimal which ];
+  doCheck = true;
 
   # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
   preFixup = "rm -rfv src";
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index dbe108f586f42..a319de5ce6b25 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsndfile";
-  version = "1.0.31";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1alba3iv8i7i2jb5fd6q5s7j9bcj48sf28nfjd3qigz2n2is5jl2";
+    sha256 = "sha256-bhIXVSKuUnUzs5aaLDHt21RcnqekEpLU414sFtl2Lro=";
   };
 
   nativeBuildInputs = [ autoreconfHook autogen pkg-config python3 ];
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 3b7cae36a0ee5..06c073c718ac9 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.9.13";
+  version = "2.9.14";
 
   outputs = [ "bin" "dev" "out" "man" "doc" ]
     ++ lib.optional pythonSupport "py"
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "J2EwYC0S/khOzANEfuXnWdBGVVj7yda9FE43RTBuvw4=";
+    sha256 = "1vnzk33wfms348lgz9pvkq9li7jm44pvm73lbr3w1khwgljlmmv0";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 6818418ad68cc..26a89fe47a413 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -178,8 +178,8 @@ in {
 
 
   openssl_1_1 = common rec {
-    version = "1.1.1n";
-    sha256 = "sha256-QNzrUaT2pSdb3g5r8g70uRv8Mu1XwFUuLo4VRjNysXo=";
+    version = "1.1.1o";
+    sha256 = "sha256-k4SisFcN2ANYhBRkZ3EV33he25QccSEfdQdtcv5rQ48=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index da594346c297c..96d8c9c205297 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -2,7 +2,6 @@
 , lib
 , buildPackages
 , fetchFromGitLab
-, fetchpatch
 , removeReferencesTo
 , python3
 , meson
@@ -68,7 +67,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.49";
+    version = "0.3.51";
 
     outputs = [
       "out"
@@ -86,7 +85,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-8heX/9BsPguIOzHOuqEQdt6MS3eS4HxR4A+FUZKNpdo=";
+      sha256 = "sha256-k5OdKgkQUaelvrGS4KtO0MtSJg6cF2Nf8RrsR8Kf+C8=";
     };
 
     patches = [
@@ -102,12 +101,6 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
-      # Fixes missing function declarations in pipewire headers
-      # Should be removed after the next release
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/a2e98e28c1e6fb58b273ef582398d8bee4d2b769.patch";
-        sha256 = "sha256-tqiiAW2fTEp23HT59XR2D/G08pVENJtpxUI7UVufj/A=";
-      })
     ];
 
     nativeBuildInputs = [
diff --git a/pkgs/development/libraries/protobuf/3.19.nix b/pkgs/development/libraries/protobuf/3.19.nix
index 7e2be4bec04c0..e47bb62e736ac 100644
--- a/pkgs/development/libraries/protobuf/3.19.nix
+++ b/pkgs/development/libraries/protobuf/3.19.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.19.3";
-  sha256 = "sha256-nA6L064MuyP5Si4MCLk2yg8PDM7RWggFEGQyibputYQ=";
+  version = "3.19.4";
+  sha256 = "sha256-mxQ8XonVgctfaNAyd3vqQHMLHVnkjBa9EObk47vxH24=";
 }
diff --git a/pkgs/development/libraries/signond/default.nix b/pkgs/development/libraries/signond/default.nix
index 7e986ed2635e0..ff5aeca626ebf 100644
--- a/pkgs/development/libraries/signond/default.nix
+++ b/pkgs/development/libraries/signond/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "signond";
-  version = "8.60";
+  version = "8.61";
 
   src = fetchFromGitLab {
     owner = "accounts-sso";
     repo = pname;
     rev = "VERSION_${version}";
-    sha256 = "pFpeJ13ut5EoP37W33WrYL2LzkX/k7ZKJcRpPO5l8i4=";
+    sha256 = "sha256-d7JZmGpjIvSN9l1nvKbBZjF0OR5L5frPTGHF/pNEqHE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 0d80a83e8ed7f..726ccff02bb9a 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -12,13 +12,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${optionalString interactive "-interactive"}";
-  version = "3.38.2";
+  version = "3.38.3";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-55dKoUMLrWkKXp95pu5chJKtqCadxnWHWtD7dH18raQ=";
+    sha256 = "sha256-YfLdk6LjjDNGi3EllnwyGL+fTdg2Xe9gJeMU+QXclC4=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 73ce1c35f505f..d112515c8e9e3 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.38.2";
+    version = "3.38.3";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-x8DwcKM4yS6wiAWQXAXyVPpG0cTdo1SKAkdPb7VnMpo=";
+      sha256 = "sha256-oQTUk+CEAGvXT/H/esLrKzh8fAo7Y7pv6i+vtBGDE68=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/webrtc-audio-processing/0.3.nix b/pkgs/development/libraries/webrtc-audio-processing/0.3.nix
index 1ce3c2d9fa8be..c9fafdd276678 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/0.3.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/0.3.nix
@@ -9,7 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1gsx7k77blfy171b6g3m0k0s0072v6jcawhmx1kjs9w5zlwdkzd0";
   };
 
-  patches = [ ./enable-riscv.patch ];
+  patches = [
+    ./enable-riscv.patch
+    ./enable-powerpc.patch
+  ];
 
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices ]);
 
diff --git a/pkgs/development/libraries/webrtc-audio-processing/enable-powerpc.patch b/pkgs/development/libraries/webrtc-audio-processing/enable-powerpc.patch
new file mode 100644
index 0000000000000..636cae4df854c
--- /dev/null
+++ b/pkgs/development/libraries/webrtc-audio-processing/enable-powerpc.patch
@@ -0,0 +1,37 @@
+This patch was extracted from the Gentoo powerpc64le-qtwebengine
+patchset, referenced here:
+
+  https://gitweb.gentoo.org/repo/gentoo.git/tree/dev-qt/qtwebengine/qtwebengine-5.15.3_p20220406.ebuild
+
+and downloaded from here:
+
+  https://dev.gentoo.org/~asturm/distfiles/${PN}-5.15.3_p20220406-patchset.tar.xz
+
+From 4bbb4482e14ad27cf0bd5032b1b5d4abba29dc99 Mon Sep 17 00:00:00 2001
+From: Georgy Yakovlev <gyakovlev@gentoo.org>
+Date: Fri, 27 Nov 2020 13:05:45 -0800
+Subject: [PATCH] 5.15.2 ppc64le patchet
+
+diff --git a/webrtc/typedefs.h b/webrtc/typedefs.h
+index ce1f3e8..fd39a16 100644
+--- a/webrtc/typedefs.h
++++ b/webrtc/typedefs.h
+@@ -38,6 +38,18 @@
+ #define WEBRTC_ARCH_X86
+ #define WEBRTC_ARCH_32_BITS
+ #define WEBRTC_ARCH_LITTLE_ENDIAN
++#elif defined(__PPC__)
++#define WEBRTC_ARCH_PPC_FAMILY
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
++#define WEBRTC_ARCH_LITTLE_ENDIAN
++#else
++#define WEBRTC_ARCH_BIG_ENDIAN
++#endif
++#if defined(__LP64__)
++#define WEBRTC_ARCH_64_BITS
++#else
++#define WEBRTC_ARCH_32_BITS
++#endif
+ #elif defined(__ARMEL__)
+ // TODO(ajm): We'd prefer to control platform defines here, but this is
+ // currently provided by the Android makefiles. Commented to avoid duplicate
diff --git a/pkgs/development/libraries/zimg/default.nix b/pkgs/development/libraries/zimg/default.nix
index 38b106d474b7b..475ebc7517e51 100644
--- a/pkgs/development/libraries/zimg/default.nix
+++ b/pkgs/development/libraries/zimg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zimg";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     owner  = "sekrit-twc";
     repo   = "zimg";
     rev    = "release-${version}";
-    sha256 = "0pwgf1mybpa3fs13p6jryzm32vfldyql9biwaypqdcimlnlmyk20";
+    sha256 = "1069x49l7kh1mqcq1h3f0m5j0h832jp5x230bh4c613ymgg5kn00";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/python-modules/curio/default.nix b/pkgs/development/python-modules/curio/default.nix
index 1a0f4e2d9fe75..7a66e47966489 100644
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@@ -26,9 +26,10 @@ buildPythonPackage rec {
 
   disabledTests = [
      "test_aside_basic" # times out
+     "test_write_timeout" # flaky, does not always time out
      "test_aside_cancel" # fails because modifies PYTHONPATH and cant find pytest
      "test_ssl_outgoing" # touches network
-   ] ++ lib.optionals (stdenv.isDarwin) [
+   ] ++ lib.optionals stdenv.isDarwin [
      "test_unix_echo" # socket bind error on hydra when built with other packages
      "test_unix_ssl_server" # socket bind error on hydra when built with other packages
    ];
diff --git a/pkgs/development/python-modules/flask-restful/default.nix b/pkgs/development/python-modules/flask-restful/default.nix
index 1af875d4bbc59..25f02b87c9e78 100644
--- a/pkgs/development/python-modules/flask-restful/default.nix
+++ b/pkgs/development/python-modules/flask-restful/default.nix
@@ -1,23 +1,28 @@
 { lib
+, aniso8601
+, blinker
 , buildPythonPackage
 , fetchPypi
-, aniso8601
 , flask
-, pytz
-, six
-, blinker
 , mock
 , nose
 , pytestCheckHook
+, pythonOlder
+, pytz
+, six
 }:
 
 buildPythonPackage rec {
-  pname = "Flask-RESTful";
+  pname = "flask-restful";
   version = "0.3.9";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "0gm5dz088v3d2k1dkcp9b3nnqpkk0fp2jly870hijj2xhc5nbv6c";
+    pname = "Flask-RESTful";
+    inherit version;
+    hash = "sha256-zOxlC4NdSBkhOMhTKa4Dc15s7VjpstnCFG1shMBvpT4=";
   };
 
   patches = [
@@ -32,19 +37,24 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-    pytestCheckHook
+    blinker
     mock
     nose
-    blinker
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "flask_restful"
   ];
 
   meta = with lib; {
+    description = "Framework for creating REST APIs";
     homepage = "https://flask-restful.readthedocs.io";
-    description = "Simple framework for creating REST APIs";
     longDescription = ''
       Flask-RESTful provides the building blocks for creating a great
       REST API.
     '';
     license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index 7cb622df047ec..e99c23a79f4fc 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -1,21 +1,75 @@
-{ lib, fetchPypi, buildPythonPackage, six }:
+{ lib
+, buildPythonPackage
+, deprecated
+, fetchFromGitHub
+, hiro
+, packaging
+, pymemcache
+, pymongo
+, pytest-asyncio
+, pytest-lazy-fixture
+, pytestCheckHook
+, pythonOlder
+, redis
+, setuptools
+, typing-extensions
+}:
 
 buildPythonPackage rec {
   pname = "limits";
-  version = "2.4.0";
+  version = "2.6.1";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-jiK2PfJjECB6d7db1HRZnwpGE6fZFjZQ7TpCjpzHrjU=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "alisaifee";
+    repo = pname;
+    rev = version;
+    hash = "sha256-4Njai0LT72U9Ra4pgHU0ZjF9oZexbijUgLFYaZi/LgE=";
   };
 
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [
+    deprecated
+    packaging
+    setuptools
+    typing-extensions
+  ];
+
+  checkInputs = [
+    hiro
+    pymemcache
+    pymongo
+    pytest-asyncio
+    pytest-lazy-fixture
+    pytestCheckHook
+    redis
+  ];
+
+  postPatch = ''
+    substituteInPlace pytest.ini \
+      --replace "--cov=limits" "" \
+      --replace "-K" ""
+    # redis-py-cluster doesn't support redis > 4
+    substituteInPlace tests/conftest.py \
+      --replace "import rediscluster" ""
+  '';
 
-  doCheck = false; # ifilter
+  pythonImportsCheck = [
+    "limits"
+  ];
+
+  pytestFlagsArray = [
+    # All other tests require a running Docker instance
+    "tests/test_limits.py"
+    "tests/test_ratelimit_parser.py"
+    "tests/test_limit_granularities.py"
+  ];
 
   meta = with lib; {
     description = "Rate limiting utilities";
-    license = licenses.mit;
     homepage = "https://limits.readthedocs.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index cc118d9f0ab08..933fd3865d6bb 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -17,7 +17,7 @@ let
 in
 
 buildPythonPackage rec {
-  version = "3.5.1";
+  version = "3.5.2";
   pname = "matplotlib";
   format = "setuptools";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b2e9810e09c3a47b73ce9cab5a72243a1258f61e7900969097a817232246ce1c";
+    sha256 = "18h78s5ld1i6mz00w258hy29909nfr3ddq6ry9kq18agw468bks8";
   };
 
   XDG_RUNTIME_DIR = "/tmp";
diff --git a/pkgs/development/python-modules/pkgconfig/default.nix b/pkgs/development/python-modules/pkgconfig/default.nix
index fc593e6a48fb1..105beaccb9b0a 100644
--- a/pkgs/development/python-modules/pkgconfig/default.nix
+++ b/pkgs/development/python-modules/pkgconfig/default.nix
@@ -1,8 +1,15 @@
-{ lib, buildPythonPackage, fetchPypi, pkg-config }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pkg-config
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pkgconfig";
   version = "1.5.5";
+  format = "pyproject";
 
   inherit (pkg-config)
     setupHooks
@@ -10,28 +17,39 @@ buildPythonPackage rec {
     suffixSalt
     targetPrefix
     baseBinName
-  ;
+    ;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "deb4163ef11f75b520d822d9505c1f462761b4309b1bb713d08689759ea8b899";
+  src = fetchFromGitHub {
+    owner = "matze";
+    repo = "pkgconfig";
+    rev = "v${version}";
+    sha256 = "sha256-uuLUGRNLCR3NS9g6OPCI+qG7tPWsLhI3OE5WmSI3vm8=";
   };
 
-
-  propagatedNativeBuildInputs = [ pkg-config ];
-
-  doCheck = false;
-
   patches = [ ./executable.patch ];
+
   postPatch = ''
-    substituteInPlace pkgconfig/pkgconfig.py --replace 'PKG_CONFIG_EXE = "pkg-config"' 'PKG_CONFIG_EXE = "${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config"'
+    rm pkgconfig/pkgconfig.py.orig
+    substituteInPlace pkgconfig/pkgconfig.py \
+      --replace 'PKG_CONFIG_EXE = "pkg-config"' 'PKG_CONFIG_EXE = "${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config"'
+
+    # those pc files are missing and pkg-config validates that they exist
+    substituteInPlace data/fake-openssl.pc \
+      --replace "Requires: libssl libcrypto" ""
   '';
 
+  nativeBuildInputs = [ poetry-core ];
+
+  propagatedNativeBuildInputs = [ pkg-config ];
+
+  checkInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "pkgconfig" ];
 
   meta = with lib; {
     description = "Interface Python with pkg-config";
     homepage = "https://github.com/matze/pkgconfig";
     license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index e7f3b87ad0c3c..4b0e215f22c1a 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPyPy
 , fetchPypi
+, fetchpatch
 , pythonOlder
 , curl
 , openssl
@@ -20,6 +21,16 @@ buildPythonPackage rec {
     sha256 = "sha256-qGOtGP9Hj1VFkkBXiHza5CLhsnRuQWdGFfaHSY6luIo=";
   };
 
+  patches = [
+    # Pull upstream patch for curl-3.83:
+    #  https://github.com/pycurl/pycurl/pull/753
+    (fetchpatch {
+      name = "curl-3.83.patch";
+      url = "https://github.com/pycurl/pycurl/commit/d47c68b1364f8a1a45ab8c584c291d44b762f7b1.patch";
+      sha256 = "sha256-/lGq7O7ZyytzBAxWJPigcWdvypM7OHLBcp9ItmX7z1g=";
+    })
+  ];
+
   preConfigure = ''
     substituteInPlace setup.py --replace '--static-libs' '--libs'
     export PYCURL_SSL_LIBRARY=openssl
diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index addc12b3637a4..4def2f46317f6 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "rich";
-  version = "12.2.0";
+  version = "12.3.0";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Textualize";
     repo = pname;
     rev = "v${version}";
-    sha256 = "02zypmnc9sijlipki0riywh82piamd3hlrl5xbg2bxlldnlnwx1d";
+    sha256 = "sha256-/BPJcFjUldbTa/M3i9jGGU7apbrTcWbF+yrrFuLXcHY=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index 24c60839fe0bd..10f46fecf6f48 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.2.0";
+  version = "1.3.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-CkraR56Mfj2L18tW4aKazCsruYwjJQUbDNy1fX8Fbeg=";
+    sha256 = "sha256-lYxb9Ktkg9Wdq4iFOBIYccxQBjVKQvsPvVCs8Dyq0d4=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index 84900ad5477e9..430d0374ef20d 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonRelaxDepsHook
 , pbr
 , python-mimeparse
 , extras
@@ -20,15 +21,13 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pbr python-mimeparse extras ];
   buildInputs = [ traceback2 ];
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
   # testscenarios has a circular dependency on testtools
   doCheck = false;
   checkInputs = [ testscenarios ];
 
-  # testtools 2.0.0 and up has a circular run-time dependency on futures
-  postPatch = ''
-    substituteInPlace requirements.txt --replace "fixtures>=1.3.0" ""
-  '';
+  pythonRemoveDeps = [ "fixtures" ];
 
   meta = {
     description = "A set of extensions to the Python standard library's unit testing framework";
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index adee94dafa91e..fa867c263162e 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -85,6 +85,8 @@ stdenv.mkDerivation rec {
     homepage = "https://sourceware.org/elfutils/";
     description = "A set of utilities to handle ELF objects";
     platforms = platforms.linux;
+    # https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-November/004223.html
+    broken = stdenv.hostPlatform.isStatic;
     # licenses are GPL2 or LGPL3+ for libraries, GPL3+ for bins,
     # but since this package isn't split that way, all three are listed.
     license = with licenses; [ gpl2Only lgpl3Plus gpl3Plus ];
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index f7d1667dfa24e..05c6586971768 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, perlPackages, gettext }:
+{ lib, stdenv, fetchurl, perlPackages, gettext, libintl }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -17,7 +17,11 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   nativeBuildInputs = [ gettext perlPackages.perl perlPackages.LocaleGettext ];
-  buildInputs = [ perlPackages.LocaleGettext ];
+  buildInputs = [ perlPackages.LocaleGettext libintl ];
+
+  configureFlags = [
+    "--enable-nls"
+  ];
 
   doCheck = false;                                # target `check' is missing
 
diff --git a/pkgs/development/tools/pandoc/default.nix b/pkgs/development/tools/pandoc/default.nix
index e587a2ef4e756..515c7dc4c37de 100644
--- a/pkgs/development/tools/pandoc/default.nix
+++ b/pkgs/development/tools/pandoc/default.nix
@@ -13,9 +13,6 @@ in
       remove-references-to \
         -t ${haskellPackages.pandoc-types} \
         $out/bin/pandoc
-      remove-references-to \
-        -t ${haskellPackages.HTTP} \
-        $out/bin/pandoc
     '';
   }) static).overrideAttrs (drv: {
     # These libraries are still referenced, because they generate
@@ -25,5 +22,5 @@ in
     # lead to a transitive runtime dependency on the whole GHC distribution.
     # This should ideally be fixed in haskellPackages (or even Cabal),
     # but a minimal pandoc is important enough to patch it manually.
-    disallowedReferences = [ haskellPackages.pandoc-types haskellPackages.HTTP ];
+    disallowedReferences = [ haskellPackages.pandoc-types ];
   })
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 327cf2862346c..28344c3fc5a3e 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -1,6 +1,6 @@
 { config, stdenv, lib, fetchurl, pkg-config, zlib, expat, openssl, autoconf
 , libjpeg, libpng, libtiff, freetype, fontconfig, libpaper, jbig2dec
-, libiconv, ijs, lcms2, fetchpatch, callPackage, bash, buildPackages
+, libiconv, ijs, lcms2, callPackage, bash, buildPackages, openjpeg
 , cupsSupport ? config.ghostscript.cups or (!stdenv.isDarwin), cups
 , x11Support ? cupsSupport, xlibsWrapper # with CUPS, X11 only adds very little
 }:
@@ -30,19 +30,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ghostscript${lib.optionalString (x11Support) "-with-X"}";
-  version = "9.55.0";
+  version = "9.56.1";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs9${lib.versions.minor version}${lib.versions.patch version}/ghostscript-${version}.tar.xz";
-    sha512 = "27g72152mlwlalg232jxdhaf3ykgmqwi2pccbkwfygql1h9iz40plfbwbs1n0fkvm4zwzg5r9cr8g7w2dxih4jldiidv7rflxdy1is2";
+    sha512 = "22ysgdprh960rxmxyk2fy2my47cdrhfhbrwar1955hvad54iw79l916drp92wh3qzbxw6z40i70wk00vz8bn2ryig7qgpc1q01m2npy";
   };
 
   patches = [
-    (fetchpatch {
-      name = "fix-non-vendored-lcms2-typo.patch";
-      url = "https://github.com/ArtifexSoftware/ghostpdl/commit/830afae5454dea3bff903869d82022306890a96c.patch";
-      sha256 = "1w9yspsgxyabvrw9ld6pv6pb7708c44ihjqvag7qqh9v1lhm48j0";
-    })
     ./urw-font-files.patch
     ./doc-no-ref.diff
   ];
@@ -61,7 +56,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     zlib expat openssl
     libjpeg libpng libtiff freetype fontconfig libpaper jbig2dec
-    libiconv ijs lcms2 bash
+    libiconv ijs lcms2 bash openjpeg
   ]
   ++ lib.optional x11Support xlibsWrapper
   ++ lib.optional cupsSupport cups
@@ -72,8 +67,7 @@ stdenv.mkDerivation rec {
     export CCAUX=$CC_FOR_BUILD
     ${lib.optionalString cupsSupport ''export CUPSCONFIG="${cups.dev}/bin/cups-config"''}
 
-    # requires in-tree (heavily patched) openjpeg
-    rm -rf jpeg libpng zlib jasper expat tiff lcms2mt jbig2dec freetype cups/libs ijs
+    rm -rf jpeg libpng zlib jasper expat tiff lcms2mt jbig2dec freetype cups/libs ijs openjpeg
 
     sed "s@if ( test -f \$(INCLUDE)[^ ]* )@if ( true )@; s@INCLUDE=/usr/include@INCLUDE=/no-such-path@" -i base/unix-aux.mak
     sed "s@^ZLIBDIR=.*@ZLIBDIR=${zlib.dev}/include@" -i configure.ac
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 1f6fb31d93db7..1d93174ec65de 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , alsa-lib
 , dbus
 , ell
@@ -49,6 +50,17 @@ in stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";
 
+  patches = [
+    # https://github.com/bluez/bluez/commit/0905a06410d4a5189f0be81e25eb3c3e8a2199c5
+    # which fixes https://github.com/bluez/bluez/issues/329
+    # and is already merged upstream and not yet in a release.
+    (fetchpatch {
+      name = "StateDirectory_and_ConfigurationDirectory.patch";
+      url = "https://github.com/bluez/bluez/commit/0905a06410d4a5189f0be81e25eb3c3e8a2199c5.patch";
+      sha256 = "sha256-MI6yPTiDLHsSTjLvNqtWnuy2xUMYpSat1WhMbeoedSM=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
       --replace /sbin/udevadm ${systemd}/bin/udevadm \
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index 4c89d8c821972..4d08a38dbe85e 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [ check pam ];
+  NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isStatic "-laudit";
   nativeBuildInputs = [ autoreconfHook pkg-config flex ];
 
   passthru.tests = {
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index e130abbf27ff3..9e914132ef22c 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -666,6 +666,18 @@ stdenv.mkDerivation {
     rm -rf $out/share/doc
   '';
 
+  # Avoid *.EFI binary stripping. At least on aarch64-linux strip
+  # removes too much from PE32+ files:
+  #   https://github.com/NixOS/nixpkgs/issues/169693
+  # The hack is to move EFI file out of lib/ before doStrip
+  # run and return it after doStrip run.
+  preFixup = lib.optionalString withEfi ''
+    mv $out/lib/systemd/boot/efi $out/dont-strip-me
+  '';
+  postFixup = lib.optionalString withEfi ''
+    mv $out/dont-strip-me $out/lib/systemd/boot/efi
+  '';
+
   passthru = {
     # The interface version prevents NixOS from switching to an
     # incompatible systemd at runtime.  (Switching across reboots is
@@ -687,6 +699,8 @@ stdenv.mkDerivation {
     description = "A system and service manager for Linux";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
+    # https://github.com/systemd/systemd/issues/20600#issuecomment-912338965
+    broken = stdenv.hostPlatform.isStatic;
     priority = 10;
     maintainers = with maintainers; [ flokli kloenk mic92 ];
   };
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 3efb3914b85e5..efd75ce9b3f2d 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, pkg-config, zlib, shadow, libcap_ng
 , ncursesSupport ? true
 , ncurses, pam
-, systemdSupport ? stdenv.isLinux
+, systemdSupport ? stdenv.isLinux && !stdenv.hostPlatform.isStatic
 , systemd
 , nlsSupport ? true
 }:
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 95a454850b647..9e3075f09b76f 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -114,7 +114,9 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = lib.optionalString libOnly ''
-    rm -rf $out/{bin,share,etc,lib/{pulse-*,systemd}}
+    find $out/share -maxdepth 1 -mindepth 1 ! -name "vala" -prune -exec rm -r {} \;
+    find $out/share/vala -maxdepth 1 -mindepth 1 ! -name "vapi" -prune -exec rm -r {} \;
+    rm -r $out/{bin,etc,lib/pulse-*}
   ''
     + ''
     moveToOutput lib/cmake "$dev"
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 6fbd78c422dad..32e4fe9749ab3 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -98,6 +98,7 @@ rec {
 
       doSign = localSystem.isAarch64 && last != null;
       doUpdateAutoTools = localSystem.isAarch64 && last != null;
+      inherit (last.pkgs) runCommandLocal;
 
       mkExtraBuildCommands = cc: ''
         rsrc="$out/resource-root"
@@ -223,23 +224,15 @@ rec {
         '';
       };
 
-      pbzx = stdenv.mkDerivation {
-        name = "bootstrap-stage0-pbzx";
-        phases = [ "installPhase" ];
-        installPhase = ''
-          mkdir -p $out/bin
-          ln -s ${bootstrapTools}/bin/pbzx $out/bin
-        '';
-      };
+      pbzx = self.runCommandLocal "bootstrap-stage0-pbzx" { } ''
+        mkdir -p $out/bin
+        ln -s ${bootstrapTools}/bin/pbzx $out/bin
+      '';
 
-      cpio = stdenv.mkDerivation {
-        name = "bootstrap-stage0-cpio";
-        phases = [ "installPhase" ];
-        installPhase = ''
-          mkdir -p $out/bin
-          ln -s ${bootstrapFiles.cpio} $out/bin/cpio
-        '';
-      };
+      cpio = self.runCommandLocal "bootstrap-stage0-cpio" { } ''
+        mkdir -p $out/bin
+        ln -s ${bootstrapFiles.cpio} $out/bin/cpio
+      '';
 
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         darwin-stubs = superDarwin.darwin-stubs.override { inherit (self) stdenvNoCC fetchurl; };
@@ -253,43 +246,21 @@ rec {
           '';
         };
 
-        sigtool = stdenv.mkDerivation {
-          name = "bootstrap-stage0-sigtool";
-          phases = [ "installPhase" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            ln -s ${bootstrapTools}/bin/sigtool $out/bin
-
-            # Rewrite nuked references
-            sed -e "s|[^( ]*\bsigtool\b|$out/bin/sigtool|g" \
-              ${bootstrapTools}/bin/codesign > $out/bin/codesign
-            chmod a+x $out/bin/codesign
-          '';
-          # on next bootstrap tools update, use the following:
-          # installPhase = ''
-          #   mkdir -p $out/bin
-          #   ln -s ${bootstrapTools}/bin/sigtool  $out/bin
-          #   ln -s ${bootstrapTools}/bin/codesign $out/bin
-          # '';
-        };
+        sigtool = self.runCommandLocal "bootstrap-stage0-sigtool" { } ''
+           mkdir -p $out/bin
+           ln -s ${bootstrapTools}/bin/sigtool  $out/bin
+           ln -s ${bootstrapTools}/bin/codesign $out/bin
+        '';
 
-        print-reexports = stdenv.mkDerivation {
-          name = "bootstrap-stage0-print-reexports";
-          phases = [ "installPhase" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            ln -s ${bootstrapTools}/bin/print-reexports $out/bin
-          '';
-        };
+        print-reexports = self.runCommandLocal "bootstrap-stage0-print-reexports" { } ''
+          mkdir -p $out/bin
+          ln -s ${bootstrapTools}/bin/print-reexports $out/bin
+        '';
 
-        rewrite-tbd = stdenv.mkDerivation {
-          name = "bootstrap-stage0-rewrite-tbd";
-          phases = [ "installPhase" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            ln -s ${bootstrapTools}/bin/rewrite-tbd $out/bin
-          '';
-        };
+        rewrite-tbd = self.runCommandLocal "bootstrap-stage0-rewrite-tbd" { } ''
+          mkdir -p $out/bin
+          ln -s ${bootstrapTools}/bin/rewrite-tbd $out/bin
+        '';
 
         binutils-unwrapped = { name = "bootstrap-stage0-binutils"; outPath = bootstrapTools; };
 
@@ -359,7 +330,7 @@ rec {
 
         libcxx = stdenv.mkDerivation {
           name = "bootstrap-stage0-libcxx";
-          phases = [ "installPhase" "fixupPhase" ];
+          dontUnpack = true;
           installPhase = ''
             mkdir -p $out/lib $out/include
             ln -s ${bootstrapTools}/lib/libc++.dylib $out/lib/libc++.dylib
diff --git a/pkgs/tools/networking/curl/7.82.0-openssl-fix-CN-check.patch b/pkgs/tools/networking/curl/7.82.0-openssl-fix-CN-check.patch
deleted file mode 100644
index 5d84f51249955..0000000000000
--- a/pkgs/tools/networking/curl/7.82.0-openssl-fix-CN-check.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 911714d617c106ed5d553bf003e34ec94ab6a136 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Tue, 8 Mar 2022 13:38:13 +0100
-Subject: [PATCH] openssl: fix CN check error code
-
-Due to a missing 'else' this returns error too easily.
-
-Regressed in: d15692ebb
-
-Reported-by: Kristoffer Gleditsch
-Fixes #8559
-Closes #8560
----
- lib/vtls/openssl.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
-index 0b79fc50a9c5..4618beeb3867 100644
---- a/lib/vtls/openssl.c
-+++ b/lib/vtls/openssl.c
-@@ -1817,7 +1817,8 @@ CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
-               memcpy(peer_CN, ASN1_STRING_get0_data(tmp), peerlen);
-               peer_CN[peerlen] = '\0';
-             }
--            result = CURLE_OUT_OF_MEMORY;
-+            else
-+              result = CURLE_OUT_OF_MEMORY;
-           }
-         }
-         else /* not a UTF8 name */
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index a4056fd28a92c..d3258e0a946b8 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -54,19 +54,18 @@ assert zstdSupport -> zstd != null;
 
 stdenv.mkDerivation rec {
   pname = "curl";
-  version = "7.82.0";
+  version = "7.83.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
     ];
-    sha256 = "sha256-RtmgQAozQI/ZkncLBKRKdDSzA28ugImsKLV1c9WdNx8=";
+    sha256 = "sha256-JHx+x1IcQljmVjTlKScNIU/jKWmXHMy3KEXnqkaDH5Y=";
   };
 
   patches = [
     ./7.79.1-darwin-no-systemconfiguration.patch
-    ./7.82.0-openssl-fix-CN-check.patch
   ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/wayland/wlogout/default.nix b/pkgs/tools/wayland/wlogout/default.nix
index d9d4421260106..7f9935b6c3c59 100644
--- a/pkgs/tools/wayland/wlogout/default.nix
+++ b/pkgs/tools/wayland/wlogout/default.nix
@@ -10,6 +10,11 @@
 , wayland
 , wayland-protocols
 , gtk-layer-shell
+# gtk-layer-shell fails to cross-compile due to a hard dependency
+# on gobject-introspection.
+# Disable it when cross-compiling since it's an optional dependency.
+# This disables transparency support.
+, withGtkLayerShell ? (stdenv.buildPlatform == stdenv.hostPlatform)
 }:
 
 stdenv.mkDerivation rec {
@@ -23,12 +28,15 @@ stdenv.mkDerivation rec {
     sha256 = "cTscfx+erHVFHwwYpN7pADQWt5sq75sQSyXSP/H8kOs=";
   };
 
+  strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ pkg-config meson ninja scdoc ];
   buildInputs = [
     gtk3
     libxkbcommon
     wayland
     wayland-protocols
+  ] ++ lib.optionals withGtkLayerShell [
     gtk-layer-shell
   ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 26e8d7120e6ad..5de4b02ecfc8e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17910,8 +17910,13 @@ with pkgs;
   } // (lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
       stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
     }));
+  icu71 = callPackage ../development/libraries/icu/71.nix ({
+    nativeBuildRoot = buildPackages.icu71.override { buildRootOnly = true; };
+  } // (lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
+      stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
+    }));
 
-  icu = icu70;
+  icu = icu71;
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a6963c11358f1..dee60882cdc75 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -120,6 +120,7 @@ in {
     pythonImportsCheckHook
     pythonNamespacesHook
     pythonRecompileBytecodeHook
+    pythonRelaxDepsHook
     pythonRemoveBinBytecodeHook
     pythonRemoveTestsDirHook
     setuptoolsBuildHook