about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix15
-rw-r--r--maintainers/scripts/update-luarocks-shell.nix2
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2111.section.xml8
-rw-r--r--nixos/doc/manual/release-notes/rl-2111.section.md2
-rw-r--r--nixos/modules/config/no-x-libs.nix4
-rw-r--r--nixos/modules/config/xdg/portal.nix12
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/services/backup/borgbackup.xml2
-rw-r--r--nixos/modules/services/databases/cassandra.nix31
-rw-r--r--nixos/modules/services/networking/twingate.nix28
-rw-r--r--nixos/modules/services/printing/ipp-usb.nix63
-rw-r--r--nixos/modules/services/x11/desktop-managers/cinnamon.nix4
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--pkgs/applications/audio/cardinal/default.nix4
-rw-r--r--pkgs/applications/audio/cyanrip/default.nix4
-rw-r--r--pkgs/applications/audio/mmtc/default.nix6
-rw-r--r--pkgs/applications/audio/pt2-clone/default.nix4
-rw-r--r--pkgs/applications/audio/sooperlooper/default.nix4
-rw-r--r--pkgs/applications/audio/soundux/default.nix142
-rw-r--r--pkgs/applications/audio/spek/default.nix4
-rw-r--r--pkgs/applications/blockchains/electrs/default.nix3
-rw-r--r--pkgs/applications/blockchains/ledger-live-desktop/default.nix4
-rw-r--r--pkgs/applications/blockchains/lighthouse/default.nix4
-rw-r--r--pkgs/applications/blockchains/lndhub-go/default.nix6
-rw-r--r--pkgs/applications/blockchains/nearcore/default.nix10
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix3
-rw-r--r--pkgs/applications/blockchains/snarkos/default.nix4
-rw-r--r--pkgs/applications/blockchains/solana-validator/default.nix7
-rw-r--r--pkgs/applications/blockchains/teos/default.nix9
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix6
-rw-r--r--pkgs/applications/editors/gnome-builder/default.nix9
-rw-r--r--pkgs/applications/editors/jove/default.nix25
-rw-r--r--pkgs/applications/editors/kakoune/plugins/update-shell.nix2
-rw-r--r--pkgs/applications/editors/tiled/default.nix60
-rw-r--r--pkgs/applications/editors/vim/plugins/update-shell.nix2
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix8
-rw-r--r--pkgs/applications/emulators/dolphin-emu/default.nix4
-rw-r--r--pkgs/applications/emulators/mame/001-use-absolute-paths.diff (renamed from pkgs/applications/emulators/mame/emuopts.patch)16
-rw-r--r--pkgs/applications/emulators/mame/default.nix77
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/graphics/freecad/default.nix4
-rw-r--r--pkgs/applications/misc/authenticator/default.nix4
-rw-r--r--pkgs/applications/misc/clipcat/default.nix5
-rw-r--r--pkgs/applications/misc/hugo/default.nix6
-rw-r--r--pkgs/applications/misc/imag/default.nix4
-rw-r--r--pkgs/applications/misc/latte-dock/default.nix2
-rw-r--r--pkgs/applications/misc/lenmus/default.nix4
-rw-r--r--pkgs/applications/misc/lutris/fhsenv.nix2
-rw-r--r--pkgs/applications/misc/mediainfo-gui/default.nix4
-rw-r--r--pkgs/applications/misc/oxker/default.nix6
-rw-r--r--pkgs/applications/misc/pwsafe/default.nix4
-rw-r--r--pkgs/applications/misc/tippecanoe/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform-compliance/default.nix58
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json72
-rw-r--r--pkgs/applications/networking/cluster/terragrunt/default.nix4
-rw-r--r--pkgs/applications/networking/ftp/filezilla/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/sync/rsync/default.nix4
-rw-r--r--pkgs/applications/networking/twingate/default.nix51
-rw-r--r--pkgs/applications/networking/yaup/default.nix47
-rw-r--r--pkgs/applications/office/portfolio/default.nix4
-rw-r--r--pkgs/applications/radio/freedv/default.nix4
-rw-r--r--pkgs/applications/science/astronomy/phd2/default.nix4
-rw-r--r--pkgs/applications/science/logic/isabelle/default.nix39
-rwxr-xr-xpkgs/applications/science/machine-learning/streamlit/default.nix20
-rw-r--r--pkgs/applications/science/misc/snakemake/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix21
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-privacy/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix16
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-up/default.nix16
-rw-r--r--pkgs/applications/version-management/git-and-tools/lefthook/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/legit/default.nix7
-rw-r--r--pkgs/applications/version-management/jujutsu/default.nix6
-rw-r--r--pkgs/applications/version-management/rapidsvn/default.nix4
-rw-r--r--pkgs/applications/video/dvdstyler/default.nix4
-rw-r--r--pkgs/applications/video/mpv/default.nix73
-rw-r--r--pkgs/applications/window-managers/icewm/default.nix4
-rw-r--r--pkgs/build-support/fetchzip/default.nix2
-rw-r--r--pkgs/build-support/mkshell/default.nix15
-rw-r--r--pkgs/build-support/rust/build-rust-crate/configure-crate.nix5
-rw-r--r--pkgs/build-support/rust/build-rust-crate/lib.sh6
-rw-r--r--pkgs/build-support/setup-hooks/multiple-outputs.sh2
-rw-r--r--pkgs/data/fonts/amiri/default.nix5
-rw-r--r--pkgs/data/fonts/carlito/default.nix21
-rw-r--r--pkgs/data/fonts/iosevka/bin.nix3
-rw-r--r--pkgs/data/fonts/iosevka/variants.nix184
-rw-r--r--pkgs/data/fonts/lexend/default.nix10
-rw-r--r--pkgs/data/fonts/material-design-icons/default.nix18
-rw-r--r--pkgs/data/icons/simp1e-cursors/default.nix42
-rw-r--r--pkgs/data/misc/iana-etc/default.nix4
-rw-r--r--pkgs/data/misc/v2ray-geoip/default.nix6
-rw-r--r--pkgs/desktops/cinnamon/mint-artwork/default.nix6
-rw-r--r--pkgs/desktops/pantheon/apps/elementary-camera/default.nix4
-rw-r--r--pkgs/development/androidndk-pkgs/androidndk-pkgs.nix19
-rw-r--r--pkgs/development/compilers/chicken/4/chicken.nix1
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix24
-rw-r--r--pkgs/development/compilers/glslang/default.nix15
-rw-r--r--pkgs/development/compilers/jetbrains-jdk/default.nix7
-rw-r--r--pkgs/development/compilers/julia/1.8.nix10
-rw-r--r--pkgs/development/compilers/llvm/10/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/10/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/10/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/11/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/11/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/11/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/12/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/12/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/12/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/13/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/13/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/13/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/14/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/14/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/14/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/5/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/5/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/5/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/6/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/6/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/6/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/7/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/7/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/7/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/8/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/8/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/8/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/9/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/9/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/9/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/llvm/git/clang/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/git/libcxx/default.nix14
-rw-r--r--pkgs/development/compilers/llvm/git/libcxxabi/default.nix6
-rw-r--r--pkgs/development/compilers/openjdk/11.nix3
-rw-r--r--pkgs/development/compilers/openjdk/12.nix3
-rw-r--r--pkgs/development/compilers/openjdk/13.nix3
-rw-r--r--pkgs/development/compilers/openjdk/14.nix3
-rw-r--r--pkgs/development/compilers/openjdk/17.nix8
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/11.nix39
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/15.nix7
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/17.nix4
-rw-r--r--pkgs/development/compilers/rust/1_65.nix (renamed from pkgs/development/compilers/rust/1_64.nix)32
-rw-r--r--pkgs/development/compilers/sbcl/2.x.nix10
-rw-r--r--pkgs/development/embedded/jtag-remote-server/default.nix6
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/CVE-2019-20907.patch24
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/CVE-2021-23336.patch390
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/CVE-2021-3177.patch181
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix24
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix13
-rw-r--r--pkgs/development/interpreters/python/default.nix4
-rw-r--r--pkgs/development/interpreters/ruby/default.nix3
-rw-r--r--pkgs/development/libraries/boost/generic.nix12
-rw-r--r--pkgs/development/libraries/fancypp/default.nix31
-rw-r--r--pkgs/development/libraries/ffmpegthumbnailer/default.nix6
-rw-r--r--pkgs/development/libraries/glib/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/2.35-make-4.4.patch66
-rw-r--r--pkgs/development/libraries/glibc/common.nix3
-rw-r--r--pkgs/development/libraries/gobject-introspection/wrapper.nix128
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix15
-rw-r--r--pkgs/development/libraries/httplib/default.nix31
-rw-r--r--pkgs/development/libraries/hunspell/default.nix2
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/liblouis/default.nix4
-rw-r--r--pkgs/development/libraries/libnfs/default.nix19
-rw-r--r--pkgs/development/libraries/libplctag/default.nix4
-rw-r--r--pkgs/development/libraries/librsvg/default.nix5
-rw-r--r--pkgs/development/libraries/libtiff/default.nix5
-rw-r--r--pkgs/development/libraries/libvterm-neovim/default.nix7
-rw-r--r--pkgs/development/libraries/libvterm/default.nix21
-rw-r--r--pkgs/development/libraries/libxcrypt/default.nix4
-rw-r--r--pkgs/development/libraries/libyuv/default.nix4
-rw-r--r--pkgs/development/libraries/libyuv/link-library-against-libjpeg.patch11
-rw-r--r--pkgs/development/libraries/mdds/default.nix17
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/mpfr/default.nix27
-rw-r--r--pkgs/development/libraries/ntirpc/default.nix4
-rw-r--r--pkgs/development/libraries/openldap/default.nix6
-rw-r--r--pkgs/development/libraries/openscenegraph/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/3.0/legacy.cnf395
-rw-r--r--pkgs/development/libraries/openssl/default.nix4
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtbase.nix2
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtwayland.nix3
-rw-r--r--pkgs/development/libraries/science/math/liblapack/default.nix4
-rw-r--r--pkgs/development/libraries/semver-cpp/default.nix31
-rw-r--r--pkgs/development/libraries/silgraphite/graphite2.nix5
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/subunit/default.nix4
-rw-r--r--pkgs/development/libraries/tracker/default.nix9
-rw-r--r--pkgs/development/libraries/wayland/protocols.nix4
-rw-r--r--pkgs/development/libraries/webkitgtk/fix-bubblewrap-paths.patch29
-rw-r--r--pkgs/development/libraries/wolfssl/default.nix2
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK30.nix10
-rw-r--r--pkgs/development/mobile/androidenv/compose-android-packages.nix6
-rw-r--r--pkgs/development/node-packages/overrides.nix4
-rw-r--r--pkgs/development/ocaml-modules/gen_js_api/default.nix1
-rw-r--r--pkgs/development/ocaml-modules/gen_js_api/ojs.nix1
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.14.nix4
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.15.nix5
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix6
-rw-r--r--pkgs/development/python-modules/GitPython/hardcode-git-path.patch13
-rw-r--r--pkgs/development/python-modules/aiogithubapi/default.nix7
-rw-r--r--pkgs/development/python-modules/angr/default.nix4
-rw-r--r--pkgs/development/python-modules/apache-airflow/default.nix4
-rw-r--r--pkgs/development/python-modules/astroid/default.nix20
-rw-r--r--pkgs/development/python-modules/asttokens/default.nix5
-rw-r--r--pkgs/development/python-modules/azure-storage-queue/default.nix7
-rw-r--r--pkgs/development/python-modules/bandit/default.nix41
-rw-r--r--pkgs/development/python-modules/bootstrapped-pip/default.nix2
-rw-r--r--pkgs/development/python-modules/btrfsutil/default.nix26
-rw-r--r--pkgs/development/python-modules/cccolutils/default.nix42
-rw-r--r--pkgs/development/python-modules/cryptography/default.nix6
-rw-r--r--pkgs/development/python-modules/cryptography/vectors.nix2
-rw-r--r--pkgs/development/python-modules/cryptolyzer/default.nix26
-rw-r--r--pkgs/development/python-modules/cryptoparser/default.nix11
-rw-r--r--pkgs/development/python-modules/curio/default.nix8
-rw-r--r--pkgs/development/python-modules/cvelib/default.nix29
-rw-r--r--pkgs/development/python-modules/dateparser/default.nix4
-rw-r--r--pkgs/development/python-modules/db-dtypes/default.nix5
-rw-r--r--pkgs/development/python-modules/deal-solver/default.nix2
-rw-r--r--pkgs/development/python-modules/django/4.nix5
-rw-r--r--pkgs/development/python-modules/docstring-to-markdown/default.nix11
-rw-r--r--pkgs/development/python-modules/exceptiongroup/default.nix4
-rw-r--r--pkgs/development/python-modules/flake8-bugbear/default.nix4
-rw-r--r--pkgs/development/python-modules/frozenlist/default.nix4
-rw-r--r--pkgs/development/python-modules/gcal-sync/default.nix4
-rw-r--r--pkgs/development/python-modules/git-sweep/default.nix19
-rw-r--r--pkgs/development/python-modules/gitpython/default.nix (renamed from pkgs/development/python-modules/GitPython/default.nix)31
-rw-r--r--pkgs/development/python-modules/homematicip/default.nix4
-rw-r--r--pkgs/development/python-modules/httplib2/default.nix4
-rw-r--r--pkgs/development/python-modules/ical/default.nix4
-rw-r--r--pkgs/development/python-modules/jpylyzer/default.nix33
-rw-r--r--pkgs/development/python-modules/json-schema-for-humans/default.nix7
-rw-r--r--pkgs/development/python-modules/jupytext/default.nix6
-rw-r--r--pkgs/development/python-modules/losant-rest/default.nix4
-rw-r--r--pkgs/development/python-modules/mathlibtools/default.nix4
-rw-r--r--pkgs/development/python-modules/meson-python/default.nix4
-rw-r--r--pkgs/development/python-modules/mlflow/default.nix5
-rw-r--r--pkgs/development/python-modules/nbdime/default.nix20
-rw-r--r--pkgs/development/python-modules/opentimestamps/default.nix5
-rw-r--r--pkgs/development/python-modules/orjson/default.nix12
-rw-r--r--pkgs/development/python-modules/pillow-simd/default.nix2
-rw-r--r--pkgs/development/python-modules/pillow/default.nix5
-rw-r--r--pkgs/development/python-modules/pillow/generic.nix17
-rw-r--r--pkgs/development/python-modules/pip/default.nix6
-rw-r--r--pkgs/development/python-modules/platformdirs/default.nix4
-rw-r--r--pkgs/development/python-modules/protobuf/default.nix3
-rw-r--r--pkgs/development/python-modules/psrpcore/default.nix7
-rw-r--r--pkgs/development/python-modules/psutil/default.nix4
-rw-r--r--pkgs/development/python-modules/py-desmume/default.nix56
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix12
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix8
-rw-r--r--pkgs/development/python-modules/pyext/default.nix24
-rw-r--r--pkgs/development/python-modules/pylint/default.nix28
-rw-r--r--pkgs/development/python-modules/pytest-random-order/default.nix4
-rw-r--r--pkgs/development/python-modules/python-arango/default.nix138
-rw-r--r--pkgs/development/python-modules/python-glanceclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-manilaclient/default.nix5
-rw-r--r--pkgs/development/python-modules/python-novaclient/default.nix4
-rw-r--r--pkgs/development/python-modules/pytz/default.nix4
-rw-r--r--pkgs/development/python-modules/rich-click/default.nix18
-rw-r--r--pkgs/development/python-modules/rich/default.nix10
-rw-r--r--pkgs/development/python-modules/rsa/default.nix41
-rw-r--r--pkgs/development/python-modules/rstcheck-core/default.nix13
-rw-r--r--pkgs/development/python-modules/rstcheck/default.nix13
-rw-r--r--pkgs/development/python-modules/scipy/default.nix12
-rw-r--r--pkgs/development/python-modules/scmrepo/default.nix4
-rw-r--r--pkgs/development/python-modules/simplejson/default.nix4
-rw-r--r--pkgs/development/python-modules/strenum/default.nix7
-rw-r--r--pkgs/development/python-modules/stytra/default.nix71
-rw-r--r--pkgs/development/python-modules/subunit/default.nix44
-rw-r--r--pkgs/development/python-modules/tern/default.nix29
-rw-r--r--pkgs/development/python-modules/tilequant/default.nix33
-rw-r--r--pkgs/development/python-modules/trustme/default.nix8
-rw-r--r--pkgs/development/python-modules/twisted/default.nix25
-rw-r--r--pkgs/development/python-modules/versionfinder/default.nix5
-rw-r--r--pkgs/development/python-modules/wandb/default.nix4
-rw-r--r--pkgs/development/python-modules/wrapt/default.nix4
-rw-r--r--pkgs/development/python-modules/wxPython/4.0.nix5
-rw-r--r--pkgs/development/python-modules/zamg/default.nix5
-rw-r--r--pkgs/development/python-modules/zopfli/default.nix6
-rw-r--r--pkgs/development/r-modules/default.nix6
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix5
-rw-r--r--pkgs/development/ruby-modules/with-packages/Gemfile1
-rw-r--r--pkgs/development/tools/agda-pkg/default.nix6
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix2
-rw-r--r--pkgs/development/tools/analysis/cvehound/default.nix2
-rw-r--r--pkgs/development/tools/analysis/valgrind/default.nix4
-rw-r--r--pkgs/development/tools/documentation/gi-docgen/default.nix30
-rw-r--r--pkgs/development/tools/fdroidserver/default.nix18
-rw-r--r--pkgs/development/tools/go-mockery/default.nix4
-rw-r--r--pkgs/development/tools/misc/autoconf-archive/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix6
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/default.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix3
-rw-r--r--pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix3
-rw-r--r--pkgs/development/tools/open-policy-agent/default.nix4
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/default.nix12
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json96
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix8
-rw-r--r--pkgs/development/tools/protoc-gen-validate/default.nix6
-rw-r--r--pkgs/development/tools/refurb/default.nix6
-rw-r--r--pkgs/development/tools/ruff/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-public-api/default.nix6
-rw-r--r--pkgs/games/heroic/fhsenv.nix10
-rw-r--r--pkgs/games/megaglest/default.nix6
-rw-r--r--pkgs/games/portmod/default.nix35
-rw-r--r--pkgs/games/rigsofrods/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipp-usb/default.nix42
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix9
-rw-r--r--pkgs/os-specific/linux/lvm2/2_02.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/2_03.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/common.nix10
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix16
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch12
-rw-r--r--pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch2
-rw-r--r--pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch22
-rw-r--r--pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch22
-rw-r--r--pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch21
-rw-r--r--pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch2
-rw-r--r--pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix7
-rw-r--r--pkgs/servers/http/dufs/default.nix5
-rw-r--r--pkgs/servers/invidious/versions.json6
-rw-r--r--pkgs/servers/klipper/klipper-firmware.nix4
-rw-r--r--pkgs/servers/matrix-synapse/default.nix6
-rw-r--r--pkgs/servers/misc/navidrome/default.nix4
-rw-r--r--pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix4
-rw-r--r--pkgs/servers/monitoring/sensu-go/default.nix4
-rw-r--r--pkgs/servers/nfs-ganesha/default.nix10
-rw-r--r--pkgs/servers/nosql/cassandra/4.json4
-rw-r--r--pkgs/servers/nosql/cassandra/4.nix8
-rw-r--r--pkgs/servers/nosql/ferretdb/default.nix6
-rw-r--r--pkgs/servers/search/zinc/default.nix56
-rw-r--r--pkgs/servers/snappymail/default.nix4
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix7
-rw-r--r--pkgs/shells/nushell/default.nix6
-rw-r--r--pkgs/stdenv/cross/default.nix3
-rw-r--r--pkgs/stdenv/generic/default.nix5
-rw-r--r--pkgs/stdenv/generic/setup.sh2
-rw-r--r--pkgs/stdenv/tests/succeedOnFailure.nix14
-rw-r--r--pkgs/tools/X11/bumblebee/default.nix8
-rw-r--r--pkgs/tools/X11/xdg-utils/allow-forcing-portal-use.patch29
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix16
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--pkgs/tools/backup/dar/default.nix4
-rw-r--r--pkgs/tools/backup/ugarit-manifest-maker/default.nix1
-rw-r--r--pkgs/tools/backup/ugarit/default.nix1
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix16
-rw-r--r--pkgs/tools/graphics/graphviz/default.nix19
-rw-r--r--pkgs/tools/graphics/unpaper/default.nix4
-rw-r--r--pkgs/tools/graphics/zbar/default.nix5
-rw-r--r--pkgs/tools/misc/findutils/default.nix5
-rw-r--r--pkgs/tools/misc/jdupes/default.nix10
-rw-r--r--pkgs/tools/misc/man-db/default.nix4
-rw-r--r--pkgs/tools/misc/opentimestamps-client/default.nix31
-rw-r--r--pkgs/tools/misc/synth/default.nix6
-rw-r--r--pkgs/tools/networking/httplz/default.nix10
-rw-r--r--pkgs/tools/networking/netbird/default.nix4
-rw-r--r--pkgs/tools/networking/p2p/amule/default.nix4
-rw-r--r--pkgs/tools/security/tpm2-tools/default.nix4
-rw-r--r--pkgs/tools/security/trufflehog/default.nix17
-rw-r--r--pkgs/tools/security/vaultwarden/vault.nix4
-rw-r--r--pkgs/tools/system/plan9port/default.nix8
-rw-r--r--pkgs/tools/text/poedit/default.nix4
-rw-r--r--pkgs/tools/text/transifex-client/default.nix15
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix104
-rw-r--r--pkgs/top-level/perl-packages.nix2
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix19
-rw-r--r--pkgs/top-level/ruby-packages.nix105
385 files changed, 3721 insertions, 2122 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 48f94d935a236..21e53a2ecc946 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9442,6 +9442,15 @@
     githubId = 249317;
     name = "montag451";
   };
+  montchr = {
+    name = "Chris Montgomery";
+    email = "chris@cdom.io";
+    github = "montchr";
+    githubId = 1757914;
+    keys = [{
+      fingerprint = "6460 4147 C434 F65E C306  A21F 135E EDD0 F719 34F3";
+    }];
+  };
   moosingin3space = {
     email = "moosingin3space@gmail.com";
     github = "moosingin3space";
@@ -14118,6 +14127,12 @@
     githubId = 8794235;
     name = "Tom Siewert";
   };
+  tonyshkurenko = {
+    email = "support@twingate.com";
+    github = "tonyshkurenko";
+    githubId = 8597964;
+    name = "Anton Shkurenko";
+  };
   toonn = {
     email = "nixpkgs@toonn.io";
     matrix = "@toonn:matrix.org";
diff --git a/maintainers/scripts/update-luarocks-shell.nix b/maintainers/scripts/update-luarocks-shell.nix
index a58674fca8d38..346b0319b08c9 100644
--- a/maintainers/scripts/update-luarocks-shell.nix
+++ b/maintainers/scripts/update-luarocks-shell.nix
@@ -2,7 +2,7 @@
 }:
 with nixpkgs;
 let
-  pyEnv = python3.withPackages(ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages(ps: [ ps.gitpython ]);
 in
 mkShell {
   packages = [
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 688f0f47676c9..9b6e755fd470d 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -561,6 +561,14 @@
           <link xlink:href="options.html#opt-services.prometheus.exporters.smartctl.enable">services.prometheus.exporters.smartctl</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://docs.twingate.com/docs/linux">twingate</link>,
+          a high performance, easy to use zero trust solution that
+          enables access to private resources from any device with
+          better security than a VPN.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-incompatibilities">
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 1ff2e826c6018..fc4b44957c36c 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -164,6 +164,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
 
+- [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
 - The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index 1a6c64ef26cc3..18ea1f52a9766 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -30,8 +30,8 @@ with lib;
       beam = super.beam_nox;
       cairo = super.cairo.override { x11Support = false; };
       dbus = super.dbus.override { x11Support = false; };
-      ffmpeg_4 = super.ffmpeg_4.override { sdlSupport = false; vdpauSupport = false; };
-      ffmpeg_5 = super.ffmpeg_5.override { sdlSupport = false; vdpauSupport = false; };
+      ffmpeg_4 = super.ffmpeg_4-headless;
+      ffmpeg_5 = super.ffmpeg_5-headless;
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
       imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
       imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; };
diff --git a/nixos/modules/config/xdg/portal.nix b/nixos/modules/config/xdg/portal.nix
index e28ff74e5d80a..ab6cffe499aa8 100644
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@@ -61,6 +61,17 @@ in
         Defaults to `false` to respect its opt-in nature.
       '';
     };
+
+    xdgOpenUsePortal = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Sets environment variable `NIXOS_XDG_OPEN_USE_PORTAL` to `1`
+        This will make `xdg-open` use the portal to open programs, which resolves bugs involving
+        programs opening inside FHS envs or with unexpected env vars set from wrappers.
+        See [#160923](https://github.com/NixOS/nixpkgs/issues/160923) for more info.
+      '';
+    };
   };
 
   config =
@@ -95,6 +106,7 @@ in
 
         sessionVariables = {
           GTK_USE_PORTAL = mkIf cfg.gtkUsePortal "1";
+          NIXOS_XDG_OPEN_USE_PORTAL = mkIf cfg.xdgOpenUsePortal "1";
           XDG_DESKTOP_PORTAL_DIR = "${joinedPortals}/share/xdg-desktop-portal/portals";
         };
       };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9faa58409b19d..af6917ccab6fb 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -988,6 +988,7 @@
   ./services/networking/tox-node.nix
   ./services/networking/toxvpn.nix
   ./services/networking/tvheadend.nix
+  ./services/networking/twingate.nix
   ./services/networking/ucarp.nix
   ./services/networking/unbound.nix
   ./services/networking/unifi.nix
@@ -1015,6 +1016,7 @@
   ./services/networking/zerotierone.nix
   ./services/networking/znc/default.nix
   ./services/printing/cupsd.nix
+  ./services/printing/ipp-usb.nix
   ./services/scheduling/atd.nix
   ./services/scheduling/cron.nix
   ./services/scheduling/fcron.nix
diff --git a/nixos/modules/services/backup/borgbackup.xml b/nixos/modules/services/backup/borgbackup.xml
index 8f623c9365684..f38064f867756 100644
--- a/nixos/modules/services/backup/borgbackup.xml
+++ b/nixos/modules/services/backup/borgbackup.xml
@@ -179,7 +179,7 @@ sudo borg init --encryption=repokey-blake2  \
           mode = "repokey-blake2";
           passCommand = "cat /run/keys/borgbackup_passphrase";
         };
-        BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase";
+        environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
         compression = "auto,lzma";
         startAt = "daily";
     };
diff --git a/nixos/modules/services/databases/cassandra.nix b/nixos/modules/services/databases/cassandra.nix
index 7556dbfc7b849..e26acb88d8c85 100644
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@@ -19,6 +19,10 @@ let
 
   cfg = config.services.cassandra;
 
+  atLeast3 = versionAtLeast cfg.package.version "3";
+  atLeast3_11 = versionAtLeast cfg.package.version "3.11";
+  atLeast4 = versionAtLeast cfg.package.version "4";
+
   defaultUser = "cassandra";
 
   cassandraConfig = flip recursiveUpdate cfg.extraConfig (
@@ -39,7 +43,7 @@ let
           parameters = [{ seeds = concatStringsSep "," cfg.seedAddresses; }];
         }
       ];
-    } // optionalAttrs (versionAtLeast cfg.package.version "3") {
+    } // optionalAttrs atLeast3 {
       hints_directory = "${cfg.homeDir}/hints";
     }
   );
@@ -62,7 +66,7 @@ let
     cassandraLogbackConfig = pkgs.writeText "logback.xml" cfg.logbackConfig;
 
     passAsFile = [ "extraEnvSh" ];
-    inherit (cfg) extraEnvSh;
+    inherit (cfg) extraEnvSh package;
 
     buildCommand = ''
       mkdir -p "$out"
@@ -80,6 +84,10 @@ let
 
       # Delete default password file
       sed -i '/-Dcom.sun.management.jmxremote.password.file=\/etc\/cassandra\/jmxremote.password/d' "$out/cassandra-env.sh"
+
+      ${lib.optionalString atLeast4 ''
+        cp $package/conf/jvm*.options $out/
+      ''}
     '';
   };
 
@@ -95,8 +103,20 @@ let
       "-Dcom.sun.management.jmxremote.password.file=${cfg.jmxRolesFile}"
     ] ++ optionals cfg.remoteJmx [
       "-Djava.rmi.server.hostname=${cfg.rpcAddress}"
+    ] ++ optionals atLeast4 [
+      # Historically, we don't use a log dir, whereas the upstream scripts do
+      # expect this. We override those by providing our own -Xlog:gc flag.
+      "-Xlog:gc=warning,heap*=warning,age*=warning,safepoint=warning,promotion*=warning"
     ];
 
+  commonEnv = {
+    # Sufficient for cassandra 2.x, 3.x
+    CASSANDRA_CONF = "${cassandraEtc}";
+
+    # Required since cassandra 4
+    CASSANDRA_LOGBACK_CONF = "${cassandraEtc}/logback.xml";
+  };
+
 in
 {
   options.services.cassandra = {
@@ -435,7 +455,7 @@ in
     jmxRolesFile = mkOption {
       type = types.nullOr types.path;
       default =
-        if versionAtLeast cfg.package.version "3.11"
+        if atLeast3_11
         then pkgs.writeText "jmx-roles-file" defaultJmxRolesFile
         else null;
       defaultText = literalMD ''generated configuration file if version is at least 3.11, otherwise `null`'';
@@ -486,8 +506,7 @@ in
     systemd.services.cassandra = {
       description = "Apache Cassandra service";
       after = [ "network.target" ];
-      environment = {
-        CASSANDRA_CONF = "${cassandraEtc}";
+      environment = commonEnv // {
         JVM_OPTS = builtins.concatStringsSep " " fullJvmOptions;
         MAX_HEAP_SIZE = toString cfg.maxHeapSize;
         HEAP_NEWSIZE = toString cfg.heapNewSize;
@@ -508,6 +527,7 @@ in
       description = "Perform a full repair on this Cassandra node";
       after = [ "cassandra.service" ];
       requires = [ "cassandra.service" ];
+      environment = commonEnv;
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
@@ -536,6 +556,7 @@ in
       description = "Perform an incremental repair on this cassandra node.";
       after = [ "cassandra.service" ];
       requires = [ "cassandra.service" ];
+      environment = commonEnv;
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
diff --git a/nixos/modules/services/networking/twingate.nix b/nixos/modules/services/networking/twingate.nix
new file mode 100644
index 0000000000000..17140bffd2187
--- /dev/null
+++ b/nixos/modules/services/networking/twingate.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.twingate;
+
+in {
+
+  options.services.twingate = {
+    enable = mkEnableOption (lib.mdDoc "Twingate Client daemon");
+  };
+
+  config = mkIf cfg.enable {
+
+    networking.firewall.checkReversePath = lib.mkDefault false;
+    networking.networkmanager.enable = true;
+
+    environment.systemPackages = [ pkgs.twingate ]; # for the CLI
+    systemd.packages = [ pkgs.twingate ];
+
+    systemd.services.twingate.preStart = ''
+      cp -r -n ${pkgs.twingate}/etc/twingate/. /etc/twingate/
+    '';
+
+    systemd.services.twingate.wantedBy = [ "multi-user.target" ];
+  };
+}
diff --git a/nixos/modules/services/printing/ipp-usb.nix b/nixos/modules/services/printing/ipp-usb.nix
new file mode 100644
index 0000000000000..0425eb9137315
--- /dev/null
+++ b/nixos/modules/services/printing/ipp-usb.nix
@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }: {
+  options = {
+    services.ipp-usb = {
+      enable = lib.mkEnableOption (lib.mdDoc "ipp-usb, a daemon to turn an USB printer/scanner supporting IPP everywhere (aka AirPrint, WSD, AirScan) into a locally accessible network printer/scanner");
+    };
+  };
+  config = lib.mkIf config.services.ipp-usb.enable {
+    systemd.services.ipp-usb = {
+      description = "Daemon for IPP over USB printer support";
+      after = [ "cups.service" "avahi-deamon.service" ];
+      wants = [ "avahi-daemon.service" ];
+      serviceConfig = {
+        ExecStart = [ "${pkgs.ipp-usb}/bin/ipp-usb" ];
+        Type = "simple";
+        Restart = "on-failure";
+        StateDirectory = "ipp-usb";
+        LogsDirectory = "ipp-usb";
+
+        # hardening.
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        # breaks the daemon, presumably because it messes with DeviceAllow
+        ProtectClock = false;
+        ProtectKernelTunables = true;
+        ProtectKernelLogs = true;
+        ProtectSystem = "strict";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        PrivateMounts = true;
+        ProtectHostname = true;
+        ProtectKernelModules = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_NETLINK" "AF_INET" "AF_INET6" ];
+        ProtectProc = "noaccess";
+      };
+    };
+
+    # starts the systemd service
+    services.udev.packages = [ pkgs.ipp-usb ];
+    services.avahi = {
+      enable = true;
+      publish = {
+        enable = true;
+        userServices = true;
+      };
+    };
+    # enable printing and scanning by default, but not required.
+    services.printing.enable = lib.mkDefault true;
+    hardware.sane.enable = lib.mkDefault true;
+    # so that sane discovers scanners
+    hardware.sane.extraBackends = [ pkgs.sane-airscan ];
+  };
+}
+
+
diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
index 8e6a44428fce1..aaad1de5f87bd 100644
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@@ -67,11 +67,11 @@ in
 
         # Taken from mint-artwork.gschema.override
         theme = mkIf (notExcluded pkgs.cinnamon.mint-themes) {
-          name = mkDefault "Mint-X";
+          name = mkDefault "Mint-Y-Aqua";
           package = mkDefault pkgs.cinnamon.mint-themes;
         };
         iconTheme = mkIf (notExcluded pkgs.cinnamon.mint-x-icons) {
-          name = mkDefault "Mint-X-Dark";
+          name = mkDefault "Mint-Y-Aqua";
           package = mkDefault pkgs.cinnamon.mint-x-icons;
         };
         cursorTheme = mkIf (notExcluded pkgs.cinnamon.mint-cursor-themes) {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 895cbe4290dc2..4d652210baaec 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -113,6 +113,7 @@ in {
   calibre-web = handleTest ./calibre-web.nix {};
   cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
   cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
+  cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; };
   ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
   ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
   ceph-single-node-bluestore = handleTestOn ["x86_64-linux"] ./ceph-single-node-bluestore.nix {};
diff --git a/pkgs/applications/audio/cardinal/default.nix b/pkgs/applications/audio/cardinal/default.nix
index e1f6d25c2d7bd..f1487312684eb 100644
--- a/pkgs/applications/audio/cardinal/default.nix
+++ b/pkgs/applications/audio/cardinal/default.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation rec {
   pname = "cardinal";
-  version = "22.10";
+  version = "22.11";
 
   src = fetchurl {
     url =
       "https://github.com/DISTRHO/Cardinal/releases/download/${version}/cardinal+deps-${version}.tar.xz";
-    sha256 = "sha256-qr6akeSN0y6cDVZ8Y6SNuJ8OnAuwrlJL1pqhPPJ+/EQ=";
+    sha256 = "sha256-xYQi209whY5/lN+6Fp7PTp7JSzL6RS6VL+Exst7RrS0=";
   };
 
   prePatch = ''
diff --git a/pkgs/applications/audio/cyanrip/default.nix b/pkgs/applications/audio/cyanrip/default.nix
index 4f3a5a08af2e0..358c769ea07c8 100644
--- a/pkgs/applications/audio/cyanrip/default.nix
+++ b/pkgs/applications/audio/cyanrip/default.nix
@@ -4,7 +4,7 @@
 , meson
 , ninja
 , pkg-config
-, ffmpeg
+, ffmpeg-headless
 , libcdio
 , libcdio-paranoia
 , libmusicbrainz5
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
-  buildInputs = [ ffmpeg libcdio libcdio-paranoia libmusicbrainz5 curl ];
+  buildInputs = [ ffmpeg-headless libcdio libcdio-paranoia libmusicbrainz5 curl ];
 
   meta = with lib; {
     homepage = "https://github.com/cyanreg/cyanrip";
diff --git a/pkgs/applications/audio/mmtc/default.nix b/pkgs/applications/audio/mmtc/default.nix
index db6e0d27be75a..5a229f0ae3485 100644
--- a/pkgs/applications/audio/mmtc/default.nix
+++ b/pkgs/applications/audio/mmtc/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mmtc";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "figsoda";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fWd349IDlN6XNv7MrqJeLwkmevZoKXLSz8a09YWsNcI=";
+    sha256 = "sha256-7jQwa4BfyI1CPnMt1YEP9rE6cok90FbEJpyLAPFuxtE=";
   };
 
-  cargoSha256 = "sha256-WrEC3zWwY1plOn8DrspbJFI3R/fE6yDQT2u2lVubbQU=";
+  cargoSha256 = "sha256-f18aXs8PyA0IaGnPG568ZB/oPsAO+U44WsoDNEgKKXk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index bbabcb45187ea..77695f968969e 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.53.1";
+  version = "1.54";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "sha256-7qBvv4D86uX8oqqJ+UDI+fbaG5g1+Zg1otuU9lqyTdo=";
+    sha256 = "sha256-d/BUt6jqJmw2MnerbvvhuUWpTHgQr47XuSoFDXo7GEQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/sooperlooper/default.nix b/pkgs/applications/audio/sooperlooper/default.nix
index a05a0174afc03..63cb7398201bc 100644
--- a/pkgs/applications/audio/sooperlooper/default.nix
+++ b/pkgs/applications/audio/sooperlooper/default.nix
@@ -9,7 +9,7 @@
 , libxml2
 , libjack2
 , libsndfile
-, wxGTK30-gtk3
+, wxGTK30
 , libsigcxx
 , libsamplerate
 , rubberband
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     libxml2
     libjack2
     libsndfile
-    wxGTK30-gtk3
+    wxGTK30
     libsigcxx
     libsamplerate
     rubberband
diff --git a/pkgs/applications/audio/soundux/default.nix b/pkgs/applications/audio/soundux/default.nix
new file mode 100644
index 0000000000000..f6616e58353ec
--- /dev/null
+++ b/pkgs/applications/audio/soundux/default.nix
@@ -0,0 +1,142 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, makeBinaryWrapper
+, pipewire
+, libpulseaudio
+, libappindicator
+, libstartup_notification
+, openssl
+, libwnck
+, pcre
+, util-linux
+, libselinux
+, libsepol
+, libthai
+, libdatrie
+, xorg
+, libxkbcommon
+, libepoxy
+, dbus
+, at-spi2-core
+, nlohmann_json
+, fancypp
+, httplib
+, semver-cpp
+, webkitgtk
+, yt-dlp
+, ffmpeg
+, lsb-release
+}:
+
+stdenv.mkDerivation rec {
+  pname = "soundux";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "Soundux";
+    repo = "Soundux";
+    rev = version;
+    sha256 = "sha256-aSCsg6nJt6F+6O7UeXnvYva0vllTfsxK/cjaeOhObZY=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    pipewire
+    libpulseaudio
+    libappindicator
+    openssl
+    libwnck
+    pcre
+    util-linux
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    xorg.libXdmcp
+    xorg.libXtst
+    xorg.libXres
+    libxkbcommon
+    libepoxy
+    dbus
+    at-spi2-core
+    nlohmann_json
+    fancypp
+    httplib
+    semver-cpp
+    libstartup_notification
+    webkitgtk
+    yt-dlp
+    ffmpeg
+  ];
+
+  postPatch = ''
+    # cannot be overwritten with variables
+    substituteInPlace CMakeLists.txt \
+      --replace "set(CMAKE_INSTALL_PREFIX \"/opt/soundux\" CACHE PATH \"Install path prefix, prepended onto install directories.\" FORCE)" "" \
+      --replace "/usr/share" "$out/usr/share"
+    substituteInPlace src/ui/impl/webview/webview.cpp \
+      --replace "/usr/share/pixmaps/soundux.png" "$out/share/pixmaps/soundux.png"
+  '';
+
+  # We need to append /opt to our CMAKE_INSTALL_PREFIX
+  dontAddPrefix = true;
+
+  preConfigure = ''
+    # This needs to be set in preConfigure to access the $prefix variable
+    export cmakeFlags="-DCMAKE_INSTALL_PREFIX=$prefix/opt $cmakeFlags"
+
+    # Replace some fetched submodules with symlinks nix packages.
+    rm -rf \
+      lib/json \
+      lib/fancypp \
+      lib/lib-httplib \
+      lib/semver
+
+    ln -s ${nlohmann_json} lib/json
+    ln -s ${fancypp} lib/fancypp
+    ln -s ${httplib} lib/lib-httplib
+    ln -s ${semver-cpp} lib/semver
+  '';
+
+  # Somehow some of the install destination paths in the build system still
+  # gets transformed to point to /var/empty/share, even though they are at least
+  # relative to the nix output directory with our earlier patching.
+  postInstall = ''
+    mv "$out/var/empty/share" "$out"
+    rm -rf "$out/var"
+    mkdir "$out/bin"
+    ln -s "$out/opt/soundux" "$out/bin"
+    substituteInPlace "$out/share/applications/soundux.desktop" \
+      --replace "/opt/soundux/soundux" "soundux"
+  '';
+
+  postFixup = let
+    rpaths = lib.makeLibraryPath [libwnck pipewire libpulseaudio];
+  in ''
+    # Wnck, PipeWire, and PulseAudio are dlopen-ed by Soundux, so they do
+    # not end up on the RPATH during the build process.
+    patchelf --add-rpath "${rpaths}" "$out/opt/soundux-${version}"
+
+    # Work around upstream bug https://github.com/Soundux/Soundux/issues/435
+    wrapProgram "$out/bin/soundux" \
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1 \
+      --prefix PATH : ${lib.makeBinPath [ yt-dlp ffmpeg lsb-release ]} \
+  '';
+
+  meta = with lib; {
+    description = "A cross-platform soundboard.";
+    homepage = "https://soundux.rocks/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ aidalgol ];
+  };
+}
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index 1a73b8adea72a..74c53f96efdc1 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30-gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30, gtk3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "spek";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];
 
-  buildInputs = [ ffmpeg wxGTK30-gtk3 wxGTK30-gtk3.gtk ];
+  buildInputs = [ ffmpeg wxGTK30 gtk3 ];
 
   meta = with lib; {
     description = "Analyse your audio files by showing their spectrogram";
diff --git a/pkgs/applications/blockchains/electrs/default.nix b/pkgs/applications/blockchains/electrs/default.nix
index 35470a7b8542c..0bc5c7baa4161 100644
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@@ -24,8 +24,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-p4t+G13XaCl7+IbX5YyBFF0PmARbw4XlRvnA0PRcjvQ=";
 
   # needed for librocksdb-sys
-  nativeBuildInputs = [ llvmPackages.clang ];
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   # link rocksdb dynamically
   ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
diff --git a/pkgs/applications/blockchains/ledger-live-desktop/default.nix b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
index 4f6ae53ec7845..3bed576e5dbff 100644
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.49.2";
+  version = "2.50.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-8KGZRTJu3uGFyf4vogoC9kDrKegD8Op4Z7gqQK+UFl8=";
+    hash = "sha256-Xh0UwE2rgFmUI4mx/PHqhRkgw51/CuNPxrsxI9al2E8=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index c778ce3f75755..3eebd80cb5934 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -34,14 +34,12 @@ rustPlatform.buildRustPackage rec {
 
   buildFeatures = [ "modern" "gnosis" ];
 
-  nativeBuildInputs = [ clang cmake perl protobuf ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook cmake perl protobuf ];
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
   ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   depositContractSpec = fetchurl {
     url = "https://raw.githubusercontent.com/ethereum/eth2.0-specs/v${depositContractSpecVersion}/deposit_contract/contracts/validator_registration.json";
     hash = "sha256-ZslAe1wkmkg8Tua/AmmEfBmjqMVcGIiYHwi+WssEwa8=";
diff --git a/pkgs/applications/blockchains/lndhub-go/default.nix b/pkgs/applications/blockchains/lndhub-go/default.nix
index a563703c6bcb0..74f0d4f9f7bfe 100644
--- a/pkgs/applications/blockchains/lndhub-go/default.nix
+++ b/pkgs/applications/blockchains/lndhub-go/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lndhub-go";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "lndhub.go";
     rev = "${version}";
-    sha256 = "sha256-f/CkmO0KHupmi4XZDWRbvesLnYIxT6DlThgX3S/kdJ8=";
+    sha256 = "sha256-UGrIj/0ysU4i6PQVkuIeyGdKNCMa9LxikaIPhSKGvaQ=";
   };
 
-  vendorSha256 = "sha256-SWQudULFRMrKmxY6ZgH0NL8d6UPxowQnovhRx+209D4=";
+  vendorSha256 = "sha256-AiRbUSgMoU8nTzis/7H9HRW2/xZxXFf39JipRbukeiA=";
 
   doCheck = false; # tests require networking
 
diff --git a/pkgs/applications/blockchains/nearcore/default.nix b/pkgs/applications/blockchains/nearcore/default.nix
index e484538f4168a..a929406cee929 100644
--- a/pkgs/applications/blockchains/nearcore/default.nix
+++ b/pkgs/applications/blockchains/nearcore/default.nix
@@ -4,7 +4,7 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nearcore";
-  version = "1.29.2";
+  version = "1.29.3";
 
   # https://github.com/near/nearcore/tags
   src = fetchFromGitHub {
@@ -13,10 +13,10 @@ rustPlatform.buildRustPackage rec {
     # there is also a branch for this version number, so we need to be explicit
     rev = "refs/tags/${version}";
 
-    sha256 = "sha256-dVju9emwTqNQCYST4HuwSWdafM0yxVS3JXXJqCdFEpc=";
+    sha256 = "sha256-Qbpp+ITWVFbigWLdSDHAo5JhHejEN2FknRIjcpcS2wY=";
   };
 
-  cargoSha256 = "sha256-k/JzKbWn5M+H6w1UEv2APzZNBZOBYZY09keyCrXaGCM=";
+  cargoSha256 = "sha256-GSgzJNpVGxbvGF6AtFQxGyev/9c8Roav1HBz0SCQyvw=";
   cargoPatches = [ ./0001-make-near-test-contracts-optional.patch ];
 
   postPatch = ''
@@ -42,14 +42,12 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
     protobuf
+    rustPlatform.bindgenHook
   ];
 
   # fat LTO requires ~3.4GB RAM
   requiredSystemFeatures = [ "big-parallel" ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-  BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${llvmPackages.libclang.lib}/lib/clang/${lib.getVersion llvmPackages.clang}/include";
-
   meta = with lib; {
     description = "Reference client for NEAR Protocol";
     homepage = "https://github.com/near/nearcore";
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 443fe36143c50..596130337c7ad 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -36,14 +36,13 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
-  nativeBuildInputs = [ clang ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
   preBuild = ''
     export SUBSTRATE_CLI_GIT_COMMIT_HASH=$(cat .git_commit)
     rm .git_commit
   '';
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
   PROTOC = "${protobuf}/bin/protoc";
 
   # NOTE: We don't build the WASM runtimes since this would require a more
diff --git a/pkgs/applications/blockchains/snarkos/default.nix b/pkgs/applications/blockchains/snarkos/default.nix
index 82c3555f64d6a..fe8b24b6ca227 100644
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@@ -23,15 +23,13 @@ rustPlatform.buildRustPackage rec {
 
   # buildAndTestSubdir = "cli";
 
-  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config llvmPackages.clang ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config rustPlatform.bindgenHook ];
 
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
   OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   OPENSSL_DIR="${lib.getDev openssl}";
 
-  LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
-
   # TODO check why rust compilation fails by including the rocksdb from nixpkgs
   # Used by build.rs in the rocksdb-sys crate. If we don't set these, it would
   # try to build RocksDB from source.
diff --git a/pkgs/applications/blockchains/solana-validator/default.nix b/pkgs/applications/blockchains/solana-validator/default.nix
index 503d4b404e728..bb35f7be38892 100644
--- a/pkgs/applications/blockchains/solana-validator/default.nix
+++ b/pkgs/applications/blockchains/solana-validator/default.nix
@@ -68,12 +68,9 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = builtins.map (n: "--bin=${n}") solanaPkgs;
 
   # weird errors. see https://github.com/NixOS/nixpkgs/issues/52447#issuecomment-852079285
-  LIBCLANG_PATH = "${libclang.lib}/lib";
-  BINDGEN_EXTRA_CLANG_ARGS =
-    "-isystem ${libclang.lib}/lib/clang/${lib.getVersion clang}/include";
-  LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";
+  # LLVM_CONFIG_PATH = "${llvm}/bin/llvm-config";
 
-  nativeBuildInputs = [ clang llvm pkg-config protobuf rustfmt perl ];
+  nativeBuildInputs = [ pkg-config protobuf rustfmt perl rustPlatform.bindgenHook ];
   buildInputs =
     [ openssl zlib libclang hidapi ] ++ (lib.optionals stdenv.isLinux [ udev ]);
   strictDeps = true;
diff --git a/pkgs/applications/blockchains/teos/default.nix b/pkgs/applications/blockchains/teos/default.nix
index 197246770d0dc..b1fb1a77c1d48 100644
--- a/pkgs/applications/blockchains/teos/default.nix
+++ b/pkgs/applications/blockchains/teos/default.nix
@@ -38,11 +38,8 @@ let
     perl  # used by openssl-sys to configure
     protobuf
     rustfmt
-    llvmPackages.clang
+    rustPlatform.bindgenHook
   ];
-
-
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 in
 {
   teos = rustPlatform.buildRustPackage {
@@ -50,7 +47,7 @@ in
     cargoSha256 = "sha256-7VYYYSMJ2JP1KuA8sD0X3wInubH/jbA/sgzsTsomyEc=";
     buildAndTestSubdir = "teos";
 
-    inherit version src cargoPatches buildInputs nativeBuildInputs LIBCLANG_PATH;
+    inherit version src cargoPatches buildInputs nativeBuildInputs;
 
     meta = common.meta // {
       description = "A Lightning watchtower compliant with BOLT13, written in Rust";
@@ -66,7 +63,7 @@ in
     cargoSha256 = "sha256-xL+DiEfgBYJQ1UJm7LAr1/f34pkU8FRl4Seic8MFAlM=";
     buildAndTestSubdir = "watchtower-plugin";
 
-    inherit version src cargoPatches buildInputs nativeBuildInputs LIBCLANG_PATH;
+    inherit version src cargoPatches buildInputs nativeBuildInputs;
 
     meta = common.meta // {
       description = "A Lightning watchtower plugin for clightning";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
index a9462298979d0..9825ed0834a2e 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/default.nix
@@ -43,13 +43,9 @@ let
 
     pname = "tsc-dyn";
 
-    nativeBuildInputs = [ clang ];
+    nativeBuildInputs = [ rustPlatform.bindgenHook ];
     sourceRoot = "source/core";
 
-    configurePhase = ''
-      export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib"
-    '';
-
     postInstall = ''
       LIB=($out/lib/libtsc_dyn.*)
       TSC_PATH=$out/share/emacs/site-lisp/elpa/tsc-${version}
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index 5b6f5d0098203..e7a018b26c62d 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -66,14 +66,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     desktop-file-utils
-    (gi-docgen.overrideAttrs (attrs: {
-      patches = attrs.patches ++ [
-        (fetchpatch {
-          url = "https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/f4ff4787cce962b705fb2588b31f2988c5063c13.patch";
-          sha256 = "11VGFFb2PLVxnX/qUQdLPLfhGQWx4sf4apBP7R2JWjA=";
-        })
-      ];
-    }))
+    gi-docgen
     gobject-introspection
     meson
     ninja
diff --git a/pkgs/applications/editors/jove/default.nix b/pkgs/applications/editors/jove/default.nix
index 2fd28714481ca..01a428a9fd68c 100644
--- a/pkgs/applications/editors/jove/default.nix
+++ b/pkgs/applications/editors/jove/default.nix
@@ -1,21 +1,24 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib
+, stdenv
+, fetchFromGitHub
 , groff
-, ncurses
 , makeWrapper
-} :
+, ncurses
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jove";
-  version = "4.17.4.6";
+  version = "4.17.4.7";
 
   src = fetchFromGitHub {
     owner = "jonmacs";
     repo = "jove";
-    rev = version;
-    sha256 = "sha256-UCjqF0i43TSvtG5uxb2SA/F9oGBeo/WdEVJlrSSHV8g=";
+    rev = finalAttrs.version;
+    sha256 = "sha256-a8amp8JAI25XIeL8MzvJEAvv6B0oIaQvUOQlAaS3PeI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
+
   buildInputs = [
     groff
     ncurses
@@ -34,11 +37,13 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "Jonathan's Own Version of Emacs";
     homepage = "https://github.com/jonmacs/jove";
+    description = "Jonathan's Own Version of Emacs";
+    changelog = "https://github.com/jonmacs/jove/releases/tag/${finalAttrs.version}";
     license = licenses.bsd2;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/jove.x86_64-darwin
+    # never built on Hydra: https://hydra.nixos.org/job/nixpkgs/trunk/jove.x86_64-darwin
+    broken = stdenv.isDarwin;
   };
-}
+})
diff --git a/pkgs/applications/editors/kakoune/plugins/update-shell.nix b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
index ca83f09c7154b..b323574169aa3 100644
--- a/pkgs/applications/editors/kakoune/plugins/update-shell.nix
+++ b/pkgs/applications/editors/kakoune/plugins/update-shell.nix
@@ -2,7 +2,7 @@
 
 with pkgs;
 let
-  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.gitpython ]);
 in
 
 mkShell {
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index 7be6d48971094..03c6d19b80c45 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -1,19 +1,65 @@
-{ lib, mkDerivation, fetchFromGitHub, pkg-config, qmake
-, python3, qtbase, qttools }:
+{ lib
+, stdenv
+, env
+, fetchFromGitHub
+, pkg-config
+, qbs
+, wrapQtAppsHook
+, qtbase
+, qtdeclarative
+, qttools
+, qtsvg
+, zlib
+, libGL
+}:
 
-mkDerivation rec {
+let
+  qtEnv = env "tiled-qt-env" [ qtbase qtdeclarative qtsvg qttools ];
+in
+
+stdenv.mkDerivation rec {
   pname = "tiled";
-  version = "1.8.4";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QYA2krbwH807BkzVST+/+sjSR6So/aGY/YenEjYxE48=";
+    sha256 = "sha256-026OO7r8n1BUapUtKRHvqKdSZiClTQIiYfajiC2TAcQ=";
   };
 
-  nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [ python3 qtbase qttools ];
+  nativeBuildInputs = [ pkg-config qbs wrapQtAppsHook ];
+  buildInputs = [ qtEnv zlib libGL ];
+
+  outputs = [ "out" "dev" ];
+
+  strictDeps = true;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    qbs setup-qt --settings-dir . ${qtEnv}/bin/qmake qtenv
+    qbs config --settings-dir . defaultProfile qtenv
+    qbs resolve --settings-dir . config:release qbs.installPrefix:/ projects.Tiled.installHeaders:true
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    qbs build --settings-dir . config:release
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    qbs install --settings-dir . --install-root $out config:release
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Free, easy to use and flexible tile map editor";
diff --git a/pkgs/applications/editors/vim/plugins/update-shell.nix b/pkgs/applications/editors/vim/plugins/update-shell.nix
index 52a9e741af21e..eae7db7f53ec0 100644
--- a/pkgs/applications/editors/vim/plugins/update-shell.nix
+++ b/pkgs/applications/editors/vim/plugins/update-shell.nix
@@ -3,7 +3,7 @@
 # Ideally, pkgs points to default.nix file of Nixpkgs official tree
 with pkgs;
 let
-  pyEnv = python3.withPackages (ps: [ ps.GitPython ]);
+  pyEnv = python3.withPackages (ps: [ ps.gitpython ]);
 in
 
 mkShell {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 36ce6758aed3c..6bb6db618ad03 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -891,8 +891,8 @@ let
         mktplcRef = {
           name = "gitlens";
           publisher = "eamodio";
-          version = "2022.11.2204";
-          sha256 = "0npr9fymfjnrq7xvfj6fdc04lysz28qncf9r8syv0w9873f3695h";
+          version = "2022.12.604";
+          sha256 = "sha256-yfqGITviASp5ZDEJA+zyVz1LpPWV4FM/4fU4eq52Xng=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -2544,8 +2544,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.11.1";
-          sha256 = "sha256-o6Se+xpqwrdJIMnVE/HaDGIoDqZkeX0nTGHa8GjaqVQ=";
+          version = "2.12.0";
+          sha256 = "sha256-Dhd0QVWdCCvdGKuu8OB4KrBS0XUHWLzRSyreAf7sGLU=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
diff --git a/pkgs/applications/emulators/dolphin-emu/default.nix b/pkgs/applications/emulators/dolphin-emu/default.nix
index 5eec3c865df5a..b27937a6b838e 100644
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@@ -21,7 +21,7 @@
 , fetchFromGitHub
 , libusb1
 , libevdev
-, wxGTK30-gtk3
+, wxGTK30
 , soundtouch
 , miniupnpc
 , mbedtls
@@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
     portaudio
     libusb1
     libpulseaudio
-    wxGTK30-gtk3
+    wxGTK30
     soundtouch
     miniupnpc
     mbedtls
diff --git a/pkgs/applications/emulators/mame/emuopts.patch b/pkgs/applications/emulators/mame/001-use-absolute-paths.diff
index 233d64eb15d02..35ed10d181720 100644
--- a/pkgs/applications/emulators/mame/emuopts.patch
+++ b/pkgs/applications/emulators/mame/001-use-absolute-paths.diff
@@ -10,18 +10,18 @@
 -	{ OPTION_CTRLRPATH,                                  "ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
 -	{ OPTION_INIPATH,                                    ".;ini;ini/presets",     core_options::option_type::STRING,     "path to ini files" },
 -	{ OPTION_FONTPATH,                                   ".",         core_options::option_type::STRING,     "path to font files" },
-+	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mame@/hash",      core_options::option_type::STRING,     "path to software definition files" },
-+	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mame@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
-+	{ OPTION_ARTPATH,                                    "artwork;@mame@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
-+	{ OPTION_CTRLRPATH,                                  "ctrlr;@mame@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
-+	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mame@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
-+	{ OPTION_FONTPATH,                                   ".;@mame@",         core_options::option_type::STRING,     "path to font files" },
++	{ OPTION_HASHPATH ";hash_directory;hash",            "hash;@mamePath@/hash",      core_options::option_type::STRING,     "path to software definition files" },
++	{ OPTION_SAMPLEPATH ";sp",                           "samples;@mamePath@/samples",   core_options::option_type::STRING,     "path to audio sample sets" },
++	{ OPTION_ARTPATH,                                    "artwork;@mamePath@/artwork",   core_options::option_type::STRING,     "path to artwork files" },
++	{ OPTION_CTRLRPATH,                                  "ctrlr;@mamePath@/ctrlr",     core_options::option_type::STRING,     "path to controller definitions" },
++	{ OPTION_INIPATH,                                    ".;ini;ini/presets;@mamePath@/ini/presets",     core_options::option_type::STRING,     "path to ini files" },
++	{ OPTION_FONTPATH,                                   ".;@mamePath@",         core_options::option_type::STRING,     "path to font files" },
  	{ OPTION_CHEATPATH,                                  "cheat",     core_options::option_type::STRING,     "path to cheat files" },
  	{ OPTION_CROSSHAIRPATH,                              "crosshair", core_options::option_type::STRING,     "path to crosshair files" },
 -	{ OPTION_PLUGINSPATH,                                "plugins",   core_options::option_type::STRING,     "path to plugin files" },
 -	{ OPTION_LANGUAGEPATH,                               "language",  core_options::option_type::STRING,     "path to UI translation files" },
-+	{ OPTION_PLUGINSPATH,                                "plugins;@mame@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
-+	{ OPTION_LANGUAGEPATH,                               "language;@mame@/language",  core_options::option_type::STRING,     "path to UI translation files" },
++	{ OPTION_PLUGINSPATH,                                "plugins;@mamePath@/plugins",   core_options::option_type::STRING,     "path to plugin files" },
++	{ OPTION_LANGUAGEPATH,                               "language;@mamePath@/language",  core_options::option_type::STRING,     "path to UI translation files" },
  	{ OPTION_SWPATH,                                     "software",  core_options::option_type::STRING,     "path to loose software" },
  
  	// output directory options
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index a5b104d31abe3..760b9e63d282a 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -1,24 +1,24 @@
 { lib
 , stdenv
+, fetchFromGitHub
 , alsa-lib
+, SDL2
+, SDL2_ttf
 , copyDesktopItems
-, CoreAudioKit
 , expat
-, fetchFromGitHub
-, fetchurl
 , flac
 , fontconfig
-, ForceFeedback
 , glm
 , installShellFiles
+, libXi
+, libXinerama
 , libjpeg
 , libpcap
 , libpulseaudio
-, libXi
-, libXinerama
 , lua5_3
 , makeDesktopItem
 , makeWrapper
+, papirus-icon-theme
 , pkg-config
 , portaudio
 , portmidi
@@ -26,31 +26,26 @@
 , python3
 , qtbase
 , rapidjson
-, SDL2
-, SDL2_ttf
 , sqlite
 , utf8proc
 , which
 , writeScript
 , zlib
+, darwin
 }:
 
 let
-  # Get icon from Arch Linux package
-  icon = fetchurl {
-    url = "https://raw.githubusercontent.com/archlinux/svntogit-community/614b24ef3856cb52b5cafc386b0f77923cbc9156/trunk/mame.svg";
-    sha256 = "sha256-F8RCyTPXZBdeTOHeUKgMDC3dXXM8rwnDzV5rppesQ/Q=";
-  };
-  dest = "$out/opt/mame";
+  inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
 in
 stdenv.mkDerivation rec {
   pname = "mame";
   version = "0.250";
+  srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
-    rev = "mame${builtins.replaceStrings [ "." ] [ "" ] version}";
+    rev = "mame${srcVersion}";
     sha256 = "sha256-jexs/1ovRk9Is5orD7hT9fN+dYm+WA+57aZ6JH7zjL4=";
   };
 
@@ -109,15 +104,17 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    # by default MAME assumes that paths with stock resources
-    # are relative and that you run MAME changing to
-    # install directory, so we add absolute paths here
-    ./emuopts.patch
+    # by default MAME assumes that paths with stock resources are relative and
+    # that you run MAME changing to install directory, so we add absolute paths
+    # here
+    ./001-use-absolute-paths.diff
   ];
 
+  # Since the bug described in https://github.com/NixOS/nixpkgs/issues/135438,
+  # it is not possible to use substituteAll
   postPatch = ''
     substituteInPlace src/emu/emuopts.cpp \
-      --subst-var-by mame ${dest}
+      --subst-var-by mamePath "$out/opt/mame"
   '';
 
   desktopItems = [
@@ -134,23 +131,26 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  installPhase = ''
+  # TODO: copy shaders from src/osd/modules/opengl/shader/glsl*.*h
+  # to the final package after we figure out how they work
+  installPhase = let
+    icon = "${papirus-icon-theme}/share/icons/Papirus/32x32/apps/mame.svg";
+  in ''
     runHook preInstall
 
     # mame
-    mkdir -p ${dest}
+    mkdir -p $out/opt/mame
 
     install -Dm755 mame -t $out/bin
     install -Dm644 ${icon} $out/share/icons/hicolor/scalable/apps/mame.svg
     installManPage docs/man/*.1 docs/man/*.6
-    cp -ar {artwork,bgfx,plugins,language,ctrlr,keymaps,hash} ${dest}
-    # TODO: copy shaders from src/osd/modules/opengl/shader/glsl*.*h
-    # to the final package after we figure out how they work
+    cp -ar {artwork,bgfx,plugins,language,ctrlr,keymaps,hash} $out/opt/mame
 
     # mame-tools
-    for _i in castool chdman floptool imgtool jedutil ldresample ldverify nltool nlwav pngcmp regrep romcmp \
-              split srcclean testkeys unidasm; do
-      install -Dm755 $_i -t $tools/bin
+    for _tool in castool chdman floptool imgtool jedutil ldresample ldverify \
+                 nltool nlwav pngcmp regrep romcmp split srcclean testkeys \
+                 unidasm; do
+       install -Dm755 $_tool -t $tools/bin
     done
     mv $tools/bin/{,mame-}split
 
@@ -176,11 +176,26 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
-    description = "Is a multi-purpose emulation framework";
     homepage = "https://www.mamedev.org/";
+    description = "A multi-purpose emulation framework";
+    longDescription = ''
+      MAME's purpose is to preserve decades of software history. As electronic
+      technology continues to rush forward, MAME prevents this important
+      "vintage" software from being lost and forgotten. This is achieved by
+      documenting the hardware and how it functions. The source code to MAME
+      serves as this documentation. The fact that the software is usable serves
+      primarily to validate the accuracy of the documentation (how else can you
+      prove that you have recreated the hardware faithfully?). Over time, MAME
+      (originally stood for Multiple Arcade Machine Emulator) absorbed the
+      sister-project MESS (Multi Emulator Super System), so MAME now documents a
+      wide variety of (mostly vintage) computers, video game consoles and
+      calculators, in addition to the arcade video games that were its initial
+      focus.
+    '';
+    changelog = "https://github.com/mamedev/mame/releases/download/mame${srcVersion}/whatsnew_${srcVersion}.txt";
     license = with licenses; [ bsd3 gpl2Plus ];
-    platforms = platforms.unix;
     maintainers = with maintainers; [ thiagokokada ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 44397108f245f..5de210fcad25b 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -46,13 +46,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-52";
+  version = "7.1.0-53";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    hash = "sha256-GV71O4cHUKJ7+6u4T+vdaFz5q2SpZVDCfEAbfz0s6f4=";
+    hash = "sha256-U111mor498zAyoYKqCerb9cnxUUOlXKYPfaIzKxZiUM=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/graphics/freecad/default.nix b/pkgs/applications/graphics/freecad/default.nix
index 3794f7cf84fa7..bcc504effec2a 100644
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitHub
 , cmake
 , ninja
-, GitPython
+, gitpython
 , boost
 , coin3d
 , eigen
@@ -68,7 +68,7 @@ mkDerivation rec {
   ];
 
   buildInputs = [
-    GitPython # for addon manager
+    gitpython # for addon manager
     boost
     coin3d
     eigen
diff --git a/pkgs/applications/misc/authenticator/default.nix b/pkgs/applications/misc/authenticator/default.nix
index cdf6ca3e6f803..735355107ef26 100644
--- a/pkgs/applications/misc/authenticator/default.nix
+++ b/pkgs/applications/misc/authenticator/default.nix
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     appstream-glib
-    clang
     desktop-file-utils
     meson
     ninja
@@ -52,6 +51,7 @@ stdenv.mkDerivation rec {
     cargoSetupHook
     rust.cargo
     rust.rustc
+    bindgenHook
   ]);
 
   buildInputs = [
@@ -69,8 +69,6 @@ stdenv.mkDerivation rec {
     zbar
   ];
 
-  LIBCLANG_PATH = "${lib.getLib libclang}/lib";
-
   meta = {
     description = "Two-factor authentication code generator for GNOME";
     homepage = "https://gitlab.gnome.org/World/Authenticator";
diff --git a/pkgs/applications/misc/clipcat/default.nix b/pkgs/applications/misc/clipcat/default.nix
index 38c0c103943a9..be197e819371c 100644
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@@ -14,8 +14,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1n4il3l59m2a6ca54vfaivzg25abf8s4w5kpd5q51p13624iz0kb";
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";
   PROTOC_INCLUDE = "${protobuf}/include";
@@ -23,8 +21,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
 
-    clang
-    llvmPackages.libclang
+    rustPlatform.bindgenHook
 
     rustfmt
     protobuf
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index bfe380275899d..a92a6801ba90f 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.107.0";
+  version = "0.108.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8Ru1T6GSz5TfMxFvUU2QgpiWNLJK+ky723qc3flrDIw=";
+    sha256 = "sha256-MbpBGqu7IwQCf9DjSfIDi25ZGJYTI6xxSk9wPWxychw=";
   };
 
-  vendorSha256 = "sha256-92QLkSUrwMEZ/8pIeOj4KKtC47oN+ITxJnpp7Fb0Z10=";
+  vendorSha256 = "sha256-qFqSpQExz4u1ngjpt2Li6dk/qz4DCKEY9IcFFCna5is=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/imag/default.nix b/pkgs/applications/misc/imag/default.nix
index b637cd077d761..acc03f59a7018 100644
--- a/pkgs/applications/misc/imag/default.nix
+++ b/pkgs/applications/misc/imag/default.nix
@@ -21,13 +21,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0f9915f083z5qqcxyavj0w6m973c8m1x7kfb89pah5agryy5mkaq";
   };
 
-  nativeBuildInputs = [ installShellFiles pkg-config ];
+  nativeBuildInputs = [ installShellFiles pkg-config rustPlatform.bindgenHook ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
   checkInputs = [ gitMinimal util-linuxMinimal ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-
   cargoSha256 = "1vnrc72g2271i2p847z30kplxmdpi60n3dzpw0s7dahg33g14ai6";
 
   checkPhase = ''
diff --git a/pkgs/applications/misc/latte-dock/default.nix b/pkgs/applications/misc/latte-dock/default.nix
index 7e48781f5c471..f232400fbfbf4 100644
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@@ -22,7 +22,7 @@ mkDerivation rec {
     ./0001-Disable-autostart.patch
   ];
 
-  fixupPhase = ''
+  postInstall = ''
     mkdir -p $out/etc/xdg/autostart
     cp $out/share/applications/org.kde.latte-dock.desktop $out/etc/xdg/autostart
   '';
diff --git a/pkgs/applications/misc/lenmus/default.nix b/pkgs/applications/misc/lenmus/default.nix
index f50dd23ff013e..023045d67917a 100644
--- a/pkgs/applications/misc/lenmus/default.nix
+++ b/pkgs/applications/misc/lenmus/default.nix
@@ -11,7 +11,7 @@
 , libpng
 , pngpp
 , zlib
-, wxGTK30-gtk3
+, wxGTK30
 , wxsqlite3
 }:
 
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     libpng
     pngpp
     zlib
-    wxGTK30-gtk3
+    wxGTK30
     wxsqlite3
   ];
 
diff --git a/pkgs/applications/misc/lutris/fhsenv.nix b/pkgs/applications/misc/lutris/fhsenv.nix
index b4b2b2e2ac5df..5c39576ac6f3b 100644
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@@ -30,7 +30,7 @@ in buildFHSUserEnv {
     # DGen // TODO: libarchive is broken
 
     # Dolphin
-    bluez ffmpeg gettext portaudio wxGTK30-gtk3 miniupnpc mbedtls lzo sfml gsm
+    bluez ffmpeg gettext portaudio wxGTK30 miniupnpc mbedtls lzo sfml gsm
     wavpack orc nettle gmp pcre vulkan-loader
 
     # DOSBox
diff --git a/pkgs/applications/misc/mediainfo-gui/default.nix b/pkgs/applications/misc/mediainfo-gui/default.nix
index a15733dd526c8..b3ca8032b1964 100644
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libmediainfo, wxGTK30-gtk3
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libmediainfo, wxGTK30
 , desktop-file-utils, libSM, imagemagick }:
 
 stdenv.mkDerivation rec {
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libmediainfo wxGTK30-gtk3 desktop-file-utils libSM imagemagick ];
+  buildInputs = [ libmediainfo wxGTK30 desktop-file-utils libSM imagemagick ];
 
   sourceRoot = "./MediaInfo/Project/GNU/GUI/";
 
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index 50d0e5a012b42..0647ba26dc0ef 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.1.7";
+  version = "0.1.9";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-kMomzIViN7ooBsjUfCIk0XRi4WtXtiaHWHT2pECx//k=";
+    sha256 = "sha256-3J3Xe9LT4bHatU/wWsF0Gq9gGRcSdCzyQnIIfLXE8KA=";
   };
 
-  cargoSha256 = "sha256-ASBu4p8+/Donmynnyryktc6dXA3yiOb9w5XpmN4PotY=";
+  cargoSha256 = "sha256-TWpshqvWMRk2A6RvjWWQc7Nu6tOrctUBZmzyjEFKPRw=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";
diff --git a/pkgs/applications/misc/pwsafe/default.nix b/pkgs/applications/misc/pwsafe/default.nix
index 75f09742c1e22..8f8aef6c8cfd9 100644
--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@@ -6,7 +6,7 @@
 , zip
 , gettext
 , perl
-, wxGTK30-gtk3
+, wxGTK30
 , libXext
 , libXi
 , libXt
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     libXi
     libXt
     libXtst
-    wxGTK30-gtk3
+    wxGTK30
     curl
     qrencode
     libuuid
diff --git a/pkgs/applications/misc/tippecanoe/default.nix b/pkgs/applications/misc/tippecanoe/default.nix
index 4d0936c0b431b..a11e1c5174117 100644
--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.13.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-cDNaZ3ZYCUWg30Td1hlzzaB46tI7cFZLvgwCAZN72QI=";
+    hash = "sha256-InKVwB031BLOngcLAa1zRbgoswUb4z5I0FPNMZk9KVI=";
   };
 
   buildInputs = [ sqlite zlib ];
diff --git a/pkgs/applications/networking/cluster/terraform-compliance/default.nix b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
index e60c4f14e3064..590abb80acef0 100644
--- a/pkgs/applications/networking/cluster/terraform-compliance/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
@@ -1,47 +1,31 @@
 { lib
-, GitPython
-, buildPythonApplication
-, emoji
 , fetchFromGitHub
-, filetype
-, ipython
-, junit-xml
-, lxml
-, mock
-, netaddr
-, pytestCheckHook
-, radish-bdd
-, semver
+, python3
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "terraform-compliance";
-  version = "1.2.11";
+  version = "1.3.34";
+  format = "setuptools";
 
-  # No tests in Pypi package
   src = fetchFromGitHub {
-    owner = "eerkunt";
-    repo = pname;
-    rev = version;
-    sha256 = "161mszmxqp3wypnda48ama2mmq8yjilkxahwc1mxjwzy1n19sn7v";
+    owner = "terraform-compliance";
+    repo = "cli";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-1TFLpBwkpMMdiJJfVvDXlJg4SXWQ8VV605wMFGU+InQ=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "IPython==7.16.1" "IPython"
+      --replace "IPython==7.16.1" "IPython" \
+      --replace "diskcache==5.1.0" "diskcache>=5.1.0"
   '';
 
-  checkInputs = [ pytestCheckHook ];
-
-  disabledTests = [
-    "test_which_success"
-    "test_readable_plan_file_is_not_json"
-  ];
-
-  propagatedBuildInputs = [
-    GitPython
+  propagatedBuildInputs = with python3.pkgs; [
+    diskcache
     emoji
     filetype
+    gitpython
     ipython
     junit-xml
     lxml
@@ -51,9 +35,23 @@ buildPythonApplication rec {
     semver
   ];
 
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    "test_which_success"
+    "test_readable_plan_file_is_not_json"
+  ];
+
+  pythonImportsCheck = [
+    "terraform_compliance"
+  ];
+
   meta = with lib; {
     description = "BDD test framework for terraform";
-    homepage = "https://github.com/eerkunt/terraform-compliance";
+    homepage = "https://github.com/terraform-compliance/cli";
+    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
   };
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 54a3a16e6d10f..fddb9cc57ed0d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -48,11 +48,11 @@
     "vendorHash": "sha256-byReViTX0KRFVgWMkte00CDB/3Mw8Ov5GyD48sENmIA="
   },
   "alicloud": {
-    "hash": "sha256-YdXnw0j2PSuT2BoQQUxyomH+dycjy6Fed7+xVuOwJhk=",
+    "hash": "sha256-4f29+7irL+6uNTEFnUu46LGz4aBDwortClCZ0+EDZ4Q=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.193.0",
+    "rev": "v1.193.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -176,11 +176,11 @@
     "vendorHash": "sha256-Qkla3OEcyiMn6eqBj+4LB8JwpIwceLAASI1qvOcUBD0="
   },
   "brightbox": {
-    "hash": "sha256-l4gN7gxLMTuUMjf50Hc2Els5pJ4BId1QlRAhykseK7c=",
+    "hash": "sha256-F/AQq45ADM0+PbFpMPtpMvbYw8F41GDBzk7LoY/L/Qg=",
     "homepage": "https://registry.terraform.io/providers/brightbox/brightbox",
     "owner": "brightbox",
     "repo": "terraform-provider-brightbox",
-    "rev": "v3.0.5",
+    "rev": "v3.0.6",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-ZT+SOHn/8aoZLXUau9toc3NtQNaXfttM0agIw8T28tk="
   },
@@ -349,11 +349,11 @@
     "vendorHash": "sha256-EaWVf8GmNsabpfeOEzRjKPubCyEReGjdzRy7Ohb4mno="
   },
   "elasticsearch": {
-    "hash": "sha256-+cktPArBOysc4V+uR3KWsVlxtxSIbuVMCmPSU21xF/U=",
+    "hash": "sha256-a6kHN3w0sQCP+0+ZtFwcg9erfVBYkhNo+yOrnwweGWo=",
     "homepage": "https://registry.terraform.io/providers/phillbaker/elasticsearch",
     "owner": "phillbaker",
     "repo": "terraform-provider-elasticsearch",
-    "rev": "v2.0.6",
+    "rev": "v2.0.7",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-oVTanZpCWs05HwyIKW2ajiBPz1HXOFzBAt5Us+EtTRw="
   },
@@ -442,24 +442,24 @@
     "vendorHash": "sha256-QAFx/Ew86T4LWJ6ZtJTUWwR5rGunWj0E5Vzt++BN9ks="
   },
   "google": {
-    "hash": "sha256-e2jVnL13j4iSb288CB/H6G3vR58bjwi+2ZHzve1tuUo=",
+    "hash": "sha256-VqQK6NifhilmnJL5L4EHmmeFWZPBmQhoUl3mz8igSck=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.44.1",
+    "rev": "v4.45.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X5wjho+hotqi9aZ5ABv3RY0xJj1HFH7IN/HLPKIxi2c="
+    "vendorHash": "sha256-nwA+OD0gtnV5di43wgH1OZp/RngLvnVRAuKQxsxnlLw="
   },
   "google-beta": {
-    "hash": "sha256-ejMWZTSrkGMAKr02TIg0yngzpqEVL8y56JSoQrCJ7lA=",
+    "hash": "sha256-/fdgwdIIFHLEMeqsWashkQJlIoFU86ZmsbA4pX18FhE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.44.1",
+    "rev": "v4.45.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X5wjho+hotqi9aZ5ABv3RY0xJj1HFH7IN/HLPKIxi2c="
+    "vendorHash": "sha256-nwA+OD0gtnV5di43wgH1OZp/RngLvnVRAuKQxsxnlLw="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -507,11 +507,11 @@
     "vendorHash": null
   },
   "heroku": {
-    "hash": "sha256-NabwjOTbBRlDNFBpCshxZMO9E958tfAIPPuyArvacFI=",
+    "hash": "sha256-TdL0m83sIS8BuNE6j6mSsEnXq7KuaYJEhuDHkXyNAMc=",
     "homepage": "https://registry.terraform.io/providers/heroku/heroku",
     "owner": "heroku",
     "repo": "terraform-provider-heroku",
-    "rev": "v5.1.6",
+    "rev": "v5.1.7",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -598,13 +598,13 @@
     "vendorHash": null
   },
   "kafka": {
-    "hash": "sha256-bKbY2cOIORy3D9yCBqVuKUZb650sx+87d4wtUB3dPdg=",
+    "hash": "sha256-p8KT6K9fcd0OFy+NoZyZzQxG13fIiyMJg2yNPKIWH60=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka",
-    "rev": "v0.5.1",
+    "rev": "v0.5.2",
     "spdx": "MIT",
-    "vendorHash": "sha256-03QV6C2DEN5xwMwABwSvv5Ts6pTHQDBP2zUUqIcOtVQ="
+    "vendorHash": "sha256-RzC8j+Toub7kiOKW6IppjwyJ0vGEJ0YHb8YXrWFkZW4="
   },
   "kafka-connect": {
     "hash": "sha256-PiSVfzNPEXAgONb/eaVAN4yPudn5glcHL0BLqE5PWsw=",
@@ -643,11 +643,11 @@
     "vendorHash": "sha256-lXQHo66b9X0jZhoF+5Ix5qewQGyI82VPJ7gGzc2CHao="
   },
   "kubernetes": {
-    "hash": "sha256-hWFC8VBbM3BRGrX1Y45Znd/W3klYy/7aS7JbbKN7EUg=",
+    "hash": "sha256-aKGcKmnlYxNS7SrFW2SouRQUXYy339qHrDtQMXGD4DE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/kubernetes",
     "owner": "hashicorp",
     "repo": "terraform-provider-kubernetes",
-    "rev": "v2.16.0",
+    "rev": "v2.16.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -743,13 +743,13 @@
     "vendorHash": "sha256-VxISNcWEnBAa+8WsmqxcT+DPF74X8rLlvdSNJtx0++I="
   },
   "mongodbatlas": {
-    "hash": "sha256-rHT/x3Wpd7b4u7v1/g6DY85TwRkf5A7KaOiqoWeN05Y=",
+    "hash": "sha256-QMwsVD1RZwL9DPF0gnio4quqUa1b4G0SK73yd6BYnG4=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.6.0",
+    "rev": "v1.6.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-dFlDUJGVTWQwXXGaWeG07kKyXcWWzuyqYlPm11yaCqI="
+    "vendorHash": "sha256-WO8B5tiDYQTbKbqWfjjgyMLCmclhE0r2XNRTQ2uyu7s="
   },
   "namecheap": {
     "hash": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
@@ -770,13 +770,13 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-wTQmqe7oicD7MOZdKgRHlz4Vs8dQqEUjnrKU/1pldRI=",
+    "hash": "sha256-nN4KXXSYp4HWxImfgd/C/ykQi02EIpq4mb20EpKboaE=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.8.0",
+    "rev": "v3.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CIiRPwzlx5WWyRmg2tXEB+yp05ZbN5mLBGuFxm0h//4="
+    "vendorHash": "sha256-WuGf6gMOOCTwUTzbinyT7yNM3S8ddHY5aS5VTAEf5Js="
   },
   "nomad": {
     "hash": "sha256-oHY+jM4JQgLlE1wd+/H9H8H2g0e9ZuxI6OMlz3Izfjg=",
@@ -843,13 +843,13 @@
     "vendorHash": null
   },
   "opennebula": {
-    "hash": "sha256-jm7k0k28TSfnUA6P2RjSfF36o/nznvDWcDmJz/MAMXU=",
+    "hash": "sha256-+EbEVwgo2HWmVhff7u5ohSJW8wuxK1kvWfvRWRwIP4o=",
     "homepage": "https://registry.terraform.io/providers/OpenNebula/opennebula",
     "owner": "OpenNebula",
     "repo": "terraform-provider-opennebula",
-    "rev": "v1.0.2",
+    "rev": "v1.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tkb+P+eTid5dgCw6bErr7i0F+E8UCt/HyFA2e3y0XT0="
+    "vendorHash": "sha256-zKtBDnvlQHe+q0OZUMUGu1gNsx2wIrIoArtJrt0VaBk="
   },
   "openstack": {
     "hash": "sha256-k5UyK9jmjZzHw8AwmDRtyCyJgILAcCK+nN+hklJ9VFw=",
@@ -879,11 +879,11 @@
     "vendorHash": null
   },
   "ovh": {
-    "hash": "sha256-6lBhEmeAvTv8xRMi5ZabcJg/59xJ9o4/MaAJP+H7pqk=",
+    "hash": "sha256-G1YRp6ScdlPnV8cCC05TKToJk+iLx2l28x7Lv4GS2/k=",
     "homepage": "https://registry.terraform.io/providers/ovh/ovh",
     "owner": "ovh",
     "repo": "terraform-provider-ovh",
-    "rev": "v0.23.0",
+    "rev": "v0.24.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -969,13 +969,13 @@
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-0NQRAv05GuVRAkZd580TINEur/G+c0jUmMtyMv05+PY=",
+    "hash": "sha256-2991jDjOlyJuVcgzTmfKfMt4NfLc1QP7TY9mw+5Z5aM=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.7.1",
+    "rev": "v2.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XlEvaXd+mAvbFeQmTOE+bFsYok/Ke1mVwIUY3VY8zDI="
+    "vendorHash": "sha256-YlZSM3duS2QEZo5j+WvCw5KFPbY+NadYonylpB8Zw+o="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1104,13 +1104,13 @@
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-ikuLRGm9Z+tt0Zsx7DYKNBrS08rW4DOvVWYpl3wvaeU=",
+    "hash": "sha256-y9v+13/u91tpRwyI/oLHsd7oUUj0OGFJkqzbk2z8MxU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.39.0",
+    "rev": "v0.40.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Ws9IzlZQDDAdQ4JJ326jHXUe9oQphBXb/ZNO7Kl/A1w="
+    "vendorHash": "sha256-Z2pIUAe2Beq5Hi7HBxNenFEtAFhJFMPi3k2qiifN+Jg="
   },
   "thunder": {
     "hash": "sha256-fXvwBOIW3/76V3O9t25wff0oGViqSaSB2VgMdItXyn4=",
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index b15f60afe016d..437f5813a3acb 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.41.0";
+  version = "0.42.3";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1if7Z+4Lr5eevf1NUJn//pcVU3Ts/FznDd/604aJO/c=";
+    sha256 = "sha256-CK2+leFJuNQqX1t34LLTJ6eVEUFdZSb/0E3XTf3S9gQ=";
   };
 
   vendorSha256 = "sha256-Qc0FnNxyErtieVvEj/eKPW5PpvYFwiYtv+ReJTVFAPA=";
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 5a4585135f015..49f2aaa37e9cb 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -12,7 +12,8 @@
 , sqlite
 , tinyxml
 , wrapGAppsHook
-, wxGTK30-gtk3
+, wxGTK30
+, gtk3
 , xdg-utils
 }:
 
@@ -42,8 +43,8 @@ stdenv.mkDerivation rec {
     pugixml
     sqlite
     tinyxml
-    wxGTK30-gtk3
-    wxGTK30-gtk3.gtk
+    wxGTK30
+    gtk3
     xdg-utils
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index a71cad3224af8..cb7801d3896b7 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "6.0.0"; # Please backport all updates to the stable channel.
+  version = "6.0.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-aJLsRxxpLWKl0Y/91uR56nIUUOALd572LtXpqXGTXSg=";
+    sha256 = "sha256-7Cojhz3wBPd/13uVg2MgJXvR9QMPZcwBibk/sCrRMAE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index f172a7fc420b6..52ff6a5c108ac 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -20,12 +20,12 @@
 
 stdenv.mkDerivation rec {
   pname = "rsync";
-  version = "3.2.6";
+  version = "3.2.7";
 
   src = fetchurl {
     # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
     url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-    sha256 = "sha256-+zNlurJ4N9Qf6vQulnxXvTpHvI8Qdlo2ce/Wo4NUVNM=";
+    sha256 = "sha256-Tn2dP27RCHjFjF+3JKZ9rPS2qsc0CxPkiPstxBNG8rs=";
   };
 
   nativeBuildInputs = [ perl ];
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
new file mode 100644
index 0000000000000..33e0820bec9f4
--- /dev/null
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -0,0 +1,51 @@
+{ autoPatchelfHook
+, curl
+, dpkg
+, dbus
+, fetchurl
+, lib
+, libnl
+, udev
+, cryptsetup
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "twingate";
+  version = "1.0.60";
+
+  src = fetchurl {
+    url = "https://binaries.twingate.com/client/linux/DEB/${version}/twingate-amd64.deb";
+    sha256 = "b308c422af8a33ecd58e21a10a72c353351a189df67006e38d1ec029a93d5678";
+  };
+
+  buildInputs = [ dbus curl libnl udev cryptsetup ];
+  nativeBuildInputs = [ dpkg autoPatchelfHook ];
+
+  unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+
+  postPatch = ''
+    while read file; do
+      substituteInPlace "$file" \
+        --replace "/usr/bin" "$out/bin" \
+        --replace "/usr/sbin" "$out/bin"
+    done < <(find etc usr/lib usr/share -type f)
+  '';
+
+  installPhase = ''
+    mkdir $out
+    mv etc $out/
+    mv usr/bin $out/bin
+    mv usr/sbin/* $out/bin
+    mv usr/lib $out/lib
+    mv usr/share $out/share
+  '';
+
+  meta = with lib; {
+    description = "Twingate Client";
+    homepage = "https://twingate.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ tonyshkurenko ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/yaup/default.nix b/pkgs/applications/networking/yaup/default.nix
new file mode 100644
index 0000000000000..5894e758e9d96
--- /dev/null
+++ b/pkgs/applications/networking/yaup/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, intltool
+, pkg-config
+, wrapGAppsHook
+, gtk3
+, miniupnpc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "yaup";
+  version = "unstable-2019-10-16";
+
+  src = fetchFromGitHub {
+    owner = "Holarse-Linuxgaming";
+    repo = "yaup";
+    rev = "7ee3fdbd8c1ecf0a0e6469c47560e26082808250";
+    hash = "sha256-RWnNjpgXRYncz9ID8zirENffy1UsfHD1H6Mmd8DKN4k=";
+  };
+
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    miniupnpc
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/Holarse-Linuxgaming/yaup";
+    description = "Yet Another UPnP Portmapper";
+    longDescription = ''
+      Portmapping made easy.
+      Portforward your incoming traffic to a specified local ip.
+      Mostly used for IPv4.
+    '';
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    # ld: unknown option: --export-dynamic
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index 030d5cdb7eb28..6e5941bd3eef4 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.59.4";
+  version = "0.59.5";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "sha256-Yjp69p1UCLkGgTm8jn/sJfh2dYSKVbHdi1OLIYeB18w=";
+    sha256 = "sha256-6AEc9wc3/8AubPvqq8s9R1RnO+P8+92UsNEt6AdQv+w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/freedv/default.nix b/pkgs/applications/radio/freedv/default.nix
index b648c04577e0d..c7877f96e8437 100644
--- a/pkgs/applications/radio/freedv/default.nix
+++ b/pkgs/applications/radio/freedv/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freedv";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     rev = "v${version}";
-    hash = "sha256-X/jL6q2yLNtRq7Xg9JeXu1zXD0KCs59D1poA9hM3Ndo=";
+    hash = "sha256-BkxEg4vQ943QyDo9V1hG2XimguGn8XpO9aIz5si0PKU=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/applications/science/astronomy/phd2/default.nix b/pkgs/applications/science/astronomy/phd2/default.nix
index 52049302a27b5..dc84dcfd98d72 100644
--- a/pkgs/applications/science/astronomy/phd2/default.nix
+++ b/pkgs/applications/science/astronomy/phd2/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30-gtk3
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, gtk3, wxGTK30
 , curl, gettext, glib, indi-full, libnova, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gtk3
-    wxGTK30-gtk3
+    wxGTK30
     curl
     gettext
     glib
diff --git a/pkgs/applications/science/logic/isabelle/default.nix b/pkgs/applications/science/logic/isabelle/default.nix
index 1bb7ede6da7b7..d2326d2d4d0eb 100644
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@@ -6,7 +6,6 @@
 , java
 , scala_3
 , polyml
-, z3
 , veriT
 , vampire
 , eprover-ho
@@ -15,7 +14,6 @@
 , perl
 , makeDesktopItem
 , isabelle-components
-, isabelle
 , symlinkJoin
 , fetchhg
 }:
@@ -46,7 +44,7 @@ let
       cp libsha1.so $out/lib/
     '';
   };
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation (finalAttrs: rec {
   pname = "isabelle";
   version = "2022";
 
@@ -68,25 +66,22 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ java ];
 
-  buildInputs = [ polyml z3 veriT vampire eprover-ho nettools ]
+  buildInputs = [ polyml veriT vampire eprover-ho nettools ]
     ++ lib.optionals (!stdenv.isDarwin) [ java ];
 
-  sourceRoot = dirname;
+  sourceRoot = "${dirname}${lib.optionalString stdenv.isDarwin ".app"}";
+
+  doCheck = true;
+  checkPhase = "bin/isabelle build -v HOL-SMT_Examples";
 
   postUnpack = lib.optionalString stdenv.isDarwin ''
-    mv $sourceRoot.app $sourceRoot
+    mv $sourceRoot ${dirname}
+    sourceRoot=${dirname}
   '';
 
   postPatch = ''
     patchShebangs lib/Tools/ bin/
 
-    cat >contrib/z3*/etc/settings <<EOF
-      Z3_HOME=${z3}
-      Z3_VERSION=${z3.version}
-      Z3_SOLVER=${z3}/bin/z3
-      Z3_INSTALLED=yes
-    EOF
-
     cat >contrib/verit-*/etc/settings <<EOF
       ISABELLE_VERIT=${veriT}/bin/veriT
     EOF
@@ -122,7 +117,7 @@ in stdenv.mkDerivation rec {
 
     echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings
 
-    for comp in contrib/jdk* contrib/polyml-* contrib/z3-* contrib/verit-* contrib/vampire-* contrib/e-*; do
+    for comp in contrib/jdk* contrib/polyml-* contrib/verit-* contrib/vampire-* contrib/e-*; do
       rm -rf $comp/x86*
     done
 
@@ -143,15 +138,14 @@ in stdenv.mkDerivation rec {
       --replace 'ISABELLE_APPLE_PLATFORM64=arm64-darwin' ""
   '' + lib.optionalString stdenv.isLinux ''
     arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
-    for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
-    done
-    for f in contrib/*/platform_$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
+    for f in contrib/*/$arch/{z3,epclextract,nunchaku,SPASS,zipperposition}; do
       patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
     done
+    patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) contrib/bash_process-*/platform_$arch/bash_process
     for d in contrib/kodkodi-*/jni/$arch; do
       patchelf --set-rpath "${lib.concatStringsSep ":" [ "${java}/lib/openjdk/lib/server" "${stdenv.cc.cc.lib}/lib" ]}" $d/*.so
     done
+    patchelf --set-rpath "${stdenv.cc.cc.lib}/lib" contrib/z3-*/$arch/z3
   '';
 
   buildPhase = ''
@@ -219,14 +213,15 @@ in stdenv.mkDerivation rec {
     maintainers = [ maintainers.jwiegley maintainers.jvanbruegge ];
     platforms = platforms.unix;
   };
-} // {
-  withComponents = f:
+
+  passthru.withComponents = f:
     let
+      isabelle = finalAttrs.finalPackage;
       base = "$out/${isabelle.dirname}";
       components = f isabelle-components;
     in symlinkJoin {
       name = "isabelle-with-components-${isabelle.version}";
-      paths = [ isabelle ] ++ components;
+      paths = [ isabelle ] ++ (builtins.map (c: c.override { inherit isabelle; }) components);
 
       postBuild = ''
         rm $out/bin/*
@@ -244,4 +239,4 @@ in stdenv.mkDerivation rec {
         echo contrib/${c.pname}-${c.version} >> ${base}/etc/components
       '') components;
     };
-}
+})
diff --git a/pkgs/applications/science/machine-learning/streamlit/default.nix b/pkgs/applications/science/machine-learning/streamlit/default.nix
index 90830ae9ffcab..189c4cf97d3bf 100755
--- a/pkgs/applications/science/machine-learning/streamlit/default.nix
+++ b/pkgs/applications/science/machine-learning/streamlit/default.nix
@@ -1,21 +1,18 @@
-{
-  # Nix
-  lib
-, buildPythonApplication
-, fetchPypi
-, # Build inputs
-  altair
+{ lib
+, altair
 , blinker
-, click
+, buildPythonApplication
 , cachetools
-, GitPython
+, click
+, fetchPypi
+, gitpython
 , importlib-metadata
 , jinja2
 , pillow
+, protobuf3
 , pyarrow
 , pydeck
 , pympler
-, protobuf3
 , requests
 , rich
 , semver
@@ -25,7 +22,6 @@
 , tzlocal
 , validators
 , watchdog
-,
 }:
 
 buildPythonApplication rec {
@@ -43,7 +39,7 @@ buildPythonApplication rec {
     blinker
     cachetools
     click
-    GitPython
+    gitpython
     importlib-metadata
     jinja2
     pillow
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 956b98ffd5f18..89b174515c479 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication rec {
     datrie
     docutils
     filelock
-    GitPython
+    gitpython
     jinja2
     jsonschema
     nbformat
diff --git a/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix b/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
index 66dc5ece90a88..16c5b49406f67 100644
--- a/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
@@ -1,29 +1,38 @@
 { lib
-, buildPythonApplication
-, fetchPypi
 , annexremote
+, buildPythonApplication
 , drivelib
-, GitPython
-, tenacity
+, fetchPypi
+, gitpython
 , humanfriendly
+, tenacity
 }:
 
 buildPythonApplication rec {
   pname = "git-annex-remote-googledrive";
   version = "1.3.2";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
   };
 
-  propagatedBuildInputs = [ annexremote drivelib GitPython tenacity humanfriendly ];
+  propagatedBuildInputs = [
+    annexremote
+    drivelib
+    gitpython
+    tenacity
+    humanfriendly
+  ];
 
   # while git-annex does come with a testremote command that *could* be used,
   # testing this special remote obviously depends on authenticating with google
   doCheck = false;
 
-  pythonImportsCheck = [ "git_annex_remote_googledrive" ];
+  pythonImportsCheck = [
+    "git_annex_remote_googledrive"
+  ];
 
   meta = with lib; {
     description = "A git-annex special remote for Google Drive";
diff --git a/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
index c17654174382a..d162f9ce20ba5 100644
--- a/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-privacy/default.nix
@@ -9,8 +9,6 @@ python3.pkgs.buildPythonApplication rec {
   version = "2.1.0";
   format = "setuptools";
 
-  disabled = python3.pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "EMPRI-DEVOPS";
     repo = pname;
@@ -21,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python3.pkgs; [
     click
     git-filter-repo
-    GitPython
+    gitpython
     pynacl
     setuptools
   ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
index d78972aa07bdf..ebea57c1552a8 100644
--- a/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-repo-updater/default.nix
@@ -1,5 +1,9 @@
-{ lib, buildPythonApplication, fetchPypi
-, colorama, GitPython }:
+{ lib
+, buildPythonApplication
+, colorama
+, fetchPypi
+, gitpython
+}:
 
 buildPythonApplication rec {
   pname = "gitup";
@@ -10,7 +14,10 @@ buildPythonApplication rec {
     sha256 = "1pa612rcc94nc461zs9sag9p46sycc214622b06gdn35rmwp0y2g";
   };
 
-  propagatedBuildInputs = [ colorama GitPython ];
+  propagatedBuildInputs = [
+    colorama
+    gitpython
+  ];
 
   # no tests
   doCheck = false;
@@ -19,7 +26,6 @@ buildPythonApplication rec {
     description = "Easily update multiple Git repositories at once";
     homepage = "https://github.com/earwig/git-repo-updater";
     license = licenses.mit;
-    maintainers = [ maintainers.bdesham ];
-    platforms = platforms.all;
+    maintainers = with maintainers; [bdesham ];
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-up/default.nix b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
index 0a366827e40d5..71ae40e25d35b 100644
--- a/pkgs/applications/version-management/git-and-tools/git-up/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-up/default.nix
@@ -1,4 +1,7 @@
-{ lib, pythonPackages, git }:
+{ lib
+, pythonPackages
+, git
+}:
 
 pythonPackages.buildPythonApplication rec {
   pname = "git-up";
@@ -10,7 +13,16 @@ pythonPackages.buildPythonApplication rec {
   };
 
   # git should be on path for tool to work correctly
-  propagatedBuildInputs = [ git ] ++ (with pythonPackages; [ click colorama docopt GitPython six termcolor ]);
+  propagatedBuildInputs = [
+    git
+  ] ++ (with pythonPackages; [
+    click
+    colorama
+    docopt
+    gitpython
+    six
+    termcolor
+  ]);
 
   checkInputs = [ git pythonPackages.nose ]; # git needs to be on path
   # 1. git fails to run as it cannot detect the email address, so we set it
diff --git a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
index e73d4de6dc41c..38d6d740c83c1 100644
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lefthook";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "evilmartians";
     repo = "lefthook";
-    sha256 = "sha256-tns/JUOYlgG+oiFACnXlCwHBF4enctV4GPlpEZCM/nM=";
+    sha256 = "sha256-Z6j/Y8b9lq2nYS5Ki8iJoDsG3l5M6RylfDqQL7WrwNg=";
   };
 
   vendorSha256 = "sha256-sBcgt2YsV9RQhSjPN6N54tRk7nNvcOVhPEsEP+0Dtco=";
diff --git a/pkgs/applications/version-management/git-and-tools/legit/default.nix b/pkgs/applications/version-management/git-and-tools/legit/default.nix
index df2866527115b..33efad77f9089 100644
--- a/pkgs/applications/version-management/git-and-tools/legit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/legit/default.nix
@@ -1,8 +1,11 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "legit";
   version = "1.2.0";
+
   src = python3Packages.fetchPypi {
     inherit pname version;
     sha256 = "0ngh3ar6v15516f52j21k6qz7hykmxfjadhb2rakvl27b5xvjy1c";
@@ -12,7 +15,7 @@ python3Packages.buildPythonApplication rec {
     click
     clint
     crayons
-    GitPython
+    gitpython
     six
   ];
 
diff --git a/pkgs/applications/version-management/jujutsu/default.nix b/pkgs/applications/version-management/jujutsu/default.nix
index e9b9d02ca6c34..19eb42c3cef41 100644
--- a/pkgs/applications/version-management/jujutsu/default.nix
+++ b/pkgs/applications/version-management/jujutsu/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jujutsu";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    sha256 = "sha256-ITYpdCUh+WzP2RrAkSep3DsQ7dztvOMuwESKimn8JBQ=";
+    sha256 = "sha256-xS4uktydrvkeTsR9QGT9gYdhFh92XdpoG0TrDt7IPdc=";
   };
 
-  cargoSha256 = "sha256-eH8/R4dwQ08Q7Dyw8CnE+DGjneAmtTdsRben2cxpG8Q=";
+  cargoSha256 = "sha256-VM+Oq0nf4pMK3nbPbHbl7E2qgUnGlu7kf2p47d8cm1c=";
 
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/applications/version-management/rapidsvn/default.nix b/pkgs/applications/version-management/rapidsvn/default.nix
index 4bede0ac82b68..0027af3defe90 100644
--- a/pkgs/applications/version-management/rapidsvn/default.nix
+++ b/pkgs/applications/version-management/rapidsvn/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wxGTK30-gtk3, subversion, apr, aprutil, python3, fetchpatch }:
+{ lib, stdenv, fetchurl, wxGTK30, subversion, apr, aprutil, python3, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "rapidsvn";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1bmcqjc12k5w0z40k7fkk8iysqv4fw33i80gvcmbakby3d4d4i4p";
   };
 
-  buildInputs = [ wxGTK30-gtk3 subversion apr aprutil python3 ];
+  buildInputs = [ wxGTK30 subversion apr aprutil python3 ];
 
   NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
 
diff --git a/pkgs/applications/video/dvdstyler/default.nix b/pkgs/applications/video/dvdstyler/default.nix
index 8d42c2b2bfd66..cd36914583364 100644
--- a/pkgs/applications/video/dvdstyler/default.nix
+++ b/pkgs/applications/video/dvdstyler/default.nix
@@ -17,7 +17,7 @@
 , libjpeg
 , pkg-config
 , wrapGAppsHook
-, wxGTK30-gtk3 # crash with wxGTK30 with GTK2 compat
+, wxGTK30 # crash with wxGTK30 with GTK2 compat
 , wxSVG
 , xine-ui
 , xmlto
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
     libexif
     libjpeg
     wxSVG
-    wxGTK30-gtk3
+    wxGTK30
     xine-ui
  ]
   ++ optionals dvdisasterSupport [ dvdisaster ]
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 05ec95d006bdf..11203b62df57c 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -4,11 +4,10 @@
 , fetchFromGitHub
 , addOpenGLRunpath
 , docutils
-, perl
+, meson
+, ninja
 , pkg-config
 , python3
-, wafHook
-, which
 , ffmpeg
 , freefont_ttf
 , freetype
@@ -19,6 +18,7 @@
 , libuchardet
 , libiconv
 , CoreFoundation, Cocoa, CoreAudio, MediaPlayer
+, xcbuild
 
 , waylandSupport ? stdenv.isLinux
   , wayland
@@ -97,40 +97,36 @@ in stdenv.mkDerivation rec {
     patchShebangs version.* ./TOOLS/
   '';
 
-  NIX_LDFLAGS = lib.optionalString x11Support "-lX11 -lXext "
-    + lib.optionalString stdenv.isDarwin "-framework CoreFoundation";
-
-  # These flags are not supported and cause the build
-  # to fail, even when cross compilation itself works.
-  dontAddWafCrossFlags = true;
-
-  wafConfigureFlags = [
-    "--enable-libmpv-shared"
-    "--enable-manpage-build"
-    "--disable-libmpv-static"
-    "--disable-static-build"
-    "--disable-build-date" # Purity
-    (lib.enableFeature archiveSupport  "libarchive")
-    (lib.enableFeature cddaSupport     "cdda")
-    (lib.enableFeature dvdnavSupport   "dvdnav")
-    (lib.enableFeature javascriptSupport "javascript")
-    (lib.enableFeature openalSupport   "openal")
-    (lib.enableFeature sdl2Support     "sdl2")
-    (lib.enableFeature sixelSupport    "sixel")
-    (lib.enableFeature vaapiSupport    "vaapi")
-    (lib.enableFeature waylandSupport  "wayland")
-    (lib.enableFeature dvbinSupport  "dvbin")
-  ] # Disable whilst Swift isn't supported
-    ++ lib.optional (!swiftSupport) "--disable-macos-cocoa-cb";
+  NIX_LDFLAGS = lib.optionalString x11Support "-lX11 -lXext ";
+
+  mesonFlags = let
+    mesonFeatureFlag = feature: flag: "-D${feature}=${if flag then "enabled" else "disabled"}";
+  in [
+    "-Ddefault_library=shared"
+    "-Dlibmpv=true"
+    (mesonFeatureFlag "libarchive" archiveSupport)
+    (mesonFeatureFlag "manpage-build" true)
+    (mesonFeatureFlag "cdda" cddaSupport)
+    (mesonFeatureFlag "dvbin" dvbinSupport)
+    (mesonFeatureFlag "dvdnav" dvdnavSupport)
+    (mesonFeatureFlag "openal" openalSupport)
+    (mesonFeatureFlag "sdl2" sdl2Support)
+    # Disable whilst Swift isn't supported
+    (mesonFeatureFlag "swift-build" swiftSupport)
+    (mesonFeatureFlag "macos-cocoa-cb" swiftSupport)
+  ];
+
+  mesonAutoFeatures = "auto";
 
   nativeBuildInputs = [
     addOpenGLRunpath
     docutils # for rst2man
-    perl
+    meson
+    ninja
     pkg-config
     python3
-    wafHook
-    which
+  ] ++ lib.optionals stdenv.isDarwin [
+    xcbuild.xcrun
   ] ++ lib.optionals swiftSupport [ swift ]
     ++ lib.optionals waylandSupport [ wayland-scanner ];
 
@@ -175,10 +171,10 @@ in stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isDarwin    [ libiconv ]
     ++ lib.optionals stdenv.isDarwin    [ CoreFoundation Cocoa CoreAudio MediaPlayer ];
 
-  enableParallelBuilding = true;
-
   postBuild = lib.optionalString stdenv.isDarwin ''
+    pushd .. # Must be run from the source dir because it uses relative paths
     python3 TOOLS/osxbundle.py -s build/mpv
+    popd
   '';
 
   postInstall = ''
@@ -186,16 +182,13 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/mpv
     ln -s ${freefont_ttf}/share/fonts/truetype/FreeSans.ttf $out/share/mpv/subfont.ttf
 
-    cp TOOLS/mpv_identify.sh $out/bin
-    cp TOOLS/umpv $out/bin
+    cp ../TOOLS/mpv_identify.sh $out/bin
+    cp ../TOOLS/umpv $out/bin
     cp $out/share/applications/mpv.desktop $out/share/applications/umpv.desktop
     sed -i '/Icon=/ ! s/mpv/umpv/g' $out/share/applications/umpv.desktop
-
-    substituteInPlace $out/lib/pkgconfig/mpv.pc \
-      --replace "$out/include" "$dev/include"
   '' + lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
-    cp -r build/mpv.app $out/Applications
+    cp -r mpv.app $out/Applications
   '';
 
   # Set RUNPATH so that libcuda in /run/opengl-driver(-32)/lib can be found.
@@ -227,6 +220,6 @@ in stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ AndersonTorres fpletz globin ma27 tadeokondrak ];
-    platforms = platforms.darwin ++ platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/window-managers/icewm/default.nix b/pkgs/applications/window-managers/icewm/default.nix
index 07c45bbcc6934..fe0c275b72e2f 100644
--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     rev = finalAttrs.version;
-    hash = "sha256-tVbBV3eaZ9MUXlzriiOeEuzojI3GHNaXRBjdsQjXrzw=";
+    hash = "sha256-cG+I7WMWboMNH6A0eKFI3evN16C5EGE127q+a/PBR5E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/fetchzip/default.nix b/pkgs/build-support/fetchzip/default.nix
index 9c08276cdb9b5..8605564fc1e51 100644
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@@ -36,7 +36,7 @@ in
 fetchurl ((
   if (pname != "" && version != "") then
     {
-      name = "${name}-${version}";
+      name = "${pname}-${version}";
       inherit pname version;
     }
   else
diff --git a/pkgs/build-support/mkshell/default.nix b/pkgs/build-support/mkshell/default.nix
index e7552f4348481..39b02a47141ac 100644
--- a/pkgs/build-support/mkshell/default.nix
+++ b/pkgs/build-support/mkshell/default.nix
@@ -44,12 +44,13 @@ stdenv.mkDerivation ({
   phases = [ "buildPhase" ];
 
   buildPhase = ''
-    echo "------------------------------------------------------------" >>$out
-    echo " WARNING: the existence of this path is not guaranteed." >>$out
-    echo " It is an internal implementation detail for pkgs.mkShell."   >>$out
-    echo "------------------------------------------------------------" >>$out
-    echo >> $out
-    # Record all build inputs as runtime dependencies
-    export >> $out
+    { echo "------------------------------------------------------------";
+      echo " WARNING: the existence of this path is not guaranteed.";
+      echo " It is an internal implementation detail for pkgs.mkShell.";
+      echo "------------------------------------------------------------";
+      echo;
+      # Record all build inputs as runtime dependencies
+      export;
+    } >> "$out"
   '';
 } // rest)
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index 473a91f9ce07e..ea150c2fe85d3 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -186,7 +186,10 @@ in ''
      set +e
      EXTRA_BUILD=$(sed -n "s/^cargo:rustc-flags=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
      EXTRA_FEATURES=$(sed -n "s/^cargo:rustc-cfg=\(.*\)/--cfg \1/p" target/build/${crateName}.opt | tr '\n' ' ')
-     EXTRA_LINK=$(sed -n "s/^cargo:rustc-link-lib=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS=$(sed -n "s/^cargo:rustc-link-arg=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS_BINS=$(sed -n "s/^cargo:rustc-link-arg-bins=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS_LIB=$(sed -n "s/^cargo:rustc-link-arg-lib=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_LIBS=$(sed -n "s/^cargo:rustc-link-lib=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ')
      EXTRA_LINK_SEARCH=$(sed -n "s/^cargo:rustc-link-search=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
 
      # We want to read part of every line that has cargo:rustc-env= prefix and
diff --git a/pkgs/build-support/rust/build-rust-crate/lib.sh b/pkgs/build-support/rust/build-rust-crate/lib.sh
index 39f7d53f6f75d..7f98701b5409c 100644
--- a/pkgs/build-support/rust/build-rust-crate/lib.sh
+++ b/pkgs/build-support/rust/build-rust-crate/lib.sh
@@ -17,6 +17,8 @@ build_lib() {
     -L dependency=target/deps \
     --cap-lints allow \
     $LINK \
+    $EXTRA_LINK_ARGS \
+    $EXTRA_LINK_ARGS_LIB \
     $LIB_RUSTC_OPTS \
     $BUILD_OUT_DIR \
     $EXTRA_BUILD \
@@ -47,6 +49,8 @@ build_bin() {
     --out-dir target/bin \
     -L dependency=target/deps \
     $LINK \
+    $EXTRA_LINK_ARGS \
+    $EXTRA_LINK_ARGS_BINS \
     $EXTRA_LIB \
     --cap-lints allow \
     $BUILD_OUT_DIR \
@@ -94,7 +98,7 @@ setup_link_paths() {
        done
      fi
   done
-  echo "$EXTRA_LINK" | while read i; do
+  echo "$EXTRA_LINK_LIBS" | while read i; do
      if [[ ! -z "$i" ]]; then
        for library in $i; do
          echo "-l $library" >> target/link
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index bfa47e3b20e17..881cf6c90f483 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -88,7 +88,7 @@ NIX_NO_SELF_RPATH=1
 
 
 # Move subpaths that match pattern $1 from under any output/ to the $2 output/
-# Beware: only globbing patterns are accepted, e.g.: * ? {foo,bar}
+# Beware: only globbing patterns are accepted, e.g.: * ? [abc]
 # A special target "REMOVE" is allowed: moveToOutput foo REMOVE
 moveToOutput() {
     local patt="$1"
diff --git a/pkgs/data/fonts/amiri/default.nix b/pkgs/data/fonts/amiri/default.nix
index 2c9acc391711a..87185e8469fd0 100644
--- a/pkgs/data/fonts/amiri/default.nix
+++ b/pkgs/data/fonts/amiri/default.nix
@@ -1,17 +1,16 @@
 { lib, fetchzip }:
 
 let
-  version = "0.900";
+  version = "1.000";
 
 in fetchzip rec {
   name = "Amiri-${version}";
 
   url = "https://github.com/alif-type/amiri/releases/download/${version}/${name}.zip";
 
-  sha256 = "sha256-FjuzWW9xVWDOxHBwYL4pmopQVc9KYHGHhye5tPdw68s=";
+  sha256 = "sha256-hG6m/zsGoGF5/xhHz9EHVL9Sg9dlQqfXpQ/lqNyI1vU=";
 
   postFetch = ''
-    rm -rf $out/otf
     mkdir -p $out/share/fonts/truetype
     mv $out/*.ttf $out/share/fonts/truetype/
     mkdir -p $out/share/doc/${name}
diff --git a/pkgs/data/fonts/carlito/default.nix b/pkgs/data/fonts/carlito/default.nix
index 1de2e9afc0f94..0ecd3f85c6933 100644
--- a/pkgs/data/fonts/carlito/default.nix
+++ b/pkgs/data/fonts/carlito/default.nix
@@ -1,22 +1,21 @@
-{ lib, fetchzip }:
+{ lib, fetchzip, stdenvNoCC }:
 
-let
+stdenvNoCC.mkDerivation rec {
+  pname = "carlito";
   version = "20130920";
-in fetchzip {
-  name = "carlito-${version}";
 
-  url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-carlito-${version}.tar.gz";
+  src = fetchzip {
+    url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/crosextrafonts-carlito-${version}.tar.gz";
+    sha256 = "sha256-OGDO5WoF7OmiRdLRRrIXMzg276Pgeq1L3Offcl0W2jg=";
+  };
 
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
+  installPhase = ''
     mkdir -p $out/etc/fonts/conf.d
     mkdir -p $out/share/fonts/truetype
-    cp -v *.ttf $out/share/fonts/truetype
+    cp -v $src/*.ttf $out/share/fonts/truetype
     cp -v ${./calibri-alias.conf} $out/etc/fonts/conf.d/30-calibri.conf
   '';
 
-  sha256 = "0d72zy6kdmxgpi63r3yvi3jh1hb7lvlgv8hgd4ag0x10dz18mbzv";
-
   meta = with lib; {
     # This font doesn't appear to have any official web site but this
     # one provides some good information and samples.
@@ -25,7 +24,7 @@ in fetchzip {
     longDescription = ''
       Carlito is a free font that is metric-compatible with the
       Microsoft Calibri font. The font is designed by Łukasz Dziedzic
-      of the tyPoland foundry and based his Lato font.
+      of the tyPoland foundry and based upon his Lato font.
     '';
     license = licenses.ofl;
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index d7f107b784282..0eabedc7c0bb3 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "16.3.6";
+  version = "16.4.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
@@ -34,6 +34,7 @@ in stdenv.mkDerivation rec {
     inherit (iosevka.meta) homepage downloadPage description license platforms;
     maintainers = with lib.maintainers; [
       cstrahan
+      montchr
     ];
   };
 
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index e5d7447ed59ac..ff64990d65284 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1xjpzif2v3p78abny74wwrrcq05hahvk4rf0swhbjhsv7j1ycmnf";
-  iosevka-aile = "1m1naxhf6ksasd3fq5npikgm8yv60salnhvb9b50rmyw6as2hmyb";
-  iosevka-curly = "0xdb8ymcg0kmdcj7jhr3pqfyv6cw9ab1f1rgs0cvn6g97n4ag2yq";
-  iosevka-curly-slab = "0396zjh043qv1j10f7m2pbibfyfkc6361rzjjgdqyvjhj0qh3wsi";
-  iosevka-etoile = "0d89q4d8fvcl2130v45v873g31vvcd051wk461lid1mdmydvfs9d";
-  iosevka-slab = "0jgsg1rnkx8mrcp74qbkc7dazlkh9wzyb6gn51yvwzv2gs2sj69m";
-  iosevka-ss01 = "16c3kh3ynmwm0r83gv1swv2z4bhdm78a91hkdczzkngbzaa0mxhg";
-  iosevka-ss02 = "1xmylqgh0972p1cz2vshlgnjpfg20k7x5alirjhpsvyj8n1v7jsx";
-  iosevka-ss03 = "1qw2rwwhw4yd2s0876xp3z5kxxgf5x125vwy83wbcgca9hx7b1cw";
-  iosevka-ss04 = "1nlw7na37rx9lk9g3b01v2wipglcj0lszyyk0s6j2g8cdmvcdqap";
-  iosevka-ss05 = "1b3ckxpw28ail62x8g06rs6fn4gba7xfpnk2qaf8fl0lhvjyv0kf";
-  iosevka-ss06 = "0ifrzd1kxhflf2kxbfsshp9chpiidx6nvvblws11276qz7qir9lq";
-  iosevka-ss07 = "0bm2n688i8f40awi8k1jj8p6pz45p230pp7brlps99ljjq7ipqcb";
-  iosevka-ss08 = "0qqhfcr9xmfr24rp4xq3xy8zld5l2pnqwbd801ljv6qy3zza9xhk";
-  iosevka-ss09 = "0dgpzjnab2fwp2jns5fvgzh4n8w0qhxzx1fhxw4b5c99n5bnim07";
-  iosevka-ss10 = "1nz8an3ar3lw3zfdyck1xh17hdkqdpg8rmwih4wxz93hpp5xhrbv";
-  iosevka-ss11 = "1wmxs075ymvyzl9r687xh32iqp3xsaakdfh01m1iwpyglspyr8y0";
-  iosevka-ss12 = "0c7abkq0ylzqv8ssizby5g6lnibqyiw2pfmyk8cccx9pq1ihr1jq";
-  iosevka-ss13 = "0xalbmkgyj30a9y4wzqpcc8ix64jdll1sm972fc35ln8134m7fzl";
-  iosevka-ss14 = "1638n30hhqv0rm2q1gqvj36knjn2n6jry6dz1xfczlaqm956395v";
-  iosevka-ss15 = "05blb6va180fk4iw3ldgq17w11gqi0jflmcdgzjzxw5pxs8j1qwp";
-  iosevka-ss16 = "1qgfrc5kj0x7yc77aqswy5668ymnxw9gw5rp71r4j5778wmslr5s";
-  iosevka-ss17 = "03226nda56dhbia3nf5p603zz04avh5j1x24qz9z3irhqg4rn0js";
-  iosevka-ss18 = "17vyf3msafgdhqhhby4qrn8p5pxdmvxwfgf44vx41iy860q89avh";
-  sgr-iosevka = "0vxfkhx77b9hf63an7wzpgldlj6pbs27i65qsq45n869cyvzd9ga";
-  sgr-iosevka-aile = "1iqxc42hc6398a61k84ibmjkl328sza9q3l81s04iav4kkrjd0g6";
-  sgr-iosevka-curly = "0ww4h12xfpa8yxjxhgs3m819024vz6isw8gq88spj07p2w4jx4mp";
-  sgr-iosevka-curly-slab = "1my79s02hhi803rakwia61c2rkpgzf6zw6xhzw6n1jkmjj1r77a7";
-  sgr-iosevka-etoile = "0rp1fk156s2mxibyak8pzw871p33pjdizi2ix9ppxqdb2zyn64xd";
-  sgr-iosevka-fixed = "0rldw2gq22hf2hy0brf03g12vw4rh8h5ascccsc6mljzzgwy6wir";
-  sgr-iosevka-fixed-curly = "1sal7i1kybfgxfhr1c90rmjal8zhh4cbf6xqzs6zrz3zxhp1zj30";
-  sgr-iosevka-fixed-curly-slab = "0spkivcqg4nzkd7r3gvym1v87d8r7cd353sw8sbllq9a93axcffs";
-  sgr-iosevka-fixed-slab = "1kpzcsjdk74fbr16iqz7xm10arg8kmcnpv54xxn23h4xbxx6qy5z";
-  sgr-iosevka-fixed-ss01 = "0j7kzcy7rwjqhl9hlhpbm4495b5ifl0kl9jh58nc0r17c3vfhhxq";
-  sgr-iosevka-fixed-ss02 = "1lx6gx2qr82nzphxyd38xj50mrhn9y2c0lq2c1n6iq7zig7yybn6";
-  sgr-iosevka-fixed-ss03 = "0clpiaa12mxksvbyrxahq56nh0dmn3y5x0dclx8clh7v39z652s6";
-  sgr-iosevka-fixed-ss04 = "1lvr6vs6qbmkrgkzw5jvp3a3ib681y9784mwv25il5z7q6imlnng";
-  sgr-iosevka-fixed-ss05 = "0bxqcd18657pvf6j64rhwvgpq6frqdhp65r8rb90bwfv12yqxrw7";
-  sgr-iosevka-fixed-ss06 = "1fz1zvbvkyj04c8qh2xwshcnwswnzldvi6y7c1qzbfm357xsjblg";
-  sgr-iosevka-fixed-ss07 = "01ndbbchf4azc4n8w26snd1l6078zxc8xzxy2vbw7vby3lify2i1";
-  sgr-iosevka-fixed-ss08 = "1rv1rywpk53nf6kyc5wjsjf9j2aj1bzlr4gwk5s6m63klr7q10wx";
-  sgr-iosevka-fixed-ss09 = "10rv346mjg12rihix0rr97vi5y63j4ia0q24rbs0546g4g309k6w";
-  sgr-iosevka-fixed-ss10 = "0ry6abyjaq6dy39mkvzqglzrrpbgwfcq2lxy5j9kncjcwx72mpin";
-  sgr-iosevka-fixed-ss11 = "0nq997c81pxjkgsr1gvkbaapv4qkqpf5w5pixhdkc22g2fp68w6s";
-  sgr-iosevka-fixed-ss12 = "1v7irhjrf31mlj3h0v1bxnl1x187555zdrrv2fhycn7700im5pj2";
-  sgr-iosevka-fixed-ss13 = "17m1fjlvh279wc1n2m7fhmrn3a8b2rqrnj34vps67f1m7bafh1yz";
-  sgr-iosevka-fixed-ss14 = "1sm9z1zad7war4066rj5mdmc0qhl03bjq7wir01na42bw464yz2a";
-  sgr-iosevka-fixed-ss15 = "0xsgjz0225vdzw5b9x8333anmshpva1w5kw7g6m0m2m21n3kvpc8";
-  sgr-iosevka-fixed-ss16 = "1z5h9s9vqmmdjzkv6jzd2rxzkrdbchcbbdxilgvh0nkicpz7h1f6";
-  sgr-iosevka-fixed-ss17 = "06va44pbrbp3yrpb6k58c5vkyrfjbl1sm2jhbpih0vxcpmqa209k";
-  sgr-iosevka-fixed-ss18 = "03plkqbjmpbz200k062s5j9a42717fzi37c6d0jjmhqlyr62j478";
-  sgr-iosevka-slab = "0xf2wzd5679j3csd5br4yfyh1m8vmijf42871szxbq85mw8k1q6f";
-  sgr-iosevka-ss01 = "1v4cifbn4icgsnzvxqyg2sqza5m2378bmcqmw511cbkhrgzr15ff";
-  sgr-iosevka-ss02 = "1d91qzbzlkwj0f9nfd4jvvy2lq0dy70w6dzkgggb75xm6rwn0251";
-  sgr-iosevka-ss03 = "0praj6n5i1ahxnp3zji3jffvvzhpb1382inzihlgrbysjna4cqkv";
-  sgr-iosevka-ss04 = "1lxifnvb61ad8v53cnj4zi4m1jnlh4gk1w6kk5w04yd0z749hyx1";
-  sgr-iosevka-ss05 = "1a446rhyn69ss20ybf9mqy55i4ajq2jpwppmn6srfnrjx63706w6";
-  sgr-iosevka-ss06 = "112k2gyv6r9ircw2rnrgsijw9v1fs64p5737ww6540kg8xrpz1kx";
-  sgr-iosevka-ss07 = "0alc313vgf9649xgynq8h6d006phw9mbijn2m4qjzgjkw4v28xh8";
-  sgr-iosevka-ss08 = "1c1xfj3jryfcgzmqyfmcz7nafhh5jzj7glcdaifviddbbdj5xi88";
-  sgr-iosevka-ss09 = "1fw4qnn22fvz42mfbl1gwr4bwv53xjy0dqd7c6sy7886gxmkr04y";
-  sgr-iosevka-ss10 = "1m62m1xb6xb9vwpgicag8vw817r8qf6gq6mv7kr18fs0mqv4h8sh";
-  sgr-iosevka-ss11 = "0xa5wy6qnk9fgkm3yb0scwkhfxg59hchimzfzrbgvfylsdpq527y";
-  sgr-iosevka-ss12 = "0c49wjypsxjgkm9s1py58lx8rybb3kzm6z3xysvmffqhyx4h03xa";
-  sgr-iosevka-ss13 = "1hr0fbmhjq5ngp4hdm7zjxk3wggbk2yhx50byvbm39056v3pxbym";
-  sgr-iosevka-ss14 = "0ibqdh2ddz9rv8icbfvba6jj5pcpi7l7kjkwsqx0081wqv1c3jxk";
-  sgr-iosevka-ss15 = "004ibn5hrgcby93h2kz248x5qmz4xbirih1k3ic0xqda23yyqq7j";
-  sgr-iosevka-ss16 = "1mad0yiwknl9f7z6c52fv12ngdgwr1yic74ssbzk529vrqmafwy1";
-  sgr-iosevka-ss17 = "1igrbzw63jailzgqlv72h1iv3lz33qd3z9s0hv92w2kh2ig7q6kf";
-  sgr-iosevka-ss18 = "0nsq4hg8mmnzi8dgdn0km03x72ja1vk7g7kbzr7m148kb1p4x5vv";
-  sgr-iosevka-term = "1ax6i21cf4w8gwhml0rwvb3yk9hlhkjfn1pyjyglajnsbh8z4r3w";
-  sgr-iosevka-term-curly = "0y7jkqddqkc2cnmgfsrq29c7id070y8gxj664q81k6alivpj62rs";
-  sgr-iosevka-term-curly-slab = "021m8lmxss1qms0slsc83l78njvnjjyniarrkx95x9vpqs2dym0h";
-  sgr-iosevka-term-slab = "0qkxy91hvxa36bz8q1wwf31qn18b2zvyabkpsjnv6yhpzimz4wm0";
-  sgr-iosevka-term-ss01 = "0sxm07qr1l64n0p5f7dnssgi545i73gdahm18iyvijwqcvxg83rn";
-  sgr-iosevka-term-ss02 = "0zlzvxbf2p27g7p5g19ixa5vf77fxd0b7bqky9pfzf72wpwd89jd";
-  sgr-iosevka-term-ss03 = "09qd2np8z224h2z7yyqfz7csxdbr11kc4v9p8z4qnb8k8wg5akz9";
-  sgr-iosevka-term-ss04 = "0jr5bk9x3nb9841nxlsl3wjwdy5si8g4rwh5axm5g5hwjxr29x8z";
-  sgr-iosevka-term-ss05 = "1w41g52b2b5qzkhai3wk3fvsa5qi8h70wmbq0shq954gqzrlchnp";
-  sgr-iosevka-term-ss06 = "0hmsq5jpnb9605scvh89wqdvyxsypm74aqwz8zsyn7siwfkhh3hc";
-  sgr-iosevka-term-ss07 = "06spijbyw6dzwc73gzi9r14af9g47js0p94ddn54aq3sw2d1c9jq";
-  sgr-iosevka-term-ss08 = "1yrr7lknz0h126gr6srxzfs4npl7vv8v32b2hzkixqzf1pfjv3mr";
-  sgr-iosevka-term-ss09 = "1lf04m0f3l2pw1rm3klfynainxma8fs5x2zv9vgjd1vr07si0c5n";
-  sgr-iosevka-term-ss10 = "1p9p3gpfd353jq1aab5dh16ppzx2qjii8x8hvaqnmhy1a1ip15jg";
-  sgr-iosevka-term-ss11 = "1x1n5fjya6a01m0cwcdcf6xlynzgk2413axkr4p5glmqad7w82h8";
-  sgr-iosevka-term-ss12 = "07bxpw4bsxbwsrjvbw3n6kj1bkvr9a730zp509zjzg72dy6i96ca";
-  sgr-iosevka-term-ss13 = "1mw0nfknzk4qcf9nsg9904389li6sbpvgn48iydrk4bzyr41qza1";
-  sgr-iosevka-term-ss14 = "13pvn4kkl4yz1hkrl04ifqbk9x7lym1i7w3d6nh8l3ch3783sjha";
-  sgr-iosevka-term-ss15 = "1hqrn050qx5iljfbflzpzl4nl21jnnlih53kj9ik3scwb76pkfal";
-  sgr-iosevka-term-ss16 = "1svj0wq7j0kzn4pnyn5lkd5sni3k6vv78r943zc6dlxrs7vbkljp";
-  sgr-iosevka-term-ss17 = "0qmzpxgsibf8c0k6hzq7ps1gd0mb050z3dsjmjjammh0cwflax6p";
-  sgr-iosevka-term-ss18 = "0qss7kz6mwzaxlff4m1lylf0a8sy65l7z6my7k6kif9iiy2595wx";
+  iosevka = "07v98pr0anqbxn1yc55245k5ixxzfk2wmfq67zhz84aa18viqhbc";
+  iosevka-aile = "03y0xijb7c0kampm3gjb69mv8hikhsgqhlw1w3zfcjhr2vc62g6q";
+  iosevka-curly = "1i31zj0j8npgx7wn2qibih48s76qjxakz14sa2hgx908p8xyfwq5";
+  iosevka-curly-slab = "1xijhk5vbgs3c89a7g9cfjqjqv801gimjja4wqpvaficab692jh2";
+  iosevka-etoile = "1rqagk6gyja15fa4m107ylbjwbhn811gbl9lbr9yzashw4drjpp9";
+  iosevka-slab = "063qk1d75l1jq7gdwzqxd7j8j56g7da0aagsqm0lvwl217l7x48b";
+  iosevka-ss01 = "0rjbyfmm46ffslf0glvn5yrsxiaznj3bk53si5jhnipphqw11r9v";
+  iosevka-ss02 = "0sgpaqzcp4zpk96xr2nz04sfg026ph4glkkzky7z1245z12lzdlc";
+  iosevka-ss03 = "01wjv069mmyjw9mk9hkcj4d23f0lgwdy91j21lcja6gybawly5g6";
+  iosevka-ss04 = "0j2qjly3z8vr8z62g2dlj1i6cpx5mlzfvng41x8hxq23j9gfr2y6";
+  iosevka-ss05 = "1aimq0mm749mai3ykh6975ya8ng402ddkzb1hhxz3nnm8v6cwd27";
+  iosevka-ss06 = "1yd882vj4l0qhz67nbba61nyplg9psyr3hnvknvkmr2wnj723dbm";
+  iosevka-ss07 = "09x54z8lzg85akfdc95k6gyka77qgmz3fnhq2ji01apshf8hc751";
+  iosevka-ss08 = "1lmsgcc5q68wm2hs0h35s374bql7rl8r5yp7z17vrjz2qwp3n7b4";
+  iosevka-ss09 = "1p5f2885b18xgxbl63g5zphr2kz52swdpm98d0rcwr60bkqkf79l";
+  iosevka-ss10 = "0kmc0fxyi1imndw88wsdfg6nhvijprrxc2d6nmgvnalnwrx95d33";
+  iosevka-ss11 = "15k64sn23jh2plwwqsvplc04099xv9w16fmmzxzz9vd4js8j4245";
+  iosevka-ss12 = "10y5ll8256h61ycgyjrysfaki9h93va271qgam0b5bjl0v9vhdlk";
+  iosevka-ss13 = "1lv9w2yiqy09sggbzd17vx8nn8vh1qv7yn9rsnwcq95xqd4dpw60";
+  iosevka-ss14 = "1pb53ahx5jig7a6yjb4kwpcgbpdbxans25p3amiswy7xyklhw3la";
+  iosevka-ss15 = "1jax0zx17k8mzp7489fd1bprvh79ww4ghcy6vhih2nbg18kzxsqc";
+  iosevka-ss16 = "0s3xq3ijrd8b51myh779hf5cvwvxvxz8xx9gxksnbzh1pml9zz1a";
+  iosevka-ss17 = "1mnw0lh65yj936p3shsayq6k31s708cqb60qys82hcwas5bacidr";
+  iosevka-ss18 = "1jyywvp9j6rj21v99psbwsr8xrfzfvq76z54hw0acb3j5mhl7s4r";
+  sgr-iosevka = "1p2n8q6nj9f8nibb7zzy60ck0sp2cg6lz1z3inizs5i9lpnr8mx3";
+  sgr-iosevka-aile = "1nxysymkc273cmk00b44bky63lm73dl3p9yai8lcn14lv1apdjg6";
+  sgr-iosevka-curly = "0bwlalijphm1aykv8j652lp9p1xl4jj4gmc26ag8s13gmbx6gxhy";
+  sgr-iosevka-curly-slab = "11d3biggpk6r0pa7k7ig8sgxmjw80b723ass3pqxns13y3krm8il";
+  sgr-iosevka-etoile = "0lspbn81bajdc905wafqmfp8cjlw6q6xlvry1alq7y7ng19vm5dh";
+  sgr-iosevka-fixed = "1zzqi09pafma9fj9603ixhygwa2aayzk27xda2yzhixiw11wxz33";
+  sgr-iosevka-fixed-curly = "1j07rqa1495dr0s2ppcypycclmzgpbpl0yibkd7f1mlzl629gk38";
+  sgr-iosevka-fixed-curly-slab = "1wlq2qdl3nx8q6a39dc3sv6h2gr8v3bhswgvgavbr7m2q6jcss8g";
+  sgr-iosevka-fixed-slab = "1m20f9zc4q2rv16yl5pfvx4l2031783ixv4k6vhnzwqkvqqrk9dg";
+  sgr-iosevka-fixed-ss01 = "1c7ldr1h2bgl6w8ggwbsifad7n3mincwplfiam4w4n56xkn19qdx";
+  sgr-iosevka-fixed-ss02 = "1hck8rcja59c0jgl62dk9i5xrixxihd3mzcma6yqqsxadgvf6cc5";
+  sgr-iosevka-fixed-ss03 = "1qck9qdanfwl1jgbjmyzvv52dgxa46gw9h6ygn3pp34pgbgj6lnd";
+  sgr-iosevka-fixed-ss04 = "1d3gv5zcs66qjazxwig2kw6nlwqzvn3pmnpbwif65xd5hlqs1m3c";
+  sgr-iosevka-fixed-ss05 = "1l335c8fnh3ijhx7bl2wpa8k1vnjskhrlhcg7k04z9jhjcyagr9f";
+  sgr-iosevka-fixed-ss06 = "06zm8yr6n17b6vmic9ngv3iv7jvnps0bazvdi8y38r371gwp4af9";
+  sgr-iosevka-fixed-ss07 = "0ambs05hjxvx6v905wzqk8wjl8a8yrd216fm8sy23wr8vkm7zrca";
+  sgr-iosevka-fixed-ss08 = "10zgxj5p50hzbczh33mq1qw708srwcwp615ajfmmx0b86qgxmfqw";
+  sgr-iosevka-fixed-ss09 = "1k0hd06lislhzvgd5vz7sra9pbwnl7nv0cxzmxglmlskafcls7zb";
+  sgr-iosevka-fixed-ss10 = "0bgkfk31fd60w7x1nzy6x3p7gi2d72z7cf8f5av54rnamw4a4hnq";
+  sgr-iosevka-fixed-ss11 = "0vsv9plkcmynrj6s75kbb57kkfpxay4k90nlimgb3s1z7d17az0a";
+  sgr-iosevka-fixed-ss12 = "040bpjhgjii0s19ilfrvg1261ssk4n9xyynw61cbn65rh2dpfdcl";
+  sgr-iosevka-fixed-ss13 = "0bmmfpynl5j74i71b0cyi9vyrrb6d5axz3frsg48q8pwqac2vkx7";
+  sgr-iosevka-fixed-ss14 = "1bqfbv4rcvcpbrzsg2zpk870yq2a6j7ishsgc6p9xsqfblnw1p6a";
+  sgr-iosevka-fixed-ss15 = "1rhks1drqs0yx2sbcdqyq9lvxrh11adqisw7pxncgm6flcgkhx29";
+  sgr-iosevka-fixed-ss16 = "14kkdvmj2gpyxs5dcbfyghidbqaz147r114xi42yhl4fpsdppkrk";
+  sgr-iosevka-fixed-ss17 = "0csd2ag4h8cdngscbmhj5kh1rlj022pmg8ig758hxp25ddmb2h8l";
+  sgr-iosevka-fixed-ss18 = "0hpkzzx35a1nmspb2k7gg5z9kp00i4hd4k1nni4jg661mgvilldp";
+  sgr-iosevka-slab = "1y8csc7kgm2xipa6s2jy0ibgb4j9pj6wxpjlxyad3ssbsqf5yfvc";
+  sgr-iosevka-ss01 = "0hq5s1ajqfmq6y3l189h2xjkawayq10sjwpcmzkbf4565qifinm6";
+  sgr-iosevka-ss02 = "0921izv9x38zziw8vfha4aqvvdb5g926gycg6rl2rxfymjsg2f1m";
+  sgr-iosevka-ss03 = "0c9sfswgf4rgmwbsm4wwyfaqk7brp0dmw76krzylbppcyzsczjbr";
+  sgr-iosevka-ss04 = "0ic7g811156cwkrsizjd5f051k964lpr216nrd15ap06viar4vk4";
+  sgr-iosevka-ss05 = "0hxpi57xzxw03qr9ss2mrpl4p479v14c15y9iqjflb478qdicxg0";
+  sgr-iosevka-ss06 = "04ny0vyr0sayfymaxgsqfnvqsx1afsh9fjdpcfna5vpl661ljnsf";
+  sgr-iosevka-ss07 = "10s8vhcikk6xrvyjmzjq7k4b81cf9i71c6dhsrnwxvn732dx5awl";
+  sgr-iosevka-ss08 = "0ji3gsf26xji6qfx99azhxj816q7bhpzqdxh43ncs86snl86g9xf";
+  sgr-iosevka-ss09 = "0c1n399v3vf68q165mn26qc0cnbi5yfvvkxwxp1inl7vdsgzhslw";
+  sgr-iosevka-ss10 = "07g2zbpgd8zbb2zyqk9kfb9s1hd94wmx1ijaf9fh6c6sby2wgssk";
+  sgr-iosevka-ss11 = "0kfiln8w5gim2swyk80k2bnvnyr853imgp91z2v330hdllca99ra";
+  sgr-iosevka-ss12 = "01kljfahn4ljss2rd66srp2lwj94fvkigpzk315zd21qxyy4wfl2";
+  sgr-iosevka-ss13 = "0bgxfrpfn4yh6852155qj0j7zfsrf14rg4gc3ffidmszhindllcc";
+  sgr-iosevka-ss14 = "04qldb75h61wca2pzkmks3amcq6q3n0dhjva0b5v1dg0y6qzs2c9";
+  sgr-iosevka-ss15 = "1344wgx2nx1a7aphi06xkl6niij5cqlnnydbb6la0k75invyz2i6";
+  sgr-iosevka-ss16 = "1apkrdmhz69vdbjhr88288qyqz4pfya11fj4gpxkb3hk01dbkwzs";
+  sgr-iosevka-ss17 = "0mba09669408icz6p944pivfb0m99pirapmml1d1glni0xj4mndd";
+  sgr-iosevka-ss18 = "0j463s8is0w0rvgqn63mxhf3wcx0r5a7q4zs6621f3xigqvbhkdm";
+  sgr-iosevka-term = "034p2llrz2ffm5aslxg1ah8l0bj6kr9lx53yi1hg61cnx18z3yx0";
+  sgr-iosevka-term-curly = "0zixih0y7ksav7qxswysijfdnnj1jjb74znz0bkb0f7cviaa6w2i";
+  sgr-iosevka-term-curly-slab = "1vsz17s0yp3v01054342plc62pag3mx7xs5jb8llx729zc5qzpd7";
+  sgr-iosevka-term-slab = "04bsgvzyjy2d0jndzxb2d0pv6sfr9gm3ryv94va65rxv3fc0mj73";
+  sgr-iosevka-term-ss01 = "12hfzalx076gh9kskfxvgr9b3w8i3kk2lhbcsj417vsn5nx48grq";
+  sgr-iosevka-term-ss02 = "15chkrw65nyfl9vd23y12cqvsn4sddrnf3zmxy0jval5paz8hnx3";
+  sgr-iosevka-term-ss03 = "0ivxs8pdpbx1lcmfm1r6qkvzsx82swwi7xn4ja92rh8zix9i78bv";
+  sgr-iosevka-term-ss04 = "08zfbmq6cvc7jzkindyvx7mlfvyhhicdxqm4pyblgb9xfh6vvk0k";
+  sgr-iosevka-term-ss05 = "0c8mbjbkw6a5hpxshr20qsrwp0chwnxxijm3sqaf28hg2ka79qhg";
+  sgr-iosevka-term-ss06 = "1ymdi01cl9v86qlcl0ka9v1p9ry129wqjmsjy1i60ld579yy8x05";
+  sgr-iosevka-term-ss07 = "09qqjmn7iaykl08pdd4qj57z12npap246y8c0kp3rvwjdyh3p7y1";
+  sgr-iosevka-term-ss08 = "10qca50vbwb5fa509jrb3w63dxk6ny7i7ffdmyiz1slv418jjjha";
+  sgr-iosevka-term-ss09 = "0chhlxql7j1b0nfa6pnw3dfrjv6wij8wsl0i2xf5ar52rgzr2s95";
+  sgr-iosevka-term-ss10 = "1z6za3sdaf793vma9d70a38rlb47nzqj08pnp6jqir2fifdsvzl1";
+  sgr-iosevka-term-ss11 = "1midlf29xqli721gv195gy6mjmp9w8nq8kc1ly2d62spq3lhqmqw";
+  sgr-iosevka-term-ss12 = "0bagnqg4r0a76p32d3yg8j6raxwzc7wbhx5kv7habpbinhq96ink";
+  sgr-iosevka-term-ss13 = "0wj3gx4h4r99whfsnqja8j3a737b8firn5sga6320qm33szzgh69";
+  sgr-iosevka-term-ss14 = "0zsmy58w23355laqjs9xh76i4bz80yha65yaj44ssrsz1h0f9bpn";
+  sgr-iosevka-term-ss15 = "1yp9kywi00lykwj2wwvwvw4qblaw1549lj0ahrhrhljnijjc1zmb";
+  sgr-iosevka-term-ss16 = "12c8i4gwshxj3mnzz7ycprwlmc5nhfc9dvg1wwcvc59xvdphpgzc";
+  sgr-iosevka-term-ss17 = "0fiji4hbb9cbssx3whvjhsvm7zi1chrnrp46q01627z4nzw2s5a7";
+  sgr-iosevka-term-ss18 = "0hmdpzffywgdls5qy38sq04jfsx9ym56lypb6fiwjvppgn8vkcgl";
 }
diff --git a/pkgs/data/fonts/lexend/default.nix b/pkgs/data/fonts/lexend/default.nix
index 3efb1886b1717..9bb00bf105955 100644
--- a/pkgs/data/fonts/lexend/default.nix
+++ b/pkgs/data/fonts/lexend/default.nix
@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lexend";
-  version = "0.pre+date=2022-01-27";
+  version = "0.pre+date=2022-09-22";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = pname;
-    rev = "57e6c14e2a9b457e8376044a31525c2100297e9c";
-    sha256 = "sha256-+tPggQIO50a8kOSnOVN/MR9ZwX5xZqYVNZO79eog9QA=";
+    rev = "cd26b9c2538d758138c20c3d2f10362ed613854b";
+    sha256 = "ZKogntyJ/44GBZmFwbtw5Ujw5Gnvv0tVB59ciKqR4c8=";
   };
 
   installPhase = ''
@@ -19,8 +19,8 @@ stdenvNoCC.mkDerivation rec {
 
     cd fonts
     for f in *; do
-      mkdir -p $out/share/fonts/truetype/lexend/$f
-      install $f/ttf/* $out/share/fonts/truetype/lexend/$f/
+      install -D -t $out/share/fonts/truetype/lexend/$f $f/ttf/*
+      install -D -t $out/share/fonts/variable/lexend/$f $f/variable/*
     done
 
     runHook postInstall
diff --git a/pkgs/data/fonts/material-design-icons/default.nix b/pkgs/data/fonts/material-design-icons/default.nix
index 80c887f58913b..82f422146ac7d 100644
--- a/pkgs/data/fonts/material-design-icons/default.nix
+++ b/pkgs/data/fonts/material-design-icons/default.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:
 
 let
-  version = "6.6.96";
+  version = "7.0.96";
 in fetchFromGitHub {
   name = "material-design-icons-${version}";
   owner  = "Templarian";
@@ -9,17 +9,19 @@ in fetchFromGitHub {
   rev    = "v${version}";
 
   postFetch = ''
-    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/{eot,truetype,woff,woff2}
-    cp fonts/*.eot $out/share/fonts/eot/
-    cp fonts/*.ttf $out/share/fonts/truetype/
-    cp fonts/*.woff $out/share/fonts/woff/
-    cp fonts/*.woff2 $out/share/fonts/woff2/
+    mv $out/fonts/*.eot $out/share/fonts/eot/
+    mv $out/fonts/*.ttf $out/share/fonts/truetype/
+    mv $out/fonts/*.woff $out/share/fonts/woff/
+    mv $out/fonts/*.woff2 $out/share/fonts/woff2/
+    shopt -s extglob dotglob
+    rm -rf $out/!(share)
+    shopt -u extglob dotglob
   '';
-  sha256 = "sha256-rfDb9meTF0Y0kiCQd11SgnntQnw34Ti/IXn35xaPO1M=";
+  sha256 = "sha256-l60LRXLwLh+7Ls3kMTJ5eDTVpVMcqtshMv/ehIk8fCk=";
 
   meta = with lib; {
-    description = "4600+ Material Design Icons from the Community";
+    description = "7000+ Material Design Icons from the Community";
     longDescription = ''
       Material Design Icons' growing icon collection allows designers and
       developers targeting various platforms to download icons in the format,
diff --git a/pkgs/data/icons/simp1e-cursors/default.nix b/pkgs/data/icons/simp1e-cursors/default.nix
new file mode 100644
index 0000000000000..962f4ea2618ab
--- /dev/null
+++ b/pkgs/data/icons/simp1e-cursors/default.nix
@@ -0,0 +1,42 @@
+{ lib, stdenvNoCC, fetchFromGitLab, python3, librsvg, xcursorgen }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "simp1e-cursors";
+  version = "20221103.2";
+
+  src = fetchFromGitLab {
+    owner = "cursors";
+    repo = "simp1e";
+    rev = version;
+    sha256 = "sha256-3DCF6TwxWwYK5pF2Ykr3OwF76H7J03vLNZch/XoZZZk=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    (python3.withPackages (ps: with ps; [ pillow ]))
+    librsvg
+    xcursorgen
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs ./build.sh ./cursor-generator
+    HOME=$TMP ./build.sh
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -dm 755 $out/share/icons
+    cp -r built_themes/* $out/share/icons/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An aesthetic cursor theme for Linux desktops";
+    homepage = "https://gitlab.com/cursors/simp1e";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ natto1784 ];
+  };
+}
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index 19331f458def2..a5c5fd88a0a23 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20220915";
+  version = "20221107";
 
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-gBaM5YEK2XA42S7ELwjQChie/wYgo6n8dt2WEg3Pdns=";
+    sha256 = "sha256-vucC9MfpCCPyST21n09QDrj3z3MzKdBGo/ONUQvuxxQ=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index a92bfec486c13..bbd994d61363c 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202211240054";
+  version = "202212010055";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "1887d855ed4b4b92999d3afecf71f43358029369";
-    sha256 = "sha256-WozqLA/akUF7T0LyR/nQkTxuZPNCpYarOQG5zQwGAMk=";
+    rev = "350625ecfeec1300d541cc618fddb1922d5d2365";
+    sha256 = "sha256-EnqINoG6nB1m1K7mp0UBW3K2MDuaE7Z84wfCJBFwweU=";
   };
 
   installPhase = ''
diff --git a/pkgs/desktops/cinnamon/mint-artwork/default.nix b/pkgs/desktops/cinnamon/mint-artwork/default.nix
index fab1c48578fba..490c4fa068f32 100644
--- a/pkgs/desktops/cinnamon/mint-artwork/default.nix
+++ b/pkgs/desktops/cinnamon/mint-artwork/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mint-artwork";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchurl {
     urls = [
       "http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
-      "https://web.archive.org/web/20221203023403/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
+      "https://web.archive.org/web/20221206154838/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
     ];
-    hash = "sha256-I8gLWwwuXZkgc5zZ9QVkSarugcNWLFIz2mU1d4QqJRU=";
+    hash = "sha256-lusYlmTL71VTGSJFssuIZVu7xJMuZQ7wj2rMtO1lhZ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
index 9682f17a8162d..b967341c468c2 100644
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-camera";
-  version = "6.2.0";
+  version = "6.2.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "camera";
     rev = version;
-    sha256 = "sha256-866Iky0GKQv2yUJVNY1McgXGeup5WqONN3gvoOlilGU=";
+    sha256 = "sha256-ijzEMGXoH0gACem/3JaC/aOIaOQgP7Y7n48NgoDMKBk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index 2d5619620417a..5c04ca4a50ffa 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -49,17 +49,18 @@ let
   # targetInfo.triple is what Google thinks the toolchain should be, this is a little
   # different from what we use. We make it four parts to conform with the existing
   # standard more properly.
-  targetConfig = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config);
+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config + "-");
 in
 
 rec {
   # Misc tools
   binaries = stdenv.mkDerivation {
-    pname = "${targetConfig}-ndk-toolchain";
+    pname = "${targetPrefix}ndk-toolchain";
     inherit (androidndk) version;
     nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
     propagatedBuildInputs = [ androidndk ];
     passthru = {
+      inherit targetPrefix;
       isClang = true; # clang based cc, but bintools ld
     };
     dontUnpack = true;
@@ -91,23 +92,23 @@ rec {
       ln -s $out/toolchain/bin $out/bin
       ln -s $out/toolchain/${targetInfo.triple}/bin/* $out/bin/
       for f in $out/bin/${targetInfo.triple}-*; do
-        ln -s $f ''${f/${targetInfo.triple}-/${targetConfig}-}
+        ln -s $f ''${f/${targetInfo.triple}-/${targetPrefix}}
       done
       for f in $(find $out/toolchain -type d -name ${targetInfo.triple}); do
-        ln -s $f ''${f/${targetInfo.triple}/${targetConfig}}
+        ln -s $f ''${f/${targetInfo.triple}/${targetPrefix}}
       done
 
-      rm -f $out/bin/${targetConfig}-ld
-      ln -s $out/bin/lld $out/bin/${targetConfig}-ld
+      rm -f $out/bin/${targetPrefix}ld
+      ln -s $out/bin/lld $out/bin/${targetPrefix}ld
 
       (cd $out/bin;
         for tool in llvm-*; do
-          ln -sf $tool ${targetConfig}-$(echo $tool | sed 's/llvm-//')
+          ln -sf $tool ${targetPrefix}$(echo $tool | sed 's/llvm-//')
           ln -sf $tool $(echo $tool | sed 's/llvm-//')
         done)
 
       # handle last, as llvm-as is for llvm bytecode
-      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetConfig}-as
+      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetPrefix}as
       ln -sf $out/bin/${targetInfo.triple}-as $out/bin/as
 
       patchShebangs $out/bin
@@ -131,7 +132,7 @@ rec {
       # Android needs executables linked with -pie since version 5.0
       # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
       echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
-      echo "-z,noexecstack -z,relro -z,now" >> $out/nix-support/cc-ldflags
+      echo "-z,noexecstack -z,relro -z,now -z,muldefs" >> $out/nix-support/cc-ldflags
       echo 'if [[ ! " $@ " =~ " -shared " ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
       echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
       if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
diff --git a/pkgs/development/compilers/chicken/4/chicken.nix b/pkgs/development/compilers/chicken/4/chicken.nix
index 47625a4d5de96..f33e594b7e250 100644
--- a/pkgs/development/compilers/chicken/4/chicken.nix
+++ b/pkgs/development/compilers/chicken/4/chicken.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
   ] ++ (lib.optionals stdenv.isDarwin [
     "XCODE_TOOL_PATH=${darwin.binutils.bintools}/bin"
     "C_COMPILER=$(CC)"
+    "POSTINSTALL_PROGRAM=install_name_tool"
   ]);
 
   # We need a bootstrap-chicken to regenerate the c-files after
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 220339c29595d..de764b9ccc7c2 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -47,13 +47,7 @@ with lib;
 with builtins;
 
 let majorVersion = "11";
-    # The patch below for aarch64-darwin does not apply to 11.3.0 and an
-    # updated version is not available. Keep aarch64-darwin on 11.2.0 so the
-    # large body of packages which depend on gfortran are still functional
-    # until GCC 12 is the default.
-    # On x86_64-darwin, building libgcc suffers from some different issues with 11.3.0.
-    version = if stdenv.isDarwin then
-      "${majorVersion}.2.0" else "${majorVersion}.3.0";
+    version = "${majorVersion}.3.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
@@ -70,10 +64,14 @@ let majorVersion = "11";
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
 
-      ++ optional (stdenv.isDarwin && stdenv.isAarch64) (fetchpatch {
-        url = "https://github.com/fxcoudert/gcc/compare/releases/gcc-11.2.0...gcc-11.2.0-arm-20211201.diff";
-        sha256 = "sha256-z62s/cXuH9Kgq/oD/OiiZ8LWnX1xl1D43sONnwaEW1w=";
-      })
+      ++ optionals stdenv.isDarwin [
+        (fetchpatch {
+          # There are no upstream release tags in https://github.com/iains/gcc-11-branch.
+          # 2d280e7 is the commit from https://github.com/gcc-mirror/gcc/releases/tag/releases%2Fgcc-11.3.0
+          url = "https://github.com/iains/gcc-11-branch/compare/2d280e7eafc086e9df85f50ed1a6526d6a3a204d..gcc-11.3-darwin-r2.diff";
+          sha256 = "sha256-LFAXUEoYD7YeCG8V9mWanygyQOI7U5OhCRIKOVCCDAg=";
+        })
+      ]
 
       # Obtain latest patch with ../update-mcfgthread-patches.sh
       ++ optional (!crossStageStatic && targetPlatform.isMinGW && threadsCross.model == "mcf") ./Added-mcf-thread-model-support-from-mcfgthread.patch;
@@ -93,9 +91,7 @@ stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = if stdenv.isDarwin
-      then "sha256-0I7cU2tUw3KhAQ/2YZ3SdMDxYDqkkhK6IPeqLNo2+os="
-      else "sha256-tHzygYaR9bHiHfK7OMeV+sLPvWQO3i0KXhyJ4zijrDk=";
+    sha256 = "sha256-tHzygYaR9bHiHfK7OMeV+sLPvWQO3i0KXhyJ4zijrDk=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index dddf7a2b63d5b..d93f647f84629 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , bison
 , cmake
 , jq
@@ -26,6 +27,20 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake python3 bison jq ];
 
+  patches = [
+    # https://github.com/NixOS/nixpkgs/pull/201747
+    (fetchpatch {
+      name = "Fix-locations-of-cmake-files-in-side-compat-shims.patch";
+      url = "https://github.com/KhronosGroup/glslang/commit/88fd417b0bb7d91755961c70e846d274c182f2b0.patch";
+      hash = "sha256-rjeaPX5Ieem6zkICNvPd2SjvvLzG5wBERZfDLZEJsAk=";
+    })
+    (fetchpatch {
+      name = "Use-CMAKE_INSTALL_FULL_LIBDIR-in-compat-cmake-files.patch";
+      url = "https://github.com/KhronosGroup/glslang/commit/7627bd89583c5aafb8b38c81c15494019271fabf.patch";
+      hash = "sha256-1Dwhn78PG4gAGgEwTXpC+mkZRyvy8sTIsEvihXFeNaQ=";
+    })
+  ];
+
   postPatch = ''
     cp --no-preserve=mode -r "${spirv-tools.src}" External/spirv-tools
     ln -s "${spirv-headers.src}" External/spirv-tools/external/spirv-headers
diff --git a/pkgs/development/compilers/jetbrains-jdk/default.nix b/pkgs/development/compilers/jetbrains-jdk/default.nix
index 8f7896aa6bfa1..2a436dda06af6 100644
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@@ -7,16 +7,13 @@
 
 openjdk17.overrideAttrs (oldAttrs: rec {
   pname = "jetbrains-jdk";
-  version = "17.0.3-b469.37";
+  version = "17.0.5-b653.14";
 
   src = fetchFromGitHub {
     owner = "JetBrains";
     repo = "JetBrainsRuntime";
     rev = "jb${version}";
-    hash =
-     # Upstream issue: https://github.com/JetBrains/JetBrainsRuntime/issues/163
-     if stdenv.isDarwin then "sha256-ExRvjs53rIuhUx4oCgAqu1Av3CNAgmE1ZlN0srEh3XM="
-     else "sha256-O+OIDRJcIsb/vhO2+SYuYdUYWYTGkBcQ9cHTExLIFDE=";
+    hash = "sha256-7Nx7Y12oMfs4zeQMSfnUaDCW1xJYMEkcoTapSpmVCfU=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/compilers/julia/1.8.nix b/pkgs/development/compilers/julia/1.8.nix
index f8b0daa1ace73..1c614103bdece 100644
--- a/pkgs/development/compilers/julia/1.8.nix
+++ b/pkgs/development/compilers/julia/1.8.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , which
 , python3
 , gfortran
@@ -40,6 +41,15 @@ stdenv.mkDerivation rec {
       path = name: "https://raw.githubusercontent.com/archlinux/svntogit-community/6fd126d089d44fdc875c363488a7c7435a223cec/trunk/${name}";
     in
     [
+      # Pull upstream fix to fix tests mpfr-4.1.1
+      #   https://github.com/JuliaLang/julia/pull/47659
+      (fetchpatch {
+        name = "mfr-4.1.1.patch";
+        url = "https://github.com/JuliaLang/julia/commit/59965205ccbdffb4e25e1b60f651ca9df79230a4.patch";
+        hash = "sha256-QJ5wxZMhz+or8BqcYv/5fNSTxDAvdSizTYqt7630kcw=";
+        includes = [ "stdlib/MPFR_jll/test/runtests.jl" ];
+      })
+
       (fetchurl {
         url = path "julia-hardcoded-libs.patch";
         sha256 = "sha256-kppSpVA7bRohd0wXDs4Jgct9ocHnpbeiiSz7ElFom1U=";
diff --git a/pkgs/development/compilers/llvm/10/clang/default.nix b/pkgs/development/compilers/llvm/10/clang/default.nix
index 083ab65238b4c..0f3c943b527ea 100644
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -84,6 +84,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/10/libcxx/default.nix b/pkgs/development/compilers/llvm/10/libcxx/default.nix
index 6a4e645bb3004..0c0f535f7433e 100644
--- a/pkgs/development/compilers/llvm/10/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxx/default.nix
@@ -51,6 +51,20 @@ stdenv.mkDerivation {
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
     ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
 
+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
index b046e627d8313..d62422fc9a12a 100644
--- a/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxxabi/default.nix
@@ -42,8 +42,10 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -54,7 +56,7 @@ stdenv.mkDerivation {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index 2e7465698c186..fa8080c998fb8 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -89,6 +89,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/11/libcxx/default.nix b/pkgs/development/compilers/llvm/11/libcxx/default.nix
index 2a83b36fc4252..237bbd4e06101 100644
--- a/pkgs/development/compilers/llvm/11/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxx/default.nix
@@ -67,6 +67,20 @@ stdenv.mkDerivation {
       stdenv.hostPlatform != stdenv.buildPlatform
     ) "-DCMAKE_SYSTEM_VERSION=20.1.0";
 
+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
index 6b5cf85d1ec37..ed0efe28a170e 100644
--- a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
@@ -46,8 +46,10 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -58,7 +60,7 @@ stdenv.mkDerivation {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index 5329f0d4b659a..ed99f4fe7bc90 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -83,6 +83,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/12/libcxx/default.nix b/pkgs/development/compilers/llvm/12/libcxx/default.nix
index 1386d3680f916..ef90eedb38c98 100644
--- a/pkgs/development/compilers/llvm/12/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxx/default.nix
@@ -42,6 +42,20 @@ stdenv.mkDerivation {
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
     ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
 
+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
index 3d9a92d9305d3..41c559a52ee8e 100644
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@@ -44,8 +44,10 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -56,7 +58,7 @@ stdenv.mkDerivation {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index ec38f6d8873b5..056a1b7e0f0db 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -77,6 +77,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/13/libcxx/default.nix b/pkgs/development/compilers/llvm/13/libcxx/default.nix
index 0ce73ed97af6c..f6b76901de3fe 100644
--- a/pkgs/development/compilers/llvm/13/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxx/default.nix
@@ -46,6 +46,20 @@ stdenv.mkDerivation rec {
   buildFlags = lib.optional headersOnly "generate-cxx-headers";
   installTargets = lib.optional headersOnly "install-cxx-headers";
 
+  preInstall = lib.optionalString (stdenv.isDarwin && !headersOnly) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   # At this point, cxxabi headers would be installed in the dev output, which
   # prevents moveToOutput from doing its job later in the build process.
   postInstall = lib.optionalString (!headersOnly) ''
diff --git a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
index 9043c6bff25b8..bced2ccb789f3 100644
--- a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
@@ -41,8 +41,10 @@ stdenv.mkDerivation rec {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -53,7 +55,7 @@ stdenv.mkDerivation rec {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/14/clang/default.nix b/pkgs/development/compilers/llvm/14/clang/default.nix
index 38cd0c21eff5d..55d879fb76e4c 100644
--- a/pkgs/development/compilers/llvm/14/clang/default.nix
+++ b/pkgs/development/compilers/llvm/14/clang/default.nix
@@ -80,6 +80,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/14/libcxx/default.nix b/pkgs/development/compilers/llvm/14/libcxx/default.nix
index 0a684782d490a..c623d41f92f61 100644
--- a/pkgs/development/compilers/llvm/14/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxx/default.nix
@@ -62,6 +62,20 @@ stdenv.mkDerivation rec {
   buildFlags = lib.optional headersOnly "generate-cxx-headers";
   installTargets = lib.optional headersOnly "install-cxx-headers";
 
+  preInstall = lib.optionalString (stdenv.isDarwin && !headersOnly) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
index 26f4c4dba8e42..3be2f964abcd2 100644
--- a/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/14/libcxxabi/default.nix
@@ -52,8 +52,10 @@ stdenv.mkDerivation rec {
   installPhase = if stdenv.isDarwin
     then ''
       for file in lib/*.dylib; do
+        if [ -L "$file" ]; then continue; fi
+
         # Fix up the install name. Preserve the basename, just replace the path.
-        installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+        installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
         # this should be done in CMake, but having trouble figuring out
         # the magic combination of necessary CMake variables
@@ -64,7 +66,7 @@ stdenv.mkDerivation rec {
         # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
         # libcxxabi to sometimes link against a different version of itself.
         # Here we simply make that second reference point to ourselves.
-        for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
           ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
         done
       done
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index f1b872c190f43..57d6fe6ae7f88 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -77,6 +77,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/5/libcxx/default.nix b/pkgs/development/compilers/llvm/5/libcxx/default.nix
index 44026fba187b7..a5a86fcab4d06 100644
--- a/pkgs/development/compilers/llvm/5/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/5/libcxx/default.nix
@@ -41,6 +41,20 @@ stdenv.mkDerivation {
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1";
 
+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
index 925c8947ccf51..97077ac771125 100644
--- a/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/5/libcxxabi/default.nix
@@ -27,8 +27,10 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -39,7 +41,7 @@ stdenv.mkDerivation {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/6/clang/default.nix b/pkgs/development/compilers/llvm/6/clang/default.nix
index 788fa1fa6e50c..1b37efe3f08ee 100644
--- a/pkgs/development/compilers/llvm/6/clang/default.nix
+++ b/pkgs/development/compilers/llvm/6/clang/default.nix
@@ -77,6 +77,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/6/libcxx/default.nix b/pkgs/development/compilers/llvm/6/libcxx/default.nix
index 7077081c59173..a6e723753ef8c 100644
--- a/pkgs/development/compilers/llvm/6/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/6/libcxx/default.nix
@@ -47,6 +47,20 @@ stdenv.mkDerivation {
     "-DLIBCXX_CXX_ABI=libcxxabi"
   ] ++ lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1";
 
+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/6/libcxxabi/default.nix b/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
index 3371a8ba1a158..aea126b31d9f3 100644
--- a/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/6/libcxxabi/default.nix
@@ -27,8 +27,10 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -39,7 +41,7 @@ stdenv.mkDerivation {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index 13563c43662a8..d146e5b5f8156 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -89,6 +89,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/7/libcxx/default.nix b/pkgs/development/compilers/llvm/7/libcxx/default.nix
index 07d84432d4220..145f0df8837c7 100644
--- a/pkgs/development/compilers/llvm/7/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/7/libcxx/default.nix
@@ -52,6 +52,20 @@ stdenv.mkDerivation {
     ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
     ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF" ;
 
+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/7/libcxxabi/default.nix b/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
index 8be9690f5f40a..d6f90634cd0b6 100644
--- a/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/7/libcxxabi/default.nix
@@ -46,8 +46,10 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -58,7 +60,7 @@ stdenv.mkDerivation {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index 8ecb7fef80da6..bc2ed03eed90a 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -95,6 +95,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/8/libcxx/default.nix b/pkgs/development/compilers/llvm/8/libcxx/default.nix
index 5368011292186..4a078ac9cda3c 100644
--- a/pkgs/development/compilers/llvm/8/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxx/default.nix
@@ -55,6 +55,20 @@ stdenv.mkDerivation {
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
     ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
 
+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
index 6b4de0786b984..ab2d46f40a479 100644
--- a/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxxabi/default.nix
@@ -42,8 +42,10 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -54,7 +56,7 @@ stdenv.mkDerivation {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index 42103aee15bda..7819676e33a8b 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -90,6 +90,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/9/libcxx/default.nix b/pkgs/development/compilers/llvm/9/libcxx/default.nix
index 31a00ba548591..65441c359d609 100644
--- a/pkgs/development/compilers/llvm/9/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxx/default.nix
@@ -51,6 +51,20 @@ stdenv.mkDerivation {
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
     ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
 
+  preInstall = lib.optionalString (stdenv.isDarwin) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
index b7c0c2b0475ae..cfd1c32abd00e 100644
--- a/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxxabi/default.nix
@@ -42,8 +42,10 @@ stdenv.mkDerivation {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -54,7 +56,7 @@ stdenv.mkDerivation {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index 129f8e930ed20..8f2663b7e896c 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -81,6 +81,7 @@ let
       fi
       mv $out/share/clang/*.py $python/share/clang
       rm $out/bin/c-index-test
+      patchShebangs $python/bin
 
       mkdir -p $dev/bin
       cp bin/clang-tblgen $dev/bin
diff --git a/pkgs/development/compilers/llvm/git/libcxx/default.nix b/pkgs/development/compilers/llvm/git/libcxx/default.nix
index 5e1f875bf338f..95e32041037a4 100644
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@@ -76,6 +76,20 @@ stdenv.mkDerivation rec {
   buildFlags = lib.optional headersOnly "generate-cxx-headers";
   installTargets = lib.optional headersOnly "install-cxx-headers";
 
+  preInstall = lib.optionalString (stdenv.isDarwin && !headersOnly) ''
+    for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
+      baseName=$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))
+      installName="$out/lib/$baseName"
+      abiName=$(echo "$baseName" | sed -e 's/libc++/libc++abi/')
+
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+        ${stdenv.cc.targetPrefix}install_name_tool -change $other ${libcxxabi}/lib/$abiName $file
+      done
+    done
+  '';
+
   passthru = {
     isLLVM = true;
   };
diff --git a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
index 42a811e131b88..804acd6c7451c 100644
--- a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
@@ -70,8 +70,10 @@ stdenv.mkDerivation rec {
 
   preInstall = lib.optionalString stdenv.isDarwin ''
     for file in lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+
       # Fix up the install name. Preserve the basename, just replace the path.
-      installName="$out/lib/$(basename $(otool -D $file | tail -n 1))"
+      installName="$out/lib/$(basename $(${stdenv.cc.targetPrefix}otool -D $file | tail -n 1))"
 
       # this should be done in CMake, but having trouble figuring out
       # the magic combination of necessary CMake variables
@@ -82,7 +84,7 @@ stdenv.mkDerivation rec {
       # cc-wrapper passes '-lc++abi' to all c++ link steps, but that causes
       # libcxxabi to sometimes link against a different version of itself.
       # Here we simply make that second reference point to ourselves.
-      for other in $(otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
+      for other in $(${stdenv.cc.targetPrefix}otool -L $file | awk '$1 ~ "/libc\\+\\+abi" { print $1 }'); do
         ${stdenv.cc.targetPrefix}install_name_tool -change $other $installName $file
       done
     done
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 95abb373272c5..820469ab8f156 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/12.nix b/pkgs/development/compilers/openjdk/12.nix
index 60100a5ecc16a..a8de9fe43ffc6 100644
--- a/pkgs/development/compilers/openjdk/12.nix
+++ b/pkgs/development/compilers/openjdk/12.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11, fetchpatch
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/13.nix b/pkgs/development/compilers/openjdk/13.nix
index 68a0a9fa70072..5b7e87b0ef3ac 100644
--- a/pkgs/development/compilers/openjdk/13.nix
+++ b/pkgs/development/compilers/openjdk/13.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk13-bootstrap, fetchpatch
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/14.nix b/pkgs/development/compilers/openjdk/14.nix
index 37c3a6a3de3a6..1381b0995a76c 100644
--- a/pkgs/development/compilers/openjdk/14.nix
+++ b/pkgs/development/compilers/openjdk/14.nix
@@ -4,8 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk14-bootstrap
 , setJavaClassPath
 , headless ? false
-# disabled by default since openjfx11 depends on python2 (EOL)
-, enableJavaFX ? false, openjfx
+, enableJavaFX ? openjfx.meta.available, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/17.nix b/pkgs/development/compilers/openjdk/17.nix
index f49ef7bf553db..bc92b1393fdb3 100644
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@@ -11,7 +11,7 @@
 let
   version = {
     feature = "17";
-    interim = ".0.4";
+    interim = ".0.5";
     build = "8";
   };
 
@@ -23,7 +23,7 @@ let
       owner = "openjdk";
       repo = "jdk${version.feature}u";
       rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      sha256 = "drbljLz82ZyK29lIDLPqCkwqpBdgU/7zCTZ0ceeb1SI=";
+      sha256 = "sha256-2k1Mm36ds6MZheZVsLvXkoqQG4zYeIRWzbP1aZ72Vqs=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];
@@ -55,8 +55,8 @@ let
       # Patch borrowed from Alpine to fix build errors with musl libc and recent gcc.
       # This is applied anywhere to prevent patchrot.
       (fetchurl {
-        url = "https://git.alpinelinux.org/aports/plain/community/openjdk17/FixNullPtrCast.patch?id=6f97cb0ae4dff6588dae5868c2522aea96c99d2c";
-        sha256 = "sha256-giOmMInwLH0Ei9H7ETsrrzQU09I6+dn8KpPrKb7zn8I=";
+        url = "https://git.alpinelinux.org/aports/plain/community/openjdk17/FixNullPtrCast.patch?id=41e78a067953e0b13d062d632bae6c4f8028d91c";
+        sha256 = "sha256-LzmSew51+DyqqGyyMw2fbXeBluCiCYsS1nCjt9hX6zo=";
       })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk13.patch
diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index 7a01486e2dd98..1bbb4e42dbc5b 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -1,26 +1,36 @@
 { stdenv, lib, fetchurl, writeText, gradle_4, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4, python2, ruby
+, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby
 , openjdk11-bootstrap }:
 
 let
   major = "11";
-  update = ".0.3";
+  update = ".0.11";
   build = "1";
   repover = "${major}${update}+${build}";
   gradle_ = (gradle_4.override {
     java = openjdk11-bootstrap;
   });
 
+  NIX_CFLAGS_COMPILE = [
+    # avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
+    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
+    # glib-2.62 deprecations
+    # -fcommon: gstreamer workaround for -fno-common toolchains:
+    #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
+    #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
+    "-fcommon"
+  ];
+
   makePackage = args: stdenv.mkDerivation ({
     version = "${major}${update}-${build}";
 
     src = fetchurl {
-      url = "https://hg.openjdk.java.net/openjfx/${major}/rt/archive/${repover}.tar.gz";
-      sha256 = "1h7qsylr7rnwnbimqjyn3whszp9kv4h3gpicsrb3mradxc9yv194";
+      url = "https://hg.openjdk.java.net/openjfx/${major}-dev/rt/archive/${repover}.tar.gz";
+      sha256 = "sha256-mbEALUxuwbtlGeZ2Xsm3m3aNDdthLYWd6QHmdkAILxc=";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
-    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python2 ruby ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
+    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
 
@@ -34,8 +44,7 @@ let
       JDK_HOME = ${openjdk11-bootstrap.home}
     '' + args.gradleProperties or "");
 
-    #avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
-    NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+    inherit NIX_CFLAGS_COMPILE;
 
     buildPhase = ''
       runHook preBuild
@@ -67,8 +76,7 @@ let
     outputHashMode = "recursive";
     # Downloaded AWT jars differ by platform.
     outputHash = {
-      i686-linux = "0mjlyf6jvbis7nrm5d394sjv4hjw6k3753hr1nwdxk8skwc3ry08";
-      x86_64-linux = "0d4msxswdav1xsfkpr0qd3xgqkcbxzf47v1zdy5jmg5w4bs6a78a";
+      x86_64-linux = "sha256-syceJMUEknBDCHK8eGs6rUU3IQn+HnQfURfCrDxYPa8=";
     }.${stdenv.system} or (throw "Unsupported platform");
   };
 
@@ -91,11 +99,7 @@ in makePackage {
     cp -r build/modular-sdk $out
   '';
 
-  # glib-2.62 deprecations
-  # -fcommon: gstreamer workaround for -fno-common toolchains:
-  #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
-  #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS -fcommon";
+  inherit NIX_CFLAGS_COMPILE;
 
   stripDebugList = [ "." ];
 
@@ -105,6 +109,9 @@ in makePackage {
       new_refs="$(patchelf --print-rpath "$lib" | sed -E 's,:?${openjdk11-bootstrap}[^:]*,,')"
       patchelf --set-rpath "$new_refs" "$lib"
     done
+
+    # Remove licenses, otherwise they may conflict with the ones included in the openjdk
+    rm -rf $out/modules_legal/*
   '';
 
   disallowedReferences = [ openjdk11-bootstrap ];
@@ -119,6 +126,6 @@ in makePackage {
     license = licenses.gpl2;
     description = "The next-generation Java client toolkit";
     maintainers = with maintainers; [ abbradar ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/compilers/openjdk/openjfx/15.nix b/pkgs/development/compilers/openjdk/openjfx/15.nix
index 74f83fdabf1ac..d2903c685a90c 100644
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk11_headless, gradle_5
 , pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4, python3, ruby }:
+, ffmpeg_4-headless, python3, ruby }:
 
 let
   major = "15";
@@ -21,7 +21,7 @@ let
       sha256 = "019glq8rhn6amy3n5jc17vi2wpf1pxpmmywvyz1ga8n09w7xscq1";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -72,7 +72,6 @@ let
     # Downloaded AWT jars differ by platform.
     outputHash = {
       x86_64-linux = "0hmyr5nnjgwyw3fcwqf0crqg9lny27jfirycg3xmkzbcrwqd6qkw";
-      i686-linux = "0hx69p2z96p7jbyq4r20jykkb8gx6r8q2cj7m30pldlsw3650bqx";
     }.${stdenv.system} or (throw "Unsupported platform");
   };
 
@@ -121,6 +120,6 @@ in makePackage {
     license = licenses.gpl2;
     description = "The next-generation Java client toolkit";
     maintainers = with maintainers; [ abbradar ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/development/compilers/openjdk/openjfx/17.nix b/pkgs/development/compilers/openjdk/openjfx/17.nix
index 734f4d079ef0d..1c1fb89ce8e17 100644
--- a/pkgs/development/compilers/openjdk/openjfx/17.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/17.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk17_headless, gradle_7
 , pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4, python3, ruby, icu68 }:
+, ffmpeg_4-headless, python3, ruby, icu68 }:
 
 let
   major = "17";
@@ -21,7 +21,7 @@ let
       sha256 = "sha256-PSiE9KbF/4u9VyBl9PAMLGzKyGFB86/XByeh7vhL6Kw=";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
diff --git a/pkgs/development/compilers/rust/1_64.nix b/pkgs/development/compilers/rust/1_65.nix
index f93123fcd70ac..5b2397b5de48a 100644
--- a/pkgs/development/compilers/rust/1_64.nix
+++ b/pkgs/development/compilers/rust/1_65.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.64.0";
-  rustcSha256 = "sha256-s82fSB4aKQG/bzgI0wxpzE6oDZPEzE4u1SJYsYA4EgU=";
+  rustcVersion = "1.65.0";
+  rustcSha256 = "sha256-WCi7Z/Z36r+MOEAgWCsM56+IThyEOJSE9/jQDdgsADg=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_14.libllvm.override { enableSharedLibraries = true; };
@@ -37,25 +37,25 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.63.0";
+  bootstrapVersion = "1.64.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "6ac6ca18f119e099749d67c6dc25ce3f70542b43cc05062d5138fc1052e44c54";
-    x86_64-unknown-linux-gnu = "536bcf16807a4ff49b7b29af6e573a2f1821055bfad72c275c60e56edc693984";
-    x86_64-unknown-linux-musl = "4516f1fa2a0d9ec9176cc734e5faaa0a3d439bd49f75553a484b6c3c6d7905ab";
-    arm-unknown-linux-gnueabihf = "8847d8482e1d5ec962e092a63c95618dc7e17a079a9bf58bec1da39cac0ba4ce";
-    armv7-unknown-linux-gnueabihf = "d9227bf6d93f49889c698d35adc7ab3e042988740b9d9d9c81fb54fc0f854474";
-    aarch64-unknown-linux-gnu = "26745b57500da293a8147122a5998926301350a610c164f053107cbe026d3a51";
-    aarch64-unknown-linux-musl = "8fee65f2bd7e010259763939cbef8ed0794773ec8959c5ef90273cf39dcba180";
-    x86_64-apple-darwin = "37f76a45b8616e764c2663850758ce822c730e96af60168a46b818f528c1467d";
-    aarch64-apple-darwin = "25c3f43459da9b8683292999c3522d88980b0ca3244fe830f5a87a8092aac5a6";
-    powerpc64le-unknown-linux-gnu = "781662048caa48b78540c2fb22f0aa7c06d6d8e81aede0f6ef900c11428056cf";
-    riscv64gc-unknown-linux-gnu = "a7f398b45229c5cca833f75421c32897174e365fbbdf78e19b87612736c918aa";
-    mips64el-unknown-linux-gnuabi64 = "19f04c576c9d6b171acba65cfe44edcbcf6134a75a853d2f1538fdb2128ec654";
+    i686-unknown-linux-gnu = "177b4f95c8cdaa34bb29e69950cbfe236e123757078af4792779c43ee3818199";
+    x86_64-unknown-linux-gnu = "a893977f238291370ab96726a74b6b9ae854dc75fbf5730954d901a93843bf9b";
+    x86_64-unknown-linux-musl = "d5c4293a8fe1b34d857bec4124229c39711f8759aa2f6108c8b6c22a308f96bb";
+    arm-unknown-linux-gnueabihf = "0d7c9c746f7b98f1f99e4cf720f9a32b2f5cdf22cb1d9f677b41c1dca62f14f8";
+    armv7-unknown-linux-gnueabihf = "0be29740f565ca8835ba260691274585733a7f4130ec872bfa37654a08013828";
+    aarch64-unknown-linux-gnu = "7d8860572431bd4ee1b9cd0cd77cf7ff29fdd5b91ed7c92a820f872de6ced558";
+    aarch64-unknown-linux-musl = "9e7cfd960fb8ad3e1f51ef667c56032d3d4d9d9f573a06bbcf65a7c7a96ab430";
+    x86_64-apple-darwin = "b6003d49fb857ff8dc105a3ccba98b851cd3e7d874005acb92284fd1113adc0d";
+    aarch64-apple-darwin = "e1a37dc5991304716e260144311fd291d8fb514042e45c244c582b3454477038";
+    powerpc64le-unknown-linux-gnu = "9d4591033eac22093d107991a68fffccea087b26bb54115d46cc544fbf5ef66c";
+    riscv64gc-unknown-linux-gnu = "f63981d9c1057cb20cf30871757d42475a1cd0c187b3dcce5fabb0cce0f80c5b";
+    mips64el-unknown-linux-gnuabi64 = "47488e4c53cca5c99b5837474a880f6c2368a7fe8368560dd8077bddb94959b5";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_64;
+  selectRustPackage = pkgs: pkgs.rust_1_65;
 
   rustcPatches = [
   ];
diff --git a/pkgs/development/compilers/sbcl/2.x.nix b/pkgs/development/compilers/sbcl/2.x.nix
index ec12ccf17b722..85b3881e3a153 100644
--- a/pkgs/development/compilers/sbcl/2.x.nix
+++ b/pkgs/development/compilers/sbcl/2.x.nix
@@ -53,6 +53,10 @@ let
     "2.2.9" = {
       sha256 = "sha256-fr69bSAj//cHewNy+hFx+IBSm97GEE8gmDKXwv63wXI=";
     };
+
+    "2.2.10" = {
+      sha256 = "sha256-jMPDqHYSI63vFEqIcwsmdQg6Oyb6FV1wz5GruTXpCDM=";
+    };
   };
 
 in with versionMap.${version};
@@ -99,6 +103,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/sbcl/sbcl/commit/f88989694200a5192fb68047d43d0500b2165f7b.patch";
       sha256 = "sha256-MXEsK46RARPmB2WBPcrmZk6ArliU8DgHw73x9+/QAmk=";
     })
+  ] ++ lib.optionals (version == "2.2.10") [
+    # hard-coded /bin/cat to just ‘cat’, trusting the PATH
+    (fetchpatch {
+      url = "https://github.com/sbcl/sbcl/commit/8ed662fbfeb5dde35eb265f390b55b01f79f70c1.patch";
+      sha256 = "sha256-2aqb13AFdw9KMf8KQ9yj1HVxgoFWZ9xWmnoDdbRSLy4=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/embedded/jtag-remote-server/default.nix b/pkgs/development/embedded/jtag-remote-server/default.nix
index bcfba506a0025..4a2c9c3df3d2b 100644
--- a/pkgs/development/embedded/jtag-remote-server/default.nix
+++ b/pkgs/development/embedded/jtag-remote-server/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jtag-remote-server";
-  version = "unstable-2022-06-09";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "jiegec";
     repo = pname;
-    rev = "917d8d298423ba1aa6e75aa92e009b7f27f74a57";
-    hash = "sha256-Jy0OyRgn9SYpjP3HYWPvRirfxXk4/vMYvZuI3XpPtBw=";
+    rev = "v${version}";
+    hash = "sha256-qtgO0BO2hvWi/E2RzGTTuQynKbh7/OLeoLcm60dqro8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/interpreters/python/cpython/2.7/CVE-2019-20907.patch b/pkgs/development/interpreters/python/cpython/2.7/CVE-2019-20907.patch
deleted file mode 100644
index cf67ae2b51bed..0000000000000
--- a/pkgs/development/interpreters/python/cpython/2.7/CVE-2019-20907.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4 Mon Sep 17 00:00:00 2001
-From: Rishi <rishi_devan@mail.com>
-Date: Wed, 15 Jul 2020 13:51:00 +0200
-Subject: [PATCH] bpo-39017: Avoid infinite loop in the tarfile module
- (GH-21454)
-
-Avoid infinite loop when reading specially crafted TAR files using the tarfile module
-(CVE-2019-20907).
----
- Lib/tarfile.py                                    |   2 ++
-
-diff --git a/Lib/tarfile.py b/Lib/tarfile.py
-index e2b60532f6..6769066cab 100755
---- a/Lib/tarfile.py
-+++ b/Lib/tarfile.py
-@@ -1249,6 +1249,8 @@ class TarInfo(object):
- 
-             length, keyword = match.groups()
-             length = int(length)
-+            if length == 0:
-+                raise InvalidHeaderError("invalid header")
-             value = buf[match.end(2) + 1:match.start(1) + length - 1]
- 
-             # Normally, we could just use "utf-8" as the encoding and "strict"
diff --git a/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-23336.patch b/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-23336.patch
deleted file mode 100644
index 760d0e7eed8e5..0000000000000
--- a/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-23336.patch
+++ /dev/null
@@ -1,390 +0,0 @@
-From e7b005c05dbdbce967a409abd71641281a8604bf Mon Sep 17 00:00:00 2001
-From: Senthil Kumaran <senthil@uthcode.com>
-Date: Mon, 15 Feb 2021 11:16:43 -0800
-Subject: [PATCH 24/26] [3.6] bpo-42967: only use '&' as a query string
- separator (GH-24297)  (GH-24532)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-bpo-42967: [security] Address a web cache-poisoning issue reported in
-urllib.parse.parse_qsl().
-
-urllib.parse will only us "&" as query string separator by default
-instead of both ";" and "&" as allowed in earlier versions. An optional
-argument seperator with default value "&" is added to specify the
-separator.
-
-Co-authored-by: Éric Araujo <merwok@netwok.org>
-Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
-Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
-
-Rebased for Python 2.7 by Michał Górny
----
- Doc/library/cgi.rst                           |  7 +++-
- Doc/library/urlparse.rst                      | 23 ++++++++++-
- Lib/cgi.py                                    | 20 +++++++---
- Lib/test/test_cgi.py                          | 29 +++++++++++---
- Lib/test/test_urlparse.py                     | 38 +++++++++----------
- Lib/urlparse.py                               | 22 ++++++++---
- .../2021-02-14-15-59-16.bpo-42967.YApqDS.rst  |  1 +
- 7 files changed, 100 insertions(+), 40 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2021-02-14-15-59-16.bpo-42967.YApqDS.rst
-
-diff --git a/Doc/library/cgi.rst b/Doc/library/cgi.rst
-index ecd62c8c01..b85cdd8b61 100644
---- a/Doc/library/cgi.rst
-+++ b/Doc/library/cgi.rst
-@@ -285,10 +285,10 @@ These are useful if you want more control, or if you want to employ some of the
- algorithms implemented in this module in other circumstances.
- 
- 
--.. function:: parse(fp[, environ[, keep_blank_values[, strict_parsing]]])
-+.. function:: parse(fp[, environ[, keep_blank_values[, strict_parsing]]], separator="&")
- 
-    Parse a query in the environment or from a file (the file defaults to
--   ``sys.stdin`` and environment defaults to ``os.environ``).  The *keep_blank_values* and *strict_parsing* parameters are
-+   ``sys.stdin`` and environment defaults to ``os.environ``).  The *keep_blank_values*, *strict_parsing* and *separator* parameters are
-    passed to :func:`urlparse.parse_qs` unchanged.
- 
- 
-@@ -316,6 +316,9 @@ algorithms implemented in this module in other circumstances.
-    Note that this does not parse nested multipart parts --- use
-    :class:`FieldStorage` for that.
- 
-+   .. versionchanged:: 3.6.13
-+      Added the *separator* parameter.
-+
- 
- .. function:: parse_header(string)
- 
-diff --git a/Doc/library/urlparse.rst b/Doc/library/urlparse.rst
-index 0989c88c30..2f8e4c5a44 100644
---- a/Doc/library/urlparse.rst
-+++ b/Doc/library/urlparse.rst
-@@ -136,7 +136,7 @@ The :mod:`urlparse` module defines the following functions:
-       now raise :exc:`ValueError`.
- 
- 
--.. function:: parse_qs(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]])
-+.. function:: parse_qs(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]], separator='&')
- 
-    Parse a query string given as a string argument (data of type
-    :mimetype:`application/x-www-form-urlencoded`).  Data are returned as a
-@@ -157,6 +157,9 @@ The :mod:`urlparse` module defines the following functions:
-    read. If set, then throws a :exc:`ValueError` if there are more than
-    *max_num_fields* fields read.
- 
-+   The optional argument *separator* is the symbol to use for separating the
-+   query arguments. It defaults to ``&``.
-+
-    Use the :func:`urllib.urlencode` function to convert such dictionaries into
-    query strings.
- 
-@@ -166,7 +169,14 @@ The :mod:`urlparse` module defines the following functions:
-    .. versionchanged:: 2.7.16
-       Added *max_num_fields* parameter.
- 
--.. function:: parse_qsl(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]])
-+   .. versionchanged:: 2.7.18-gentoo
-+      Added *separator* parameter with the default value of ``&``. Earlier
-+      Python versions allowed using both ``;`` and ``&`` as query parameter
-+      separator. This has been changed to allow only a single separator key,
-+      with ``&`` as the default separator.
-+
-+
-+.. function:: parse_qsl(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]], separator='&')
- 
-    Parse a query string given as a string argument (data of type
-    :mimetype:`application/x-www-form-urlencoded`).  Data are returned as a list of
-@@ -186,6 +196,9 @@ The :mod:`urlparse` module defines the following functions:
-    read. If set, then throws a :exc:`ValueError` if there are more than
-    *max_num_fields* fields read.
- 
-+   The optional argument *separator* is the symbol to use for separating the
-+   query arguments. It defaults to ``&``.
-+
-    Use the :func:`urllib.urlencode` function to convert such lists of pairs into
-    query strings.
- 
-@@ -195,6 +208,12 @@ The :mod:`urlparse` module defines the following functions:
-    .. versionchanged:: 2.7.16
-       Added *max_num_fields* parameter.
- 
-+   .. versionchanged:: 2.7.18-gentoo
-+      Added *separator* parameter with the default value of ``&``. Earlier
-+      Python versions allowed using both ``;`` and ``&`` as query parameter
-+      separator. This has been changed to allow only a single separator key,
-+      with ``&`` as the default separator.
-+
- .. function:: urlunparse(parts)
- 
-    Construct a URL from a tuple as returned by ``urlparse()``. The *parts* argument
-diff --git a/Lib/cgi.py b/Lib/cgi.py
-index 5b903e0347..9d0848b6b1 100755
---- a/Lib/cgi.py
-+++ b/Lib/cgi.py
-@@ -121,7 +121,8 @@ log = initlog           # The current logging function
- # 0 ==> unlimited input
- maxlen = 0
- 
--def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
-+def parse(fp=None, environ=os.environ, keep_blank_values=0,
-+          strict_parsing=0, separator='&'):
-     """Parse a query in the environment or from a file (default stdin)
- 
-         Arguments, all optional:
-@@ -140,6 +141,9 @@ def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
-         strict_parsing: flag indicating what to do with parsing errors.
-             If false (the default), errors are silently ignored.
-             If true, errors raise a ValueError exception.
-+
-+        separator: str. The symbol to use for separating the query arguments.
-+            Defaults to &.
-     """
-     if fp is None:
-         fp = sys.stdin
-@@ -171,7 +175,8 @@ def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
-         else:
-             qs = ""
-         environ['QUERY_STRING'] = qs    # XXX Shouldn't, really
--    return urlparse.parse_qs(qs, keep_blank_values, strict_parsing)
-+    return urlparse.parse_qs(qs, keep_blank_values, strict_parsing,
-+                             separator=separator)
- 
- 
- # parse query string function called from urlparse,
-@@ -395,7 +400,7 @@ class FieldStorage:
- 
-     def __init__(self, fp=None, headers=None, outerboundary="",
-                  environ=os.environ, keep_blank_values=0, strict_parsing=0,
--                 max_num_fields=None):
-+                 max_num_fields=None, separator='&'):
-         """Constructor.  Read multipart/* until last part.
- 
-         Arguments, all optional:
-@@ -430,6 +435,7 @@ class FieldStorage:
-         self.keep_blank_values = keep_blank_values
-         self.strict_parsing = strict_parsing
-         self.max_num_fields = max_num_fields
-+        self.separator = separator
-         if 'REQUEST_METHOD' in environ:
-             method = environ['REQUEST_METHOD'].upper()
-         self.qs_on_post = None
-@@ -613,7 +619,8 @@ class FieldStorage:
-         if self.qs_on_post:
-             qs += '&' + self.qs_on_post
-         query = urlparse.parse_qsl(qs, self.keep_blank_values,
--                                   self.strict_parsing, self.max_num_fields)
-+                                   self.strict_parsing, self.max_num_fields,
-+                                   separator=self.separator)
-         self.list = [MiniFieldStorage(key, value) for key, value in query]
-         self.skip_lines()
- 
-@@ -629,7 +636,8 @@ class FieldStorage:
-             query = urlparse.parse_qsl(self.qs_on_post,
-                                        self.keep_blank_values,
-                                        self.strict_parsing,
--                                       self.max_num_fields)
-+                                       self.max_num_fields,
-+                                       separator=self.separator)
-             self.list.extend(MiniFieldStorage(key, value)
-                              for key, value in query)
-             FieldStorageClass = None
-@@ -649,7 +657,7 @@ class FieldStorage:
-             headers = rfc822.Message(self.fp)
-             part = klass(self.fp, headers, ib,
-                          environ, keep_blank_values, strict_parsing,
--                         max_num_fields)
-+                         max_num_fields, separator=self.separator)
- 
-             if max_num_fields is not None:
-                 max_num_fields -= 1
-diff --git a/Lib/test/test_cgi.py b/Lib/test/test_cgi.py
-index 743c2afbd4..f414faa23b 100644
---- a/Lib/test/test_cgi.py
-+++ b/Lib/test/test_cgi.py
-@@ -61,12 +61,9 @@ parse_strict_test_cases = [
-     ("", ValueError("bad query field: ''")),
-     ("&", ValueError("bad query field: ''")),
-     ("&&", ValueError("bad query field: ''")),
--    (";", ValueError("bad query field: ''")),
--    (";&;", ValueError("bad query field: ''")),
-     # Should the next few really be valid?
-     ("=", {}),
-     ("=&=", {}),
--    ("=;=", {}),
-     # This rest seem to make sense
-     ("=a", {'': ['a']}),
-     ("&=a", ValueError("bad query field: ''")),
-@@ -81,8 +78,6 @@ parse_strict_test_cases = [
-     ("a=a+b&b=b+c", {'a': ['a b'], 'b': ['b c']}),
-     ("a=a+b&a=b+a", {'a': ['a b', 'b a']}),
-     ("x=1&y=2.0&z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
--    ("x=1;y=2.0&z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
--    ("x=1;y=2.0;z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
-     ("Hbc5161168c542333633315dee1182227:key_store_seqid=400006&cuyer=r&view=bustomer&order_id=0bb2e248638833d48cb7fed300000f1b&expire=964546263&lobale=en-US&kid=130003.300038&ss=env",
-      {'Hbc5161168c542333633315dee1182227:key_store_seqid': ['400006'],
-       'cuyer': ['r'],
-@@ -188,6 +183,30 @@ class CgiTests(unittest.TestCase):
-             self.assertEqual(expect[k], v)
-         self.assertItemsEqual(expect.values(), d.values())
- 
-+    def test_separator(self):
-+        parse_semicolon = [
-+            ("x=1;y=2.0", {'x': ['1'], 'y': ['2.0']}),
-+            ("x=1;y=2.0;z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
-+            (";", ValueError("bad query field: ''")),
-+            (";;", ValueError("bad query field: ''")),
-+            ("=;a", ValueError("bad query field: 'a'")),
-+            (";b=a", ValueError("bad query field: ''")),
-+            ("b;=a", ValueError("bad query field: 'b'")),
-+            ("a=a+b;b=b+c", {'a': ['a b'], 'b': ['b c']}),
-+            ("a=a+b;a=b+a", {'a': ['a b', 'b a']}),
-+        ]
-+        for orig, expect in parse_semicolon:
-+            env = {'QUERY_STRING': orig}
-+            fs = cgi.FieldStorage(separator=';', environ=env)
-+            if isinstance(expect, dict):
-+                for key in expect.keys():
-+                    expect_val = expect[key]
-+                    self.assertIn(key, fs)
-+                    if len(expect_val) > 1:
-+                        self.assertEqual(fs.getvalue(key), expect_val)
-+                    else:
-+                        self.assertEqual(fs.getvalue(key), expect_val[0])
-+
-     def test_log(self):
-         cgi.log("Testing")
- 
-diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
-index 86c4a0595c..0b2107339a 100644
---- a/Lib/test/test_urlparse.py
-+++ b/Lib/test/test_urlparse.py
-@@ -24,16 +24,20 @@ parse_qsl_test_cases = [
-     ("&a=b", [('a', 'b')]),
-     ("a=a+b&b=b+c", [('a', 'a b'), ('b', 'b c')]),
-     ("a=1&a=2", [('a', '1'), ('a', '2')]),
--    (";", []),
--    (";;", []),
--    (";a=b", [('a', 'b')]),
--    ("a=a+b;b=b+c", [('a', 'a b'), ('b', 'b c')]),
--    ("a=1;a=2", [('a', '1'), ('a', '2')]),
--    (b";", []),
--    (b";;", []),
--    (b";a=b", [(b'a', b'b')]),
--    (b"a=a+b;b=b+c", [(b'a', b'a b'), (b'b', b'b c')]),
--    (b"a=1;a=2", [(b'a', b'1'), (b'a', b'2')]),
-+    (b"", []),
-+    (b"&", []),
-+    (b"&&", []),
-+    (b"=", [(b'', b'')]),
-+    (b"=a", [(b'', b'a')]),
-+    (b"a", [(b'a', b'')]),
-+    (b"a=", [(b'a', b'')]),
-+    (b"&a=b", [(b'a', b'b')]),
-+    (b"a=a+b&b=b+c", [(b'a', b'a b'), (b'b', b'b c')]),
-+    (b"a=1&a=2", [(b'a', b'1'), (b'a', b'2')]),
-+    (";a=b", [(';a', 'b')]),
-+    ("a=a+b;b=b+c", [('a', 'a b;b=b c')]),
-+    (b";a=b", [(b';a', b'b')]),
-+    (b"a=a+b;b=b+c", [(b'a', b'a b;b=b c')]),
- ]
- 
- parse_qs_test_cases = [
-@@ -57,16 +61,10 @@ parse_qs_test_cases = [
-     (b"&a=b", {b'a': [b'b']}),
-     (b"a=a+b&b=b+c", {b'a': [b'a b'], b'b': [b'b c']}),
-     (b"a=1&a=2", {b'a': [b'1', b'2']}),
--    (";", {}),
--    (";;", {}),
--    (";a=b", {'a': ['b']}),
--    ("a=a+b;b=b+c", {'a': ['a b'], 'b': ['b c']}),
--    ("a=1;a=2", {'a': ['1', '2']}),
--    (b";", {}),
--    (b";;", {}),
--    (b";a=b", {b'a': [b'b']}),
--    (b"a=a+b;b=b+c", {b'a': [b'a b'], b'b': [b'b c']}),
--    (b"a=1;a=2", {b'a': [b'1', b'2']}),
-+    (";a=b", {';a': ['b']}),
-+    ("a=a+b;b=b+c", {'a': ['a b;b=b c']}),
-+    (b";a=b", {b';a': [b'b']}),
-+    (b"a=a+b;b=b+c", {b'a':[ b'a b;b=b c']}),
- ]
- 
- class UrlParseTestCase(unittest.TestCase):
-diff --git a/Lib/urlparse.py b/Lib/urlparse.py
-index 798b467b60..6c32727fce 100644
---- a/Lib/urlparse.py
-+++ b/Lib/urlparse.py
-@@ -382,7 +382,8 @@ def unquote(s):
-             append(item)
-     return ''.join(res)
- 
--def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
-+def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None,
-+             separator='&'):
-     """Parse a query given as a string argument.
- 
-         Arguments:
-@@ -402,17 +403,22 @@ def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
- 
-         max_num_fields: int. If set, then throws a ValueError if there
-             are more than n fields read by parse_qsl().
-+
-+        separator: str. The symbol to use for separating the query arguments.
-+            Defaults to &.
-+
-     """
-     dict = {}
-     for name, value in parse_qsl(qs, keep_blank_values, strict_parsing,
--                                 max_num_fields):
-+                                 max_num_fields, separator=separator):
-         if name in dict:
-             dict[name].append(value)
-         else:
-             dict[name] = [value]
-     return dict
- 
--def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
-+def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None,
-+              separator='&'):
-     """Parse a query given as a string argument.
- 
-     Arguments:
-@@ -432,17 +438,23 @@ def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
-     max_num_fields: int. If set, then throws a ValueError if there
-         are more than n fields read by parse_qsl().
- 
-+        separator: str. The symbol to use for separating the query arguments.
-+            Defaults to &.
-+
-     Returns a list, as G-d intended.
-     """
-+    if not separator or (not isinstance(separator, (str, bytes))):
-+        raise ValueError("Separator must be of type string or bytes.")
-+
-     # If max_num_fields is defined then check that the number of fields
-     # is less than max_num_fields. This prevents a memory exhaustion DOS
-     # attack via post bodies with many fields.
-     if max_num_fields is not None:
--        num_fields = 1 + qs.count('&') + qs.count(';')
-+        num_fields = 1 + qs.count(separator)
-         if max_num_fields < num_fields:
-             raise ValueError('Max number of fields exceeded')
- 
--    pairs = [s2 for s1 in qs.split('&') for s2 in s1.split(';')]
-+    pairs = [s1 for s1 in qs.split(separator)]
-     r = []
-     for name_value in pairs:
-         if not name_value and not strict_parsing:
-diff --git a/Misc/NEWS.d/next/Security/2021-02-14-15-59-16.bpo-42967.YApqDS.rst b/Misc/NEWS.d/next/Security/2021-02-14-15-59-16.bpo-42967.YApqDS.rst
-new file mode 100644
-index 0000000000..f08489b414
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2021-02-14-15-59-16.bpo-42967.YApqDS.rst
-@@ -0,0 +1 @@
-+Fix web cache poisoning vulnerability by defaulting the query args separator to ``&``, and allowing the user to choose a custom separator.
--- 
-2.31.1
-
diff --git a/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-3177.patch b/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-3177.patch
deleted file mode 100644
index 6c0ae468461f2..0000000000000
--- a/pkgs/development/interpreters/python/cpython/2.7/CVE-2021-3177.patch
+++ /dev/null
@@ -1,181 +0,0 @@
-From fab838b2ee7cfb9037c24f0f18dfe01aa379b3f7 Mon Sep 17 00:00:00 2001
-From: Benjamin Peterson <benjamin@python.org>
-Date: Mon, 18 Jan 2021 15:11:46 -0600
-Subject: [3.6] closes bpo-42938: Replace snprintf with Python unicode
- formatting in ctypes param reprs. (GH-24250)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-(cherry picked from commit 916610ef90a0d0761f08747f7b0905541f0977c7)
-
-Co-authored-by: Benjamin Peterson <benjamin@python.org>
-Rebased for Python 2.7 by Michał Górny <mgorny@gentoo.org>
----
- Lib/ctypes/test/test_parameters.py                 | 43 +++++++++++++++++++
- .../2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst       |  2 +
- Modules/_ctypes/callproc.c                         | 49 +++++++++++-----------
- 3 files changed, 69 insertions(+), 25 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
-
-diff --git a/Lib/ctypes/test/test_parameters.py b/Lib/ctypes/test/test_parameters.py
-index 23c1b6e225..3456882ccb 100644
---- a/Lib/ctypes/test/test_parameters.py
-+++ b/Lib/ctypes/test/test_parameters.py
-@@ -206,6 +206,49 @@ class SimpleTypesTestCase(unittest.TestCase):
-         with self.assertRaises(ZeroDivisionError):
-             WorseStruct().__setstate__({}, b'foo')
- 
-+    def test_parameter_repr(self):
-+        from ctypes import (
-+            c_bool,
-+            c_char,
-+            c_wchar,
-+            c_byte,
-+            c_ubyte,
-+            c_short,
-+            c_ushort,
-+            c_int,
-+            c_uint,
-+            c_long,
-+            c_ulong,
-+            c_longlong,
-+            c_ulonglong,
-+            c_float,
-+            c_double,
-+            c_longdouble,
-+            c_char_p,
-+            c_wchar_p,
-+            c_void_p,
-+        )
-+        self.assertRegexpMatches(repr(c_bool.from_param(True)), r"^<cparam '\?' at 0x[A-Fa-f0-9]+>$")
-+        self.assertEqual(repr(c_char.from_param('a')), "<cparam 'c' (a)>")
-+        self.assertRegexpMatches(repr(c_wchar.from_param('a')), r"^<cparam 'u' at 0x[A-Fa-f0-9]+>$")
-+        self.assertEqual(repr(c_byte.from_param(98)), "<cparam 'b' (98)>")
-+        self.assertEqual(repr(c_ubyte.from_param(98)), "<cparam 'B' (98)>")
-+        self.assertEqual(repr(c_short.from_param(511)), "<cparam 'h' (511)>")
-+        self.assertEqual(repr(c_ushort.from_param(511)), "<cparam 'H' (511)>")
-+        self.assertRegexpMatches(repr(c_int.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
-+        self.assertRegexpMatches(repr(c_uint.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
-+        self.assertRegexpMatches(repr(c_long.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
-+        self.assertRegexpMatches(repr(c_ulong.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
-+        self.assertRegexpMatches(repr(c_longlong.from_param(20000)), r"^<cparam '[liq]' \(20000\)>$")
-+        self.assertRegexpMatches(repr(c_ulonglong.from_param(20000)), r"^<cparam '[LIQ]' \(20000\)>$")
-+        self.assertEqual(repr(c_float.from_param(1.5)), "<cparam 'f' (1.5)>")
-+        self.assertEqual(repr(c_double.from_param(1.5)), "<cparam 'd' (1.5)>")
-+        self.assertEqual(repr(c_double.from_param(1e300)), "<cparam 'd' (1e+300)>")
-+        self.assertRegexpMatches(repr(c_longdouble.from_param(1.5)), r"^<cparam ('d' \(1.5\)|'g' at 0x[A-Fa-f0-9]+)>$")
-+        self.assertRegexpMatches(repr(c_char_p.from_param(b'hihi')), "^<cparam 'z' \(0x[A-Fa-f0-9]+\)>$")
-+        self.assertRegexpMatches(repr(c_wchar_p.from_param('hihi')), "^<cparam 'Z' \(0x[A-Fa-f0-9]+\)>$")
-+        self.assertRegexpMatches(repr(c_void_p.from_param(0x12)), r"^<cparam 'P' \(0x0*12\)>$")
-+
- ################################################################
- 
- if __name__ == '__main__':
-diff --git a/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
-new file mode 100644
-index 0000000000..7df65a156f
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
-@@ -0,0 +1,2 @@
-+Avoid static buffers when computing the repr of :class:`ctypes.c_double` and
-+:class:`ctypes.c_longdouble` values.
-diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
-index 066fefc0cc..421addf353 100644
---- a/Modules/_ctypes/callproc.c
-+++ b/Modules/_ctypes/callproc.c
-@@ -460,50 +460,51 @@ PyCArg_dealloc(PyCArgObject *self)
- static PyObject *
- PyCArg_repr(PyCArgObject *self)
- {
--    char buffer[256];
-     switch(self->tag) {
-     case 'b':
-     case 'B':
--        sprintf(buffer, "<cparam '%c' (%d)>",
-+        return PyString_FromFormat("<cparam '%c' (%d)>",
-             self->tag, self->value.b);
--        break;
-     case 'h':
-     case 'H':
--        sprintf(buffer, "<cparam '%c' (%d)>",
-+        return PyString_FromFormat("<cparam '%c' (%d)>",
-             self->tag, self->value.h);
--        break;
-     case 'i':
-     case 'I':
--        sprintf(buffer, "<cparam '%c' (%d)>",
-+        return PyString_FromFormat("<cparam '%c' (%d)>",
-             self->tag, self->value.i);
--        break;
-     case 'l':
-     case 'L':
--        sprintf(buffer, "<cparam '%c' (%ld)>",
-+        return PyString_FromFormat("<cparam '%c' (%ld)>",
-             self->tag, self->value.l);
--        break;
- 
- #ifdef HAVE_LONG_LONG
-     case 'q':
-     case 'Q':
--        sprintf(buffer,
-+        return PyString_FromFormat(
-             "<cparam '%c' (%" PY_FORMAT_LONG_LONG "d)>",
-             self->tag, self->value.q);
--        break;
- #endif
-     case 'd':
--        sprintf(buffer, "<cparam '%c' (%f)>",
--            self->tag, self->value.d);
--        break;
--    case 'f':
--        sprintf(buffer, "<cparam '%c' (%f)>",
--            self->tag, self->value.f);
--        break;
--
-+    case 'f': {
-+        PyObject *f = PyFloat_FromDouble((self->tag == 'f') ? self->value.f : self->value.d);
-+        if (f == NULL) {
-+            return NULL;
-+        }
-+        PyObject *r = PyObject_Repr(f);
-+        if (r == NULL) {
-+            Py_DECREF(f);
-+            return NULL;
-+        }
-+        PyObject *result = PyString_FromFormat(
-+            "<cparam '%c' (%s)>", self->tag, PyString_AsString(r));
-+        Py_DECREF(r);
-+        Py_DECREF(f);
-+        return result;
-+    }
-     case 'c':
--        sprintf(buffer, "<cparam '%c' (%c)>",
-+        return PyString_FromFormat("<cparam '%c' (%c)>",
-             self->tag, self->value.c);
--        break;
- 
- /* Hm, are these 'z' and 'Z' codes useful at all?
-    Shouldn't they be replaced by the functionality of c_string
-@@ -512,16 +513,14 @@ PyCArg_repr(PyCArgObject *self)
-     case 'z':
-     case 'Z':
-     case 'P':
--        sprintf(buffer, "<cparam '%c' (%p)>",
-+        return PyString_FromFormat("<cparam '%c' (%p)>",
-             self->tag, self->value.p);
-         break;
- 
-     default:
--        sprintf(buffer, "<cparam '%c' at %p>",
-+        return PyString_FromFormat("<cparam '%c' at %p>",
-             self->tag, self);
--        break;
-     }
--    return PyString_FromString(buffer);
- }
- 
- static PyMemberDef PyCArgType_members[] = {
--- 
-cgit v1.2.3
-
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 30b7732ed51e0..684088186a0a6 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , bzip2
 , expat
 , libffi
@@ -79,8 +79,12 @@ let
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
-  src = fetchurl {
-    url = with sourceVersion; "https://www.python.org/ftp/python/${major}.${minor}.${patch}/Python-${version}.tar.xz";
+  # ActiveState is a fork of cpython that includes fixes for security
+  # issues after its EOL
+  src = fetchFromGitHub {
+    owner = "ActiveState";
+    repo = "cpython";
+    rev = "v${version}";
     inherit sha256;
   };
 
@@ -119,12 +123,12 @@ let
       # Backport from CPython 3.8 of a good list of tests to run for PGO.
       ./profile-task.patch
 
-      # Patch is likely to go away in the next release (if there is any)
-      ./CVE-2019-20907.patch
-
-      ./CVE-2021-3177.patch
-
-      ./CVE-2021-23336.patch
+      # remove once 2.7.18.6 is released
+      (fetchpatch {
+        name = "CVE-2021-3733.patch";
+        url = "https://github.com/ActiveState/cpython/commit/eeb7fe50450f08a782921f3229abed2f23e7b2d7.patch";
+        sha256 = "sha256-ch4cMoFythDmyvlVxOAVw3Ow4PPWVDq5o9c1qox2824=";
+      })
 
       # The workaround is for unittests on Win64, which we don't support.
       # It does break aarch64-darwin, which we do support. See:
@@ -334,7 +338,7 @@ in with passthru; stdenv.mkDerivation ({
       '';
       license = lib.licenses.psfl;
       platforms = lib.platforms.all;
-      maintainers = with lib.maintainers; [ fridh ];
+      maintainers = with lib.maintainers; [ fridh thiagokokada ];
       # Higher priority than Python 3.x so that `/bin/python` points to `/bin/python2`
       # in case both 2 and 3 are installed.
       priority = -100;
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index e84b4918afb86..8fbcd7027ae95 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -7,6 +7,7 @@
 , mailcap, mimetypesSupport ? true
 , ncurses
 , openssl
+, openssl_legacy
 , readline
 , sqlite
 , tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
@@ -76,6 +77,10 @@ assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
 with lib;
 
 let
+  # some python packages need legacy ciphers, so we're using openssl 3, but with that config
+  # null check for Minimal
+  openssl' = if openssl != null then openssl_legacy else null;
+
   buildPackages = pkgsBuildHost;
   inherit (passthru) pythonForBuild;
 
@@ -116,7 +121,7 @@ let
   ];
 
   buildInputs = filter (p: p != null) ([
-    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl ]
+    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl' ]
     ++ optionals x11Support [ tcl tk libX11 xorgproto ]
     ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
     ++ optionals stdenv.isDarwin [ configd ])
@@ -322,8 +327,8 @@ in with passthru; stdenv.mkDerivation {
     "--with-threads"
   ] ++ optionals (sqlite != null && isPy3k) [
     "--enable-loadable-sqlite-extensions"
-  ] ++ optionals (openssl != null) [
-    "--with-openssl=${openssl.dev}"
+  ] ++ optionals (openssl' != null) [
+    "--with-openssl=${openssl'.dev}"
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_buggy_getaddrinfo=no"
     # Assume little-endian IEEE 754 floating point when cross compiling
@@ -488,7 +493,7 @@ in with passthru; stdenv.mkDerivation {
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
   disallowedReferences =
-    lib.optionals (openssl != null && !static) [ openssl.dev ]
+    lib.optionals (openssl' != null && !static) [ openssl'.dev ]
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # Ensure we don't have references to build-time packages.
     # These typically end up in shebangs.
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 12f9c50535d08..903dae38ac12a 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -145,9 +145,9 @@ in {
       major = "2";
       minor = "7";
       patch = "18";
-      suffix = "";
+      suffix = ".5"; # ActiveState's Python 2 extended support
     };
-    sha256 = "0hzgxl94hnflis0d6m4szjx0b52gah7wpmcg5g00q7am6xwhwb5n";
+    sha256 = "sha256-f5A0go0mUEv8cXuXo0ZRNfGwNPjnDhP7KqhkETOoqsw=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index dc7594da17d92..c7e01ea0f94d8 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -188,10 +188,11 @@ let
             ''
           }
           # Remove unnecessary external intermediate files created by gems
-          extMakefiles=$(find $out/lib/ruby/gems -name Makefile)
+          extMakefiles=$(find $out/${passthru.gemPath} -name Makefile)
           for makefile in $extMakefiles; do
             make -C "$(dirname "$makefile")" distclean
           done
+          find "$out/${passthru.gemPath}" -name gem_make.out -delete
           # Bundler tries to create this directory
           mkdir -p $out/nix-support
           cat > $out/nix-support/setup-hook <<EOF
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index b6ab49e4b4d9e..bea3f007e6318 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -207,6 +207,15 @@ stdenv.mkDerivation {
         <ranlib>$RANLIB
       ;
     EOF
+  ''
+  # b2 needs to be explicitly told how to find Python when cross-compiling
+  + optionalString enablePython ''
+    cat << EOF >> user-config.jam
+    using python : : ${python.interpreter}
+      : ${python}/include/python${python.pythonVersion}
+      : ${python}/lib
+      ;
+    EOF
   '';
 
   NIX_CFLAGS_LINK = lib.optionalString stdenv.isDarwin
@@ -229,8 +238,7 @@ stdenv.mkDerivation {
     "--includedir=$(dev)/include"
     "--libdir=$(out)/lib"
     "--with-bjam=b2" # prevent bootstrapping b2 in configurePhase
-  ] ++ optional enablePython "--with-python=${python.interpreter}"
-    ++ optional (toolset != null) "--with-toolset=${toolset}"
+  ] ++ optional (toolset != null) "--with-toolset=${toolset}"
     ++ [ (if stdenv.hostPlatform == stdenv.buildPlatform then "--with-icu=${icu.dev}" else "--without-icu") ];
 
   buildPhase = ''
diff --git a/pkgs/development/libraries/fancypp/default.nix b/pkgs/development/libraries/fancypp/default.nix
new file mode 100644
index 0000000000000..f93ab77c63deb
--- /dev/null
+++ b/pkgs/development/libraries/fancypp/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "fancypp";
+  version = "unstable-2021-04-08";
+
+  src = fetchFromGitHub {
+    owner = "Curve";
+    repo = "fancypp";
+    rev = "ede7f712a08f7c66ff4a5590ad94a477c48850a5";
+    sha256 = "sha256-E2JsQnvrqrZFYo+xBJr7xDCoPnRQftqUjjBpZzFvIic=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r include "$out"
+  '';
+
+  meta = with lib; {
+    description = "Tiny C++ Library for terminal colors and more!";
+    homepage = "https://github.com/Curve/fancypp";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/ffmpegthumbnailer/default.nix b/pkgs/development/libraries/ffmpegthumbnailer/default.nix
index bfe8f80032dd8..381bb7b2984cc 100644
--- a/pkgs/development/libraries/ffmpegthumbnailer/default.nix
+++ b/pkgs/development/libraries/ffmpegthumbnailer/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, ffmpeg, cmake, libpng, pkg-config, libjpeg
+{ fetchFromGitHub, lib, stdenv, ffmpeg-headless, cmake, libpng, pkg-config, libjpeg
 }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ ffmpeg libpng libjpeg ];
+  buildInputs = [ ffmpeg-headless libpng libjpeg ];
   cmakeFlags = [ "-DENABLE_THUMBNAILER=ON" ];
 
   # https://github.com/dirkvdb/ffmpegthumbnailer/issues/215
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
         This thumbnailer was designed to be as fast and lightweight as possible.
         The only dependencies are ffmpeg and libpng.
     ";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.jagajaga ];
   };
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 2e06967dc8bca..a566062c0ee47 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -165,12 +165,12 @@ stdenv.mkDerivation (finalAttrs: {
     perl
     python3
     gettext
+    libxslt
+    docbook_xsl
   ] ++ lib.optionals buildDocs [
     gtk-doc
-    docbook_xsl
     docbook_xml_dtd_45
     libxml2
-    libxslt
   ];
 
   propagatedBuildInputs = [ zlib libffi gettext libiconv ];
diff --git a/pkgs/development/libraries/glibc/2.35-make-4.4.patch b/pkgs/development/libraries/glibc/2.35-make-4.4.patch
new file mode 100644
index 0000000000000..346c141d3b368
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.35-make-4.4.patch
@@ -0,0 +1,66 @@
+https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=2d7ed98add14f75041499ac189696c9bd3d757fe
+--- a/Makeconfig
++++ b/Makeconfig
+@@ -43,6 +43,22 @@ else
+ $(error objdir must be defined by the build-directory Makefile)
+ endif
+ 
++# Did we request 'make -s' run? "yes" or "no".
++# Starting from make-4.4 MAKEFLAGS now contains long
++# options like '--shuffle'. To detect presence of 's'
++# we pick first word with short options. Long options
++# are guaranteed to come after whitespace. We use '-'
++# prefix to always have a word before long options
++# even if no short options were passed.
++# Typical MAKEFLAGS values to watch for:
++#   "rs --shuffle=42" (silent)
++#   " --shuffle" (not silent)
++ifeq ($(findstring s, $(firstword -$(MAKEFLAGS))),)
++silent-make := no
++else
++silent-make := yes
++endif
++
+ # Root of the sysdeps tree.
+ sysdep_dir := $(..)sysdeps
+ export sysdep_dir := $(sysdep_dir)
+@@ -917,7 +933,7 @@ endif
+ # umpteen zillion filenames along with it (we use `...' instead)
+ # but we don't want this echoing done when the user has said
+ # he doesn't want to see commands echoed by using -s.
+-ifneq	"$(findstring s,$(MAKEFLAGS))" ""	# if -s
++ifeq ($(silent-make),yes)			# if -s
+ +cmdecho	:= echo >/dev/null
+ else						# not -s
+ +cmdecho	:= echo
+--- a/Makerules
++++ b/Makerules
+@@ -794,7 +794,7 @@ endif
+ # Maximize efficiency by minimizing the number of rules.
+ .SUFFIXES:	# Clear the suffix list.  We don't use suffix rules.
+ # Don't define any builtin rules.
+-MAKEFLAGS := $(MAKEFLAGS)r
++MAKEFLAGS := $(MAKEFLAGS) -r
+ 
+ # Generic rule for making directories.
+ %/:
+@@ -811,7 +811,7 @@ MAKEFLAGS := $(MAKEFLAGS)r
+ .PRECIOUS: $(foreach l,$(libtypes),$(patsubst %,$(common-objpfx)$l,c))
+ 
+ # Use the verbose option of ar and tar when not running silently.
+-ifeq	"$(findstring s,$(MAKEFLAGS))" ""	# if not -s
++ifeq ($(silent-make),no)			# if not -s
+ verbose := v
+ else	   					# -s
+ verbose	:=
+--- a/elf/rtld-Rules
++++ b/elf/rtld-Rules
+@@ -52,7 +52,7 @@ $(objpfx)rtld-libc.a: $(foreach dir,$(rtld-subdirs),\
+ 	mv -f $@T $@
+ 
+ # Use the verbose option of ar and tar when not running silently.
+-ifeq	"$(findstring s,$(MAKEFLAGS))" ""	# if not -s
++ifeq ($(silent-make),no)			# if not -s
+ verbose := v
+ else						# -s
+ verbose	:=
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 83cde07749496..ad2a8ae7ab64f 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -72,6 +72,9 @@ stdenv.mkDerivation ({
        */
       ./2.35-master.patch.gz
 
+      /* Can be removed after next snapshot update or release update.  */
+      ./2.35-make-4.4.patch
+
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
 
diff --git a/pkgs/development/libraries/gobject-introspection/wrapper.nix b/pkgs/development/libraries/gobject-introspection/wrapper.nix
index d59cbe6faffa4..6ac3224b2d565 100644
--- a/pkgs/development/libraries/gobject-introspection/wrapper.nix
+++ b/pkgs/development/libraries/gobject-introspection/wrapper.nix
@@ -30,78 +30,76 @@ in
 # wrap both pkgsCrossX.buildPackages.gobject-introspection and {pkgs,pkgsSomethingExecutableOnBuildSystem).buildPackages.gobject-introspection
 if (!stdenv.hostPlatform.canExecute stdenv.targetPlatform) && stdenv.targetPlatform.emulatorAvailable buildPackages
 then
-  stdenv.mkDerivation
-    (builtins.removeAttrs overridenUnwrappedGir.drvAttrs [ "name" ] # so we can get a fresh name generated from the pname
-      // {
+  overridenUnwrappedGir.overrideAttrs
+    (previousAttrs:
+      {
 
-      inherit (overridenUnwrappedGir) meta;
+        pname = "gobject-introspection-wrapped";
+        passthru = previousAttrs.passthru // {
+          unwrapped = overridenUnwrappedGir;
+        };
+        dontStrip = true;
+        depsTargetTargetPropagated = [ overridenTargetUnwrappedGir ];
+        buildCommand = ''
+          eval fixupPhase
+          ${lib.concatMapStrings (output: ''
+            mkdir -p ${"$" + "${output}"}
+            ${lib.getExe buildPackages.xorg.lndir} ${overridenUnwrappedGir.${output}} ${"$" + "${output}"}
+          '') overridenUnwrappedGir.outputs}
+
+          cp $dev/bin/g-ir-compiler $dev/bin/.g-ir-compiler-wrapped
+          cp $dev/bin/g-ir-scanner $dev/bin/.g-ir-scanner-wrapped
+
+          (
+            rm "$dev/bin/g-ir-compiler"
+            rm "$dev/bin/g-ir-scanner"
+            export bash="${buildPackages.bash}"
+            export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
+            export emulatorwrapper="$dev/bin/g-ir-scanner-qemuwrapper"
+            export buildlddtree="${buildPackages.pax-utils}/bin/lddtree"
+
+            export targetgir="${lib.getDev overridenTargetUnwrappedGir}"
+
+            substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
+            substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
+            substituteAll "${./wrappers/g-ir-scanner-lddwrapper.sh}" "$dev/bin/g-ir-scanner-lddwrapper"
+            substituteAll "${./wrappers/g-ir-scanner-qemuwrapper.sh}" "$dev/bin/g-ir-scanner-qemuwrapper"
+            chmod +x $dev/bin/g-ir-compiler
+            chmod +x $dev/bin/g-ir-scanner*
+          )
+        ''
+        # when cross-compiling and using the wrapper then when a package looks up the g_ir_X
+        # variable with pkg-config they'll get the host version which can't be run
+        # override the variable to use the absolute path to g_ir_X in PATH which can be run
+        + ''
+          cat >> $dev/nix-support/setup-hook <<-'EOF'
+            override-pkg-config-gir-variables() {
+              PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER="$(type -p g-ir-scanner)"
+              PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER="$(type -p g-ir-compiler)"
+              PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE="$(type -p g-ir-generate)"
+              export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER
+              export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER
+              export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE
+            }
+
+            preConfigureHooks+=(override-pkg-config-gir-variables)
+          EOF
+        '';
+      })
+else
+  overridenUnwrappedGir.overrideAttrs (previousAttrs:
+    {
       pname = "gobject-introspection-wrapped";
-      passthru = overridenUnwrappedGir.passthru // {
+      passthru = previousAttrs.passthru // {
         unwrapped = overridenUnwrappedGir;
       };
-      phases = [ "fixupPhase" ]; # don't remove, it is valid to set phases here.
       dontStrip = true;
       depsTargetTargetPropagated = [ overridenTargetUnwrappedGir ];
-      postFixup = ''
+      buildCommand = ''
+        eval fixupPhase
         ${lib.concatMapStrings (output: ''
           mkdir -p ${"$" + "${output}"}
-          ${lib.getExe buildPackages.xorg.lndir} ${gobject-introspection-unwrapped.${output}} ${"$" + "${output}"}
-        '') gobject-introspection-unwrapped.outputs}
-
-        cp $dev/bin/g-ir-compiler $dev/bin/.g-ir-compiler-wrapped
-        cp $dev/bin/g-ir-scanner $dev/bin/.g-ir-scanner-wrapped
-
-        (
-          rm "$dev/bin/g-ir-compiler"
-          rm "$dev/bin/g-ir-scanner"
-          export bash="${buildPackages.bash}"
-          export emulator=${lib.escapeShellArg (stdenv.targetPlatform.emulator buildPackages)}
-          export emulatorwrapper="$dev/bin/g-ir-scanner-qemuwrapper"
-          export buildlddtree="${buildPackages.pax-utils}/bin/lddtree"
-
-          export targetgir="${lib.getDev overridenTargetUnwrappedGir}"
-
-          substituteAll "${./wrappers/g-ir-compiler.sh}" "$dev/bin/g-ir-compiler"
-          substituteAll "${./wrappers/g-ir-scanner.sh}" "$dev/bin/g-ir-scanner"
-          substituteAll "${./wrappers/g-ir-scanner-lddwrapper.sh}" "$dev/bin/g-ir-scanner-lddwrapper"
-          substituteAll "${./wrappers/g-ir-scanner-qemuwrapper.sh}" "$dev/bin/g-ir-scanner-qemuwrapper"
-          chmod +x $dev/bin/g-ir-compiler
-          chmod +x $dev/bin/g-ir-scanner*
-        )
-      ''
-      # when cross-compiling and using the wrapper then when a package looks up the g_ir_X
-      # variable with pkg-config they'll get the host version which can't be run
-      # override the variable to use the absolute path to g_ir_X in PATH which can be run
-      + ''
-        cat >> $dev/nix-support/setup-hook <<-'EOF'
-          override-pkg-config-gir-variables() {
-            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER="$(type -p g-ir-scanner)"
-            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER="$(type -p g-ir-compiler)"
-            PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE="$(type -p g-ir-generate)"
-            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_SCANNER
-            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_COMPILER
-            export PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_G_IR_GENERATE
-          }
-
-          preConfigureHooks+=(override-pkg-config-gir-variables)
-        EOF
+          ${lib.getExe buildPackages.xorg.lndir} ${overridenUnwrappedGir.${output}} ${"$" + "${output}"}
+        '') overridenUnwrappedGir.outputs}
       '';
     })
-else
-  stdenv.mkDerivation (builtins.removeAttrs overridenUnwrappedGir.drvAttrs [ "name" ] # so we can get a fresh name generated from the pname
-    // {
-    inherit (overridenUnwrappedGir) meta;
-    pname = "gobject-introspection-wrapped";
-    passthru = overridenUnwrappedGir.passthru // {
-      unwrapped = overridenUnwrappedGir;
-    };
-    phases = [ "fixupPhase" ]; # don't remove, it is valid to set phases here.
-    dontStrip = true;
-    depsTargetTargetPropagated = [ overridenTargetUnwrappedGir ];
-    postFixup = ''
-      ${lib.concatMapStrings (output: ''
-        mkdir -p ${"$" + "${output}"}
-        ${lib.getExe buildPackages.xorg.lndir} ${gobject-introspection-unwrapped.${output}} ${"$" + "${output}"}
-      '') gobject-introspection-unwrapped.outputs}
-    '';
-  })
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 5e892c1681c2a..797b3243ab9a0 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , glib
 , freetype
@@ -30,7 +31,7 @@
 }:
 
 let
-  version = "5.2.0";
+  version = "5.3.1";
   inherit (lib) optional optionals optionalString;
   mesonFeatureFlag = feature: flag:
     "-D${feature}=${if flag then "enabled" else "disabled"}";
@@ -42,9 +43,19 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
-    sha256 = "0b4lpkidwx0lf8slczjji652yll6g5zgmm5lmisnb4s7gf8r8nkk";
+    sha256 = "sha256-Smzgl7dagSH6zEuoO1sIO/7GV/RbADzVo0JPKua0Q00=";
   };
 
+  patches = [
+    # Pick upstream patch for exported symbol test failing on darwin
+    # https://github.com/harfbuzz/harfbuzz/issues/3850
+    (fetchpatch {
+      name = "harfbuzz-fix-check-symbol-tests-lto-and-darwin.patch";
+      url = "https://github.com/harfbuzz/harfbuzz/commit/b0b7a65388da25ae3fa01e969ad6abc67eed4f49.patch";
+      sha256 = "0my064r88pikw6q70hbgf6hwfkw544b9f5ai73qhn2a3c83jqn06";
+    })
+  ];
+
   postPatch = ''
     patchShebangs src/*.py test
   '' + lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/httplib/default.nix b/pkgs/development/libraries/httplib/default.nix
new file mode 100644
index 0000000000000..19618613ee175
--- /dev/null
+++ b/pkgs/development/libraries/httplib/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "httplib";
+  version = "0.11.1";
+
+  src = fetchFromGitHub {
+    owner = "yhirose";
+    repo = "cpp-httplib";
+    rev = "v${version}";
+    sha256 = "sha256-rsElqtoRz/sOXpAsfSJbMlwIKdaGJkSZfKHzB/wMhY8=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p "$out/include"
+    cp -r httplib.h "$out/include"
+  '';
+
+  meta = with lib; {
+    description = "A C++ header-only HTTP/HTTPS server and client library";
+    homepage = "https://github.com/yhirose/cpp-httplib";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index 8b82af586704e..66441a911607d 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     owner = "hunspell";
     repo = "hunspell";
     rev = "v${version}";
-    sha256 = "sha256-YSJztik0QTZFNR8k8Xu1hakyE16NziDavYVkEUCbtGM=";
+    sha256 = "sha256-J1kgNUElRO63mtU62qU7asf7hht9oyplMIO9I/E6BPU=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 354b73f80507f..c96bc4e41afcb 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.113";
+  version = "2.4.114";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-f9frKWf2O+tGBvItUOJ32ZNIDQXvdd2Iqb2OZ3Mj5eE=";
+    sha256 = "sha256-MEnPhDpH0S5e7vvDvjSW14L6CfQjRr8Lfe/j0eWY0CY=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index 33ec04734f5b6..da724aaac9b45 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "liblouis";
-  version = "3.23.0";
+  version = "3.24.0";
 
   outputs = [ "out" "dev" "info" "doc" ]
     # configure: WARNING: cannot generate manual pages while cross compiling
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "liblouis";
     repo = "liblouis";
     rev = "v${version}";
-    sha256 = "sha256-jXNhHzydWaMhFbEKoFHyZ77GCvAqxyT3P0xIAgFlTzY=";
+    sha256 = "sha256-QSrCQhP3t+WPyBQPLJbZEaDCjXD8Lo6IAGKHsbL2S1o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libnfs/default.nix b/pkgs/development/libraries/libnfs/default.nix
index cbfc06bc81c50..d9beee7933fa9 100644
--- a/pkgs/development/libraries/libnfs/default.nix
+++ b/pkgs/development/libraries/libnfs/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "libnfs";
@@ -13,7 +13,22 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=tautological-compare";
+  patches = [
+    # Fixes 100% CPU usage in multi-threaded mode
+    (fetchpatch {
+      url = "https://github.com/sahlberg/libnfs/commit/34d6fe37e986da5b0ced86cd028a88e482537d5a.patch";
+      sha256 = "sha256-i7mi+TVdkLb4MztT5Ic/Q8XBIWk9lo8v5bNjHOr6LaI=";
+    })
+    # Fixes deprecation warnings on macOS
+    (fetchpatch {
+      url = "https://github.com/sahlberg/libnfs/commit/f6631c54a7b0385988f11357bf96728a6d7345b9.patch";
+      sha256 = "sha256-xLRZ9J1vr04n//gNv9ljUBt5LHUGBRRVIXJCMlFbHFI=";
+    })
+  ];
+
+  configureFlags = [
+    "--enable-pthread"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libplctag/default.nix b/pkgs/development/libraries/libplctag/default.nix
index df209993bb107..de71d021d015d 100644
--- a/pkgs/development/libraries/libplctag/default.nix
+++ b/pkgs/development/libraries/libplctag/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libplctag";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "libplctag";
     repo = "libplctag";
     rev = "v${version}";
-    sha256 = "sha256-RQlT+G0aSHHETyJaWKhGFdBLSv0qoZsavggv/ubeSQA=";
+    sha256 = "sha256-eWtQaYUWZNQYQOUXnbUfjrtpoO6CnNJ8WjlowA49sG0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 1d2954eb74fcc..6b174a7dfa4df 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -87,10 +87,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     (lib.enableFeature withIntrospection "introspection")
-
-    # Vapi does not build on MacOS.
-    # https://github.com/NixOS/nixpkgs/pull/117081#issuecomment-827782004
-    (lib.enableFeature (withIntrospection && !stdenv.isDarwin) "vala")
+    (lib.enableFeature withIntrospection "vala")
 
     "--enable-always-build-tests"
   ] ++ lib.optional stdenv.isDarwin "--disable-Bsymbolic"
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 82f3b97f6f05a..ffed49235286c 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff.patch";
       sha256 = "sha256-SLq2+JaDEUOPZ5mY4GPB6uwhQOG5cD4qyL5o9i8CVVs=";
     })
+    (fetchpatch {
+      name = "CVE-2022-3970.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be.patch";
+      sha256 = "sha256-pgItgS+UhMjoSjkDJH5y7iGFZ+yxWKqlL7BdT2mFcH0=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index 1f1973b102742..ca16063cca6b9 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -17,8 +17,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ perl libtool ];
 
-  makeFlags = [ "PREFIX=$(out)" ]
-    ++ lib.optional stdenv.isDarwin "LIBTOOL=${libtool}/bin/libtool";
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "LIBTOOL=${libtool}/bin/libtool"
+    "PREFIX=$(out)"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libvterm/default.nix b/pkgs/development/libraries/libvterm/default.nix
index 066dcb4f34f4c..f1e217f2b3e52 100644
--- a/pkgs/development/libraries/libvterm/default.nix
+++ b/pkgs/development/libraries/libvterm/default.nix
@@ -9,17 +9,26 @@ stdenv.mkDerivation rec {
     sha256 = "10gaqygmmwp0cwk3j8qflri5caf8vl3f7pwfl2svw5whv8wkn0k2";
   };
 
-  patchPhase = ''
-    sed -i -e s@/usr@$out@ -e /ldconfig/d Makefile
+  preInstall = ''
+    mkdir -p $out/include $out/lib
   '';
 
-  preInstall = ''
-    mkdir -p $out/include
-    mkdir -p $out/lib
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace "gcc" "${stdenv.cc.targetPrefix}cc" \
+      --replace "ldconfig" "" \
+      --replace "/usr" "$out"
+
+    makeFlagsArray+=("PKG_CFG=`${stdenv.cc.targetPrefix}pkg-config --cflags glib-2.0`")
   '';
 
+  # For headers
+  propagatedBuildInputs = [ glib ];
+
+  strictDeps = true;
+
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib ncurses ];
+  buildInputs = [ ncurses ];
 
   meta = with lib; {
     homepage = "http://libvterm.sourceforge.net/";
diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index 8fe6a7ee0a99b..86bb12ee3d1fd 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libxcrypt";
-  version = "4.4.30";
+  version = "4.4.33";
 
   src = fetchurl {
     url = "https://github.com/besser82/libxcrypt/releases/download/v${version}/libxcrypt-${version}.tar.xz";
-    sha256 = "sha256-s2Z/C6hdqtavJGukCQ++UxY62TyLaioSV9IqeLt87ro=";
+    hash = "sha256-6HrPnGUsVzpHE9VYIVn5jzBdVu1fdUzmT1fUGU1rOm8=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/libyuv/default.nix b/pkgs/development/libraries/libyuv/default.nix
index d0d692ed98151..f4415b51f810f 100644
--- a/pkgs/development/libraries/libyuv/default.nix
+++ b/pkgs/development/libraries/libyuv/default.nix
@@ -24,7 +24,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libjpeg ];
 
-  NIX_CFLAGS_LINK = lib.optional stdenv.isDarwin "-ljpeg";
+  patches = [
+    ./link-library-against-libjpeg.patch
+  ];
 
   meta = with lib; {
     homepage = "https://chromium.googlesource.com/libyuv/libyuv";
diff --git a/pkgs/development/libraries/libyuv/link-library-against-libjpeg.patch b/pkgs/development/libraries/libyuv/link-library-against-libjpeg.patch
new file mode 100644
index 0000000000000..d0f3d29684623
--- /dev/null
+++ b/pkgs/development/libraries/libyuv/link-library-against-libjpeg.patch
@@ -0,0 +1,11 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 636531ee..af1b0e4e 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -39,6 +39,7 @@ INCLUDE ( FindJPEG )
+ if (JPEG_FOUND)
+   include_directories( ${JPEG_INCLUDE_DIR} )
+   target_link_libraries( yuvconvert ${JPEG_LIBRARY} )
++  target_link_libraries( ${ly_lib_shared} ${JPEG_LIBRARY} )
+   add_definitions( -DHAVE_JPEG )
+ endif()
diff --git a/pkgs/development/libraries/mdds/default.nix b/pkgs/development/libraries/mdds/default.nix
index 8ca137e66119e..d85e24f90781b 100644
--- a/pkgs/development/libraries/mdds/default.nix
+++ b/pkgs/development/libraries/mdds/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, boost, llvmPackages }:
+{ lib, stdenv, fetchFromGitLab, autoreconfHook, boost, llvmPackages }:
 
 stdenv.mkDerivation rec {
   pname = "mdds";
   version = "2.0.2";
 
-  src = fetchurl {
-    url = "https://kohei.us/files/${pname}/src/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-EyEfLy44fvO3TXOh3O5Soa1c4G34+OZkdnnfknijEWo=";
+  src = fetchFromGitLab {
+    owner = "mdds";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-jCzF0REocpnP56LfY42zlGTXyKyz4GPovDshhrh4jyo=";
   };
 
   postInstall = ''
@@ -14,14 +16,17 @@ stdenv.mkDerivation rec {
     cp "$out/share/pkgconfig/"* "$out/lib/pkgconfig"
   '';
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   buildInputs = lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
 
   checkInputs = [ boost ];
 
   meta = with lib; {
-    homepage = "https://gitlab.com/mdds/mdds";
     description = "A collection of multi-dimensional data structure and indexing algorithm";
-    platforms = platforms.all;
+    homepage = "https://gitlab.com/mdds/mdds";
+    maintainers = [];
     license = licenses.mit;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 54c1e8acf0415..bcc34905a23f0 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -37,7 +37,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.2.3";
+  version = "22.2.4";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -52,7 +52,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "ee7d026f7b1991dbae0861d359b671145c3a86f2a731353b885d2ea2d5c098d6";
+    sha256 = "sha256-ZddrU8pce0YBng6OW0FN5F0v7NP81xcH9sO8dpHJ96s=";
   };
 
   # TODO:
diff --git a/pkgs/development/libraries/mpfr/default.nix b/pkgs/development/libraries/mpfr/default.nix
index bf1625cf2f9f4..76d2c9e0ece99 100644
--- a/pkgs/development/libraries/mpfr/default.nix
+++ b/pkgs/development/libraries/mpfr/default.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchurl, gmp }:
+{ lib
+, stdenv
+, fetchurl
+, gmp
+, writeScript
+}:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -6,15 +11,15 @@
 # files.
 
 stdenv.mkDerivation rec {
-  version = "4.1.0";
+  version = "4.1.1";
   pname = "mpfr";
 
   src = fetchurl {
     urls = [
-      #"https://www.mpfr.org/${name}/${name}.tar.xz"
+      "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz"
       "mirror://gnu/mpfr/${pname}-${version}.tar.xz"
     ];
-    sha256 = "0zwaanakrqjf84lfr5hfsdr7hncwv9wj0mchlr7cmxigfgqs760c";
+    hash = "sha256-/9GVvVZ9uv/DuYsj/QCq0FN2gMmJYXHkT+P/eeKKwz0=";
   };
 
   outputs = [ "out" "dev" "doc" "info" ];
@@ -31,6 +36,20 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru = {
+    updateScript = writeScript "update-mpfr" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl pcre common-updater-scripts
+
+      set -eu -o pipefail
+
+      # Expect the text in format of '<title>GNU MPFR version 4.1.1</title>'
+      new_version="$(curl -s https://www.mpfr.org/mpfr-current/ |
+          pcregrep -o1 '<title>GNU MPFR version ([0-9.]+)</title>')"
+      update-source-version ${pname} "$new_version"
+    '';
+  };
+
   meta = {
     homepage = "https://www.mpfr.org/";
     description = "Library for multiple-precision floating-point arithmetic";
diff --git a/pkgs/development/libraries/ntirpc/default.nix b/pkgs/development/libraries/ntirpc/default.nix
index 95003a0b00efd..66002df49052c 100644
--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ntirpc";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "ntirpc";
     rev = "v${version}";
-    sha256 = "sha256-RTuWj795YrXVo3TIiEr3Dy/QmSL5Ch0VVc4gRlDhNTM=";
+    sha256 = "sha256-rVv5TLxirtmoRJl0+RupbkvzChuSMSGi3NTa0dchZSU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 5db0a7c8bfa94..ad4654d88b3e5 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -38,7 +38,9 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    cyrus_sasl
+    (cyrus_sasl.override {
+      inherit openssl;
+    })
     db
     libsodium
     libtool
@@ -92,8 +94,6 @@ stdenv.mkDerivation rec {
   preCheck = ''
     substituteInPlace tests/scripts/all \
       --replace "/bin/rm" "rm"
-    # fails saying "SASL(-1): generic failure: internal error: failed to init cipher 'rc4'"
-    rm tests/scripts/test076-authid-rewrite
   '';
 
   doCheck = true;
diff --git a/pkgs/development/libraries/openscenegraph/default.nix b/pkgs/development/libraries/openscenegraph/default.nix
index 885fbb058bd11..3a6a7b57c40f5 100644
--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@@ -23,7 +23,7 @@
   sdlSupport ? false, SDL2,
   restSupport ? false, asio,
   withApps ? false,
-  withExamples ? false, fltk, wxGTK30-gtk3,
+  withExamples ? false, fltk, wxGTK30,
 }:
 
 stdenv.mkDerivation rec {
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional luaSupport lua
     ++ lib.optional sdlSupport SDL2
     ++ lib.optional restSupport asio
-    ++ lib.optionals withExamples [ fltk wxGTK30-gtk3 ]
+    ++ lib.optionals withExamples [ fltk wxGTK30 ]
     ++ lib.optionals stdenv.isDarwin [ AGL Carbon Cocoa Foundation ]
     ++ lib.optional (restSupport || colladaSupport) boost
   ;
diff --git a/pkgs/development/libraries/openssl/3.0/legacy.cnf b/pkgs/development/libraries/openssl/3.0/legacy.cnf
new file mode 100644
index 0000000000000..a6485a8c37962
--- /dev/null
+++ b/pkgs/development/libraries/openssl/3.0/legacy.cnf
@@ -0,0 +1,395 @@
+# Taken from OpenSSL 3.0.7 and modified according to: https://wiki.openssl.org/index.php/OpenSSL_3.0#Programming_in_OpenSSL_3.0
+#
+# OpenSSL example configuration file.
+# See doc/man5/config.pod for more info.
+#
+# This is mostly being used for generation of certificate requests,
+# but may be used for auto loading of providers
+
+# Note that you can include other files from the main configuration
+# file using the .include directive.
+#.include filename
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+
+ # Use this in order to automatically load providers.
+openssl_conf = openssl_init
+
+# Comment out the next line to ignore configuration errors
+config_diagnostics = 1
+
+# Extra OBJECT IDENTIFIER info:
+# oid_file       = $ENV::HOME/.oid
+oid_section = new_oids
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		=
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+# Policies used by the TSA examples.
+tsa_policy1 = 1.2.3.4.1
+tsa_policy2 = 1.2.3.4.5.6
+tsa_policy3 = 1.2.3.4.5.7
+
+# For FIPS
+# Optionally include a file that is generated by the OpenSSL fipsinstall
+# application. This file contains configuration data required by the OpenSSL
+# fips provider. It contains a named section e.g. [fips_sect] which is
+# referenced from the [provider_sect] below.
+# Refer to the OpenSSL security policy for more information.
+# .include fipsmodule.cnf
+
+[openssl_init]
+providers = provider_sect
+
+# List of providers to load
+[provider_sect]
+default = default_sect
+legacy = legacy_sect
+
+# The fips section name should match the section name inside the
+# included fipsmodule.cnf.
+# fips = fips_sect
+
+# If no providers are activated explicitly, the default one is activated implicitly.
+# See man 7 OSSL_PROVIDER-default for more details.
+#
+# If you add a section explicitly activating any other provider(s), you most
+# probably need to explicitly activate the default provider, otherwise it
+# becomes unavailable in openssl.  As a consequence applications depending on
+# OpenSSL may not work correctly which could lead to significant system
+# problems including inability to remotely access the system.
+[default_sect]
+activate = 1
+
+[legacy_sect]
+activate = 1
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= ./demoCA		# Where everything is kept
+certs		= $dir/certs		# Where the issued certs are kept
+crl_dir		= $dir/crl		# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+#unique_subject	= no			# Set to 'no' to allow creation of
+					# several certs with same subject.
+new_certs_dir	= $dir/newcerts		# default place for new certs.
+
+certificate	= $dir/cacert.pem 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crlnumber	= $dir/crlnumber	# the current crl number
+					# must be commented out to leave a V1 CRL
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/private/cakey.pem# The private key
+
+x509_extensions	= usr_cert		# The extensions to add to the cert
+
+# Comment out the following two lines for the "traditional"
+# (and highly broken) format.
+name_opt 	= ca_default		# Subject Name options
+cert_opt 	= ca_default		# Certificate field options
+
+# Extension copying option: use with caution.
+# copy_extensions = copy
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crlnumber must also be commented out to leave a V1 CRL.
+# crl_extensions	= crl_ext
+
+default_days	= 365			# how long to certify for
+default_crl_days= 30			# how long before next CRL
+default_md	= default		# use public key default MD
+preserve	= no			# keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_match
+
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+####################################################################
+[ req ]
+default_bits		= 2048
+default_keyfile 	= privkey.pem
+distinguished_name	= req_distinguished_name
+attributes		= req_attributes
+x509_extensions	= v3_ca	# The extensions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options.
+# default: PrintableString, T61String, BMPString.
+# pkix	 : PrintableString, BMPString (PKIX recommendation before 2004)
+# utf8only: only UTF8Strings (PKIX recommendation after 2004).
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
+string_mask = utf8only
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_default		= AU
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= Some-State
+
+localityName			= Locality Name (eg, city)
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= Internet Widgits Pty Ltd
+
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+
+organizationalUnitName		= Organizational Unit Name (eg, section)
+#organizationalUnitName_default	=
+
+commonName			= Common Name (e.g. server FQDN or YOUR name)
+commonName_max			= 64
+
+emailAddress			= Email Address
+emailAddress_max		= 64
+
+# SET-ex3			= SET extension number 3
+
+[ req_attributes ]
+challengePassword		= A challenge password
+challengePassword_min		= 4
+challengePassword_max		= 20
+
+unstructuredName		= An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+# This is required for TSA certificates.
+# extendedKeyUsage = critical,timeStamping
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer
+
+basicConstraints = critical,CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always
+
+[ proxy_cert_ext ]
+# These extensions should be added when creating a proxy certificate
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+# This really needs to be in place for it to be a proxy certificate.
+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
+
+####################################################################
+[ tsa ]
+
+default_tsa = tsa_config1	# the default TSA section
+
+[ tsa_config1 ]
+
+# These are used by the TSA reply generation only.
+dir		= ./demoCA		# TSA root directory
+serial		= $dir/tsaserial	# The current serial number (mandatory)
+crypto_device	= builtin		# OpenSSL engine to use for signing
+signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
+					# (optional)
+certs		= $dir/cacert.pem	# Certificate chain to include in reply
+					# (optional)
+signer_key	= $dir/private/tsakey.pem # The TSA private key (optional)
+signer_digest  = sha256			# Signing digest to use. (Optional)
+default_policy	= tsa_policy1		# Policy if request did not specify it
+					# (optional)
+other_policies	= tsa_policy2, tsa_policy3	# acceptable policies (optional)
+digests     = sha1, sha256, sha384, sha512  # Acceptable message digests (mandatory)
+accuracy	= secs:1, millisecs:500, microsecs:100	# (optional)
+clock_precision_digits  = 0	# number of digits after dot. (optional)
+ordering		= yes	# Is ordering defined for timestamps?
+				# (optional, default: no)
+tsa_name		= yes	# Must the TSA name be included in the reply?
+				# (optional, default: no)
+ess_cert_id_chain	= no	# Must the ESS cert id chain be included?
+				# (optional, default: no)
+ess_cert_id_alg		= sha1	# algorithm to compute certificate
+				# identifier (optional, default: sha1)
+
+[insta] # CMP using Insta Demo CA
+# Message transfer
+server = pki.certificate.fi:8700
+# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
+# tls_use = 0
+path = pkix/
+
+# Server authentication
+recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer
+ignore_keyusage = 1 # potentially needed quirk
+unprotected_errors = 1 # potentially needed quirk
+extracertsout = insta.extracerts.pem
+
+# Client authentication
+ref = 3078 # user identification
+secret = pass:insta # can be used for both client and server side
+
+# Generic message options
+cmd = ir # default operation, can be overridden on cmd line with, e.g., kur
+
+# Certificate enrollment
+subject = "/CN=openssl-cmp-test"
+newkey = insta.priv.pem
+out_trusted = insta.ca.crt
+certout = insta.cert.pem
+
+[pbm] # Password-based protection for Insta CA
+# Server and client authentication
+ref = $insta::ref # 3078
+secret = $insta::secret # pass:insta
+
+[signature] # Signature-based protection for Insta CA
+# Server authentication
+trusted = insta.ca.crt # does not include keyUsage digitalSignature
+
+# Client authentication
+secret = # disable PBM
+key = $insta::newkey # insta.priv.pem
+cert = $insta::certout # insta.cert.pem
+
+[ir]
+cmd = ir
+
+[cr]
+cmd = cr
+
+[kur]
+# Certificate update
+cmd = kur
+oldcert = $insta::certout # insta.cert.pem
+
+[rr]
+# Certificate revocation
+cmd = rr
+oldcert = $insta::certout # insta.cert.pem
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 35ce5345d6a67..61f758b7c4a96 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -7,6 +7,8 @@
 # This will cause c_rehash to refer to perl via the environment, but otherwise
 # will produce a perfectly functional openssl binary and library.
 , withPerl ? stdenv.hostPlatform == stdenv.buildPlatform
+# path to openssl.cnf file. will be placed in $etc/etc/ssl/openssl.cnf to replace the default
+, conf ? null
 , removeReferencesTo
 }:
 
@@ -193,6 +195,8 @@ let
       rm -r $etc/etc/ssl/misc
 
       rmdir $etc/etc/ssl/{certs,private}
+
+      ${lib.optionalString (conf != null) "cat ${conf} > $etc/etc/ssl/openssl.cnf"}
     '';
 
     postFixup = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index e1675e029fc3b..d396e18aad24b 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -18,7 +18,6 @@
 , ccache
 , xmlstarlet
 , libproxy
-, xlibsWrapper
 , xorg
 , zstd
 , double-conversion
@@ -129,7 +128,6 @@ stdenv.mkDerivation rec {
     unixODBCDrivers.sqlite
     unixODBCDrivers.mariadb
   ] ++ lib.optionals stdenv.isLinux [
-    xlibsWrapper
     util-linux
     systemd
     mtdev
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index 3ac23d28a7983..e28cdb438e5e6 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -4,13 +4,12 @@
 , qtdeclarative
 , wayland
 , pkg-config
-, xlibsWrapper
 , libdrm
 }:
 
 qtModule {
   pname = "qtwayland";
   qtInputs = [ qtbase qtdeclarative ];
-  buildInputs = [ wayland xlibsWrapper libdrm ];
+  buildInputs = [ wayland libdrm ];
   nativeBuildInputs = [ pkg-config ];
 }
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index 05470f61dd3ee..c8f0b37e0659f 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "liblapack";
-  version = "3.10.1";
+  version = "3.11";
 
   src = fetchFromGitHub {
     owner = "Reference-LAPACK";
     repo = "lapack";
     rev = "v${version}";
-    sha256 = "07wwydw72gl4fhfqcyc8sbz7ynm0i23pggyfqn0r9a29g7qh8bqs";
+    sha256 = "sha256-AYD78u70y8cY19hmM/aDjQEzxO8u9lPWhCFxRe5cqXI=";
   };
 
   nativeBuildInputs = [ gfortran cmake ];
diff --git a/pkgs/development/libraries/semver-cpp/default.nix b/pkgs/development/libraries/semver-cpp/default.nix
new file mode 100644
index 0000000000000..966f170eaad07
--- /dev/null
+++ b/pkgs/development/libraries/semver-cpp/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "semver-cpp";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "Neargye";
+    repo = "semver";
+    rev = "v${version}";
+    sha256 = "sha256-nRWmY/GJtSkPJIW7i7/eIr/YtfyvYhJVZBRIDXUC7xg=";
+  };
+
+  # Header-only library.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r include "$out"
+  '';
+
+  meta = with lib; {
+    description = "Semantic Versioning for modern C++";
+    homepage = "https://github.com/Neargye/semver";
+    maintainers = with maintainers; [ aidalgol ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index a29706aefc483..41c0c3217a490 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -5,7 +5,6 @@
 , freetype
 , cmake
 , static ? stdenv.hostPlatform.isStatic
-, libgcc
 }:
 
 stdenv.mkDerivation rec {
@@ -19,9 +18,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config cmake ];
-  buildInputs = [ freetype ]
-    # On aarch64-darwin libgcc won't even build currently, and it doesn't seem needed.
-    ++ lib.optionals (with stdenv; !cc.isGNU && !(isDarwin && isAarch64)) [ libgcc ];
+  buildInputs = [ freetype ];
 
   patches = lib.optionals stdenv.isDarwin [ ./macosx.patch ];
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 085e330bed486..5f13456a47d64 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${optionalString interactive "-interactive"}";
-  version = "3.39.4";
+  version = "3.40.0";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2022/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "sha256-8x1EW0jmfihM8gZxfMFwq2PL5P1/eagnk7dyKF54/bs=";
+    sha256 = "sha256-AzNVIHbScAx1NSJW6Rx4v1zWJJFYm6DGmu0KgYaJgOc=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 4467f38b0479b..1b7fca210faf8 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.39.4";
+    version = "3.40.0";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2022/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "sha256-AtlsbM+BGrm2ORnvcX9+UqRQxCDga9Ep+0g81ww7O7o=";
+      sha256 = "sha256-SFUIKBQgUSk+F5/8aoUg9vv9guHNyni5N5L3ZsyJuOI=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/subunit/default.nix b/pkgs/development/libraries/subunit/default.nix
index 9cc61d2000866..61c30ebcf0335 100644
--- a/pkgs/development/libraries/subunit/default.nix
+++ b/pkgs/development/libraries/subunit/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "subunit";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "https://launchpad.net/subunit/trunk/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "1h7i5ifcx20qkya24j11nbwa829klw7dvnlljdgivgvcx6b20y80";
+    hash = "sha256-hlOOv6kIC97w7ICVsuXeWrsUbVu3tCSzEVKUHXYG2dI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 3643066676247..b432739beccc6 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@@ -38,6 +39,14 @@ stdenv.mkDerivation rec {
     sha256 = "6p1BqfucK0KtgPwsgjJ7XHE9WUyWmwnhpJvmP7dPT64=";
   };
 
+  patches = [
+    # Backport compatibility fix for newer SQLite.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/tracker/-/merge_requests/552.patch";
+      sha256 = "1pmhhj47dbn654vb6a0kh5h6hw71lvaqxr141r60zrv5zx7m3sh9";
+    })
+  ];
+
   postPatch = ''
     patchShebangs utils/data-generators/cc/generate
   '';
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 34b5d4ff3c6ec..d9257b7dec6f4 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wayland-protocols";
-  version = "1.27";
+  version = "1.30";
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
-    hash = "sha256-kEbxCkJdTioAlloDrPtrP7V1pWUDrHLCuGghxpZTN1w=";
+    hash = "sha256-PBSY+2X9K4CwN21+h88hXmrpV7LM26XaRaRIcYgxvGA=";
   };
 
   postPatch = lib.optionalString doCheck ''
diff --git a/pkgs/development/libraries/webkitgtk/fix-bubblewrap-paths.patch b/pkgs/development/libraries/webkitgtk/fix-bubblewrap-paths.patch
index d502958f4f1a2..9be2d74af1bd1 100644
--- a/pkgs/development/libraries/webkitgtk/fix-bubblewrap-paths.patch
+++ b/pkgs/development/libraries/webkitgtk/fix-bubblewrap-paths.patch
@@ -1,16 +1,17 @@
-diff -ru old/webkitgtk-2.26.0/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp webkitgtk-2.26.0/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
---- old/webkitgtk-2.26.0/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp	2019-09-09 04:47:07.000000000 -0400
-+++ webkitgtk-2.26.0/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp	2019-09-20 21:14:10.537921173 -0400
-@@ -724,6 +724,12 @@
-         "--ro-bind-try", "/usr/local/lib64", "/usr/local/lib64",
+diff --git a/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp b/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
+index 0a201fe176..fa3690c12a 100644
+--- a/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
++++ b/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
+@@ -819,6 +819,12 @@ GRefPtr<GSubprocess> bubblewrapSpawn(GSubprocessLauncher* launcher, const Proces
+         sandboxArgs.append("--unshare-ipc");
+     }
  
-         "--ro-bind-try", PKGLIBEXECDIR, PKGLIBEXECDIR,
++    // Nix Directories
++    sandboxArgs.appendVector(Vector<CString>({ "--ro-bind", "@storeDir@", "@storeDir@" }));
++    sandboxArgs.appendVector(Vector<CString>({ "--ro-bind-try", "/run/current-system", "/run/current-system" }));
++    sandboxArgs.appendVector(Vector<CString>({ "--ro-bind-try", "@driverLink@/lib", "@driverLink@/lib" }));
++    sandboxArgs.appendVector(Vector<CString>({ "--ro-bind-try", "@driverLink@/share", "@driverLink@/share" }));
 +
-+        // Nix Directories
-+        "--ro-bind", "@storeDir@", "@storeDir@",
-+        "--ro-bind", "/run/current-system", "/run/current-system",
-+        "--ro-bind-try", "@driverLink@/lib", "@driverLink@/lib",
-+        "--ro-bind-try", "@driverLink@/share", "@driverLink@/share",
-     };
-     // We would have to parse ld config files for more info.
-     bindPathVar(sandboxArgs, "LD_LIBRARY_PATH");
+ #if ENABLE(DEVELOPER_MODE)
+     const char* execDirectory = g_getenv("WEBKIT_EXEC_PATH");
+     if (execDirectory) {
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index 580af7235e05a..e61a6f6c39317 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     owner = "wolfSSL";
     repo = "wolfssl";
     rev = "v${version}-stable";
-    hash = "sha256-d8DDyEsK35WK7c0udZI5HxQLO+mbod8hlbSoa3IWWS0=";
+    hash = "sha256-36L7kZ9Dqp3pDjodqELBdSBFwrf+GnRP7KNFYrRUCuU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK30.nix b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
index 3b848f788c104..b60e1f486dc8f 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK30.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK30.nix
@@ -3,8 +3,6 @@
 , expat
 , fetchFromGitHub
 , gst_all_1
-, withGtk2 ? true
-, gtk2
 , gtk3
 , libGL
 , libGLU
@@ -34,11 +32,6 @@
 , WebKit
 }:
 
-assert withGtk2 -> (!withWebKit);
-
-let
-  gtk = if withGtk2 then gtk2 else gtk3;
-in
 stdenv.mkDerivation rec {
   pname = "wxwidgets";
   version = "3.0.5.1";
@@ -60,7 +53,7 @@ stdenv.mkDerivation rec {
     libjpeg_turbo
     zlib
   ] ++ lib.optionals stdenv.isLinux [
-    gtk
+    gtk3
     libSM
     libXinerama
     libXxf86vm
@@ -148,7 +141,6 @@ stdenv.mkDerivation rec {
   };
 
   passthru = {
-    inherit gtk;
     inherit compat26 compat28 unicode;
   };
 }
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 217922886df81..e379c12f97168 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -312,6 +312,12 @@ rec {
           ln -s $i $out/bin
       done
 
+      # the emulator auto-linked from platform-tools does not find its local qemu, while this one does
+      ${lib.optionalString includeEmulator ''
+        rm $out/bin/emulator
+        ln -s $out/libexec/android-sdk/emulator/emulator $out/bin
+      ''}
+
       # Write licenses
       mkdir -p licenses
       ${lib.concatMapStrings (licenseName:
diff --git a/pkgs/development/node-packages/overrides.nix b/pkgs/development/node-packages/overrides.nix
index 1ef63d3f6b92b..4e5b04e62404c 100644
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -135,10 +135,6 @@ final: prev: {
     meta = oldAttrs.meta // { broken = since "12"; };
   });
 
-  deltachat-desktop = prev."deltachat-desktop-../../applications/networking/instant-messengers/deltachat-desktop".override (oldAttrs: {
-    meta = oldAttrs.meta // { broken = true; }; # use the top-level package instead
-  });
-
   eask = prev."@emacs-eask/cli".override {
     name = "eask";
   };
diff --git a/pkgs/development/ocaml-modules/gen_js_api/default.nix b/pkgs/development/ocaml-modules/gen_js_api/default.nix
index 4baa21c57cf15..39f325b5fe761 100644
--- a/pkgs/development/ocaml-modules/gen_js_api/default.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/default.nix
@@ -10,6 +10,7 @@
 buildDunePackage rec {
   pname = "gen_js_api";
   version = "1.1.1";
+  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "LexiFi";
diff --git a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
index 381fda7acd930..0cfe8f4bbfc1a 100644
--- a/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
+++ b/pkgs/development/ocaml-modules/gen_js_api/ojs.nix
@@ -7,6 +7,7 @@ buildDunePackage rec {
   pname = "ojs";
 
   inherit (gen_js_api) version src;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ js_of_ocaml-compiler ];
 
diff --git a/pkgs/development/ocaml-modules/janestreet/0.14.nix b/pkgs/development/ocaml-modules/janestreet/0.14.nix
index 67d0e6c7896e5..8a640437bcaf2 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.14.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.14.nix
@@ -84,6 +84,7 @@ with self;
 
   async_js = janePackage {
     pname = "async_js";
+    duneVersion = "3";
     hash = "0rld8792lfwbinn9rhrgacivz49vppgy29smpqnvpga89wchjv0v";
     meta.description = "A small library that provide Async support for JavaScript platforms";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -190,6 +191,7 @@ with self;
 
   bonsai = janePackage {
     pname = "bonsai";
+    duneVersion = "3";
     hash = "0k4grabwqc9sy4shzp77bgfvyajvvc0l8qq89ia7cvlwvly7gv6a";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ ppx_pattern_bind ];
@@ -309,6 +311,7 @@ with self;
 
   incr_dom = janePackage {
     pname = "incr_dom";
+    duneVersion = "3";
     hash = "0mi98cwi4npdh5vvcz0pb4sbb9j9dydl52s51rswwc3kn8mipxfx";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -877,6 +880,7 @@ with self;
 
   virtual_dom = janePackage {
     pname = "virtual_dom";
+    duneVersion = "3";
     hash = "0vcydxx0jhbd5hbriahgp947mc7n3xymyrsfny1c4adk6aaq3c5w";
     meta.description = "OCaml bindings for the virtual-dom library";
     buildInputs = [ js_of_ocaml-ppx ];
diff --git a/pkgs/development/ocaml-modules/janestreet/0.15.nix b/pkgs/development/ocaml-modules/janestreet/0.15.nix
index 5ced2323ea70a..019afdbe09c3c 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@@ -87,6 +87,7 @@ with self;
 
   async_js = janePackage {
     pname = "async_js";
+    duneVersion = "3";
     hash = "184j077bz686k5lrqswircnrdqldb316ngpzq7xri1pcsl39sy3q";
     meta.description = "A small library that provide Async support for JavaScript platforms";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -207,6 +208,7 @@ with self;
 
   bonsai = janePackage {
     pname = "bonsai";
+    duneVersion = "3";
     hash = "150zx2g1dmhyrxwqq8j7f2m3hjpmk5bk182ihx2gdbarhw1ainpm";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ ppx_pattern_bind ];
@@ -382,6 +384,7 @@ with self;
 
   incr_dom = janePackage {
     pname = "incr_dom";
+    duneVersion = "3";
     hash = "1sija9w2im8vdp61h387w0mww9hh7jgkgsjcccps4lbv936ac7c1";
     meta.description = "A library for building dynamic webapps, using Js_of_ocaml";
     buildInputs = [ js_of_ocaml-ppx ];
@@ -570,6 +573,7 @@ with self;
 
   ppx_css = janePackage {
     pname = "ppx_css";
+    duneVersion = "3";
     hash = "09dpmj3f3m3z1ji9hq775iqr3cfmv5gh7q9zlblizj4wx4y0ibyi";
     meta.description = "A ppx that takes in css strings and produces a module for accessing the unique names defined within";
     propagatedBuildInputs = [ core_kernel ppxlib js_of_ocaml js_of_ocaml-ppx sedlex ];
@@ -1045,6 +1049,7 @@ with self;
     hash = "15xia9v4ighzm0gv3vbqk9nvg47cvzqmfnl2zr67yxv4b98kyzv3";
     meta.description = "OCaml bindings for the virtual-dom library";
     buildInputs = [ js_of_ocaml-ppx ];
+    duneVersion = "3";
     propagatedBuildInputs = [ core_kernel gen_js_api js_of_ocaml lambdasoup tyxml ];
   };
 
diff --git a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
index 60a07d30d0596..aaa68c2144601 100644
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
  propagatedBuildInputs = [ calendar js_of_ocaml-ppx_deriving_json eliom ];
  nativeBuildInputs = [ ocaml findlib opaline eliom ];
 
+ # Remove widgets not compatible with jsoo 4.1.0
+ # https://github.com/ocsigen/ocsigen-toolkit/issues/221
+ preConfigure = ''
+   rm src/widgets/ot_{carousel,drawer,swipe,tongue}.eliom{,i}
+ '';
+
   strictDeps = true;
 
  installPhase = ''
diff --git a/pkgs/development/python-modules/GitPython/hardcode-git-path.patch b/pkgs/development/python-modules/GitPython/hardcode-git-path.patch
deleted file mode 100644
index 937479959926b..0000000000000
--- a/pkgs/development/python-modules/GitPython/hardcode-git-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/git/cmd.py b/git/cmd.py
-index a4faefe..51ad442 100644
---- a/git/cmd.py
-+++ b/git/cmd.py
-@@ -175,7 +175,7 @@ class Git(LazyMixin):
- 
-     # CONFIGURATION
- 
--    git_exec_name = "git"           # default that should work on linux and windows
-+    git_exec_name = "@git@/bin/git"
- 
-     # Enables debugging of GitPython's git commands
-     GIT_PYTHON_TRACE = os.environ.get("GIT_PYTHON_TRACE", False)
diff --git a/pkgs/development/python-modules/aiogithubapi/default.nix b/pkgs/development/python-modules/aiogithubapi/default.nix
index 051913ccce564..283fd87c55fb2 100644
--- a/pkgs/development/python-modules/aiogithubapi/default.nix
+++ b/pkgs/development/python-modules/aiogithubapi/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiogithubapi";
-  version = "22.10.1";
+  version = "22.12.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ludeeus";
     repo = pname;
-    rev = version;
-    hash = "sha256-ceBuqaMqqL6qwN52765MG4sLt+08hx2G9rUVNC7x6ik=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-j7ikJS6lcqr7K4fU/EL43lFlWtGvPT4V9JC2Iqhi0ec=";
   };
 
   postPatch = ''
@@ -60,6 +60,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client for the GitHub API";
     homepage = "https://github.com/ludeeus/aiogithubapi";
+    changelog = "https://github.com/ludeeus/aiogithubapi/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index f592ba98e3903..f8f155a641564 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -11,7 +11,7 @@
 , cppheaderparser
 , dpkt
 , fetchFromGitHub
-, GitPython
+, gitpython
 , itanium-demangler
 , mulpyplexer
 , nampa
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     cle
     cppheaderparser
     dpkt
-    GitPython
+    gitpython
     itanium-demangler
     mulpyplexer
     nampa
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
index d3911f3701602..463890c61ebcd 100644
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -25,7 +25,7 @@
 , flask-caching
 , flask-session
 , flask-wtf
-, GitPython
+, gitpython
 , graphviz
 , gunicorn
 , httpx
@@ -161,7 +161,7 @@ buildPythonPackage rec {
     flask-session
     flask-wtf
     flask-login
-    GitPython
+    gitpython
     graphviz
     gunicorn
     httpx
diff --git a/pkgs/development/python-modules/astroid/default.nix b/pkgs/development/python-modules/astroid/default.nix
index 6cde2e7550307..9cacef4ac79af 100644
--- a/pkgs/development/python-modules/astroid/default.nix
+++ b/pkgs/development/python-modules/astroid/default.nix
@@ -1,12 +1,10 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonAtLeast
 , pythonOlder
 , isPyPy
 , lazy-object-proxy
 , setuptools
-, setuptools-scm
 , typing-extensions
 , typed-ast
 , pylint
@@ -16,26 +14,24 @@
 
 buildPythonPackage rec {
   pname = "astroid";
-  version = "2.11.7"; # Check whether the version is compatible with pylint
+  version = "2.12.12"; # Check whether the version is compatible with pylint
+  format = "pyproject";
 
-  disabled = pythonOlder "3.6.2";
+  disabled = pythonOlder "3.7.2";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HpniGxKf+daMh/sxP9T9UriYRrUFWqk7kDa8r+EqtVI=";
+    hash = "sha256-FN/bBAxx9p1iAB3WXIZyyKv/zse7xtXzslclADMbouA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
-    setuptools-scm
+    setuptools
   ];
 
   propagatedBuildInputs = [
     lazy-object-proxy
-    setuptools
     wrapt
   ] ++ lib.optionals (pythonOlder "3.10") [
     typing-extensions
@@ -45,11 +41,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytestCheckHook
-  ];
-
-  disabledTests = [
-    # AssertionError: Lists differ: ['ABC[16 chars]yBase', 'Final', 'Generic', 'MyProtocol', 'Protocol', 'object'] != ['ABC[16 chars]yBase', 'Final', 'Generic', 'MyProtocol', 'object']
-    "test_mro_typing_extensions"
+    typing-extensions
   ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/asttokens/default.nix b/pkgs/development/python-modules/asttokens/default.nix
index 4a07d2ac96ec5..f45c5e7aff33c 100644
--- a/pkgs/development/python-modules/asttokens/default.nix
+++ b/pkgs/development/python-modules/asttokens/default.nix
@@ -9,11 +9,12 @@
 
 buildPythonPackage rec {
   pname = "asttokens";
-  version = "2.0.8";
+  version = "2.1.0";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-xh4WJG7Pss3ilYQGtMjrwEPJ5tc6qoPJQWc7NeXTp2s=";
+    hash = "sha256-SqdkAaFRyMxXLZBqrXrqKoQXgINKGdeA9DIcD+G1RjU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-storage-queue/default.nix b/pkgs/development/python-modules/azure-storage-queue/default.nix
index 515b3f398dfd0..aa69731809ba3 100644
--- a/pkgs/development/python-modules/azure-storage-queue/default.nix
+++ b/pkgs/development/python-modules/azure-storage-queue/default.nix
@@ -3,20 +3,23 @@
 , fetchPypi
 , azure-common
 , azure-storage-common
+, msrest
 }:
 
 buildPythonPackage rec {
   pname = "azure-storage-queue";
-  version = "2.1.0";
+  version = "12.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "14e82d3691f1bbd23f2aff143a6c17af3c297164f6e597d223b65a67051ba278";
+    sha256 = "sha256-OzdEJK9y0y2v+Lr5tkYwB0w6iz/VMypFIWs7yWvHsXI=";
+    extension = "zip";
   };
 
   propagatedBuildInputs = [
     azure-common
     azure-storage-common
+    msrest
   ];
 
   # has no tests
diff --git a/pkgs/development/python-modules/bandit/default.nix b/pkgs/development/python-modules/bandit/default.nix
index cf1bbd9c54aa6..73de9a4688d07 100644
--- a/pkgs/development/python-modules/bandit/default.nix
+++ b/pkgs/development/python-modules/bandit/default.nix
@@ -1,31 +1,35 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , fetchPypi
-, lib
 , isPy3k
-
-# pythonPackages
-, GitPython
+, pythonOlder
+, gitpython
 , pbr
 , pyyaml
-, six
+, rich
 , stevedore
 }:
 
 buildPythonPackage rec {
   pname = "bandit";
   version = "1.7.4";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-LWOoxXNBe64ziWLUubBvvGCA907NlVoJKEnh5lxxe9I=";
+    hash = "sha256-LWOoxXNBe64ziWLUubBvvGCA907NlVoJKEnh5lxxe9I=";
   };
 
-  propagatedBuildInputs = [
-    GitPython
+  nativeBuildInputs = [
     pbr
+  ];
+
+  propagatedBuildInputs = [
+    gitpython
     pyyaml
-    six
+    rich
     stevedore
   ];
 
@@ -33,12 +37,15 @@ buildPythonPackage rec {
   #   and this requires Network Connectivity
   doCheck = false;
 
-  meta = {
+  pythonImportsCheck = [
+    "bandit"
+  ];
+
+  meta = with lib; {
     description = "Security oriented static analyser for python code";
-    homepage = "https://bandit.readthedocs.io/en/latest/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      kamadorueda
-    ];
+    homepage = "https://bandit.readthedocs.io/";
+    changelog = "https://github.com/PyCQA/bandit/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kamadorueda ];
   };
 }
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index b2846e3a13a18..812ff1a64cb6c 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     mkdir -p $out/bin
-  '';
+  '' + pip.postPatch;
 
   nativeBuildInputs = [ makeWrapper unzip ];
   buildInputs = [ python ];
diff --git a/pkgs/development/python-modules/btrfsutil/default.nix b/pkgs/development/python-modules/btrfsutil/default.nix
new file mode 100644
index 0000000000000..d529ec09c7058
--- /dev/null
+++ b/pkgs/development/python-modules/btrfsutil/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, btrfs-progs
+}:
+buildPythonPackage {
+  pname = "btrfsutil";
+  inherit (btrfs-progs) version src;
+  format = "setuptools";
+
+  buildInputs = [ btrfs-progs ];
+
+  preConfigure = ''
+    cd libbtrfsutil/python
+  '';
+
+  # No tests
+  doCheck = false;
+  pythonImportsCheck = [ "btrfsutil" ];
+
+  meta = with lib; {
+    description = "Library for managing Btrfs filesystems";
+    homepage = "https://btrfs.wiki.kernel.org/";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ raskin lopsided98 ];
+  };
+}
diff --git a/pkgs/development/python-modules/cccolutils/default.nix b/pkgs/development/python-modules/cccolutils/default.nix
index e231624e40f8f..4c7dfe0de3b20 100644
--- a/pkgs/development/python-modules/cccolutils/default.nix
+++ b/pkgs/development/python-modules/cccolutils/default.nix
@@ -1,23 +1,49 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, krb5Full, nose, GitPython, mock, git }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, git
+, gitpython
+, krb5Full
+, mock
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
-  pname = "CCColUtils";
+  pname = "cccolutils";
   version = "1.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "1gwcq4xan9as1j3q9k2zqrywxp46qx0ljwxbck9id2fvilds6ck3";
+    pname = "CCColUtils";
+    inherit version;
+    hash = "sha256-YzKjG43biRbTZKtzSUHHhtzOfcZfzISHDFolqzrBjL8=";
   };
 
-  buildInputs = [ krb5Full ];
-  propagatedBuildInputs = [ nose GitPython mock git ];
+  buildInputs = [
+    krb5Full
+  ];
+
+  propagatedBuildInputs = [
+    git
+    gitpython
+    mock
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  doCheck = isPy3k; # needs unpackaged module to run tests on python2
+  pythonImportsCheck = [
+    "cccolutils"
+  ];
 
   meta = with lib; {
     description = "Python Kerberos 5 Credential Cache Collection Utilities";
     homepage = "https://pagure.io/cccolutils";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ disassembler ];
   };
 }
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index c80e9a119941f..0bbc30cd23c27 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -27,19 +27,19 @@ let
 in
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "38.0.1"; # Also update the hash in vectors.nix
+  version = "38.0.3"; # Also update the hash in vectors.nix
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HbPYB6FJMfoxf5ZDVpXZ7Dhr57hLYYzGHPpdCLCuM9c=";
+    hash = "sha256-v75u4ZYVsHqYsdIofWpgc/c0c1tJ7kWxEyTYXvxNXL0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-o8l13fnfEUvUdDasq3LxSPArozRHKVsZfQg9DNR6M6Q=";
+    hash = "sha256-lzHLW1N4hZj+nn08NZiPVM/X+SEcIsuZDjEOy0OOkSc=";
   };
 
   cargoRoot = "src/rust";
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 7f33c6cb84f32..f4573a79d102e 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -8,7 +8,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-BDH9EHwfutA3dwSnBRlFs7ORFp/dxPb6C9TtxrbiNd0=";
+    hash = "sha256-HNr9QvU0jXfk5+R5Gu/R9isWvVUqAnSvyTRlM/4y6SU=";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/cryptolyzer/default.nix b/pkgs/development/python-modules/cryptolyzer/default.nix
index 2fd90b23bee0a..5928a9b90ecfe 100644
--- a/pkgs/development/python-modules/cryptolyzer/default.nix
+++ b/pkgs/development/python-modules/cryptolyzer/default.nix
@@ -1,22 +1,26 @@
 { lib
+, attrs
 , buildPythonPackage
-, fetchPypi
 , certvalidator
-, attrs
-, six
-, urllib3
 , cryptoparser
+, fetchPypi
+, pythonOlder
 , requests
+, six
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "cryptolyzer";
-  version = "0.8.1";
+  version = "0.8.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "CryptoLyzer";
     inherit version;
-    sha256 = "sha256-FbxSjKxhzlpj3IezuLCQvoeZMG1q+OE/yn5vB/XE1rI=";
+    hash = "sha256-Bo8w9ijJu9IWdgr8OQws2iErzmuxUhs9YE6NAydPYgM=";
   };
 
   propagatedBuildInputs = [
@@ -28,13 +32,17 @@ buildPythonPackage rec {
     requests
   ];
 
-  doCheck = false; # Tests require networking
+  # Tests require networking
+  doCheck = false;
 
-  pythonImportsCheck = [ "cryptolyzer" ];
+  pythonImportsCheck = [
+    "cryptolyzer"
+  ];
 
   meta = with lib; {
-    description = "Fast and flexible cryptographic protocol analyzer";
+    description = "Cryptographic protocol analyzer";
     homepage = "https://gitlab.com/coroner/cryptolyzer";
+    changelog = "https://gitlab.com/coroner/cryptolyzer/-/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
     maintainers = with maintainers; [ kranzes ];
   };
diff --git a/pkgs/development/python-modules/cryptoparser/default.nix b/pkgs/development/python-modules/cryptoparser/default.nix
index cfac7f20376ed..c4771b394994d 100644
--- a/pkgs/development/python-modules/cryptoparser/default.nix
+++ b/pkgs/development/python-modules/cryptoparser/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "cryptoparser";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-kJg8d1PoGIC0feefbJM8oyXcRyMGdg1wWkQUl/nSNCo=";
+    hash = "sha256-eLQNqeCUnjcxWbazhWHtqJJgvPUMH42fboU5y2ZMy44=";
   };
 
   propagatedBuildInputs = [
@@ -23,11 +23,14 @@ buildPythonPackage rec {
     python-dateutil
   ];
 
-  pythonImportsCheck = [ "cryptoparser" ];
+  pythonImportsCheck = [
+    "cryptoparser"
+  ];
 
   meta = with lib; {
-    description = "Fast and flexible security protocol parser and generator";
+    description = "Security protocol parser and generator";
     homepage = "https://gitlab.com/coroner/cryptoparser";
+    changelog = "https://gitlab.com/coroner/cryptoparser/-/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
     maintainers = with maintainers; [ kranzes ];
   };
diff --git a/pkgs/development/python-modules/curio/default.nix b/pkgs/development/python-modules/curio/default.nix
index 7a66e47966489..931da001fe6dd 100644
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@@ -9,12 +9,13 @@
 
 buildPythonPackage rec {
   pname = "curio";
-  version = "1.5";
+  version = "1.6";
+  format = "setuptools";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-rwghLlkLt9qOTMOcQgEnEUlNwg1iLxYhVbopbMLjvBA=";
+    sha256 = "sha256-VipYbbICFrp9K+gmPeuesHnlYEj5uJBtEdX0WqgcUkc=";
   };
 
   checkInputs = [
@@ -37,8 +38,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "curio" ];
 
   meta = with lib; {
-    homepage = "https://github.com/dabeaz/curio";
     description = "Library for performing concurrent I/O with coroutines in Python";
+    homepage = "https://github.com/dabeaz/curio";
+    changelog = "https://github.com/dabeaz/curio/raw/${version}/CHANGES";
     license = licenses.bsd3;
     maintainers = [ maintainers.marsam ];
   };
diff --git a/pkgs/development/python-modules/cvelib/default.nix b/pkgs/development/python-modules/cvelib/default.nix
index fc81da016f663..49b5c75906913 100644
--- a/pkgs/development/python-modules/cvelib/default.nix
+++ b/pkgs/development/python-modules/cvelib/default.nix
@@ -1,30 +1,45 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
+, click
 , fetchFromGitHub
+, jsonschema
+, pytestCheckHook
+, pythonOlder
 , requests
-, click
-, lib
 }:
 
 buildPythonPackage rec {
   pname = "cvelib";
-  version = "1.0.0";
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "RedHatProductSecurity";
     repo = "cvelib";
     rev = "tags/${version}";
-    sha256 = "sha256-KUj9Cnvl7r8NMmZvVj5CB0uZvLNK5aHcLc+NzxFrv0I=";
+    hash = "sha256-MZzCTUleEddIlZBRhxD8ZgaWAOFcpa5hvNuIjrBJRzk=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
-  propagatedBuildInputs = [ requests click ];
+
+  propagatedBuildInputs = [
+    click
+    jsonschema
+    requests
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [
     "cvelib"
   ];
 
   meta = with lib; {
-    description = "A library and a command line interface for the CVE Services API";
+    description = "Library and a command line interface for the CVE Services API";
     homepage = "https://github.com/RedHatProductSecurity/cvelib";
     license = licenses.mit;
     maintainers = with maintainers; [ raboof ];
diff --git a/pkgs/development/python-modules/dateparser/default.nix b/pkgs/development/python-modules/dateparser/default.nix
index 7db2e1d15b744..950afaabb8dc5 100644
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@@ -13,7 +13,7 @@
 , langdetect
 , parameterized
 , pytestCheckHook
-, GitPython
+, gitpython
 , parsel
 , requests
 , ruamel-yaml
@@ -50,7 +50,7 @@ buildPythonPackage rec {
   checkInputs = [
     parameterized
     pytestCheckHook
-    GitPython
+    gitpython
     parsel
     requests
     ruamel-yaml
diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index 8efa6983150df..db9d6bde16145 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "db-dtypes";
-  version = "1.0.4";
+  version = "1.0.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "googleapis";
     repo = "python-db-dtypes-pandas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ilcVog6mhF83GVa68BppUzvKNRPdSDXla2MU6M2EzLg=";
+    hash = "sha256-RlSze0e2NNHJ6kAbj9TX58MaEPutyjcLXIOYjpugO6o=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pandas Data Types for SQL systems (BigQuery, Spanner)";
     homepage = "https://github.com/googleapis/python-db-dtypes-pandas";
+    changelog = "https://github.com/googleapis/python-db-dtypes-pandas/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/deal-solver/default.nix b/pkgs/development/python-modules/deal-solver/default.nix
index f762ec0ca0ecf..c7241d50146f5 100644
--- a/pkgs/development/python-modules/deal-solver/default.nix
+++ b/pkgs/development/python-modules/deal-solver/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     z3
     astroid
-  ];
+  ] ++ z3.requiredPythonModules;
 
   checkInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 935abb99c8db1..cb6f40e422ce7 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.1.3";
+  version = "4.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Z4u/yGBOskbtVOIGPwdl8TsyGlBSa9yMsflD7af6MfE=";
+    hash = "sha256-04pOEI0jhsuWN9pmqC3I0HM8rt5Mg8Sv29p4r0IUIRs=";
   };
 
   patches = [
@@ -113,6 +113,7 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://docs.djangoproject.com/en/${lib.versions.majorMinor version}/releases/${version}/";
     description = "A high-level Python Web framework that encourages rapid development and clean, pragmatic design.";
     homepage = "https://www.djangoproject.com";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/docstring-to-markdown/default.nix b/pkgs/development/python-modules/docstring-to-markdown/default.nix
index 432f77220adcd..9a17d19a9d146 100644
--- a/pkgs/development/python-modules/docstring-to-markdown/default.nix
+++ b/pkgs/development/python-modules/docstring-to-markdown/default.nix
@@ -2,17 +2,21 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "docstring-to-markdown";
-  version = "0.10";
+  version = "0.11";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "python-lsp";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0rflkbms94wkcypjcnz30bc4w4iww91h7sqq3j2b6ypzl4g48csa";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4Jl1XJpxwbxGWxdF4bOerjHyzHCIHtrydklwwk1WGs4=";
   };
 
   patches = [
@@ -31,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/python-lsp/docstring-to-markdown";
     description = "On the fly conversion of Python docstrings to markdown";
+    changelog = "https://github.com/python-lsp/docstring-to-markdown/releases/tag/v${version}";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ doronbehar ];
   };
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index 76c6f0e2d34e9..96ce96e27f087 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.0.0";
+  version = "1.0.1";
   format = "flit";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-r/ur8T+26YmIw42cVlDnAVaf48HeMjPPthxfM3dGkK0=";
+    hash = "sha256-c4Zvf4Qu3myx2qQsSvB44gNeX3YH8OLHYsxRuzG757I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flake8-bugbear/default.nix b/pkgs/development/python-modules/flake8-bugbear/default.nix
index d80b703522dc1..d1abca2b6e539 100644
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "flake8-bugbear";
-  version = "22.10.27";
+  version = "22.12.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-pzVzCEkndbesX3tzuuPqtpEmCd5/bSuQmJ2J2IPFRMk=";
+    hash = "sha256-/XV0dwCkp1kOrXepEaPPEWefBphGB6rQPeTWmo3cHPY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/frozenlist/default.nix b/pkgs/development/python-modules/frozenlist/default.nix
index 73a5bfdb73fc9..531ee2b925b21 100644
--- a/pkgs/development/python-modules/frozenlist/default.nix
+++ b/pkgs/development/python-modules/frozenlist/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "frozenlist";
-  version = "1.3.1";
+  version = "1.3.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nOzS004uduS5C8y4ig0IaYyfk+h94uTiN048X66HO+Q=";
+    hash = "sha256-lJWRdXvuzyvJwNSpv0+ojY4rwws3jwDtlLOqYyLPrZc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gcal-sync/default.nix b/pkgs/development/python-modules/gcal-sync/default.nix
index 5e4b40e612bc7..110b04f658dfa 100644
--- a/pkgs/development/python-modules/gcal-sync/default.nix
+++ b/pkgs/development/python-modules/gcal-sync/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "gcal-sync";
-  version = "4.0.3";
+  version = "4.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "gcal_sync";
     rev = "refs/tags/${version}";
-    hash = "sha256-FDxyuSR0Ekal/3+OhR3Z0pkiWYMToeCcfwBQp3bjnyw=";
+    hash = "sha256-g0hnwUX33qZ36JgKx3KHP3BciYujQ+Eahe6bF3m87FM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/git-sweep/default.nix b/pkgs/development/python-modules/git-sweep/default.nix
index 2d7da28535cf7..0f223b03760ae 100644
--- a/pkgs/development/python-modules/git-sweep/default.nix
+++ b/pkgs/development/python-modules/git-sweep/default.nix
@@ -1,24 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, GitPython
+, gitpython
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "git-sweep";
   version = "0.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1csp0zd049d643d409rfivbswwzrayb4i6gkypp5mc27fb1z2afd";
+    hash = "sha256-zSnxw3JHsFru9fOZSJZX+XOu144uJ0DaIKYlAtoHV7M=";
   };
 
-  propagatedBuildInputs = [ GitPython ];
+  propagatedBuildInputs = [
+    gitpython
+  ];
 
-  # no tests
+  # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "gitsweep" ];
+  pythonImportsCheck = [
+    "gitsweep"
+  ];
 
   meta = with lib; {
     description = "A command-line tool that helps you clean up Git branches";
@@ -26,5 +34,4 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ pSub ];
   };
-
 }
diff --git a/pkgs/development/python-modules/GitPython/default.nix b/pkgs/development/python-modules/gitpython/default.nix
index 8d89c1af8d0cb..e577a1e508a4a 100644
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/gitpython/default.nix
@@ -1,44 +1,47 @@
 { lib
 , buildPythonPackage
+, ddt
 , fetchFromGitHub
-, substituteAll
-, git
 , gitdb
-, ddt
+, pkgs
 , pythonOlder
+, substituteAll
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "gitpython";
-  version = "3.1.27";
+  version = "3.1.29";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "gitpython-developers";
     repo = "GitPython";
     rev = version;
-    sha256 = "sha256-RA+6JFXHUQoXGErV8+aYuJPsfXzNSZK3kTm6eMbQIss=";
+    hash = "sha256-RNDBoGWnkirPZjxn5oqH3zwYqVFLedNrSRpZOHU0j+w=";
   };
 
-  patches = [
-    (substituteAll {
-      src = ./hardcode-git-path.patch;
-      inherit git;
-    })
-  ];
-
   propagatedBuildInputs = [
-    gitdb
     ddt
+    gitdb
+    pkgs.gitMinimal
   ] ++ lib.optionals (pythonOlder "3.10") [
     typing-extensions
   ];
 
+  postPatch = ''
+    substituteInPlace git/cmd.py \
+      --replace 'git_exec_name = "git"' 'git_exec_name = "${pkgs.gitMinimal}/bin/git"'
+  '';
+
   # Tests require a git repo
   doCheck = false;
 
-  pythonImportsCheck = [ "git" ];
+  pythonImportsCheck = [
+    "git"
+  ];
 
   meta = with lib; {
     description = "Python Git Library";
diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 50819a3c34449..3f983681316ee 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "homematicip";
-  version = "1.0.12";
+  version = "1.0.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-gad+sg5MZvAzy1xE+xF/4GdLClB5EiyPH39nIlhO7IQ=";
+    hash = "sha256-bNVvQbwtef7Q0OBtR/8vsDDPkgGQgzdBC3QyoxLW3Wo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index 7f331c8edad47..f817d8dff2d50 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.20.4";
+  version = "0.21.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eLvxmG9PUX+2RB3M6oG442Wmh6c5GI/aKP/Z8Z5Ixq8=";
+    sha256 = "sha256-1Pl+l28J7crfO2UY/9/D019IzOHWOwjR+UvVEHICTqU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index f11dd0e876421..8cdc0383c22ac 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "4.1.2";
+  version = "4.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kbPiyHu8k0cIkeX1XF2p5yQwiDvEWJhclENQly5QJa0=";
+    hash = "sha256-Ws5P6NTkqrJDSlKrmumdFg/Ud+DwlJafYR9ZOZXwV3M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jpylyzer/default.nix b/pkgs/development/python-modules/jpylyzer/default.nix
index 92c78895eb620..e161b3ffc5021 100644
--- a/pkgs/development/python-modules/jpylyzer/default.nix
+++ b/pkgs/development/python-modules/jpylyzer/default.nix
@@ -1,26 +1,51 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , buildPythonPackage
 , six
+, lxml
 , pytestCheckHook
 }:
 
-buildPythonPackage rec {
+let
+  # unclear relationship between test-files version and jpylyzer version.
+  # upstream appears to just always test against the latest version, so
+  # probably worth updating this when package is bumped.
+  testFiles = fetchFromGitHub {
+    owner = "openpreserve";
+    repo = "jpylyzer-test-files";
+    rev = "146cb0029b5ea9d8ef22dc6683cec8afae1cc63a";
+    sha256 = "sha256-uKUau7mYXqGs4dSnXGPnPsH9k81ZCK0aPj5F9HWBMZ8=";
+  };
+
+in buildPythonPackage rec {
   pname = "jpylyzer";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "openpreserve";
     repo = pname;
     rev = version;
-    sha256 = "1cd9klq83g9p4nkg7x78axqid5vcsqzggp431hcfdiixa50yjxjg";
+    sha256 = "sha256-LBVOwjWC/HEvGgoi8WxEdl33M4JrfdHEj1Dk7f1NAiA=";
   };
 
   propagatedBuildInputs = [ six ];
 
-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [ pytestCheckHook lxml ];
+
+  # don't depend on testFiles on darwin as it may not be extractable due to
+  # weird filenames
+  preCheck = lib.optionalString (!stdenv.isDarwin) ''
+    sed -i '/^testFilesDir = /ctestFilesDir = "${testFiles}"' tests/unit/test_testfiles.py
+  '';
+  disabledTestPaths = lib.optionals stdenv.isDarwin [
+    "tests/unit/test_testfiles.py"
+  ];
+
   pythonImportsCheck = [ "jpylyzer" ];
 
+  disallowedReferences = [ testFiles ];
+
   meta = with lib; {
     description = "JP2 (JPEG 2000 Part 1) image validator and properties extractor";
     homepage = "https://jpylyzer.openpreservation.org/";
diff --git a/pkgs/development/python-modules/json-schema-for-humans/default.nix b/pkgs/development/python-modules/json-schema-for-humans/default.nix
index f420aefd7df97..47cd5fed605a6 100644
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "json-schema-for-humans";
-  version = "0.42.1";
+  version = "0.44";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "coveooss";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-WVLIx85ivHz5b6C1AfgMAApngeFCuWwWhaBWNcfOvXA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LsZPf5PVXPSyHNgfBdjH4hG4OFIdSprO5uj3saPDqzo=";
   };
 
   postPatch = ''
@@ -70,6 +70,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Quickly generate HTML documentation from a JSON schema";
     homepage = "https://github.com/coveooss/json-schema-for-humans";
+    changelog = "https://github.com/coveooss/json-schema-for-humans/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ astro ];
   };
diff --git a/pkgs/development/python-modules/jupytext/default.nix b/pkgs/development/python-modules/jupytext/default.nix
index dabbe303e161c..dc5b56c3c0102 100644
--- a/pkgs/development/python-modules/jupytext/default.nix
+++ b/pkgs/development/python-modules/jupytext/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
-, GitPython
+, gitpython
 , isort
 , jupyter-client
 , jupyter-packaging
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "mwouts";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-DDF4aTLkhEl4xViYh/E0/y6swcwZ9KbeS0qKm+HdFz8=";
+    hash = "sha256-DDF4aTLkhEl4xViYh/E0/y6swcwZ9KbeS0qKm+HdFz8=";
   };
 
   patches = [
@@ -53,7 +53,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-    GitPython
+    gitpython
     isort
     jupyter-client
     notebook
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index 0e80ef1da88ba..0054d8916362e 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.16.6";
+  version = "1.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    sha256 = "sha256-x8a2W64zLDi8r7d8B7GYCwWtSAB3BH+Sprbw+Xr7mH4=";
+    hash = "sha256-nR7ZKKpqiCrQbXsS+znmNht1OvcYL6hSQxHMcJ+/yKA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mathlibtools/default.nix b/pkgs/development/python-modules/mathlibtools/default.nix
index f913beb07ef1c..02a6b5348ed45 100644
--- a/pkgs/development/python-modules/mathlibtools/default.nix
+++ b/pkgs/development/python-modules/mathlibtools/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , click
 , fetchPypi
-, GitPython
+, gitpython
 , networkx
 , pydot
 , PyGithub
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     atomicwrites
     click
-    GitPython
+    gitpython
     networkx
     pydot
     PyGithub
diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 18c00a95e8567..a4d650c27f593 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "meson-python";
-  version = "0.8.1";
+  version = "0.10.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "meson_python";
-    hash = "sha256-RC8fpM9dtQ7qYRcKYFnBD6/XCXf12980QcEGzSOwXkw=";
+    hash = "sha256-CN0SLBB029XFW1OZOnGcynPdghY3LJEhf3pVAmD55+E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index cc5abbdd3d2f4..375c56b6885a5 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -9,7 +9,7 @@
 , fetchpatch
 , fetchPypi
 , flask
-, GitPython
+, gitpython
 , gorilla
 , gunicorn
 , importlib-metadata
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     docker
     entrypoints
     flask
-    GitPython
+    gitpython
     gorilla
     gunicorn
     importlib-metadata
@@ -81,6 +81,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Open source platform for the machine learning lifecycle";
     homepage = "https://github.com/mlflow/mlflow";
+    changelog = "https://github.com/mlflow/mlflow/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ tbenst ];
   };
diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index da00ff3702dd9..78cb915b29e6b 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, pythonOlder
 , hypothesis
 , setuptools-scm
 , six
@@ -19,7 +19,7 @@
 , pygments
 , tornado
 , requests
-, GitPython
+, gitpython
 , jupyter-server-mathjax
 , notebook
 , jinja2
@@ -28,14 +28,18 @@
 buildPythonPackage rec {
   pname = "nbdime";
   version = "3.1.1";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "67767320e971374f701a175aa59abd3a554723039d39fae908e72d16330d648b";
+    hash = "sha256-Z3ZzIOlxN09wGhdapZq9OlVHIwOdOfrpCOctFjMNZIs=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     attrs
@@ -48,7 +52,7 @@ buildPythonPackage rec {
     pygments
     tornado
     requests
-    GitPython
+    gitpython
     notebook
     jinja2
   ];
@@ -78,6 +82,10 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
+  pythonImportsCheck = [
+    "nbdime"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/jupyter/nbdime";
     description = "Tools for diffing and merging of Jupyter notebooks.";
diff --git a/pkgs/development/python-modules/opentimestamps/default.nix b/pkgs/development/python-modules/opentimestamps/default.nix
index e253c0b5c9bff..e5d37fcfba8dc 100644
--- a/pkgs/development/python-modules/opentimestamps/default.nix
+++ b/pkgs/development/python-modules/opentimestamps/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , git
-, GitPython
+, gitpython
 , pycryptodomex
 , pytestCheckHook
 , pythonOlder
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     bitcoinlib
-    GitPython
+    gitpython
     pycryptodomex
   ];
 
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Create and verify OpenTimestamps proofs";
     homepage = "https://github.com/opentimestamps/python-opentimestamps";
+    changelog = "https://github.com/opentimestamps/python-opentimestamps/releases/tag/python-opentimestamps-v${version}";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ erikarvstedt ];
   };
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 98e3ede7fb925..2e3faed87f2b0 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,20 +16,20 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.8.1";
+  version = "3.8.2";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ijl";
     repo = pname;
     rev = version;
-    hash = "sha256-3U27JuKMsMla3BKbbpO0uXesGHYaVQs8MwtQvumkksY=";
+    hash = "sha256-jiyYCjZ6c62zmm4Ge9KbEI8/PtPunu79HVODyoHFdSg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY";
+    hash = "sha256-z1B0oSp37OGJ21Q57UUfmSRfUWLftiiBayN9y6yKNyg=";
   };
 
   format = "pyproject";
@@ -52,12 +52,6 @@ buildPythonPackage rec {
     xxhash
   ];
 
-  disabledTests = lib.optionals (stdenv.is32bit) [
-    # integer overflow on 32bit
-    "test_numpy_array_d1_intp"
-    "test_numpy_array_d1_uintp"
-  ];
-
   pythonImportsCheck = [ pname ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pillow-simd/default.nix b/pkgs/development/python-modules/pillow-simd/default.nix
index b39a86a7fbfcc..f16ef4465562a 100644
--- a/pkgs/development/python-modules/pillow-simd/default.nix
+++ b/pkgs/development/python-modules/pillow-simd/default.nix
@@ -9,6 +9,8 @@ import ../pillow/generic.nix (rec {
   # check for release version on https://pypi.org/project/Pillow-SIMD/#history
   # does not match the latest pillow release version!
   version = "9.0.0.post1";
+  format = "setuptools";
+
   disabled = !isPy3k;
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 6e50be53f99d0..05fe40802c5d5 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -12,14 +12,15 @@
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "9.2.0";
+  version = "9.3.0";
+  format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Pillow";
     inherit version;
-    sha256 = "sha256-deY2/T4PuHJpPyPMuKX/LNV4gBJR86T2hUxqXUN9PAQ=";
+    hash = "sha256-yTWiKlV6VgEI14D5oPxCbddFmUDcVPqknYMknI0+dg8=";
   };
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/pillow/generic.nix b/pkgs/development/python-modules/pillow/generic.nix
index 54f730751076e..adad6038964c8 100644
--- a/pkgs/development/python-modules/pillow/generic.nix
+++ b/pkgs/development/python-modules/pillow/generic.nix
@@ -11,7 +11,7 @@
 with args;
 
 buildPythonPackage rec {
-  inherit pname version src meta passthru patches;
+  inherit pname version format src meta passthru patches;
 
   # Disable imagefont tests, because they don't work well with infinality:
   # https://github.com/python-pillow/Pillow/issues/1259
@@ -19,18 +19,19 @@ buildPythonPackage rec {
     rm Tests/test_imagefont.py
   '';
 
-  # Disable darwin tests which require executables: `iconutil` and `screencapture`
-  disabledTests = lib.optionals stdenv.isDarwin [
-    "test_grab"
-    "test_grabclipboard"
-    "test_save"
+  disabledTests = [
+    # Code quality mismathch 9 vs 10
+    "test_pyroma"
 
     # pillow-simd
     "test_roundtrip"
     "test_basic"
-  ] ++ lib.optionals (lib.versions.major version == "6") [
-    # RuntimeError: Error setting from dictionary
     "test_custom_metadata"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Disable darwin tests which require executables: `iconutil` and `screencapture`
+    "test_grab"
+    "test_grabclipboard"
+    "test_save"
   ];
 
   propagatedBuildInputs = [ olefile ]
diff --git a/pkgs/development/python-modules/pip/default.nix b/pkgs/development/python-modules/pip/default.nix
index 1287ec7017e38..5c24679a9cb3a 100644
--- a/pkgs/development/python-modules/pip/default.nix
+++ b/pkgs/development/python-modules/pip/default.nix
@@ -27,6 +27,12 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ bootstrapped-pip ];
 
+  postPatch = ''
+    # Remove vendored Windows PE binaries
+    # Note: These are unused but make the package unreproducible.
+    find -type f -name '*.exe' -delete
+  '';
+
   # pip detects that we already have bootstrapped_pip "installed", so we need
   # to force it a little.
   pipInstallFlags = [ "--ignore-installed" ];
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index e04b40bc1e44e..e206c33d34cad 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "2.5.2";
+  version = "2.5.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-c7gGgqOUVYA6wYU4+nQsYYw4Gn+DpMoIq2nP8nEdPcg=";
+    sha256 = "sha256-OAvhbgmwGhElszUPksXkOgB5Dp/Wcf4s8807CcT7eyM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 7034ef322ab59..4061edfc5ae41 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -2,7 +2,6 @@
 , lib
 , buildPythonPackage
 , protobuf
-, pyext
 , isPyPy
 }:
 
@@ -31,8 +30,6 @@ buildPythonPackage {
     fi
   '';
 
-  nativeBuildInputs = [ pyext ];
-
   buildInputs = [ protobuf ];
 
   propagatedNativeBuildInputs = [
diff --git a/pkgs/development/python-modules/psrpcore/default.nix b/pkgs/development/python-modules/psrpcore/default.nix
index 41c514d2ca632..09c624bbdc1d3 100644
--- a/pkgs/development/python-modules/psrpcore/default.nix
+++ b/pkgs/development/python-modules/psrpcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "psrpcore";
-  version = "0.1.2";
+  version = "0.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jborean93";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-f1NGE+wSgi8yqBicZZRfUqzinsqazuIaoAje2y+dK1w=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uX99BsQn1Ckl+2Lt4I0EMZLTKeDrX0mtSc9w5aFpvxQ=";
   };
 
   propagatedBuildInputs = [
@@ -38,6 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for the PowerShell Remoting Protocol (PSRP)";
     homepage = "https://github.com/jborean93/psrpcore";
+    changelog = "https://github.com/jborean93/psrpcore/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index b461bc6fdcf07..01f48e627bd23 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.9.3";
+  version = "5.9.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fM/N/qT8SwoCyiwx3n/NGGvrnP+CB4AOFKtm95x3OvY=";
+    hash = "sha256-PX+XOetDXUsTOJRKviP0lYS95TlfJ0h9LuJa2ah3SmI=";
   };
 
   buildInputs =
diff --git a/pkgs/development/python-modules/py-desmume/default.nix b/pkgs/development/python-modules/py-desmume/default.nix
index 0c700151f694e..30631de36e524 100644
--- a/pkgs/development/python-modules/py-desmume/default.nix
+++ b/pkgs/development/python-modules/py-desmume/default.nix
@@ -1,32 +1,68 @@
-{ lib, buildPythonPackage, fetchFromGitHub, GitPython
-, libpcap, meson, ninja, pillow, pkg-config, pygobject3, SDL2
-, alsa-lib, soundtouch, openal
+{ lib
+, alsa-lib
+, buildPythonPackage
+, fetchFromGitHub
+, gitpython
+, libpcap
+, meson
+, ninja
+, openal
+, pillow
+, pkg-config
+, pygobject3
+, pythonOlder
+, SDL2
+, soundtouch
 }:
 
 buildPythonPackage rec {
   pname = "py-desmume";
   version = "0.0.4.post2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SkyTemple";
     repo = pname;
     rev = version;
-    sha256 = "sha256-a819+K/Ovnz53ViDKpUGGjeblWvrAO5ozt/tizdLKCY=";
+    hash = "sha256-a819+K/Ovnz53ViDKpUGGjeblWvrAO5ozt/tizdLKCY=";
     fetchSubmodules = true;
   };
 
-  buildInputs = [ GitPython libpcap SDL2 alsa-lib soundtouch openal ];
-  nativeBuildInputs = [ meson ninja pkg-config ];
-  propagatedBuildInputs = [ pillow pygobject3 ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    gitpython
+    libpcap
+    openal
+    SDL2
+    soundtouch
+  ];
+
+  propagatedBuildInputs = [
+    pillow
+    pygobject3
+  ];
 
-  hardeningDisable = [ "format" ];
+  hardeningDisable = [
+    "format"
+  ];
 
   doCheck = false; # there are no tests
-  pythonImportsCheck = [ "desmume" ];
+
+  pythonImportsCheck = [
+    "desmume"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/SkyTemple/py-desmume";
     description = "Python library to interface with DeSmuME, the Nintendo DS emulator";
+    homepage = "https://github.com/SkyTemple/py-desmume";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ xfix ];
   };
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index e97db8beefe0b..642d3c7e97f51 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/X8DZPFsNrKGbhjZ1GFOj17/NU6p4R+saCW3pLKVNeA=";
+    hash = "sha256-9NS0/fLW2zEmEXhI9GfNN3C/CeI5xibFHwMoUebI90U=";
   };
 
   postPatch = ''
@@ -33,10 +33,16 @@ buildPythonPackage rec {
 
   dontUseCmakeBuildDir = true;
 
+  # Don't build tests if not needed, read the doInstallCheck value at runtime
+  preConfigure = ''
+    if [ -n "$doInstallCheck" ]; then
+      cmakeFlagsArray+=("-DBUILD_TESTING=ON")
+    fi
+  '';
+
   cmakeFlags = [
     "-DBoost_INCLUDE_DIR=${lib.getDev boost}/include"
     "-DEIGEN3_INCLUDE_DIR=${lib.getDev eigen}/include/eigen3"
-    "-DBUILD_TESTING=on"
     "-DPYTHON_EXECUTABLE:FILEPATH=${python.pythonForBuild.interpreter}"
   ] ++ lib.optionals (python.isPy3k && !stdenv.cc.isClang) [
     "-DPYBIND11_CXX_STANDARD=-std=c++17"
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 29ef48bde1651..0b15832ba28a5 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , callPackage
 , fetchFromGitHub
+, fetchpatch
 , cffi
 , gmp
 }:
@@ -21,6 +22,13 @@ buildPythonPackage rec {
     hash = "sha256-SPRoAfwP1MFlVzZsVWmXDWUY5Yje7eg7d+9zJhZNXrw=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/Legrandin/pycryptodome/commit/1c043abb089ddbc2fc43d1c169672688ccc64c64.patch";
+      sha256 = "sha256-QklwOlFpQNAH0CpR06fWSZqx8C97RV8BRsKbp2j8js8=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace lib/Crypto/Math/_IntegerGMP.py \
       --replace 'load_lib("gmp"' 'load_lib("${gmp}/lib/libgmp.so.10"'
diff --git a/pkgs/development/python-modules/pyext/default.nix b/pkgs/development/python-modules/pyext/default.nix
deleted file mode 100644
index eb88bf7858604..0000000000000
--- a/pkgs/development/python-modules/pyext/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, buildPythonPackage, fetchFromGitHub }:
-
-buildPythonPackage {
-    pname = "pyext";
-    version = "0.8";
-
-    # Latest release not on Pypi or tagged since 2015
-    src = fetchFromGitHub {
-      owner = "kirbyfan64";
-      repo = "PyExt";
-      rev = "1e018b12752ceb279f11aee123ed773d63dcec7e";
-      sha256 = "16km897ng6lgjs39hv83xragdxh0mhyw6ds0qkm21cyci1k5m1vm";
-    };
-
-    # Has no test suite
-    doCheck = false;
-
-    meta = with lib; {
-      description = "Simple Python extensions";
-      homepage = "https://github.com/kirbyfan64/PyExt";
-      license = licenses.mit;
-      maintainers = with maintainers; [ edwtjo ];
-    };
-}
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 3bc20493dd641..a8a0229f8621e 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 , installShellFiles
 , astroid
@@ -9,10 +10,12 @@
 , isort
 , mccabe
 , platformdirs
+, requests
+, setuptools
 , tomli
 , tomlkit
 , typing-extensions
-, GitPython
+, gitpython
 , pytest-timeout
 , pytest-xdist
 , pytestCheckHook
@@ -20,8 +23,8 @@
 
 buildPythonPackage rec {
   pname = "pylint";
-  version = "2.14.5";
-  format = "setuptools";
+  version = "2.15.5";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7.2";
 
@@ -29,11 +32,25 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JTFGplqIA6WavwzKOkrm1rHBKNRrplBPvAdEkb/fTlI=";
+    hash = "sha256-dchzwMaUhHB1TqcaMZO9tCZ4KA5I1T+tdkGOxikm5AY=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-dummy-plugin-tests.patch";
+      url = "https://github.com/PyCQA/pylint/commit/e75089bae209d1b9ca72903c0d65530b02f67fdf.patch";
+      hash = "sha256-4ErlCMLTI5xIu1dCvcJsvo03dwcgLLbFFQ5M7DFdL3o=";
+    })
+    (fetchpatch {
+      name = "fix-pythonpath-tests.patch";
+      url = "https://github.com/PyCQA/pylint/commit/6725f761f2ac7a853e315790b496a2eb4d926694.patch";
+      hash = "sha256-Xaeub7uUaC07BBuusA6+neGiXFWWfVNBkGXmYJe7ot4=";
+    })
+  ];
+
   nativeBuildInputs = [
     installShellFiles
+    setuptools
   ];
 
   propagatedBuildInputs = [
@@ -56,11 +73,12 @@ buildPythonPackage rec {
   '';
 
   checkInputs = [
-    GitPython
+    gitpython
     # https://github.com/PyCQA/pylint/blob/main/requirements_test_min.txt
     pytest-timeout
     pytest-xdist
     pytestCheckHook
+    requests
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/pytest-random-order/default.nix b/pkgs/development/python-modules/pytest-random-order/default.nix
index d95af8651f343..223024fe6451e 100644
--- a/pkgs/development/python-modules/pytest-random-order/default.nix
+++ b/pkgs/development/python-modules/pytest-random-order/default.nix
@@ -6,12 +6,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.0.4";
+  version = "1.1.0";
   pname = "pytest-random-order";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6b2159342a4c8c10855bc4fc6d65ee890fc614cb2b4ff688979b008a82a0ff52";
+    sha256 = "sha256-2+beu5NTp6+YTMnt2+s1d91Nu8wVKaeePSH2jtm0VgU=";
   };
 
   disabled = pythonOlder "3.5";
diff --git a/pkgs/development/python-modules/python-arango/default.nix b/pkgs/development/python-modules/python-arango/default.nix
new file mode 100644
index 0000000000000..ba44e94b9a31a
--- /dev/null
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -0,0 +1,138 @@
+{ lib
+, arangodb
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, pyjwt
+, pytest
+, mock
+, requests
+, requests-toolbelt
+}:
+
+let
+  testDBOpts = {
+    host = "127.0.0.1";
+    port = "8529";
+    password = "test";
+    secret = "secret";
+  };
+in
+
+buildPythonPackage rec {
+  pname = "python-arango";
+  version = "7.5.3";
+  disabled = pythonOlder "3.7";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "ArangoDB-Community";
+    repo = "python-arango";
+    rev = version;
+    sha256 = "0qb2yp05z8dmgsyyxqrl3q0a60jaiih96zhxmqrn2yf7as45n07j";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    requests-toolbelt
+    pyjwt
+  ];
+
+  checkInputs = [
+    arangodb
+    mock
+    pytestCheckHook
+  ];
+
+  # arangodb is compiled only for particular target architectures
+  # (i.e. "haswell"). Thus, these tests may not pass reproducibly,
+  # failing with: `166: Illegal instruction` if not run on arangodb's
+  # specified architecture.
+  #
+  # nonetheless, the client library should remain in nixpkgs - since
+  # the client library will talk to arangodb across the network and
+  # architecture issues will be irrelevant.
+  doCheck = false;
+
+  preCheck = lib.optionalString doCheck ''
+    # Start test DB
+    mkdir -p .nix-test/{data,work}
+
+    ICU_DATA=${arangodb}/share/arangodb3 \
+    GLIBCXX_FORCE_NEW=1 \
+    TZ=UTC \
+    TZ_DATA=${arangodb}/share/arangodb3/tzdata \
+    ARANGO_ROOT_PASSWORD=${testDBOpts.password} \
+    ${arangodb}/bin/arangod \
+      --server.uid=$(id -u) \
+      --server.gid=$(id -g) \
+      --server.authentication=true \
+      --server.endpoint=http+tcp://${testDBOpts.host}:${testDBOpts.port} \
+      --server.descriptors-minimum=4096 \
+      --server.jwt-secret=${testDBOpts.secret} \
+      --javascript.app-path=.nix-test/app \
+      --log.file=.nix-test/log \
+      --database.directory=.nix-test/data \
+      --foxx.api=false &
+  '';
+
+  pytestFlagsArray = [
+    "--host"
+    testDBOpts.host
+    "--port"
+    testDBOpts.port
+    "--passwd"
+    testDBOpts.password
+    "--secret"
+    testDBOpts.secret
+  ];
+
+  disabledTests = [
+    # AssertionError geo-related - try enabling later
+    "test_document_find_in_box"
+
+    # maybe arangod misconfig - try enabling later
+    # arango.exceptions.JWTAuthError: [HTTP 401][ERR 401] Wrong credentials
+    "test_auth_jwt"
+
+    # ValueError - try enabling later
+    # maybe missed 3.9.3->3.10.0 changes
+    # most caused by key change: isNewlyCreated->new
+    "test_add_hash_index"
+    "test_add_skiplist_index"
+    "test_add_persistent_index"
+    "test_add_ttl_index"
+    "test_delete_index"
+    "test_pregel_management"
+
+    # formatting error - try enabling later
+    # maybe missed 3.9.3->3.10.0 changes
+    # caused by: body["computedValues"] = None
+    "test_permission_management"
+    "test_collection_misc_methods"
+    "test_collection_management"
+    "test_replication_inventory"
+
+    # want outgoing network to update foxx apis
+    # so foxx.api disabled in arangod startup
+    "test_foxx_service_management_file"
+    "test_foxx_service_management_json"
+    "test_foxx_config_management"
+    "test_foxx_dependency_management"
+    "test_foxx_development_toggle"
+    "test_foxx_misc_functions"
+
+    # no replication configured via arangod invocation
+    "test_replication_applier"
+  ];
+
+  pythonImportsCheck = [ "arango" ];
+
+  meta = with lib; {
+    description = "Python Driver for ArangoDB";
+    homepage = "https://github.com/ArangoDB-Community/python-arango";
+    license = licenses.mit;
+    maintainers = [ maintainers.jsoo1 ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-glanceclient/default.nix b/pkgs/development/python-modules/python-glanceclient/default.nix
index 390aad8b55cd5..560e0db14241d 100644
--- a/pkgs/development/python-modules/python-glanceclient/default.nix
+++ b/pkgs/development/python-modules/python-glanceclient/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "python-glanceclient";
-  version = "4.1.0";
+  version = "4.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fknYBKZzCA6sThugNQT5+p+/hqv8vW6M2LMMpbT+7rY=";
+    hash = "sha256-+CmOh9Dr6Gx8MLkR1u/YNpScOxIO7OUIbJAio+omOpg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index 301ce42f0c776..4e10af5b40d3e 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -18,17 +18,16 @@
 , python-keystoneclient
 , debtcollector
 , callPackage
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "python-manilaclient";
-  version = "4.1.0";
+  version = "4.2.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yoyQyhyqRQZ8yyn3sv94JqkVZQMybwxLGFForZowr3o=";
+    hash = "sha256-Hf/U3LFcIsT00lIzvvZaowfMth/zj5WY6UAxYWjC1JA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-novaclient/default.nix b/pkgs/development/python-modules/python-novaclient/default.nix
index 5ae75098ddd31..62adeb1fe759e 100644
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.1.0";
+  version = "18.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eCBVnRZfGk2BDn2nyV+IQl2L5JX20aPG9CA7isGH4lQ=";
+    hash = "sha256-GFu/LK+189dh8nLj4YSnAMx7pc99UWGQZb5/XEtbfPQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index 718ee964588e2..79750bb2435b2 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2022.2.1";
+  version = "2022.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zqIhQXIE8tGiqgPdrj6GeSGXHQ128U2Hq7RBRBW73PU=";
+    hash = "sha256-6JUSQGt5PKOfWXG8mZzFOM4SXA5RwnlBvvRWi0YAleI=";
   };
 
   checkInputs = [ unittestCheckHook ];
diff --git a/pkgs/development/python-modules/rich-click/default.nix b/pkgs/development/python-modules/rich-click/default.nix
index 4b6f8b4874c86..104e5bfb8297a 100644
--- a/pkgs/development/python-modules/rich-click/default.nix
+++ b/pkgs/development/python-modules/rich-click/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rich-click";
-  version = "1.5.2";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ewels";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-eW5CR7ReVsFLJ09F4EUQbvFB+GdlnTay0bX4NNLQ0xo=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-l8tMyxSkh4eckD21NofK9FBgeGKAqZB0J3B98HpWZ0s=";
   };
 
   propagatedBuildInputs = [
@@ -26,17 +26,6 @@ buildPythonPackage rec {
     rich
   ];
 
-  passthru.optional-dependencies = {
-    typer = [
-      typer
-    ];
-  };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "typer>=0.4,<0.6" "typer>=0.4"
-  '';
-
   # Module has no test
   doCheck = false;
 
@@ -47,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to format click help output nicely with rich";
     homepage = "https://github.com/ewels/rich-click";
+    changelog = "https://github.com/ewels/rich-click/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index c2cd935c651f0..4f87364cfe20f 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
@@ -19,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rich";
-  version = "12.5.1";
+  version = "12.6.0";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -27,7 +26,7 @@ buildPythonPackage rec {
     owner = "Textualize";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FjzvFx+A4DS2XeKBZ2DGRqudvH22AUSQJnIxKs2O0AU=";
+    hash = "sha256-g3tXftEoBCJ1pMdLyDBXQvY9haGMQkuY1/UBOtUqrLE=";
   };
 
   nativeBuildInputs = [ poetry-core ];
@@ -45,11 +44,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.isDarwin [
-    # darwin console duplicates 3 of 4 lines
-    "test_rich_console_ex"
-  ];
-
   pythonImportsCheck = [ "rich" ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/rsa/default.nix b/pkgs/development/python-modules/rsa/default.nix
index 0a70f8d8b0884..74953fa66aada 100644
--- a/pkgs/development/python-modules/rsa/default.nix
+++ b/pkgs/development/python-modules/rsa/default.nix
@@ -1,36 +1,51 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, unittest2
+, fetchFromGitHub
+, poetry-core
 , pyasn1
-, mock
-, isPy3k
+, pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "rsa";
   version = "4.9";
+  format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-44RkpJxshdfxNRsBJmYUh6fgoUpQ8WdexQ6zTU8g7yE=";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "sybrenstuvel";
+    repo = "python-rsa";
+    rev = "version-${version}";
+    hash = "sha256-PwaRe+ICy0UoguXSMSh3PFl5R+YAhJwNdNN9isadlJY=";
   };
 
-  checkInputs = [ unittest2 mock ];
+  preConfigure = lib.optionalString (pythonOlder "3.7") ''
+    substituteInPlace setup.py --replace "open('README.md')" "open('README.md',encoding='utf-8')"
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [ pyasn1 ];
 
-  preConfigure = lib.optionalString (isPy3k && pythonOlder "3.7") ''
-    substituteInPlace setup.py --replace "open('README.md')" "open('README.md',encoding='utf-8')"
+  preCheck = ''
+    sed -i '/addopts/d' tox.ini
   '';
 
-  # No tests in archive
-  doCheck = false;
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    "tests/test_mypy.py"
+  ];
 
   meta = with lib; {
     homepage = "https://stuvel.eu/rsa";
     license = licenses.asl20;
     description = "A pure-Python RSA implementation";
   };
-
 }
diff --git a/pkgs/development/python-modules/rstcheck-core/default.nix b/pkgs/development/python-modules/rstcheck-core/default.nix
index b296f5dc168d6..31938569ca5af 100644
--- a/pkgs/development/python-modules/rstcheck-core/default.nix
+++ b/pkgs/development/python-modules/rstcheck-core/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "rstcheck-core";
-  version = "1.0.2";
+  version = "1.0.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rstcheck";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-XNr+prK9VDP66ZaFvh3Qrx+eJs6mnVO8lvoMC/qrCLs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9U+GhkwBr+f3yEe7McOxqPRUuTp9vP+3WT5wZ92n32w=";
   };
 
   nativeBuildInputs = [
@@ -45,12 +45,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'types-docutils = ">=0.18, <0.19"' 'types-docutils = ">=0.18"' \
-      --replace 'docutils = ">=0.7, <0.19"' 'docutils = ">=0.7"'
-  '';
-
   pythonImportsCheck = [
     "rstcheck_core"
   ];
@@ -58,6 +52,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for checking syntax of reStructuredText";
     homepage = "https://github.com/rstcheck/rstcheck-core";
+    changelog = "https://github.com/rstcheck/rstcheck-core/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/rstcheck/default.nix b/pkgs/development/python-modules/rstcheck/default.nix
index a3789b97088a9..2f2ee962e89a6 100644
--- a/pkgs/development/python-modules/rstcheck/default.nix
+++ b/pkgs/development/python-modules/rstcheck/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "rstcheck";
-  version = "6.1.0";
+  version = "6.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,8 +23,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rstcheck";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-dw/KggiZpKaFZMcTIaSBUhR4oQsZI3iSmEj9Sy80wTs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6TpDzk0GjIn9AnWadwHoYRc3SNi9nBAM7GyKm338wH8=";
   };
 
   nativeBuildInputs = [
@@ -47,12 +47,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'docutils = ">=0.7, <0.19"' 'docutils = ">=0.7"' \
-      --replace 'types-docutils = ">=0.18, <0.19"' 'types-docutils = ">=0.18"'
-  '';
-
   pythonImportsCheck = [
     "rstcheck"
   ];
@@ -65,6 +59,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Checks syntax of reStructuredText and code blocks nested within it";
     homepage = "https://github.com/myint/rstcheck";
+    changelog = "https://github.com/rstcheck/rstcheck/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ staccato ];
   };
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 457a9c622a121..bec9752bc445f 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchPypi
-, fetchpatch
 , python
 , pythonOlder
 , buildPythonPackage
@@ -21,21 +20,14 @@
 
 buildPythonPackage rec {
   pname = "scipy";
-  version = "1.9.1";
+  version = "1.9.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-JtKMRokA5tX9s30oEqtG2wzNIsY7qglQV4cfqjpJi8k=";
+    sha256 = "sha256-+8XAXIXBoCvnex/1kQh8g7xEV5xtK9n7eYu2TqXhoCc=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/scipy/scipy/commit/318d8c6d16fdf000be8637e9917989729f2c8ce7.diff";
-      sha256 = "sha256-Zfb9GYP0r9MDJ91hSzMN1r4eNilajPThNIvZmDzFEXo=";
-    })
-  ];
-
   nativeBuildInputs = [ cython gfortran meson-python pythran pkg-config wheel ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index 4c3dffd0f80ff..873073e105cde 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -5,7 +5,7 @@
 , fetchFromGitHub
 , fsspec
 , funcy
-, GitPython
+, gitpython
 , pathspec
 , pygit2
 , pygtrie
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     dulwich
     fsspec
     funcy
-    GitPython
+    gitpython
     pathspec
     pygit2
     pygtrie
diff --git a/pkgs/development/python-modules/simplejson/default.nix b/pkgs/development/python-modules/simplejson/default.nix
index 74530b3fb830c..0f691bb1bfb9f 100644
--- a/pkgs/development/python-modules/simplejson/default.nix
+++ b/pkgs/development/python-modules/simplejson/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "simplejson";
-  version = "3.17.6";
+  version = "3.18.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "1irlp5sakbdfcf717qmrx0r9rjlmwk0vza6zm3y55d32zw5c1cxg";
+    sha256 = "sha256-X1lD/kCbKDPPgpr2deoVbC5LADqBlNZHvDg7206E9ZE=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/strenum/default.nix b/pkgs/development/python-modules/strenum/default.nix
index d73b60906cc57..563f20f6f7d05 100644
--- a/pkgs/development/python-modules/strenum/default.nix
+++ b/pkgs/development/python-modules/strenum/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "strenum";
-  version = "0.4.8";
+  version = "0.4.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "irgeek";
     repo = "StrEnum";
-    rev = "v${version}";
-    hash = "sha256-S64YfF+cbefXRWoeJK99ZPTiO9DUcDaT77hVQd7pKDk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tElXpwyjrgTw9eHqGPgXakY+G9JXkBQYG7jSZSjv6P0=";
   };
 
   postPatch = ''
@@ -37,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "MOdule for enum that inherits from str";
     homepage = "https://github.com/irgeek/StrEnum";
+    changelog = "https://github.com/irgeek/StrEnum/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/stytra/default.nix b/pkgs/development/python-modules/stytra/default.nix
index fba544789a81c..6923fe36c8ae4 100644
--- a/pkgs/development/python-modules/stytra/default.nix
+++ b/pkgs/development/python-modules/stytra/default.nix
@@ -1,36 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k
-, opencv3
-, pyqt5
-, pyqtgraph
-, numpy
-, scipy
-, numba
-, pandas
-, tables
-, git
-, scikitimage
-, matplotlib
-, qdarkstyle
-, GitPython
+{ lib
 , anytree
-, pims
+, arrayqueues
+, av
+, buildPythonPackage
+, colorspacious
+, fetchPypi
+, flammkuchen
+, git
+, gitpython
 , imageio
 , imageio-ffmpeg
-, av
+, lightparam
+, matplotlib
 , nose
-, pytestCheckHook
+, numba
+, numpy
+, opencv3
+, pandas
+, pims
+, pyqt5
+, pyqtgraph
 , pyserial
-, arrayqueues
-, colorspacious
+, pytestCheckHook
+, pythonOlder
+, qdarkstyle
 , qimage2ndarray
-, flammkuchen
-, lightparam
+, scikitimage
+, scipy
+, tables
 }:
 
 buildPythonPackage rec {
   pname = "stytra";
   version = "0.8.34";
-  disabled = !isPy3k;
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -42,12 +47,6 @@ buildPythonPackage rec {
     rm stytra/tests/test_z_experiments.py
   '';
 
-  checkInputs = [
-    nose
-    pytestCheckHook
-    pyserial
-  ];
-
   propagatedBuildInputs = [
     opencv3
     pyqt5
@@ -61,7 +60,7 @@ buildPythonPackage rec {
     scikitimage
     matplotlib
     qdarkstyle
-    GitPython
+    gitpython
     anytree
     qimage2ndarray
     flammkuchen
@@ -74,10 +73,16 @@ buildPythonPackage rec {
     av
   ];
 
-  meta = {
-    homepage = "https://github.com/portugueslab/stytra";
+  checkInputs = [
+    nose
+    pytestCheckHook
+    pyserial
+  ];
+
+  meta = with lib; {
     description = "A modular package to control stimulation and track behaviour";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ tbenst ];
+    homepage = "https://github.com/portugueslab/stytra";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ tbenst ];
   };
 }
diff --git a/pkgs/development/python-modules/subunit/default.nix b/pkgs/development/python-modules/subunit/default.nix
index 704a4cb924ac7..6f79bf563b803 100644
--- a/pkgs/development/python-modules/subunit/default.nix
+++ b/pkgs/development/python-modules/subunit/default.nix
@@ -9,30 +9,46 @@
 # python dependencies
 , fixtures
 , hypothesis
-, pytest
+, pytestCheckHook
+, setuptools
 , testscenarios
 , testtools
-, unittest2
 }:
 
 buildPythonPackage {
   inherit (subunit) name src meta;
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "version=VERSION" 'version="${subunit.version}"'
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    setuptools
+  ];
 
-  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ check cppunit ];
   propagatedBuildInputs = [ testtools ];
 
-  checkInputs = [ testscenarios hypothesis fixtures pytest unittest2 ];
+  checkInputs = [
+    testscenarios
+    hypothesis
+    fixtures
+    pytestCheckHook
+  ];
 
-  # requires unittest2, which no longer supported in 3.10
-  doCheck = pythonOlder "3.10";
-  # ignore tests which call shell code, or call methods which haven't been implemented
-  checkPhase = ''
-    pytest python/subunit \
-      --ignore=python/subunit/tests/test_{output_filter,test_protocol{,2}}.py
-  '';
+  pytestFlagsArray = [
+    "python/subunit"
+  ];
 
-  postPatch = ''
-    sed -i 's/version=VERSION/version="${subunit.version}"/' setup.py
-  '';
+  disabledTestPaths = [
+    # these tests require testtools and don't work with pytest
+    "python/subunit/tests/test_output_filter.py"
+    "python/subunit/tests/test_test_protocol.py"
+    "python/subunit/tests/test_test_protocol2.py"
+  ];
 }
diff --git a/pkgs/development/python-modules/tern/default.nix b/pkgs/development/python-modules/tern/default.nix
index 635733149504b..4769dc64e7abf 100644
--- a/pkgs/development/python-modules/tern/default.nix
+++ b/pkgs/development/python-modules/tern/default.nix
@@ -1,28 +1,32 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, pyyaml
+, debian-inspector
 , docker
 , dockerfile-parse
-, requests
-, stevedore
-, pbr
-, debian-inspector
-, license-expression
-, regex
-, GitPython
-, prettytable
+, fetchPypi
+, gitpython
 , idna
+, license-expression
 , packageurl-python
+, pbr
+, prettytable
+, pythonOlder
+, pyyaml
+, regex
+, requests
+, stevedore
 }:
 
 buildPythonPackage rec {
   pname = "tern";
   version = "2.10.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MMsq8/Obe3ogQSjiP8EebYseUJGcchMOczUrxE9jht4=";
+    hash = "sha256-MMsq8/Obe3ogQSjiP8EebYseUJGcchMOczUrxE9jht4=";
   };
 
   preBuild = ''
@@ -42,7 +46,7 @@ buildPythonPackage rec {
     stevedore
     debian-inspector
     regex
-    GitPython
+    gitpython
     prettytable
     idna
     packageurl-python
@@ -58,6 +62,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles";
     homepage = "https://github.com/tern-tools/tern";
+    changelog = "https://github.com/tern-tools/tern/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = teams.determinatesystems.members;
   };
diff --git a/pkgs/development/python-modules/tilequant/default.nix b/pkgs/development/python-modules/tilequant/default.nix
index 90caab8ebef81..a72802e2c7b3b 100644
--- a/pkgs/development/python-modules/tilequant/default.nix
+++ b/pkgs/development/python-modules/tilequant/default.nix
@@ -1,4 +1,13 @@
-{ lib, buildPythonPackage, fetchFromGitHub, GitPython, click, ordered-set, pillow, sortedcollections }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, gitpython
+, click
+, ordered-set
+, pythonOlder
+, pillow
+, sortedcollections
+}:
 
 let
   aikku93-tilequant = fetchFromGitHub {
@@ -11,6 +20,9 @@ in
 buildPythonPackage rec {
   pname = "tilequant";
   version = "0.4.0.post0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SkyTemple";
@@ -23,15 +35,26 @@ buildPythonPackage rec {
     cp -R --no-preserve=mode ${aikku93-tilequant} __aikku93_tilequant
   '';
 
-  buildInputs = [ GitPython ];
-  propagatedBuildInputs = [ click ordered-set pillow sortedcollections ];
+  buildInputs = [
+    gitpython
+  ];
+
+  propagatedBuildInputs = [
+    click
+    ordered-set
+    pillow
+    sortedcollections
+  ];
 
   doCheck = false; # there are no tests
-  pythonImportsCheck = [ "skytemple_tilequant" ];
+
+  pythonImportsCheck = [
+    "skytemple_tilequant"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/SkyTemple/tilequant";
     description = "Tool for quantizing image colors using tile-based palette restrictions";
+    homepage = "https://github.com/SkyTemple/tilequant";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ xfix ];
   };
diff --git a/pkgs/development/python-modules/trustme/default.nix b/pkgs/development/python-modules/trustme/default.nix
index 103878ccac69b..fb145ac9a99ad 100644
--- a/pkgs/development/python-modules/trustme/default.nix
+++ b/pkgs/development/python-modules/trustme/default.nix
@@ -21,9 +21,10 @@ buildPythonPackage rec {
   };
 
   checkInputs = [
-    pyopenssl
     service-identity
     pytestCheckHook
+  ] ++ lib.optionals (!stdenv.isDarwin || !stdenv.isAarch64) [
+    pyopenssl
   ];
 
   propagatedBuildInputs = [
@@ -39,6 +40,11 @@ buildPythonPackage rec {
     "test_pyopenssl_end_to_end"
   ];
 
+  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
+    substituteInPlace "tests/test_trustme.py" \
+      --replace "import OpenSSL.SSL" ""
+  '';
+
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index fae5ef8cf1039..86e009d55c408 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -16,6 +16,7 @@
 , glibcLocales
 , h2
 , hyperlink
+, hypothesis
 , idna
 , incremental
 , priority
@@ -45,7 +46,7 @@
 
 buildPythonPackage rec {
   pname = "twisted";
-  version = "22.8.0";
+  version = "22.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -54,17 +55,9 @@ buildPythonPackage rec {
     pname = "Twisted";
     inherit version;
     extension = "tar.gz";
-    hash = "sha256-5bYN458tHaFT++GHTYhf4/y9sh/MRG+nWaU+j8NRO+0=";
+    hash = "sha256-Mqy9QKlPX0bntCwQm/riswIlCUVWF4Oot6BZBI8tTTE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-test_openFileDescriptors.patch";
-      url = "https://github.com/twisted/twisted/commit/47f47634940141466177261b20bb43c300531e38.patch";
-      hash = "sha256-wacnF166PnZHXJEqTlPZUdDILJIVHOcnC2a34SQumvs=";
-    })
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   propagatedBuildInputs = [
@@ -116,6 +109,11 @@ buildPythonPackage rec {
   '' + lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) ''
     echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_fullWriteBufferAfterByteExchange.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
     echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbort.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
+
+    echo 'PosixReactorBaseTests.test_removeAllSkipsInternalReaders.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
+    echo 'PosixReactorBaseTests.test_wakerIsInternalReader.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
+
+    echo 'TCPPortTests.test_connectionLostFailed.skip = "Fails due to unclosed event loop"' >> src/twisted/internet/test/test_posixbase.py
   '';
 
   # Generate Twisted's plug-in cache. Twisted users must do it as well. See
@@ -128,6 +126,7 @@ buildPythonPackage rec {
   checkInputs = [
     git
     glibcLocales
+    hypothesis
     pyhamcrest
   ]
   ++ passthru.optional-dependencies.conch
@@ -169,11 +168,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/twisted/twisted";
-    description = "Twisted, an event-driven networking engine written in Python";
-    longDescription = ''
-      Twisted is an event-driven networking engine written in Python
-      and licensed under the MIT license.
-    '';
+    description = "Asynchronous networking framework written in Python";
     license = licenses.mit;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/versionfinder/default.nix b/pkgs/development/python-modules/versionfinder/default.nix
index 951ae8d9874da..5ca8d76499015 100644
--- a/pkgs/development/python-modules/versionfinder/default.nix
+++ b/pkgs/development/python-modules/versionfinder/default.nix
@@ -2,7 +2,7 @@
 , backoff
 , buildPythonPackage
 , fetchFromGitHub
-, GitPython
+, gitpython
 , pytestCheckHook
 , pythonOlder
 , requests
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    GitPython
+    gitpython
     backoff
   ];
 
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Find the version of another package, whether installed via pip, setuptools or git";
     homepage = "https://github.com/jantman/versionfinder";
+    changelog = "https://github.com/jantman/versionfinder/blob/${version}/CHANGES.rst";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ zakame ];
   };
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index f9e862c0fbbb6..ad1ac6da5dd3d 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -8,7 +8,7 @@
 , fetchFromGitHub
 , flask
 , git
-, GitPython
+, gitpython
 , jsonref
 , jsonschema
 , matplotlib
@@ -67,7 +67,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     click
     docker_pycreds
-    GitPython
+    gitpython
     pathtools
     promise
     protobuf
diff --git a/pkgs/development/python-modules/wrapt/default.nix b/pkgs/development/python-modules/wrapt/default.nix
index b53c52d6098a2..8074cf940c9b5 100644
--- a/pkgs/development/python-modules/wrapt/default.nix
+++ b/pkgs/development/python-modules/wrapt/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "wrapt";
-  version = "1.13.3";
+  version = "1.14.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "GrahamDumpleton";
     repo = pname;
     rev = version;
-    hash = "sha256-kq3Ujkn4HzonzjuQfVnPNnQV+2Rnbr3ZfYmrnY3upxU=";
+    hash = "sha256-nXwDuNo4yZxgjnkus9bVwIZltPaSH93D+PcZMGT2nGM=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/wxPython/4.0.nix b/pkgs/development/python-modules/wxPython/4.0.nix
index d9fead66e3550..380fefbc4cd02 100644
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@@ -12,6 +12,7 @@
 , ncurses
 , libintl
 , wxGTK
+, gtk3
 , IOKit
 , Carbon
 , Cocoa
@@ -42,7 +43,7 @@ buildPythonPackage rec {
   then
     [ AudioToolbox Carbon Cocoa CoreFoundation IOKit OpenGL ]
   else
-    [ wxGTK.gtk ]
+    [ gtk3 ]
   );
 
   propagatedBuildInputs = [
@@ -58,7 +59,7 @@ buildPythonPackage rec {
       --replace 'cairoLib = None' 'cairoLib = ctypes.CDLL("${cairo}/lib/libcairo.so")'
     substituteInPlace wx/lib/wxcairo/wx_pycairo.py \
       --replace '_dlls = dict()' '_dlls = {k: ctypes.CDLL(v) for k, v in [
-        ("gdk",        "${wxGTK.gtk}/lib/libgtk-x11-2.0.so"),
+        ("gdk",        "${gtk3}/lib/libgtk-x11-2.0.so"),
         ("pangocairo", "${pango.out}/lib/libpangocairo-1.0.so"),
         ("appsvc",     None)
       ]}'
diff --git a/pkgs/development/python-modules/zamg/default.nix b/pkgs/development/python-modules/zamg/default.nix
index 11066aa263320..e24e712e7c078 100644
--- a/pkgs/development/python-modules/zamg/default.nix
+++ b/pkgs/development/python-modules/zamg/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "zamg";
-  version = "0.1.2";
+  version = "0.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "killer0071234";
     repo = "python-zamg";
     rev = "refs/tags/v${version}";
-    hash = "sha256-R3byV8llg7X+KYuYTsEtdLSFfLsPD4tyqAaU0CifDks=";
+    hash = "sha256-mql3r1TdVHwpJi54TMj6kfP3uZO2maa5dynUL4fOiNY=";
   };
 
   postPatch = ''
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to read weather data from ZAMG Austria";
     homepage = "https://github.com/killer0071234/python-zamg";
+    changelog = "https://github.com/killer0071234/python-zamg/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/zopfli/default.nix b/pkgs/development/python-modules/zopfli/default.nix
index dc2b14bdc62be..87bb1511e448d 100644
--- a/pkgs/development/python-modules/zopfli/default.nix
+++ b/pkgs/development/python-modules/zopfli/default.nix
@@ -2,16 +2,18 @@
 
 buildPythonPackage rec {
   pname = "zopfli";
-  version = "0.2.1";
+  version = "0.2.2";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ipjkcgdbplsrhr31ypk48px8cax4cm9gcjj7yrcrhg20ql3s9p5";
+    sha256 = "1z1akqx3fjnwa75insch9p08hafikqdvqkj6mxv1k6fr81sxnj9d";
     extension = "zip";
   };
 
+  format = "pyproject";
+
   nativeBuildInputs = [ setuptools-scm ];
 
   buildInputs = [ zopfli ];
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index f5bed2e3f5b2c..2294103151505 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -321,13 +321,13 @@ let
     Biostrings = [ pkgs.zlib ];
     bnpmr = [ pkgs.gsl ];
     cairoDevice = [ pkgs.gtk2.dev ];
-    Cairo = with pkgs; [ libtiff libjpeg cairo.dev xlibsWrapper fontconfig.lib ];
+    Cairo = with pkgs; [ libtiff libjpeg cairo.dev xorg.libXt.dev fontconfig.lib ];
     Cardinal = [ pkgs.which ];
     chebpol = [ pkgs.fftw.dev ];
     ChemmineOB = with pkgs; [ openbabel pkg-config ];
     curl = [ pkgs.curl.dev ];
     data_table = [ pkgs.zlib.dev ] ++ lib.optional stdenv.isDarwin pkgs.llvmPackages.openmp;
-    devEMF = with pkgs; [ xorg.libXft.dev xlibsWrapper ];
+    devEMF = with pkgs; [ xorg.libXft.dev ];
     diversitree = with pkgs; [ gsl fftw ];
     exactextractr = [ pkgs.geos ];
     EMCluster = [ pkgs.lapack ];
@@ -346,7 +346,7 @@ let
     haven = with pkgs; [ libiconv zlib.dev ];
     h5vc = [ pkgs.zlib.dev ];
     HiCseg = [ pkgs.gsl ];
-    imager = [ pkgs.xlibsWrapper ];
+    imager = [ pkgs.xorg.libX11.dev ];
     iBMQ = [ pkgs.gsl ];
     igraph = with pkgs; [ gmp libxml2.dev ];
     JavaGD = [ pkgs.jdk ];
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 5ba3503d98610..35b93abda4900 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.3.25";
-  source.sha256 = "sha256-/YHsRjXEGJtm/QeJU31cs4s4ELcHZfbh6C3aFbl1ka0=";
+  version = "2.3.26";
+  source.sha256 = "sha256-HuU832HnKK2Cxtv/Bs/NhVHVQi6I6GID8OLb6a6Zngk=";
   dontPatchShebangs = true;
 
   passthru.updateScript = writeScript "gem-update-script" ''
@@ -25,6 +25,7 @@ buildRubyGem rec {
   meta = with lib; {
     description = "Manage your Ruby application's gem dependencies";
     homepage = "https://bundler.io";
+    changelog = "https://github.com/rubygems/rubygems/blob/bundler-v${version}/bundler/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [anthonyroussel];
   };
diff --git a/pkgs/development/ruby-modules/with-packages/Gemfile b/pkgs/development/ruby-modules/with-packages/Gemfile
index f11828cb835e3..4799814198016 100644
--- a/pkgs/development/ruby-modules/with-packages/Gemfile
+++ b/pkgs/development/ruby-modules/with-packages/Gemfile
@@ -78,6 +78,7 @@ gem 'idn-ruby'
 gem 'jbuilder'
 gem 'jekyll'
 gem 'jekyll-favicon'
+gem 'jekyll-webmention_io'
 gem 'jmespath'
 gem 'jwt'
 gem 'kramdown-rfc2629'
diff --git a/pkgs/development/tools/agda-pkg/default.nix b/pkgs/development/tools/agda-pkg/default.nix
index 7c4ddb8a68832..498b38ec7aff7 100644
--- a/pkgs/development/tools/agda-pkg/default.nix
+++ b/pkgs/development/tools/agda-pkg/default.nix
@@ -1,4 +1,6 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 with python3Packages;
 
@@ -22,7 +24,7 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     click
-    GitPython
+    gitpython
     pony
     whoosh
     natsort
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 105080ce22307..2db9533590a3f 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -70,7 +70,7 @@ buildPythonApplication rec {
     dockerfile-parse
     dpath
     flake8
-    GitPython
+    gitpython
     jmespath
     jsonpath-ng
     jsonschema
diff --git a/pkgs/development/tools/analysis/cvehound/default.nix b/pkgs/development/tools/analysis/cvehound/default.nix
index 12d36dc6089ef..5bd6cdc006976 100644
--- a/pkgs/development/tools/analysis/cvehound/default.nix
+++ b/pkgs/development/tools/analysis/cvehound/default.nix
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   checkInputs = with python3.pkgs; [
-    GitPython
+    gitpython
     psutil
     pytestCheckHook
   ];
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index e602339303f70..25a7211ef49d5 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.19.0";
+  version = "3.20.0";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-3V40SG8aSD/3vnMAzBa01rJGkJh4d8MnjXl1NNZzjwI=";
+    sha256 = "sha256-hTbAMdvgeNNC8SH6iBqezSBctaeOY5AFrVcAEb2588Y=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index 4b627782d8b54..512f7aeb7bd58 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -1,34 +1,22 @@
 { lib
-, fetchFromGitLab
-, fetchpatch
+, fetchurl
 , meson
 , ninja
 , python3
+, gnome
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2022.1";
+  version = "2022.2";
 
   format = "other";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "GNOME";
-    repo = pname;
-    rev = version;
-    sha256 = "35pL/2TQRVgPfAcfOGCLlSP1LIh4r95mFC+UoXQEEHo=";
+  src = fetchurl {
+    url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
+    sha256 = "JlQ5ENdqedYvZnEihWkqO2KnXzHQfLvupG7sfjTmOlQ=";
   };
 
-  patches = [
-    # Fix gnome-builder build
-    # https://gitlab.gnome.org/GNOME/gi-docgen/-/merge_requests/161
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/0524047ada3e6a5572c43dd36201ebe589d08095.patch";
-      sha256 = "1P+i7v1sMULOd0w8K363Mssj+tBJ2wiSmE7DlztvCbw=";
-    })
-  ];
-
   depsBuildBuild = [
     python3
   ];
@@ -55,6 +43,12 @@ python3.pkgs.buildPythonApplication rec {
       --replace "${python3}" ""
   '';
 
+  passthru = {
+    updateScript = gnome.updateScript {
+      packageName = "gi-docgen";
+    };
+  };
+
   meta = with lib; {
     description = "Documentation generator for GObject-based libraries";
     homepage = "https://gitlab.gnome.org/GNOME/gi-docgen";
diff --git a/pkgs/development/tools/fdroidserver/default.nix b/pkgs/development/tools/fdroidserver/default.nix
index 69c4e9907804b..07448b21bb80d 100644
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@@ -1,12 +1,12 @@
-{ fetchFromGitLab
+{ lib
+, fetchFromGitLab
 , python
-, lib
 , apksigner
 }:
 
 python.pkgs.buildPythonApplication rec {
-  version = "2.1.1";
   pname = "fdroidserver";
+  version = "2.1.1";
 
   src = fetchFromGitLab {
     owner = "fdroid";
@@ -16,24 +16,28 @@ python.pkgs.buildPythonApplication rec {
   };
 
   postPatch = ''
-    substituteInPlace fdroidserver/common.py --replace "FDROID_PATH = os.path.realpath(os.path.join(os.path.dirname(__file__), '..'))" "FDROID_PATH = '$out/bin'"
+    substituteInPlace fdroidserver/common.py \
+      --replace "FDROID_PATH = os.path.realpath(os.path.join(os.path.dirname(__file__), '..'))" "FDROID_PATH = '$out/bin'"
   '';
 
   preConfigure = ''
     ${python.interpreter} setup.py compile_catalog
   '';
+
   postInstall = ''
     patchShebangs gradlew-fdroid
     install -m 0755 gradlew-fdroid $out/bin
   '';
 
-  buildInputs = [ python.pkgs.babel ];
+  buildInputs = with python.pkgs; [
+    babel
+  ];
 
   propagatedBuildInputs = with python.pkgs; [
     androguard
     clint
     defusedxml
-    GitPython
+    gitpython
     libcloud
     mwclient
     paramiko
@@ -59,7 +63,7 @@ python.pkgs.buildPythonApplication rec {
     homepage = "https://f-droid.org";
     description = "Server and tools for F-Droid, the Free Software repository system for Android";
     license = licenses.agpl3;
-    maintainers = [ lib.maintainers.obfusk ];
+    maintainers = with maintainers; [ obfusk ];
   };
 
 }
diff --git a/pkgs/development/tools/go-mockery/default.nix b/pkgs/development/tools/go-mockery/default.nix
index a1b406ff8666e..3b7911c20fe3c 100644
--- a/pkgs/development/tools/go-mockery/default.nix
+++ b/pkgs/development/tools/go-mockery/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-mockery";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     rev = "v${version}";
-    sha256 = "sha256-FgDjuiBFzOaT8GlJYI7xNfxC9uhyZtBAIBFXZgW0BDU=";
+    sha256 = "sha256-RowVdrpUQdoxgJCrg9rzaF/7ZA09SKzjsVrzQb5wzR8=";
   };
 
   preCheck = ''
diff --git a/pkgs/development/tools/misc/autoconf-archive/default.nix b/pkgs/development/tools/misc/autoconf-archive/default.nix
index 318daf9e599dd..9b5ca5de570f7 100644
--- a/pkgs/development/tools/misc/autoconf-archive/default.nix
+++ b/pkgs/development/tools/misc/autoconf-archive/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "autoconf-archive";
-  version = "2022.02.11";
+  version = "2022.09.03";
 
   src = fetchurl {
     url = "mirror://gnu/autoconf-archive/autoconf-archive-${version}.tar.xz";
-    sha256 = "sha256-eKYbYR4u61WongOY4M44e8r1f+LdU8b+QnEw93etHow=";
+    sha256 = "sha256-4HRU8A2MrnkHvtQtB0d5iSeAmUdoTZTDcgek1joy9CM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
index 64313112f43b4..cec91a02f2093 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
@@ -5,12 +5,12 @@
 
 buildDunePackage rec {
   pname = "js_of_ocaml-compiler";
-  version = "4.0.0";
-  useDune2 = true;
+  version = "4.1.0";
+  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
-    sha256 = "sha256:0pj9jjrmi0xxrzmygv4b5whsibw1jxy3wgibmws85x5jwlczh0nz";
+    sha256 = "sha256-kXk/KaWvPeq6P301zqsR5znP4KXMMFVvYgFGGm1CNu8=";
   };
 
   nativeBuildInputs = [ menhir ];
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
index 679fd9ab9de81..9a86e52c65a4f 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/default.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ ppxlib ];
 
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix b/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
index 8cdb7224d891f..741dd1f6acd3a 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/lwt.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-lwt";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ js_of_ocaml-ppx ];
 
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix b/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
index 535fe6dae79c8..8c473d90996e5 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/ppx.nix
@@ -6,7 +6,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-ppx";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   buildInputs = [ js_of_ocaml ];
   propagatedBuildInputs = [ ppxlib ];
diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix b/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
index 5256cd4037fc2..0bb0674d322ef 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/ppx_deriving_json.nix
@@ -5,7 +5,8 @@
 buildDunePackage {
   pname = "js_of_ocaml-ppx_deriving_json";
 
-  inherit (js_of_ocaml-compiler) version src useDune2;
+  inherit (js_of_ocaml-compiler) version src;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ js_of_ocaml ppxlib ];
 
diff --git a/pkgs/development/tools/open-policy-agent/default.nix b/pkgs/development/tools/open-policy-agent/default.nix
index b7f94177c5868..3631c0e9e7fde 100644
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@@ -11,13 +11,13 @@ assert enableWasmEval && stdenv.isDarwin -> builtins.throw "building with wasm o
 
 buildGoModule rec {
   pname = "open-policy-agent";
-  version = "0.45.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    sha256 = "sha256-7w5HOZr1cei7AvMdHdVzjB3ZQGWCOgm/g9UhuO3vSJI=";
+    sha256 = "sha256-aN/3xJFAc4r1nXF01tz4G4lP1KEQZQ3y+QuJ+wToD6M=";
   };
   vendorSha256 = null;
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
index 4b10b3f8dd9af..6dad28bbdc058 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/default.nix
@@ -5,7 +5,7 @@
 }:
 let
   # Poetry2nix version
-  version = "1.37.0";
+  version = "1.38.0";
 
   inherit (poetryLib) isCompatible readTOML normalizePackageName normalizePackageSet;
 
@@ -221,6 +221,16 @@ lib.makeScope pkgs.newScope (self: {
         getFunctorFn
         (
           [
+            # Remove Python packages aliases with non-normalized names to avoid issues with infinite recursion (issue #750).
+            (self: super: lib.attrsets.mapAttrs
+              (
+                name: value:
+                  if lib.isDerivation value && self.hasPythonModule value && (normalizePackageName name) != name
+                  then null
+                  else value
+              )
+              super)
+
             (
               self: super:
                 {
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
index b0607e2616015..a2c30400a60d3 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -1204,6 +1204,9 @@
   "autobahn": [
     "setuptools"
   ],
+  "autoflake": [
+    "hatchling"
+  ],
   "autograd": [
     "setuptools"
   ],
@@ -1262,6 +1265,27 @@
     "poetry-core",
     "setuptools"
   ],
+  "aws-cdk-asset-awscli-v1": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-kubectl-v20": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-node-proxy-agent": [
+    "setuptools"
+  ],
+  "aws-cdk-asset-node-proxy-agent-v5": [
+    "setuptools"
+  ],
+  "aws-cdk-aws-batch-alpha": [
+    "setuptools"
+  ],
+  "aws-cdk-aws-lambda-python-alpha": [
+    "setuptools"
+  ],
+  "aws-cdk-lib": [
+    "setuptools"
+  ],
   "aws-error-utils": [
     "poetry"
   ],
@@ -1280,6 +1304,9 @@
   "awscli-cwlogs": [
     "setuptools"
   ],
+  "awscli-local": [
+    "setuptools"
+  ],
   "awscrt": [
     "setuptools"
   ],
@@ -2995,6 +3022,9 @@
   "construct": [
     "setuptools"
   ],
+  "constructs": [
+    "setuptools"
+  ],
   "consul": [
     "setuptools"
   ],
@@ -3707,6 +3737,9 @@
   "django-4": [
     "setuptools"
   ],
+  "django-admin-sortable2": [
+    "setuptools"
+  ],
   "django-allauth": [
     "setuptools"
   ],
@@ -3763,6 +3796,9 @@
   "django-cors-headers": [
     "setuptools"
   ],
+  "django-countries": [
+    "setuptools"
+  ],
   "django-crispy-forms": [
     "setuptools"
   ],
@@ -3850,6 +3886,9 @@
   "django-modelcluster": [
     "setuptools"
   ],
+  "django-modeltranslation": [
+    "setuptools"
+  ],
   "django-mptt": [
     "setuptools"
   ],
@@ -4706,6 +4745,9 @@
   "fabric": [
     "setuptools"
   ],
+  "fabric2": [
+    "setuptools"
+  ],
   "fabulous": [
     "setuptools"
   ],
@@ -7168,6 +7210,9 @@
     "pbr",
     "setuptools"
   ],
+  "jsii": [
+    "setuptools"
+  ],
   "jsmin": [
     "setuptools"
   ],
@@ -8882,6 +8927,15 @@
   "mypy-boto3-sqs": [
     "setuptools"
   ],
+  "mypy-boto3-ssm": [
+    "setuptools"
+  ],
+  "mypy-boto3-stepfunctions": [
+    "setuptools"
+  ],
+  "mypy-boto3-sts": [
+    "setuptools"
+  ],
   "mypy-extensions": [
     "setuptools"
   ],
@@ -8983,7 +9037,11 @@
     "setuptools"
   ],
   "nbclient": [
-    "setuptools"
+    "setuptools",
+    {
+      "buildSystem": "hatchling",
+      "from": "0.7.1"
+    }
   ],
   "nbconflux": [
     "setuptools"
@@ -9521,6 +9579,9 @@
   "openapi-core": [
     "setuptools"
   ],
+  "openapi-python-client": [
+    "poetry-core"
+  ],
   "openapi-schema-validator": [
     "poetry-core",
     "setuptools"
@@ -12038,7 +12099,8 @@
     "setuptools"
   ],
   "pymssql": [
-    "cython"
+    "cython",
+    "setuptools"
   ],
   "pymsteams": [
     "setuptools"
@@ -12771,6 +12833,9 @@
   "pyssim": [
     "setuptools"
   ],
+  "pystac": [
+    "setuptools"
+  ],
   "pystache": [
     "setuptools"
   ],
@@ -12932,6 +12997,9 @@
     "setuptools",
     "setuptools-scm"
   ],
+  "pytest-docker": [
+    "setuptools"
+  ],
   "pytest-doctestplus": [
     "setuptools",
     "setuptools-scm"
@@ -13640,6 +13708,9 @@
   "python-uinput": [
     "setuptools"
   ],
+  "python-ulid": [
+    "setuptools"
+  ],
   "python-unshare": [
     "setuptools"
   ],
@@ -15995,6 +16066,9 @@
   "streamlabswater": [
     "setuptools"
   ],
+  "streamlink": [
+    "setuptools"
+  ],
   "streamz": [
     "setuptools"
   ],
@@ -16702,6 +16776,9 @@
   "tornado": [
     "setuptools"
   ],
+  "tornado-utils": [
+    "setuptools"
+  ],
   "torpy": [
     "setuptools"
   ],
@@ -16982,6 +17059,9 @@
     "flit-core",
     "setuptools"
   ],
+  "types-aioboto3": [
+    "setuptools"
+  ],
   "types-aiobotocore": [
     "setuptools"
   ],
@@ -16994,6 +17074,9 @@
   "types-aiobotocore-elbv2": [
     "setuptools"
   ],
+  "types-aiobotocore-resourcegroupstaggingapi": [
+    "setuptools"
+  ],
   "types-aiobotocore-ssm": [
     "setuptools"
   ],
@@ -17039,9 +17122,15 @@
   "types-markdown": [
     "setuptools"
   ],
+  "types-pkg-resources": [
+    "setuptools"
+  ],
   "types-protobuf": [
     "setuptools"
   ],
+  "types-python-dateutil": [
+    "setuptools"
+  ],
   "types-pytz": [
     "setuptools"
   ],
@@ -17060,6 +17149,9 @@
   "types-setuptools": [
     "setuptools"
   ],
+  "types-six": [
+    "setuptools"
+  ],
   "types-tabulate": [
     "setuptools"
   ],
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index a19095230826a..cff0b459d64b8 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -59,9 +59,6 @@ let
 
 in
 lib.composeManyExtensions [
-  # normalize all the names
-  (self: super: poetryLib.normalizePackageSet super)
-
   # NixOps
   (self: super:
     lib.mapAttrs (_: v: addBuildSystem { inherit self; drv = v; attr = "poetry"; }) (lib.filterAttrs (n: _: lib.strings.hasPrefix "nixops" n) super)
@@ -639,6 +636,7 @@ lib.composeManyExtensions [
 
       fiona = super.fiona.overridePythonAttrs (
         old: {
+          format = "setuptools";
           buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.gdal ];
           nativeBuildInputs = [
             pkgs.gdal # for gdal-config
@@ -1395,6 +1393,7 @@ lib.composeManyExtensions [
             "3.7.9" = "sha256-QHzAhjHgm4XLxY2zUdnIsd/WWMI7dJLQQAvTXC+2asQ=";
             "3.8.0" = "sha256-8k0DetamwLqkdcg8V/D2J5ja6IJSLi50CE+ZjFa7Hdc=";
             "3.8.1" = "sha256-QXguyDxQHW9Fd3Nhmi5JzSxZQuk3HGPhhh/RGuOTZNY=";
+            "3.8.3" = "sha256-oSZO4cN1sJKd0T7pYrKG63is8AZMKaLRZqj5UCVY/14=";
           }.${version} or (
             lib.warn "Unknown orjson version: '${version}'. Please update getCargoHash." lib.fakeHash
           );
@@ -1771,7 +1770,7 @@ lib.composeManyExtensions [
 
       pymssql = super.pymssql.overridePythonAttrs (old: {
         buildInputs = (old.buildInputs or [ ])
-          ++ [ pkgs.openssl ];
+          ++ [ pkgs.openssl pkgs.libkrb5 ];
         propagatedBuildInputs = (old.propagatedBuildInputs or [ ])
           ++ [ pkgs.freetds ];
       });
@@ -2399,6 +2398,7 @@ lib.composeManyExtensions [
         let
           # Watchfiles does not include Cargo.lock in tarball released on PyPi for versions up to 0.17.0
           getRepoHash = version: {
+            "0.18.1" = "sha256-XEhu6M1hFi3/gAKZcei7KJSrIhhlZhlvZvbfyA6VLR4=";
             "0.18.0" = "sha256-biGGn0YAUbSO1hCJ4kU0ZWlqlXl/HRrBS3iIA3myRI8=";
             "0.17.0" = "1swpf265h9qq30cx55iy6jjirba3wml16wzb68k527ynrxr7hvqx";
             "0.16.1" = "1ss6gzcr6js2d2sddgz1p52gyiwpqmgrxm8r6wim7gnm4wvhav8a";
diff --git a/pkgs/development/tools/protoc-gen-validate/default.nix b/pkgs/development/tools/protoc-gen-validate/default.nix
index b06f345d71f37..13b61e1d694de 100644
--- a/pkgs/development/tools/protoc-gen-validate/default.nix
+++ b/pkgs/development/tools/protoc-gen-validate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protoc-gen-validate";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "protoc-gen-validate";
     rev = "v${version}";
-    sha256 = "sha256-k8FUdQDgtR6g/LRCT45RYVUImEKCneQh9BG6P4y1SME=";
+    sha256 = "sha256-5Vr7qE6AFesvBkOpgStxI26m8rbQ8pXOXvNxbcX/ilc=";
   };
 
-  vendorSha256 = "sha256-ZchgruaQOokgCh+6qkVr/d+PVflh/lKd10Ty+bMBEH0=";
+  vendorSha256 = "sha256-D8ITrzEwas/UElfsXBG2BfHGFcFsxzWFar2ehgLwy5U=";
 
   excludedPackages = [ "tests" ];
 
diff --git a/pkgs/development/tools/refurb/default.nix b/pkgs/development/tools/refurb/default.nix
index 1ecfd6e2bfe23..89fc4e87438ad 100644
--- a/pkgs/development/tools/refurb/default.nix
+++ b/pkgs/development/tools/refurb/default.nix
@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "refurb";
-  version = "1.7.0";
+  version = "1.8.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "dosisod";
     repo = "refurb";
-    rev = "v${version}";
-    hash = "sha256-JA/kU+2cpNKY2umA3NXwsqbfOMv9t6I7GlMYhiA6GTg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dpPPhA5bVLiG9DsJ3RnO9RpCd0j4u5f//x/OTdlC+GQ=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index dcf13834a51ff..5afee4e069ceb 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.132";
+  version = "0.0.165";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0UcZBGD1l2hP8VH0tdNKY/SiXVTPLL0/eZpOwYnUgPs=";
+    sha256 = "sha256-McbLVoYujMNFoZg4rOZW1GNzUYymZHEohNEntOnaP1M=";
   };
 
-  cargoSha256 = "sha256-DlSSzFf2AludfAKrXSsI/V0K2ZjCy/ehZd3ULe3fjK4=";
+  cargoSha256 = "sha256-2YczpduILH3gSXCEG2w2n1yG4bqox4MMViZJcEFNRtw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/development/tools/rust/cargo-public-api/default.nix b/pkgs/development/tools/rust/cargo-public-api/default.nix
index 4bc23ae141d0c..d5627993e2983 100644
--- a/pkgs/development/tools/rust/cargo-public-api/default.nix
+++ b/pkgs/development/tools/rust/cargo-public-api/default.nix
@@ -8,14 +8,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.24.0";
+  version = "0.24.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-6PAOyZmaqsHHyzS9sI591tnAi3/kwRlQR4K4iZJmR5Q=";
+    sha256 = "sha256-xXwJ6MXnSgqIQ5IuqfDm/TUXgkppKCPG3TB7veza/H8=";
   };
 
-  cargoSha256 = "sha256-wWSVpWmD1ZItXgH5q0u16oBQ+d4wKjg+pvt/ZlgiWBg=";
+  cargoSha256 = "sha256-1sSvK8oZspIxDcMAl2MyAQzuijAxj1kpiZf1QwwyYDs=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/games/heroic/fhsenv.nix b/pkgs/games/heroic/fhsenv.nix
index 75012f405f81a..d3625ad129b65 100644
--- a/pkgs/games/heroic/fhsenv.nix
+++ b/pkgs/games/heroic/fhsenv.nix
@@ -12,6 +12,7 @@ buildFHSUserEnv {
 
   targetPkgs = pkgs: with pkgs; [
     heroic-unwrapped
+    gamemode
     curl
     gawk
     gnome.zenity
@@ -49,21 +50,27 @@ buildFHSUserEnv {
     ];
   in pkgs: with pkgs; [
     alsa-lib
+    alsa-plugins
     bash
+    cabextract
     cairo
     coreutils
     cups
     dbus
+    freealut
     freetype
     fribidi
     giflib
     glib
     gnutls
+    gst_all_1.gst-plugins-base
     gtk3
     lcms2
     libevdev
+    libgcrypt
     libGLU
     libglvnd
+    libgpg-error
     libjpeg
     libkrb5
     libmpeg2
@@ -83,16 +90,19 @@ buildFHSUserEnv {
     libxkbcommon
     libxml2
     mpg123
+    ncurses
     ocl-icd
     openldap
     pipewire
     samba4
     sane-backends
     SDL2
+    sqlite
     udev
     udev
     unixODBC
     util-linux
+    v4l-utils
     vulkan-loader
     wayland
     zlib
diff --git a/pkgs/games/megaglest/default.nix b/pkgs/games/megaglest/default.nix
index 21ee6fa37448a..e8558af0732a5 100644
--- a/pkgs/games/megaglest/default.nix
+++ b/pkgs/games/megaglest/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, cmake, pkg-config, git, curl, SDL2, xercesc, openal, lua, libvlc
-, libjpeg, wxGTK30-gtk3, cppunit, ftgl, glew, libogg, libvorbis, buildEnv, libpng
+, libjpeg, wxGTK30, cppunit, ftgl, glew, libogg, libvorbis, buildEnv, libpng
 , fontconfig, freetype, xorg, makeWrapper, bash, which, gnome, libGLU, glib
 , fetchFromGitHub, fetchpatch
 }:
@@ -9,7 +9,7 @@ let
     name = "megaglest-lib-env";
     paths = [ SDL2 xorg.libSM xorg.libICE xorg.libX11 xorg.libXext
       xercesc openal libvorbis lua libjpeg libpng curl fontconfig ftgl freetype
-      stdenv.cc.cc glew libGLU wxGTK30-gtk3 ];
+      stdenv.cc.cc glew libGLU wxGTK30 ];
   };
   path-env = buildEnv {
     name = "megaglest-path-env";
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ cmake pkg-config makeWrapper git ];
-  buildInputs = [ curl SDL2 xercesc openal lua libpng libjpeg libvlc wxGTK30-gtk3
+  buildInputs = [ curl SDL2 xercesc openal lua libpng libjpeg libvlc wxGTK30
     glib cppunit fontconfig freetype ftgl glew libogg libvorbis libGLU ];
 
   cmakeFlags = [
diff --git a/pkgs/games/portmod/default.nix b/pkgs/games/portmod/default.nix
index 27e00a746486c..3ae372a0a8c54 100644
--- a/pkgs/games/portmod/default.nix
+++ b/pkgs/games/portmod/default.nix
@@ -1,6 +1,21 @@
-{ lib, callPackage, python3Packages, fetchFromGitLab, cacert
-, rustPlatform, bubblewrap, git, perlPackages, imagemagick, fetchurl, fetchzip
-, jre, makeWrapper, tr-patcher, tes3cmd, openmw }:
+{ lib
+, bubblewrap
+, cacert
+, callPackage
+, fetchFromGitLab
+, fetchurl
+, fetchzip
+, git
+, imagemagick
+, jre
+, makeWrapper
+, openmw
+, perlPackages
+, python3Packages
+, rustPlatform
+, tes3cmd
+, tr-patcher
+}:
 
 let
   version = "2.1.0";
@@ -9,7 +24,7 @@ let
     owner = "portmod";
     repo = "Portmod";
     rev = "v${version}";
-    sha256 = "sha256-b/ENApFovMPNUMbJhwY+TZCnSzpr1e/IKJ/5XAGTQjE=";
+    hash = "sha256-b/ENApFovMPNUMbJhwY+TZCnSzpr1e/IKJ/5XAGTQjE=";
   };
 
   portmod-rust = rustPlatform.buildRustPackage rec {
@@ -18,7 +33,9 @@ let
 
     cargoHash = "sha256-3EfMMpSWSYsB3nXaoGGDuKQ9duyCKzbrT6oeATnzqLE=";
 
-    nativeBuildInputs = [ python3Packages.python ];
+    nativeBuildInputs = [
+      python3Packages.python
+    ];
 
     doCheck = false;
   };
@@ -56,7 +73,7 @@ python3Packages.buildPythonApplication rec {
     colorama
     restrictedpython
     appdirs
-    GitPython
+    gitpython
     progressbar2
     python-sat
     redbaron
@@ -94,10 +111,10 @@ python3Packages.buildPythonApplication rec {
       "--prefix" "PATH" ":" "${lib.makeBinPath bin-programs }")
   '';
 
-  meta = {
+  meta = with lib; {
     description = "mod manager for openMW based on portage";
     homepage = "https://gitlab.com/portmod/portmod";
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ marius851000 ];
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ marius851000 ];
   };
 }
diff --git a/pkgs/games/rigsofrods/default.nix b/pkgs/games/rigsofrods/default.nix
index 1e1b8130e3779..c3bf4498fa4ba 100644
--- a/pkgs/games/rigsofrods/default.nix
+++ b/pkgs/games/rigsofrods/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, wxGTK30-gtk3, freeimage, cmake, zziplib, libGLU, libGL, boost,
+{ fetchFromGitHub, lib, stdenv, wxGTK30, freeimage, cmake, zziplib, libGLU, libGL, boost,
   pkg-config, libuuid, openal, ogre, ois, curl, gtk3, mygui, unzip,
   angelscript, ogrepaged, mysocketw, libxcb
   }:
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake pkg-config unzip ];
-  buildInputs = [ wxGTK30-gtk3 freeimage zziplib libGLU libGL boost
+  buildInputs = [ wxGTK30 freeimage zziplib libGLU libGL boost
     libuuid openal ogre ois curl gtk3 mygui angelscript
     ogrepaged mysocketw libxcb ];
 
diff --git a/pkgs/os-specific/linux/ipp-usb/default.nix b/pkgs/os-specific/linux/ipp-usb/default.nix
new file mode 100644
index 0000000000000..0e79b89cfa34f
--- /dev/null
+++ b/pkgs/os-specific/linux/ipp-usb/default.nix
@@ -0,0 +1,42 @@
+{ buildGoModule, avahi, libusb1, pkg-config, lib, fetchFromGitHub, ronn }:
+buildGoModule rec {
+  pname = "ipp-usb";
+  version = "0.9.23";
+
+  src = fetchFromGitHub {
+    owner = "openprinting";
+    repo = "ipp-usb";
+    rev = version;
+    sha256 = "sha256-sbPQWKqkTaD3kLNs0noVIzAN9cwDEaULsqO7SMQH2Jo=";
+  };
+
+  postPatch = ''
+    # rebuild with patched paths
+    rm ipp-usb.8
+    substituteInPlace Makefile --replace "install: all" "install: man"
+    substituteInPlace systemd-udev/ipp-usb.service --replace "/sbin" "$out/bin"
+    for i in Makefile paths.go ipp-usb.8.md; do
+      substituteInPlace $i --replace "/usr" "$out"
+      substituteInPlace $i --replace "/var/ipp-usb" "/var/lib/ipp-usb"
+    done
+  '';
+
+  nativeBuildInputs = [ pkg-config ronn ];
+  buildInputs = [ libusb1 avahi ];
+
+  vendorSha256 = "sha256-KwW6KgopjF4tVo8eB4OtpXF5R8jfrJ9nibNmaN8U4l8=";
+
+  postInstall = ''
+    # to accomodate the makefile
+    cp $out/bin/ipp-usb .
+    make install DESTDIR=$out
+  '';
+
+  meta = {
+    description = "Daemon to use the IPP everywhere protocol with USB printers";
+    homepage = "https://github.com/OpenPrinting/ipp-usb";
+    maintainers = [ lib.maintainers.symphorien ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd2;
+  };
+}
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 87c5c91ecea0f..89c191cb7f35e 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.19.0";
+  version = "6.0.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "JrejTWp/0vekLis5xakMthusUi0QlgZ//rGV5Wk9d5E=";
+    sha256 = "UjE56ecq7JljdPot50vkxT0t0FWJSIk00h/5e64ZWAo=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 83c72f881a1f3..1351008886a3e 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -390,7 +390,7 @@ let
 
       TMPFS           = yes;
       TMPFS_POSIX_ACL = yes;
-      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else whenAtLeast "4.9" (option module);
+      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else option module;
 
       EXT2_FS_XATTR     = yes;
       EXT2_FS_POSIX_ACL = yes;
@@ -628,7 +628,6 @@ let
     media = {
       MEDIA_DIGITAL_TV_SUPPORT = yes;
       MEDIA_CAMERA_SUPPORT     = yes;
-      MEDIA_RC_SUPPORT         = whenOlder "4.14" yes;
       MEDIA_CONTROLLER         = yes;
       MEDIA_PCI_SUPPORT        = yes;
       MEDIA_USB_SUPPORT        = yes;
@@ -708,7 +707,7 @@ let
       LOCK_TORTURE_TEST        = option no;
       MTD_TESTS                = option no;
       NOTIFIER_ERROR_INJECTION = option no;
-      RCU_PERF_TEST            = whenBetween "4.13" "5.9" no;
+      RCU_PERF_TEST            = whenOlder "5.9" no;
       RCU_SCALE_TEST           = whenAtLeast "5.10" no;
       RCU_TORTURE_TEST         = option no;
       TEST_ASYNC_DRIVER_PROBE  = option no;
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index c90027f3eb14a..198cd86816466 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -21,10 +21,6 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Report BUG() conditions and kill the offending process.
   BUG = yes;
 
-  # Safer page access permissions (wrt. code injection).  Default on >=4.11.
-  DEBUG_RODATA          = whenOlder "4.11" yes;
-  DEBUG_SET_MODULE_RONX = whenOlder "4.11" yes;
-
   # Mark LSM hooks read-only after init.  SECURITY_WRITABLE_HOOKS n
   # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
   # implicitly marks LSM hooks read-only after init.
@@ -33,10 +29,10 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   #
   # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
   # config builder fails to detect that it has indeed been unset.
-  SECURITY_SELINUX_DISABLE = whenAtLeast "4.12" no;
-  SECURITY_WRITABLE_HOOKS  = whenAtLeast "4.12" (option no);
+  SECURITY_SELINUX_DISABLE = no;
+  SECURITY_WRITABLE_HOOKS  = option no;
 
-  STRICT_KERNEL_RWX = whenAtLeast "4.11" yes;
+  STRICT_KERNEL_RWX = yes;
 
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = yes;
@@ -46,7 +42,7 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   DEBUG_SG              = yes;
   SCHED_STACK_END_CHECK = yes;
 
-  REFCOUNT_FULL = whenBetween "4.13" "5.5" yes;
+  REFCOUNT_FULL = whenOlder "5.5" yes;
 
   # Randomize page allocator when page_alloc.shuffle=1
   SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
@@ -69,11 +65,11 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
-  GCC_PLUGIN_RANDSTRUCT = whenBetween "4.13" "5.19" yes; # A port of the PaX randstruct plugin
-  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenBetween "4.13" "5.19" yes;
+  GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
+  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
 
   # Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
   RANDSTRUCT = whenAtLeast "5.19" yes;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d046c8c7d1921..edfd1f7dbc28a 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -55,8 +55,7 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [ perl ]
-    ++ optional (lib.versionAtLeast version "4.14") libelf
+  moduleBuildDependencies = [ perl libelf ]
     ++ optional (lib.versionAtLeast version "5.13") zstd;
 
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
@@ -100,7 +99,7 @@ let
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
-        ++ optional (lib.versionAtLeast version "4.13" && lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
         ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
         # Fixes determinism by normalizing metadata for the archive of kheaders
         ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
@@ -353,7 +352,7 @@ let
     };
 in
 
-assert (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") -> libelf != null;
+assert lib.versionOlder version "5.8" -> libelf != null;
 assert lib.versionAtLeast version "5.8" -> elfutils != null;
 
 stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
@@ -365,7 +364,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
       ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
-      ++ optional  (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") libelf
+      ++ optional  (lib.versionOlder version "5.8") libelf
       # Removed util-linuxMinimal since it should not be a dependency.
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
diff --git a/pkgs/os-specific/linux/lvm2/2_02.nix b/pkgs/os-specific/linux/lvm2/2_02.nix
index 56ab613afd24d..07d8de0b2270b 100644
--- a/pkgs/os-specific/linux/lvm2/2_02.nix
+++ b/pkgs/os-specific/linux/lvm2/2_02.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.02.187";
-  sha256 = "sha256-Dg1SGoY6XbJEDy4edie6grcCc65KsLvhMIUdsNWOWvE=";
+  version = "2.02.188";
+  hash = "sha256-cQHosIFq135DkP7ZdJoJAhS6UgBhzQg0N4ceGeUMyb0=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 0cca51feab306..2f48448541b32 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.16";
-  sha256 = "sha256-5mHs4VtdiNir45pMHh2y9D4YlvAZlIu5iw4V13doB4Y=";
+  version = "2.03.17";
+  hash = "sha256-cobPqWUYKMWJOJUJVGMzuNqWXfqEoaTIqz5oGkf6uuc=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 4cb86bf3d8b93..0ea8a97bdb2e0 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -1,4 +1,4 @@
-{ version, sha256 }:
+{ version, hash }:
 
 { lib, stdenv
 , fetchpatch
@@ -28,8 +28,11 @@ stdenv.mkDerivation rec {
   inherit version;
 
   src = fetchurl {
-    url = "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz";
-    inherit sha256;
+    urls = [
+      "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz"
+      "ftp://sourceware.org/pub/lvm2/LVM2.${version}.tgz"
+    ];
+    inherit hash;
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -53,6 +56,7 @@ stdenv.mkDerivation rec {
     "--bindir=${placeholder "bin"}/bin"
     "--sbindir=${placeholder "bin"}/bin"
     "--libdir=${placeholder "lib"}/lib"
+    "--with-libexecdir=${placeholder "lib"}/libexec"
   ] ++ lib.optional enableCmdlib "--enable-cmdlib"
   ++ lib.optionals enableDmeventd [
     "--enable-dmeventd"
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 45c4bbe75f5cd..c87c337e61c3b 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -1,9 +1,9 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , ncurses
 , pkg-config
+, fetchpatch
 
   # `ps` with systemd support is able to properly report different
   # attributes like unit name, so we want to have it on linux.
@@ -19,19 +19,21 @@
 
 stdenv.mkDerivation rec {
   pname = "procps";
-  version = "3.3.16";
+  version = "3.3.17";
 
   # The project's releases are on SF, but git repo on gitlab.
   src = fetchurl {
     url = "mirror://sourceforge/procps-ng/procps-ng-${version}.tar.xz";
-    sha256 = "1br0g93ysqhlv13i1k4lfbimsgxnpy5rgs4lxfc9rkzdbpbaqplj";
+    sha256 = "sha256-RRiz56r9NOwH0AY9JQ/UdJmbILIAIYw65W9dIRPxQbQ=";
   };
 
-  patches = [
+  patches = lib.optionals stdenv.hostPlatform.isMusl [
+    # NOTE: Starting from 4.x we will not need a patch anymore, but need to add
+    # "--disable-w" to configureFlags instead to prevent the utmp errors
     (fetchpatch {
-      url = "https://gitlab.com/procps-ng/procps/-/commit/bb96fc42956c9ed926a1b958ab715f8b4a663dec.diff";
-      sha256 = "0fzsb6ns3fvrszyzsz28qvbmcn135ilr4nwh2z1a0vlpl2fw961z";
-      name = "sysconf-argmax-sanity.patch";
+      name = "musl-fix-includes.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/procps/musl-fixes.patch?id=37cb5b6ef194db66d9ed07c8ecab59bca3b91215";
+      sha256 = "sha256-DphAvESmVg1U3bJABU95R++QD34odStCl82EF0vmht0=";
     })
   ];
 
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index 1ba0e083703d6..582667c0c7dad 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sysstat";
-  version = "12.6.0";
+  version = "12.6.1";
 
   src = fetchurl {
     url = "http://pagesperso-orange.fr/sebastien.godard/sysstat-${version}.tar.xz";
-    sha256 = "sha256-aZ/ZSINtd/mtBUH9Xc91zSUF+dpOwU32aShq0EfCPZc=";
+    hash = "sha256-GP9aThSeJWjkM4Vjf3JDf+a6/MEyKpPRPRmB6UZKA0I=";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index 2699c38440cee..a5cb7ba6bf783 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,17 +13,17 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 25b8a590a6..d18999ea87 100644
+index 3dbba1f850..40d367d1c8 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
-@@ -17,10 +17,6 @@ SUBSYSTEM=="ubi", TAG+="systemd"
- SUBSYSTEM=="block", TAG+="systemd"
+@@ -20,10 +20,6 @@ SUBSYSTEM=="block", TAG+="systemd"
+ SUBSYSTEM=="block", ENV{DM_SUSPENDED}=="1", IMPORT{db}="SYSTEMD_READY", GOTO="systemd_end"
  SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
  
 -# Ignore encrypted devices with no identified superblock on it, since
 -# we are probably still calling mke2fs or mkswap on it.
 -SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
 -
- # add symlink to GPT root disk
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
+ # Explicitly set SYSTEMD_READY=1 for DM devices that don't have it set yet, so that we always have something to import above
+ SUBSYSTEM=="block", ENV{DM_UUID}=="?*", ENV{SYSTEMD_READY}=="", ENV{SYSTEMD_READY}="1"
+ 
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index f46480d32febb..42a5806958110 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -25,10 +25,10 @@ index f683f05981..5a04c2c2a6 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 820aa8e286..653e43053d 100644
+index e650b82170..5d0d41aa28 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -518,6 +518,8 @@ static int delete_md(MountPoint *m) {
+@@ -522,6 +522,8 @@ static int delete_md(MountPoint *m) {
  
  static bool nonunmountable_path(const char *path) {
          return path_equal(path, "/")
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index a669350dbed8b..8cc2e22d76150 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 4ce80bba70..bb149192bd 100644
+index 01a67b5553..86dd2cea84 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5651,6 +5651,7 @@ static int run(int argc, char *argv[]) {
+@@ -5636,6 +5636,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index 4ce80bba70..bb149192bd 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5665,6 +5666,7 @@ static int run(int argc, char *argv[]) {
+@@ -5650,6 +5651,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
diff --git a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
index dfaf53e4a3149..431e79a55d50f 100644
--- a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] Look for fsck in the right place
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 745d01ff50..dd4eef45c3 100644
+index 595434ab57..374a4e6c76 100644
 --- a/src/fsck/fsck.c
 +++ b/src/fsck/fsck.c
-@@ -368,7 +368,7 @@ static int run(int argc, char *argv[]) {
+@@ -373,7 +373,7 @@ static int run(int argc, char *argv[]) {
                  } else
                          dash_c[0] = 0;
  
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
index 8a06e2cf69cb9..081615774c751 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@@ -14,7 +14,7 @@ Also, remove /usr and /lib as these don't exist on NixOS.
  2 files changed, 6 insertions(+), 19 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 1f4331a8bf..4b9a8ae26e 100644
+index 36f386254b..a968d28dfc 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
diff --git a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
index c06f12550261a..9b5afcaba9d4e 100644
--- a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 296b759959..71ef7f27b4 100644
+index a59afafb58..d9e7d77913 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1428,7 +1428,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1432,7 +1432,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 174cca335b8e8..f23d805fdac35 100644
--- a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 5f09e6d0eb..46bef3b59d 100644
+index 486b093062..580e933f14 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -910,6 +910,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -906,6 +906,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index 5f09e6d0eb..46bef3b59d 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -973,6 +976,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -969,6 +972,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,10 +35,10 @@ index 5f09e6d0eb..46bef3b59d 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 89bf9c6fba..af2f37a4ca 100644
+index 7aa47f18c2..0a8ef68931 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -359,6 +359,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+@@ -309,6 +309,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
          if (r < 0)
                  return r;
  
@@ -48,7 +48,7 @@ index 89bf9c6fba..af2f37a4ca 100644
          use_localegen = locale_gen_check_available();
  
          /* If single locale without variable name is provided, then we assume it is LANG=. */
-@@ -484,6 +487,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+@@ -423,6 +426,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
                  return r;
  
@@ -58,7 +58,7 @@ index 89bf9c6fba..af2f37a4ca 100644
          keymap = empty_to_null(keymap);
          keymap_toggle = empty_to_null(keymap_toggle);
  
-@@ -664,6 +670,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+@@ -602,6 +608,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
                  return r;
  
@@ -69,10 +69,10 @@ index 89bf9c6fba..af2f37a4ca 100644
          model = empty_to_null(model);
          variant = empty_to_null(variant);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 9ca5d37b75..e41d8d73df 100644
+index 373574cc06..6dbf73eb42 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -669,6 +669,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index 9ca5d37b75..e41d8d73df 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -748,6 +752,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -743,6 +747,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index 9ca5d37b75..e41d8d73df 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -930,6 +937,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -923,6 +930,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 106eba2bed83f..cc40140b284bb 100644
--- a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 0ad8de4b9a..b794c6c7d0 100644
+index 71b2f67350..465f1c0b15 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1281,7 +1281,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1280,7 +1280,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 0ad8de4b9a..b794c6c7d0 100644
          if (!f)
                  return -errno;
  
-@@ -1320,7 +1320,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1319,7 +1319,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
          _cleanup_strv_free_ char **zones = NULL;
          int r;
  
@@ -56,7 +56,7 @@ index 0ad8de4b9a..b794c6c7d0 100644
          if (!f)
                  return -errno;
  
-@@ -1433,7 +1433,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1431,7 +1431,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 0ad8de4b9a..b794c6c7d0 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1491,7 +1491,7 @@ int get_timezone(char **ret) {
+@@ -1489,7 +1489,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -75,10 +75,10 @@ index 0ad8de4b9a..b794c6c7d0 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 39160182ef..8dcc3307c8 100644
+index 065ee896cd..1b260416c8 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -494,7 +494,7 @@ static int process_timezone(void) {
+@@ -510,7 +510,7 @@ static int process_timezone(void) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -86,12 +86,12 @@ index 39160182ef..8dcc3307c8 100644
 +        e = strjoina("zoneinfo/", arg_timezone);
  
          (void) mkdir_parents(etc_localtime, 0755);
-         if (symlink(e, etc_localtime) < 0)
+         r = symlink_atomic(e, etc_localtime);
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index bb149192bd..08751ed944 100644
+index 86dd2cea84..4e5f03669d 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1901,8 +1901,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1905,8 +1905,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,7 +103,7 @@ index bb149192bd..08751ed944 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index e41d8d73df..ff1a384b3b 100644
+index 6dbf73eb42..a36dd459d2 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -282,7 +282,7 @@ static int context_read_data(Context *c) {
diff --git a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
index a3315a1e657a6..4f652d45a42c0 100644
--- a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,10 +10,10 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index 661d54c27d..e98b578531 100644
+index c23f1fa3f6..ad2eba82ad 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -277,7 +277,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -299,7 +299,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index 75d113d003398..eabb80c39fa8e 100644
--- a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] build: don't create statedir and don't touch prefixdir
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 9c170acc0a..818b7a3eb5 100644
+index 76ad51d3fb..839dcef437 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3928,9 +3928,6 @@ install_data('LICENSE.GPL2',
+@@ -4067,9 +4067,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
diff --git a/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
index c1659ae8a78a8..32ee37d78fa13 100644
--- a/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0012-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,10 +12,10 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/def.h b/src/basic/def.h
-index 0a1ae023a3..cc00ff6c68 100644
+index 2b4de29021..1bd61dc45f 100644
 --- a/src/basic/def.h
 +++ b/src/basic/def.h
-@@ -39,13 +39,15 @@
+@@ -44,13 +44,15 @@
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
          "/usr/lib/" n "\0"                      \
diff --git a/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 4add87267ddb6..78d1e48f6cf7e 100644
--- a/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0013-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -6,19 +6,18 @@ Subject: [PATCH] systemd-shutdown: execute scripts in
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
 ---
- src/shutdown/shutdown.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ src/shutdown/shutdown.c | 1 +
+ 1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 2c3cbec02c..1b876203c6 100644
+index dcee0f9006..24b03d6948 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -335,7 +335,7 @@ int main(int argc, char *argv[]) {
+@@ -334,6 +334,7 @@ static void init_watchdog(void) {
+ int main(int argc, char *argv[]) {
+         static const char* const dirs[] = {
+                 SYSTEM_SHUTDOWN_PATH,
++                "/etc/systemd/system-shutdown",
+                 NULL
+         };
          _cleanup_free_ char *cgroup = NULL;
-         char *arguments[3];
-         int cmd, r, umount_log_level = LOG_INFO;
--        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, NULL};
-+        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, "/etc/systemd/system-shutdown", NULL};
- 
-         /* The log target defaults to console, but the original systemd process will pass its log target in through a
-          * command line argument, which will override this default. Also, ensure we'll never log to the journal or
diff --git a/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 22e2bc8e5300f..b496dde756195 100644
--- a/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0014-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 65e391d02a..28af2f8bf5 100644
+index 3461d3e45f..d7d0ec2a7a 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -180,6 +180,7 @@ static int execute(
+@@ -184,6 +184,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 653f3beea965d..06efb13ff6f28 100644
--- a/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0015-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,7 +10,7 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 553aa4fb58..46294f4bb1 100644
+index 22d3632e6e..1e8bbb242b 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
 @@ -24,11 +24,11 @@
diff --git a/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
index f4925437aa58a..eaebb623d922e 100644
--- a/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0017-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 71ef7f27b4..33ded94a7c 100644
+index d9e7d77913..ba3ce14bf0 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3704,9 +3704,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3693,9 +3693,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch
index 1cd3c2105e1a2..d40bdbde8ef1f 100644
--- a/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0018-core-don-t-taint-on-unmerged-usr.patch
@@ -17,10 +17,10 @@ See also: https://github.com/systemd/systemd/issues/24191
  1 file changed, 4 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 33ded94a7c..8847479799 100644
+index ba3ce14bf0..03bf66ff74 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4488,10 +4488,6 @@ char* manager_taint_string(const Manager *m) {
+@@ -4493,10 +4493,6 @@ char* manager_taint_string(const Manager *m) {
          if (m->taint_usr)
                  stage[n++] = "split-usr";
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 47dbbb21db389..7c57d9edf6015 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -122,13 +122,13 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "251.7";
+  version = "252.1";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1653143108";
+  releaseTimestamp = "1667246393";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -139,7 +139,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    sha256 = "sha256-Sa5diyNFyYtREo1xSCcufAW83ZZGZvueoDVuQ2r8wno=";
+    hash = "sha256-G43qbNF7znTITSM78sOL0qi8nqaA7qIhmiqP/rZKjXY=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -406,6 +406,7 @@ stdenv.mkDerivation {
     # https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
     "-Dtime-epoch=${releaseTimestamp}"
 
+    "-Dmode=release"
     "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
     "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
     "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
diff --git a/pkgs/servers/http/dufs/default.nix b/pkgs/servers/http/dufs/default.nix
index e162a42863a54..af02b7199610e 100644
--- a/pkgs/servers/http/dufs/default.nix
+++ b/pkgs/servers/http/dufs/default.nix
@@ -23,6 +23,11 @@ rustPlatform.buildRustPackage rec {
     Security
   ];
 
+  checkFlags = [
+    # tests depend on network interface, may fail with virtual IPs.
+    "--skip=validate_printed_urls"
+  ];
+
   meta = with lib; {
     description = "A file server that supports static serving, uploading, searching, accessing control, webdav";
     homepage = "https://github.com/sigoden/dufs";
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index b7d890a83a098..615517b0b19d2 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "516efd2df3f7d242c2d1df416053b4991a554116",
-    "sha256": "sha256-4Rd8SZv2c61ROBPjOEMbVTZ8aFjerPROfU9iRt1KOg4=",
-    "version": "unstable-2022-11-17"
+    "rev": "5160d8bae39dc5cc5d51abee90571a03c08d0f2b",
+    "sha256": "sha256-cM/5xnzO5wyzudXHeud9k3M5BsralRUgO4vSoebYRZ8=",
+    "version": "unstable-2022-11-22"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/klipper/klipper-firmware.nix b/pkgs/servers/klipper/klipper-firmware.nix
index 3d37f91b11f67..4c9e4e293542c 100644
--- a/pkgs/servers/klipper/klipper-firmware.nix
+++ b/pkgs/servers/klipper/klipper-firmware.nix
@@ -5,7 +5,7 @@
 , bintools-unwrapped
 , libffi
 , libusb1
-, wxGTK30-gtk3
+, wxGTK30
 , python3
 , gcc-arm-embedded
 , klipper
@@ -28,7 +28,7 @@
     avrdude
     stm32flash
     pkg-config
-    wxGTK30-gtk3 # Required for bossac
+    wxGTK30 # Required for bossac
   ];
 
   preBuild = "cp ${firmwareConfig} ./.config";
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 27c2fe3069b82..b7a7c85bfc2fc 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -11,20 +11,20 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.72.0";
+  version = "1.73.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-LkzUrEXC+jonkEpAGIEDQhAKisrKNQB8/elchN/4YMU=";
+    hash = "sha256-Er5a+0Qyvm5V1ObWjDQ8fs+r/XB+4aRItJMqaz1VSqk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-AuQURcVaIoOYG9jh6QhPpXB0akASVWMYe4fA/376cwo=";
+    hash = "sha256-yU72e8OBnUtNdUI/crX7v2KRYHHHOY4Ga9CI3PJwais=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/misc/navidrome/default.nix b/pkgs/servers/misc/navidrome/default.nix
index 0833a1ec1a64c..8c63b0fb940df 100644
--- a/pkgs/servers/misc/navidrome/default.nix
+++ b/pkgs/servers/misc/navidrome/default.nix
@@ -4,7 +4,7 @@
 , lib
 , pkg-config
 , stdenv
-, ffmpeg
+, ffmpeg-headless
 , taglib
 , zlib
 , makeWrapper
@@ -54,7 +54,7 @@ buildGoModule {
 
   postFixup = lib.optionalString ffmpegSupport ''
     wrapProgram $out/bin/navidrome \
-      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}
+      --prefix PATH : ${lib.makeBinPath [ ffmpeg-headless ]}
   '';
 
   passthru = {
diff --git a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
index 2442735ffc4b0..bd1a5f2758a72 100644
--- a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.56.0";
+  version = "2.57.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     rev = "v${version}";
-    hash = "sha256-2Ch5XnHs2PIsmI6JKYQPsDqcUSgWE5+u3vHqAW/SB8E=";
+    hash = "sha256-N+VkdVeJ6UdRPFUFmIpZoL/Mc8MkTd+hAPjha5pimt8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index 68a8a0cf4cf94..68ecb29169f6a 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -4,14 +4,14 @@ let
   generic = { subPackages, pname, postInstall ? "", mainProgram }:
     buildGoModule rec {
       inherit pname;
-      version = "6.9.0";
+      version = "6.9.1";
       shortRev = "3a1ac58"; # for internal version info
 
       src = fetchFromGitHub {
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "sha256-H6mpry6uJtMVJmsdLgka7X/IzMP1dbp+hOl3pGVWUAE=";
+        sha256 = "sha256-vw5A5Cg4envrDfLsdauSONgd6rPZSu5wPiPOoNIcS9w=";
       };
 
       inherit subPackages postInstall;
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index a434b48388ac9..2ac109cb0dade 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,18 +5,22 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-M7lQkO36I4Cwxs49XdxsUVVI2/Nz7fhU36j9fxUuMfM=";
+    sha256 = "sha256-9Hn1teHo5sHJLYQYM+nAIwq7Gckxl1TCTk/GxLME1qo=";
   };
 
   preConfigure = "cd src";
 
-  cmakeFlags = [ "-DUSE_SYSTEM_NTIRPC=ON" ];
+  cmakeFlags = [
+    "-DUSE_SYSTEM_NTIRPC=ON"
+    "-DSYSSTATEDIR=/var"
+    "-DENABLE_VFS_POSIX_ACL=ON"
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/servers/nosql/cassandra/4.json b/pkgs/servers/nosql/cassandra/4.json
new file mode 100644
index 0000000000000..fd0a4be8f49b8
--- /dev/null
+++ b/pkgs/servers/nosql/cassandra/4.json
@@ -0,0 +1,4 @@
+{
+  "version": "4.0.7",
+  "sha256": "03k7mvm5im4lahl8wfafk5ljxd95b6zsmskip4kcpzqi6naf6s4s"
+}
diff --git a/pkgs/servers/nosql/cassandra/4.nix b/pkgs/servers/nosql/cassandra/4.nix
new file mode 100644
index 0000000000000..0a96e25790357
--- /dev/null
+++ b/pkgs/servers/nosql/cassandra/4.nix
@@ -0,0 +1,8 @@
+# GENERATED BY update.sh
+{ callPackage, ... } @ args:
+callPackage ./generic.nix (
+  args
+  // builtins.fromJSON (builtins.readFile ./4.json)
+  // {
+    generation = "4";
+  })
diff --git a/pkgs/servers/nosql/ferretdb/default.nix b/pkgs/servers/nosql/ferretdb/default.nix
index f8281eefb00b0..56a8ba6630dd7 100644
--- a/pkgs/servers/nosql/ferretdb/default.nix
+++ b/pkgs/servers/nosql/ferretdb/default.nix
@@ -5,20 +5,20 @@
 
 buildGoModule rec {
   pname = "ferretdb";
-  version = "0.6.2";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "FerretDB";
     repo = "FerretDB";
     rev = "v${version}";
-    sha256 = "sha256-wjqTYrAVrUl+i+2glSUW1xS/qjvTqRXYu4s3F5Wi0Sc=";
+    sha256 = "sha256-BjGK1HvAFBs82bDyI6A7QsJcIaEjEKCw3dyiSqaS2tA=";
   };
 
   postPatch = ''
     echo ${version} > internal/util/version/gen/version.txt
   '';
 
-  vendorSha256 = "sha256-wjlGAhut9/jZ2GmKg7XmenphkgxWn0VbuvYEtORpbtw=";
+  vendorSha256 = "sha256-xmUSjkl41jwC/vaUcqZBvLo2wWp8XlXjzzemN5Ja2gg=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/servers/search/zinc/default.nix b/pkgs/servers/search/zinc/default.nix
new file mode 100644
index 0000000000000..c9a7a256d76c1
--- /dev/null
+++ b/pkgs/servers/search/zinc/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, buildNpmPackage
+}:
+let
+  version = "0.3.5";
+  src = fetchFromGitHub {
+    owner = "zinclabs";
+    repo = "zinc";
+    rev = "v${version}";
+    sha256 = "sha256-qu3foI5Rnt2sf+B+roJOwUNvOfawKmcKq7UrmviQsHA=";
+  };
+
+  webui = buildNpmPackage {
+    inherit src version;
+    pname = "zinc-ui";
+
+    sourceRoot = "source/web";
+
+    npmDepsHash = "sha256-Ao/kDryui4thurqap/d/+82z058HoF2ZJSVKQqVwfVg=";
+
+    CYPRESS_INSTALL_BINARY = 0; # cypress tries to download binaries otherwise
+
+    installPhase = ''
+      mkdir -p $out/share
+      mv dist $out/share/zinc-ui
+    '';
+  };
+in
+buildGoModule rec {
+  pname = "zinc";
+  inherit src version;
+
+  preBuild = ''
+    cp -r ${webui}/share/zinc-ui web/dist
+  '';
+
+  vendorSha256 = "sha256-akjb0cxHbITKS26c+7lVSHWO/KRoQVVKzAOra+tdAD8=";
+  subPackages = [ "cmd/zinc" ];
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/zinclabs/zinc/pkg/meta.Version=${version}"
+  ];
+
+  meta = with lib; {
+    description = "A lightweight alternative to elasticsearch that requires minimal resources, written in Go";
+    homepage = "https://github.com/zinclabs/zinc";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ dit7ya ];
+  };
+}
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index f9ac080a7fd69..7da5c489ded4f 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -2,11 +2,11 @@
 , dataPath ? "/var/lib/snappymail" }:
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.22.4";
+  version = "2.22.6";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-SMuposSGpmJgfAXYu3YhYJWN7zxyxtAAuRI1IBibq5c=";
+    sha256 = "sha256-B3ojd6Xd5qk6KL5JAnrp52XeW0xJ7z9VJQRPjVmPgv0=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 55bc9998fdee1..529d9f2b90646 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -68,6 +68,8 @@ self: super:
       then "${tradcpp}/bin/cpp"
       else "gcc"}\"'";
 
+    configureFlags = attrs.configureFlags or [] ++ [ "ac_cv_path_RAWCPP=${stdenv.cc.targetPrefix}cpp" ];
+
     inherit tradcpp;
   });
 
@@ -151,6 +153,11 @@ self: super:
 
   xdm = super.xdm.overrideAttrs (attrs: {
     buildInputs = attrs.buildInputs ++ [ libxcrypt ];
+    configureFlags = attrs.configureFlags or [] ++ [
+      "ac_cv_path_RAWCPP=${stdenv.cc.targetPrefix}cpp"
+    ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
+      # checking for /dev/urandom... configure: error: cannot check for file existence when cross compiling
+      [ "ac_cv_file__dev_urandom=true" "ac_cv_file__dev_random=true" ];
   });
 
   # Propagate some build inputs because of header file dependencies.
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 432cbfe9ac9f5..8c33839a83cfc 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -24,16 +24,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.72.0";
+  version = "0.72.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-CWFG3ltSWwUPz+cVXUL0RaDxmm1A3Ie0BUBFFZfR9Mc=";
+    sha256 = "sha256-OVJr+usN+47yBHFAy94rIVlU2F+Klo6xdrV2MwUoKUE=";
   };
 
-  cargoSha256 = "sha256-VgE14440BumaL/wZz1ONjIK1nsJWaPlvy7M0R+ojb9A=";
+  cargoSha256 = "sha256-v6mPr+gOT64rKYuog+hS7/AqUZDailoOBXX3Sfeo+sk=";
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index e01ac74599aeb..bf410ec0a6841 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -83,9 +83,6 @@ in lib.init bootStages ++ [
              (let f = p: !p.isx86 || builtins.elem p.libc [ "musl" "wasilibc" "relibc" ] || p.isiOS || p.isGenode;
                in f hostPlatform && !(f buildPlatform) )
              buildPackages.updateAutotoolsGnuConfigScriptsHook
-           # without proper `file` command, libtool sometimes fails
-           # to recognize 64-bit DLLs
-        ++ lib.optional (hostPlatform.config == "x86_64-w64-mingw32") buildPackages.file
         ;
     }));
   })
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 4fa9ad6de2eec..81255726284b5 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -175,6 +175,11 @@ let
       # without running any commands. Because this will also skip `shopt -s extglob`
       # commands and extglob affects the Bash parser, we enable extglob always.
       shellDryRun = "${stdenv.shell} -n -O extglob";
+
+      tests = {
+        succeedOnFailure = import ../tests/succeedOnFailure.nix { inherit stdenv; };
+      };
+      passthru.tests = lib.warn "Use `stdenv.tests` instead. `passthru` is a `mkDerivation` detail." stdenv.tests;
     }
 
     # Propagate any extra attributes.  For instance, we use this to
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 62f9121d73d6b..c6cdb6c3df750 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -144,7 +144,7 @@ exitHandler() {
             echo "build failed with exit code $exitCode (ignored)"
             mkdir -p "$out/nix-support"
             printf "%s" "$exitCode" > "$out/nix-support/failed"
-            return 0
+            exit 0
         fi
 
     else
diff --git a/pkgs/stdenv/tests/succeedOnFailure.nix b/pkgs/stdenv/tests/succeedOnFailure.nix
new file mode 100644
index 0000000000000..fef7f17869979
--- /dev/null
+++ b/pkgs/stdenv/tests/succeedOnFailure.nix
@@ -0,0 +1,14 @@
+{ stdenv }:
+
+stdenv.mkDerivation {
+  name = "stdenv-test-succeedOnFailure";
+
+  succeedOnFailure = true;
+
+  passAsFile = [ "buildCommand" ];
+  buildCommand = ''
+    mkdir $out
+    echo foo > $out/foo
+    exit 1
+  '';
+}
diff --git a/pkgs/tools/X11/bumblebee/default.nix b/pkgs/tools/X11/bumblebee/default.nix
index 914972d91aa76..0415489bd765b 100644
--- a/pkgs/tools/X11/bumblebee/default.nix
+++ b/pkgs/tools/X11/bumblebee/default.nix
@@ -52,6 +52,10 @@ let
     url = "https://github.com/Bumblebee-Project/Bumblebee/commit/deceb14cdf2c90ff64ebd1010a674305464587da.patch";
     sha256 = "00c05i5lxz7vdbv445ncxac490vbl5g9w3vy3gd71qw1f0si8vwh";
   };
+  gcc10Patch = fetchpatch {
+    url = "https://github.com/Bumblebee-Project/Bumblebee/commit/f94a118a88cd76e2dbea33d735bd53cf54b486a1.patch";
+    hash = "sha256-3b5tLoMrGYSdg9Hz5bh0c44VIrbSZrY56JpWEyU/Pik=";
+  };
 
 in stdenv.mkDerivation rec {
   pname = "bumblebee";
@@ -67,6 +71,7 @@ in stdenv.mkDerivation rec {
 
     modprobePatch
     libkmodPatch
+    gcc10Patch
   ];
 
   # By default we don't want to use a display device
@@ -137,8 +142,5 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ abbradar ];
     platforms = platforms.linux;
-    # linking fails with multiple error of type:
-    # multiple definition of `bb_pm_method_string'; src/module.o:(.bss+0x0): first defined here
-    broken = true; # Added 03-08-2022
   };
 }
diff --git a/pkgs/tools/X11/xdg-utils/allow-forcing-portal-use.patch b/pkgs/tools/X11/xdg-utils/allow-forcing-portal-use.patch
new file mode 100644
index 0000000000000..0a011c05dee97
--- /dev/null
+++ b/pkgs/tools/X11/xdg-utils/allow-forcing-portal-use.patch
@@ -0,0 +1,29 @@
+From 835eed6a2b975fba40c3ac18b4cf5429ba9d2836 Mon Sep 17 00:00:00 2001
+From: Luna Nova <git@lunnova.dev>
+Date: Wed, 7 Sep 2022 08:45:56 -0700
+Subject: [PATCH] xdg-open: add $XDG_OPEN_USE_PORTAL env var
+
+When set, the same mechanism that is used in a flatpak is used,
+a dbus call to the portal. This is useful for distros with non-flatpak
+wrapper or sandboxing features which require the same treatment, eg NixOS.
+
+See https://github.com/NixOS/nixpkgs/issues/160923
+---
+ scripts/xdg-open.in | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scripts/xdg-open.in b/scripts/xdg-open.in
+index 8de839a..80d8fb3 100644
+--- a/scripts/xdg-open.in
++++ b/scripts/xdg-open.in
+@@ -508,6 +508,10 @@ if [ x"$DE" = x"" ]; then
+     DE=generic
+ fi
+ 
++if [ -n "$NIXOS_XDG_OPEN_USE_PORTAL"  ]; then
++    DE=flatpak
++fi
++
+ DEBUG 2 "Selected DE $DE"
+ 
+ # sanitize BROWSER (avoid calling ourselves in particular)
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 6be7e940c1f27..53a43dde3030b 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -1,7 +1,9 @@
 { lib, stdenv, fetchFromGitLab, fetchFromGitHub
 , file, libxslt, docbook_xml_dtd_412, docbook_xsl, xmlto
 , w3m, gnugrep, gnused, coreutils, xset, perlPackages
-, mimiSupport ? false, gawk }:
+, mimiSupport ? false, gawk
+, glib
+, withXdgOpenUsePortalPatch ? true }:
 
 let
   # A much better xdg-open
@@ -30,6 +32,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-8PtXfI8hRneEpnUvIV3M+6ACjlkx0w/NEiJFdGbbHnQ=";
   };
 
+  patches = lib.optionals withXdgOpenUsePortalPatch [
+    # Allow forcing the use of XDG portals using NIXOS_XDG_OPEN_USE_PORTAL environment variable.
+    # Upstream PR: https://github.com/freedesktop/xdg-utils/pull/12
+    ./allow-forcing-portal-use.patch
+  ];
+
   # just needed when built from git
   nativeBuildInputs = [ libxslt docbook_xml_dtd_412 docbook_xsl xmlto w3m ];
 
@@ -49,13 +57,15 @@ stdenv.mkDerivation rec {
     &#' -i "$out"/bin/*
 
     substituteInPlace $out/bin/xdg-open \
-      --replace "/usr/bin/printf" "${coreutils}/bin/printf"
+      --replace "/usr/bin/printf" "${coreutils}/bin/printf" \
+      --replace "gdbus" "${glib}/bin/gdbus"
 
     substituteInPlace $out/bin/xdg-mime \
       --replace "/usr/bin/file" "${file}/bin/file"
 
     substituteInPlace $out/bin/xdg-email \
-      --replace "/bin/echo" "${coreutils}/bin/echo"
+      --replace "/bin/echo" "${coreutils}/bin/echo" \
+      --replace "gdbus" "${glib}/bin/gdbus"
 
     sed 's|\bwhich\b|type -P|g' -i "$out"/bin/*
   '';
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 855061ef3e2d7..d882890bba78e 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.62.2";
+  version = "0.62.3";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-n3ZkSsyaNreIohCrGYQUnRAnher1VqbV8vQKA20bnPs=";
+    sha256 = "sha256-rDj/yerLY7EN/jeAh/xaUX04LqGqijajSZLFhjiyuSg=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorSha256 = "sha256-FJtyCUzp/osfXtNRWH/gK7PGoe4gd23YxBxbF4o1qos=";
+  vendorSha256 = "sha256-MUNXMdzLVgbFtVo1CRCnZfpZl8Ze2R98mx7Y9QreLRw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/backup/dar/default.nix b/pkgs/tools/backup/dar/default.nix
index c697bb4f20f77..f17a805531c70 100644
--- a/pkgs/tools/backup/dar/default.nix
+++ b/pkgs/tools/backup/dar/default.nix
@@ -28,12 +28,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "2.7.7";
+  version = "2.7.8";
   pname = "dar";
 
   src = fetchzip {
     url = "mirror://sourceforge/dar/${pname}-${version}.tar.gz";
-    sha256 = "sha256-643hU28Vl0QaqdKoKdQ1Z/j5drE59/jw5xkVO/g+MSw=";
+    sha256 = "sha256-W/6kSkIaeHumE2yGGbU4Z2lk1d2toQ1AM012TUI1EZw=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/backup/ugarit-manifest-maker/default.nix b/pkgs/tools/backup/ugarit-manifest-maker/default.nix
index 980aaa05ec365..8c37a7b72ac73 100644
--- a/pkgs/tools/backup/ugarit-manifest-maker/default.nix
+++ b/pkgs/tools/backup/ugarit-manifest-maker/default.nix
@@ -27,6 +27,5 @@ in with pkgs; eggDerivation rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.ebzzry ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/backup/ugarit/default.nix b/pkgs/tools/backup/ugarit/default.nix
index 9000ff54f6735..39c11cc0c91a1 100644
--- a/pkgs/tools/backup/ugarit/default.nix
+++ b/pkgs/tools/backup/ugarit/default.nix
@@ -37,6 +37,5 @@ in with pkgs; eggDerivation rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.ebzzry ];
     platforms = platforms.unix;
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index ee1bea9c29ef9..e01ee2a8cf47a 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -1,11 +1,10 @@
 { lib, stdenv, fetchurl
-, pkg-config, python3, sphinx
+, pkg-config, sphinx
 , zstd
 , acl, attr, e2fsprogs, libuuid, lzo, udev, zlib
 , runCommand, btrfs-progs
 , gitUpdater
 , udevSupport ? true
-, enablePython ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -19,13 +18,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-  ] ++ lib.optionals enablePython [
-    python3 python3.pkgs.setuptools
   ] ++ [
     sphinx
   ];
 
-  buildInputs = [ acl attr e2fsprogs libuuid lzo python3 udev zlib zstd ];
+  buildInputs = [ acl attr e2fsprogs libuuid lzo udev zlib zstd ];
 
   # gcc bug with -O1 on ARM with gcc 4.8
   # This should be fine on all platforms so apply universally
@@ -35,18 +32,17 @@ stdenv.mkDerivation rec {
     install -v -m 444 -D btrfs-completion $out/share/bash-completion/completions/btrfs
   '';
 
-  configureFlags = lib.optionals stdenv.hostPlatform.isMusl [
-    "--disable-backtrace"
-  ] ++ lib.optionals (!enablePython) [
+  configureFlags = [
+    # Built separately, see python3Packages.btrfsutil
     "--disable-python"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "--disable-backtrace"
   ] ++ lib.optionals (!udevSupport) [
     "--disable-libudev"
   ];
 
   makeFlags = [ "udevruledir=$(out)/lib/udev/rules.d" ];
 
-  installFlags = lib.optionals enablePython [ "install_python" ];
-
   enableParallelBuilding = true;
 
   passthru.tests = {
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index aaf42193ce7df..98d2c63d1bfd0 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "graphviz";
-  version = "7.0.0";
+  version = "7.0.2";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     rev = version;
-    sha256 = "sha256-n+g4XNTSbCXOoL7JIE6uP9AZJj3YDfTG9EcmUA+r8hY=";
+    hash = "sha256-iCpIKTGXZ1R3mbpbwv5ztdtjY7p9/NsJlA6u5lfpgdY=";
   };
 
   nativeBuildInputs = [
@@ -65,26 +65,15 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--with-ltdl-lib=${libtool.lib}/lib"
     "--with-ltdl-include=${libtool}/include"
-  ] ++ lib.optional (xorg == null) "--without-x";
+  ] ++ optional (xorg == null) "--without-x";
 
   enableParallelBuilding = true;
 
-  CPPFLAGS = lib.optionalString (withXorg && stdenv.isDarwin)
+  CPPFLAGS = optionalString (withXorg && stdenv.isDarwin)
     "-I${cairo.dev}/include/cairo";
 
-  # ''
-  #   substituteInPlace rtest/rtest.sh \
-  #     --replace "/bin/ksh" "${mksh}/bin/mksh"
-  # '';
-
   doCheck = false; # fails with "Graphviz test suite requires ksh93" which is not in nixpkgs
 
-  postPatch = ''
-    for f in $(find . -name Makefile.in); do
-      substituteInPlace $f --replace "-lstdc++" "-lc++"
-    done
-  '';
-
   preAutoreconf = "./autogen.sh";
 
   postFixup = optionalString withXorg ''
diff --git a/pkgs/tools/graphics/unpaper/default.nix b/pkgs/tools/graphics/unpaper/default.nix
index 72c63d6cfd2c3..b7fe0f6955ca6 100644
--- a/pkgs/tools/graphics/unpaper/default.nix
+++ b/pkgs/tools/graphics/unpaper/default.nix
@@ -12,7 +12,7 @@
 
 # runtime
 , buildPackages
-, ffmpeg_5
+, ffmpeg_5-headless
 
 # tests
 , nixosTests
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    ffmpeg_5
+    ffmpeg_5-headless
   ];
 
   passthru.tests = {
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 4e850e4fe6c70..9bf4a281e062a 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -22,6 +22,8 @@
   # see https://github.com/mchehab/zbar/issues/104
 , enableDbus ? false
 , libintl
+, libiconv
+, Foundation
 }:
 
 stdenv.mkDerivation rec {
@@ -50,6 +52,9 @@ stdenv.mkDerivation rec {
   buildInputs = [
     imagemagickBig
     libintl
+  ] ++ lib.optionals stdenv.isDarwin [
+    libiconv
+    Foundation
   ] ++ lib.optionals enableDbus [
     dbus
   ] ++ lib.optionals withXorg [
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 3c3b15962a7be..62f39492437ed 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -60,6 +60,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # bionic libc is super weird and has issues with fortify outside of its own libc, check this comment:
+  # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
+  # or you can check libc/include/sys/cdefs.h in bionic source code
+  hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
+
   meta = {
     homepage = "https://www.gnu.org/software/findutils/";
     description = "GNU Find Utilities, the basic directory searching utilities of the GNU operating system";
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index 71806dcb8d1bd..72970d2dc9b45 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -21,6 +21,16 @@ stdenv.mkDerivation rec {
       url = "https://github.com/jbruchon/jdupes/commit/8f5b06109b44a9e4316f9445da3044590a6c63e2.patch";
       sha256 = "0saq92v0mm5g979chr062psvwp3i3z23mgqrcliq4m07lvwc7i3s";
     })
+    (fetchpatch {
+      name = "linux-header-ioctl.patch";
+      url = "https://github.com/jbruchon/jdupes/commit/0d4d98f51c99999d2c6dbbb89d554af551b5b69b.patch";
+      sha256 = "sha256-lyuZeRp0Laa8I9nDl1HGdlKa59OvGRQJnRg2fTWv7mQ=";
+    })
+    (fetchpatch {
+      name = "darwin-apfs-comp.patch";
+      url = "https://github.com/jbruchon/jdupes/commit/517b7035945eacd82323392b13bc17b044bcc89d.patch";
+      sha256 = "sha256-lvOab6tyEyKUtik3JBdIs5SHpVjcQEDfN7n2bfUszBw=";
+    })
   ];
 
   dontConfigure = true;
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 4c23143b103ee..13246255d7ac9 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "man-db";
-  version = "2.10.2";
+  version = "2.11.1";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/man-db-${version}.tar.xz";
-    sha256 = "sha256-7peVTUkqE3MZA8nQcnubAeUIntvWlfDNtY1AWlr1UU0=";
+    sha256 = "sha256-LquqUlE0mEfenJ5DxjTZhsvMb4dkLR2cuGCOwYSHtsw=";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/tools/misc/opentimestamps-client/default.nix b/pkgs/tools/misc/opentimestamps-client/default.nix
index 6c17cf62a6401..93c10530697fd 100644
--- a/pkgs/tools/misc/opentimestamps-client/default.nix
+++ b/pkgs/tools/misc/opentimestamps-client/default.nix
@@ -1,27 +1,40 @@
-{ lib, buildPythonApplication, fetchFromGitHub, isPy3k
-, opentimestamps, appdirs, GitPython, pysocks, fetchpatch, git
+{ lib
+, fetchFromGitHub
+, python3
 }:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "opentimestamps-client";
   version = "0.7.1";
-  disabled = (!isPy3k);
+  format = "setuptools";
 
-  # We can't use the pypi source because it doesn't include README.md which is
-  # needed in setup.py
   src = fetchFromGitHub {
     owner = "opentimestamps";
     repo = "opentimestamps-client";
     rev = "refs/tags/opentimestamps-client-v${version}";
-    sha256 = "sha256-0dWaXetRlF1MveBdJ0sAdqJ5HCdn08gkbX+nen/ygsQ=";
+    hash = "sha256-0dWaXetRlF1MveBdJ0sAdqJ5HCdn08gkbX+nen/ygsQ=";
   };
 
-  propagatedBuildInputs = [ opentimestamps appdirs GitPython pysocks ];
+  propagatedBuildInputs = with python3.pkgs; [
+    appdirs
+    gitpython
+    opentimestamps
+    pysocks
+  ];
+
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "otsclient"
+  ];
 
   meta = with lib; {
     description = "Command-line tool to create and verify OpenTimestamps proofs";
     homepage = "https://github.com/opentimestamps/opentimestamps-client";
-    license = licenses.lgpl3;
+    changelog = "https://github.com/opentimestamps/opentimestamps-client/releases/tag/opentimestamps-client-v${version}";
+    license = licenses.lgpl3Only;
     maintainers = with maintainers; [ erikarvstedt ];
   };
 }
diff --git a/pkgs/tools/misc/synth/default.nix b/pkgs/tools/misc/synth/default.nix
index 8be135c59d288..92e4e8531f9aa 100644
--- a/pkgs/tools/misc/synth/default.nix
+++ b/pkgs/tools/misc/synth/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "synth";
-  version = "0.6.8";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "shuttle-hq";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-siAm6Uq8Y+RexNrkL7nTw/f/v0LkUgqTUhAtJiy9QnE=";
+    sha256 = "sha256-/z2VEfeCCuffxlMh4WOpYkMSAgmh+sbx3ajcD5d4DdE=";
   };
 
-  cargoSha256 = "sha256-COy8szsYKEzjtRBH8063ug5BkMv3qpc3i2RNb+n4I04=";
+  cargoSha256 = "sha256-i2Pp9sfTBth3DtrQ99Vw+KLnGECrkqtlRNAKiwSWf48=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     AppKit
diff --git a/pkgs/tools/networking/httplz/default.nix b/pkgs/tools/networking/httplz/default.nix
index f02623329c3e0..d327921499746 100644
--- a/pkgs/tools/networking/httplz/default.nix
+++ b/pkgs/tools/networking/httplz/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchCrate
+, fetchpatch
 , installShellFiles
 , makeWrapper
 , pkg-config
@@ -21,6 +22,15 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-+nCqMTLrBYNQvoKo1PzkyzRCkKdlE88+NYoJcIlAJts=";
   };
 
+  patches = [
+    # https://github.com/thecoshman/http/pull/151
+    (fetchpatch {
+      name = "fix-rust-1.65-compile.patch";
+      url = "https://github.com/thecoshman/http/commit/6e4c8e97cce09d0d18d4936f90aa643659d813fc.patch";
+      hash = "sha256-mXclXfp2Nzq6Pr9VFmxiOzECGZEQRNOAcXoKhiOyuFs=";
+    })
+  ];
+
   cargoSha256 = "sha256-odiVIfNJPpagoASnYvdOosHXa37gbQM8Zmvtnao0pAs=";
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index 7997962f3b972..80897a13679e8 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.11.1";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9dp/OMHIA1qYM4XLWOTPmlUm6+7EOE9PFsIa8IcZ/8M=";
+    sha256 = "sha256-2luUuCRcFkoUqPCXHBn1g4T6TxmSzzhDESlFSetowsA=";
   };
 
   vendorSha256 = "sha256-TfHBvcG3e+yjifPVo0ZgcvLvD16fni4m71nCr4cCBD4=";
diff --git a/pkgs/tools/networking/p2p/amule/default.nix b/pkgs/tools/networking/p2p/amule/default.nix
index 7538bb9412602..8cd0f7935ecf6 100644
--- a/pkgs/tools/networking/p2p/amule/default.nix
+++ b/pkgs/tools/networking/p2p/amule/default.nix
@@ -7,7 +7,7 @@
 , lib
 , cmake
 , zlib
-, wxGTK30-gtk3 # WxGTK 3.0 must be used because aMule does not yet work well with 3.1
+, wxGTK30 # WxGTK 3.0 must be used because aMule does not yet work well with 3.1
 , perl
 , cryptopp
 , libupnp
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     zlib
-    wxGTK30-gtk3
+    wxGTK30
     perl
     cryptopp.dev
     libupnp
diff --git a/pkgs/tools/security/tpm2-tools/default.nix b/pkgs/tools/security/tpm2-tools/default.nix
index 63b2f911a53a4..a7147911a865f 100644
--- a/pkgs/tools/security/tpm2-tools/default.nix
+++ b/pkgs/tools/security/tpm2-tools/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tpm2-tools";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchurl {
     url = "https://github.com/tpm2-software/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-584v0271zb14ctgjpELodUpPDKfFS2DvzbdcEqH5j48=";
+    sha256 = "sha256-9jVx0j7dltAkoiRTJry5o2+sLPia71psBaOwhS0pLJk=";
   };
 
   nativeBuildInputs = [ pandoc pkg-config makeWrapper ];
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 57f49988e75b0..27574241576ad 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -1,4 +1,6 @@
-{ lib, python3Packages }:
+{ lib
+, python3Packages
+}:
 
 let
   truffleHogRegexes = python3Packages.buildPythonPackage rec {
@@ -16,7 +18,7 @@ in
 
     src = python3Packages.fetchPypi {
       inherit pname version;
-      sha256 = "sha256-fw0JyM2iqQrkL4FAXllEozJdkKWELS3eAURx5NZcceQ=";
+      hash = "sha256-fw0JyM2iqQrkL4FAXllEozJdkKWELS3eAURx5NZcceQ=";
     };
 
     # Relax overly restricted version constraint
@@ -24,15 +26,18 @@ in
       substituteInPlace setup.py --replace "GitPython ==" "GitPython >= "
     '';
 
-    propagatedBuildInputs = [ python3Packages.GitPython truffleHogRegexes ];
+    propagatedBuildInputs = [
+      python3Packages.gitpython
+      truffleHogRegexes
+    ];
 
     # Test cases run git clone and require network access
     doCheck = false;
 
-    meta = {
+    meta = with lib; {
       homepage = "https://github.com/dxa4481/truffleHog";
       description = "Searches through git repositories for high entropy strings and secrets, digging deep into commit history";
-      license = with lib.licenses; [ gpl2 ];
-      maintainers = with lib.maintainers; [ bhipple ];
+      license = with licenses; [ gpl2 ];
+      maintainers = with maintainers; [ bhipple ];
     };
   }
diff --git a/pkgs/tools/security/vaultwarden/vault.nix b/pkgs/tools/security/vaultwarden/vault.nix
index 4353303a91600..0a80c10795326 100644
--- a/pkgs/tools/security/vaultwarden/vault.nix
+++ b/pkgs/tools/security/vaultwarden/vault.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vaultwarden-vault";
-  version = "2022.6.2";
+  version = "2022.11.1";
 
   src = fetchurl {
     url = "https://github.com/dani-garcia/bw_web_builds/releases/download/v${version}/bw_web_v${version}.tar.gz";
-    sha256 = "sha256-IG/eCBTUa7eKeaelqxCWO+rrXJUuBanhsYwklftxdOE=";
+    sha256 = "sha256-nd32Q0uTsnrdVPDe1Yglvkg2QcwgLR+x0dFvKSD8o8I=";
   };
 
   buildCommand = ''
diff --git a/pkgs/tools/system/plan9port/default.nix b/pkgs/tools/system/plan9port/default.nix
index 3e52d10a240bd..b4a277eeec4e5 100644
--- a/pkgs/tools/system/plan9port/default.nix
+++ b/pkgs/tools/system/plan9port/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plan9port";
-  version = "2021-10-19";
+  version = "2022-09-12";
 
   src = fetchFromGitHub {
     owner = "9fans";
     repo = pname;
-    rev = "d0d440860f2000a1560abb3f593cdc325fcead4c";
-    hash = "sha256-2aYXqPGwrReyFPrLDtEjgQd/RJjpOfI3ge/tDocYpRQ=";
+    rev = "ffbdd1aa20c8a20a8e9dcd3cec644b6dfa3c6acb";
+    hash = "sha256-Lq5B4VYUetkHwhFX2EaLr33wR1aLIiVn8OBobxjFt7I=";
   };
 
   postPatch = ''
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     runHook preBuild
-    ./INSTALL -b
+    PLAN9_TARGET=$out/plan9 ./INSTALL -b
     runHook postBuild
   '';
 
diff --git a/pkgs/tools/text/poedit/default.nix b/pkgs/tools/text/poedit/default.nix
index 1a9f33438c8b1..37fc346eb0a9b 100644
--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK30-gtk3,
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, pkg-config, wxGTK30,
   boost, icu, lucenepp, asciidoc, libxslt, xmlto, gtk3, gtkspell3, pugixml,
   nlohmann_json, hicolor-icon-theme, wrapGAppsHook }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoconf automake asciidoc wrapGAppsHook
     libxslt xmlto boost libtool pkg-config ];
 
-  buildInputs = [ lucenepp nlohmann_json wxGTK30-gtk3 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
+  buildInputs = [ lucenepp nlohmann_json wxGTK30 icu pugixml gtk3 gtkspell3 hicolor-icon-theme ];
 
   propagatedBuildInputs = [ gettext ];
 
diff --git a/pkgs/tools/text/transifex-client/default.nix b/pkgs/tools/text/transifex-client/default.nix
index ae23e57755928..07a49c3d45052 100644
--- a/pkgs/tools/text/transifex-client/default.nix
+++ b/pkgs/tools/text/transifex-client/default.nix
@@ -6,7 +6,7 @@
 , urllib3
 , six
 , setuptools
-, GitPython
+, gitpython
 , pythonRelaxDepsHook
 }:
 
@@ -20,11 +20,16 @@ buildPythonApplication rec {
   };
 
   # https://github.com/transifex/transifex-client/issues/323
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-  pythonRelaxDeps = [ "python-slugify" ];
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "python-slugify"
+  ];
 
   propagatedBuildInputs = [
-    GitPython
+    gitpython
     python-slugify
     requests
     setuptools
@@ -36,9 +41,9 @@ buildPythonApplication rec {
   doCheck = false;
 
   meta = with lib; {
+    description = "Transifex translation service client";
     homepage = "https://www.transifex.com/";
     license = licenses.gpl2Only;
-    description = "Transifex translation service client";
     maintainers = with maintainers; [ sikmir ];
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 12604948af507..0d4554674b2d4 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1245,6 +1245,7 @@ mapAliases ({
   pyMAILt = throw "pyMAILt has been removed from nixpkgs as it is unmaintained and python2-only";
   pybind11 = throw "pybind11 was removed because pythonPackages.pybind11 for the appropriate version of Python should be used"; # Added 2021-05-14
   pybitmessage = throw "pybitmessage was removed from nixpkgs as it is stuck on python2"; # Added 2022-01-01
+  pyext = throw "pyext was removed because it does not support python 3.11, is upstream unmaintained and was unused"; # Added 2022-11-21
   pygmentex = texlive.bin.pygmentex; # Added 2019-12-15
   pyload = throw "pyload has been removed from nixpkgs, as it was unmaintained"; # Added 2021-03-21
   pynagsystemd = throw "pynagsystemd was removed as it was unmaintained and incompatible with recent systemd versions. Instead use its fork check_systemd"; # Added 2020-10-24
@@ -1593,6 +1594,8 @@ mapAliases ({
   wxGTK = throw "wxGTK28 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
   wxGTK28 = throw "wxGTK28 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
   wxGTK29 = throw "wxGTK29 has been removed from nixpkgs as it has reached end of life"; # Added 2022-11-04
+  wxGTK30-gtk2 = throw "'wxGTK30-gtk2' has been removed from nixpkgs as it depends on deprecated GTK2"; # Added 2022-12-03
+  wxGTK30-gtk3 = throw "'wxGTK30-gtk3' has been renamed to/replaced by 'wxGTK30'"; # Added 2022-12-03
   wxGTK31-gtk2 = throw "'wxGTK31-gtk2' has been removed from nixpkgs as it depends on deprecated GTK2"; # Added 2022-10-27
   wxGTK31-gtk3 = throw "'wxGTK31-gtk3' has been renamed to/replaced by 'wxGTK31'"; # Added 2022-10-27
   wxmupen64plus = throw "wxmupen64plus was removed because the upstream disappeared"; # Added 2022-01-31
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 87376adb55f1e..883df35fb01da 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2024,11 +2024,11 @@ with pkgs;
 
   maiko = callPackage ../applications/emulators/maiko { };
 
-  mame = libsForQt5.callPackage ../applications/emulators/mame {
-    inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
-  };
+  mame = libsForQt5.callPackage ../applications/emulators/mame { };
 
-  mame-tools = (lib.getOutput "tools" mame);
+  mame-tools = lib.addMetaAttrs {
+    description = mame.meta.description + " (tools only)";
+  } (lib.getOutput "tools" mame);
 
   mednafen = callPackage ../applications/emulators/mednafen {
     inherit (darwin) libiconv;
@@ -2065,7 +2065,7 @@ with pkgs;
   pcem = callPackage ../applications/emulators/pcem { };
 
   pcsx2 = callPackage ../applications/emulators/pcsx2 {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   pcsxr = callPackage ../applications/emulators/pcsxr { };
@@ -2788,9 +2788,7 @@ with pkgs;
 
   bcachefs-tools = callPackage ../tools/filesystems/bcachefs-tools { };
 
-  bisq-desktop = callPackage ../applications/blockchains/bisq-desktop {
-    openjdk11 = openjdk11.override { enableJavaFX = true; };
-  };
+  bisq-desktop = callPackage ../applications/blockchains/bisq-desktop { };
 
   bic = callPackage ../development/interpreters/bic { };
 
@@ -3190,6 +3188,8 @@ with pkgs;
 
   ipgrep = callPackage ../tools/networking/ipgrep { };
 
+  ipp-usb = callPackage ../os-specific/linux/ipp-usb { };
+
   itch = callPackage ../games/itch {};
 
   itd = callPackage ../applications/misc/itd { };
@@ -10693,7 +10693,7 @@ with pkgs;
   pod2mdoc = callPackage ../tools/misc/pod2mdoc { };
 
   poedit = callPackage ../tools/text/poedit {
-    wxGTK30-gtk3 = wxGTK30-gtk3.override { withWebKit = true; };
+    wxGTK30 = wxGTK30.override { withWebKit = true; };
   };
 
   polaris = callPackage ../servers/polaris { };
@@ -13307,6 +13307,7 @@ with pkgs;
   zbackup = callPackage ../tools/backup/zbackup {};
 
   zbar = libsForQt5.callPackage ../tools/graphics/zbar {
+    inherit (darwin.apple_sdk.frameworks) Foundation;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
@@ -13360,6 +13361,8 @@ with pkgs;
 
   zip = callPackage ../tools/archivers/zip { };
 
+  zinc = callPackage ../servers/search/zinc { };
+
   zkfuse = callPackage ../tools/filesystems/zkfuse { };
 
   zpaq = callPackage ../tools/archivers/zpaq { };
@@ -15165,11 +15168,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_64 = callPackage ../development/compilers/rust/1_64.nix {
+  rust_1_65 = callPackage ../development/compilers/rust/1_65.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_14 = llvmPackages_14.libllvm;
   };
-  rust = rust_1_64;
+  rust = rust_1_65;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -15178,8 +15181,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_64 = rust_1_64.packages.stable;
-  rustPackages = rustPackages_1_64;
+  rustPackages_1_65 = rust_1_65.packages.stable;
+  rustPackages = rustPackages_1_65;
 
   inherit (rustPackages) cargo clippy rustc rustPlatform;
 
@@ -15446,7 +15449,8 @@ with pkgs;
   sbcl_2_2_4 = callPackage ../development/compilers/sbcl/2.x.nix { version = "2.2.4"; };
   sbcl_2_2_6 = callPackage ../development/compilers/sbcl/2.x.nix { version = "2.2.6"; };
   sbcl_2_2_9 = callPackage ../development/compilers/sbcl/2.x.nix { version = "2.2.9"; };
-  sbcl = sbcl_2_2_9;
+  sbcl_2_2_10 = callPackage ../development/compilers/sbcl/2.x.nix { version = "2.2.10"; };
+  sbcl = sbcl_2_2_10;
 
   roswell = callPackage ../development/tools/roswell { };
 
@@ -16129,12 +16133,10 @@ with pkgs;
 
   pipewire = callPackage ../development/libraries/pipewire {
     # ffmpeg depends on SDL2 which depends on pipewire by default.
-    # Break the cycle by disabling pipewire support in our ffmpeg.
-    ffmpeg = ffmpeg.override {
-      SDL2 = SDL2.override {
-        pipewireSupport = false;
-      };
-    };
+    # Break the cycle by depending on ffmpeg-headless.
+    # Pipewire only uses libavcodec (via an SPA plugin), which isn't
+    # affected by the *-headless changes.
+    ffmpeg = ffmpeg-headless;
   };
 
   pipewire-media-session = callPackage ../development/libraries/pipewire/media-session.nix {};
@@ -16729,7 +16731,7 @@ with pkgs;
   bloop = callPackage ../development/tools/build-managers/bloop { };
 
   bossa = callPackage ../development/embedded/bossa {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   bossa-arduino = callPackage ../development/embedded/bossa/arduino.nix { };
@@ -18943,6 +18945,8 @@ with pkgs;
   factor-lang-scope = callPackage ../development/compilers/factor-lang/scope.nix { };
   factor-lang = factor-lang-scope.interpreter;
 
+  fancypp = callPackage ../development/libraries/fancypp { };
+
   far2l = callPackage ../applications/misc/far2l {
     stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     inherit (darwin.apple_sdk.frameworks) IOKit Carbon Cocoa AudioToolbox OpenGL;
@@ -19217,8 +19221,6 @@ with pkgs;
 
   gd = callPackage ../development/libraries/gd {
     automake = automake115x;
-    libtiff = null;
-    libXpm = null;
   };
 
   gdal = callPackage ../development/libraries/gdal { };
@@ -19247,6 +19249,8 @@ with pkgs;
 
   graphinder = callPackage ../tools/security/graphinder { };
 
+  httplib = callPackage ../development/libraries/httplib { };
+
   icon-lang = callPackage ../development/interpreters/icon-lang { };
 
   libgit2 = callPackage ../development/libraries/libgit2 {
@@ -19477,7 +19481,7 @@ with pkgs;
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
   gst_all_1 = recurseIntoAttrs(callPackage ../development/libraries/gstreamer {
-    callPackage = newScope (gst_all_1 // { libav = pkgs.ffmpeg; });
+    callPackage = newScope (gst_all_1 // { libav = pkgs.ffmpeg-headless; });
     inherit (darwin.apple_sdk.frameworks) AudioToolbox AVFoundation Cocoa CoreFoundation CoreMedia CoreServices CoreVideo DiskArbitration Foundation IOKit MediaToolbox OpenGL VideoToolbox;
   });
 
@@ -21879,7 +21883,9 @@ with pkgs;
 
   openexrid-unstable = callPackage ../development/libraries/openexrid-unstable { };
 
-  openldap = callPackage ../development/libraries/openldap { };
+  openldap = callPackage ../development/libraries/openldap {
+    openssl = openssl_legacy;
+  };
 
   opencolorio = darwin.apple_sdk_11_0.callPackage ../development/libraries/opencolorio {
     inherit (darwin.apple_sdk_11_0.frameworks) Carbon GLUT Cocoa;
@@ -21935,6 +21941,10 @@ with pkgs;
 
   openssl = openssl_3;
 
+  openssl_legacy = openssl.override {
+    conf = ../development/libraries/openssl/3.0/legacy.cnf;
+  };
+
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_1
     openssl_3;
@@ -22469,6 +22479,8 @@ with pkgs;
 
   seasocks = callPackage ../development/libraries/seasocks { };
 
+  semver-cpp = callPackage ../development/libraries/semver-cpp { };
+
   serd = callPackage ../development/libraries/serd {};
 
   serf = callPackage ../development/libraries/serf {
@@ -23115,12 +23127,9 @@ with pkgs;
   };
 
   wxGTK30 = callPackage ../development/libraries/wxwidgets/wxGTK30.nix {
-    withGtk2 = true;
     inherit (darwin.stubs) setfile;
     inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Kernel QTKit AVFoundation AVKit WebKit;
   };
-  wxGTK30-gtk2 = wxGTK30.override { withGtk2 = true; };
-  wxGTK30-gtk3 = wxGTK30.override { withGtk2 = false; };
 
   wxmac = callPackage ../development/libraries/wxwidgets/wxmac30.nix {
     inherit (darwin.stubs) derez rez setfile;
@@ -23138,7 +23147,7 @@ with pkgs;
   };
 
   wxSVG = callPackage ../development/libraries/wxSVG {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
@@ -23605,6 +23614,11 @@ with pkgs;
   cassandra_3_11 = callPackage ../servers/nosql/cassandra/3.11.nix {
     jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
+  cassandra_4 = callPackage ../servers/nosql/cassandra/4.nix {
+    # Effective Cassandra 4.0.2 there is full Java 11 support
+    #  -- https://cassandra.apache.org/doc/latest/cassandra/new/java11.html
+    jre = pkgs.jdk11_headless;
+  };
   cassandra = cassandra_3_11;
 
   cassandra-cpp-driver = callPackage ../development/libraries/cassandra-cpp-driver/default.nix { };
@@ -24215,6 +24229,10 @@ with pkgs;
     boost = boost172;
   };
 
+  soundux = callPackage ../applications/audio/soundux {
+    yt-dlp = yt-dlp.override { withAlias = true; };
+  };
+
   tomcat_connectors = callPackage ../servers/http/apache-modules/tomcat-connectors { };
 
   tomcat-native = callPackage ../servers/http/tomcat/tomcat-native.nix { };
@@ -25679,9 +25697,7 @@ with pkgs;
 
   go-migrate = callPackage ../development/tools/go-migrate { };
 
-  go-mockery = callPackage ../development/tools/go-mockery {
-    buildGoModule = buildGo118Module; # tests fail with 1.19
-  };
+  go-mockery = callPackage ../development/tools/go-mockery { };
 
   gomacro = callPackage ../development/tools/gomacro { };
 
@@ -26035,6 +26051,8 @@ with pkgs;
 
   twa = callPackage ../tools/networking/twa { };
 
+  twingate = callPackage ../applications/networking/twingate { };
+
   # Upstream U-Boots:
   inherit (callPackage ../misc/uboot {})
     buildUBoot
@@ -26998,6 +27016,8 @@ with pkgs;
 
   sierra-breeze-enhanced = libsForQt5.callPackage ../data/themes/kwin-decorations/sierra-breeze-enhanced { };
 
+  simp1e-cursors = callPackage ../data/icons/simp1e-cursors { };
+
   sjasmplus = callPackage ../development/compilers/sjasmplus { };
 
   skeu = callPackage ../data/themes/skeu { };
@@ -31712,7 +31732,7 @@ with pkgs;
   radioboat = callPackage ../applications/audio/radioboat { };
 
   radiotray-ng = callPackage ../applications/audio/radiotray-ng {
-    wxGTK = wxGTK30-gtk3;
+    wxGTK = wxGTK30;
   };
 
   raiseorlaunch = callPackage ../applications/misc/raiseorlaunch {};
@@ -32665,9 +32685,7 @@ with pkgs;
     enableX11 = config.unison.enableX11 or true;
   };
 
-  unpaper = callPackage ../tools/graphics/unpaper {
-    ffmpeg_5 = ffmpeg_5-headless;
-  };
+  unpaper = callPackage ../tools/graphics/unpaper { };
 
   unison-ucm = callPackage ../development/compilers/unison { };
 
@@ -33410,6 +33428,8 @@ with pkgs;
 
   yate = callPackage ../applications/misc/yate { };
 
+  yaup = callPackage ../applications/networking/yaup { };
+
   ydiff = with python3.pkgs; toPythonApplication ydiff;
 
   ydict = callPackage ../applications/misc/ydict {};
@@ -35907,14 +35927,6 @@ with pkgs;
     });
 
     java = openjdk17;
-    z3 = z3_4_4_0.overrideAttrs (_: {
-      src = fetchFromGitHub {
-        owner = "Z3Prover";
-        repo = "z3";
-        rev = "0482e7fe727c75e259ac55a932b28cf1842c530e";
-        sha256 = "1m53avlljxqd2p8w266ksmjywjycsd23h224yn786qsnf36dr63x";
-      };
-    });
   };
   isabelle-components = recurseIntoAttrs (callPackage ../applications/science/logic/isabelle/components { });
 
@@ -38079,9 +38091,7 @@ with pkgs;
 
   gpio-utils = callPackage ../os-specific/linux/kernel/gpio-utils.nix { };
 
-  navidrome = callPackage ../servers/misc/navidrome {
-    ffmpeg = ffmpeg-headless;
-  };
+  navidrome = callPackage ../servers/misc/navidrome { };
 
   zalgo = callPackage ../tools/misc/zalgo { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e0cecf43d2645..2bc8fe7df5260 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -389,7 +389,7 @@ let
       substituteInPlace Build.PL \
         --replace "gtk+-2.0" "gtk+-3.0"
     '';
-    propagatedBuildInputs = [ pkgs.pkg-config pkgs.gtk3 pkgs.wxGTK30-gtk3 ModulePluggable ];
+    propagatedBuildInputs = [ pkgs.pkg-config pkgs.gtk3 pkgs.wxGTK30 ModulePluggable ];
     buildInputs = [ LWPProtocolHttps ];
     meta = {
       description = "Building, finding and using wxWidgets binaries";
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 5ec56f28527b8..a7c8782be21f5 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -87,6 +87,7 @@ mapAliases ({
   garminconnect-ha = garminconnect; # added 2022-02-05
   gigalixir = throw "gigalixir has been promoted to a top-level attribute"; # Added 2022-10-02
   gitdb2 = throw "gitdb2 has been deprecated, use gitdb instead."; # added 2020-03-14
+  GitPython = gitpython; # added 2022-10-28
   glances = throw "glances has moved to pkgs.glances"; # added 2020-20-28
   google_api_python_client = google-api-python-client; # added 2021-03-19
   googleapis_common_protos = googleapis-common-protos; # added 2021-03-19
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2c8945f53617d..1ccfa77283c6f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1430,7 +1430,7 @@ self: super: with self; {
 
   btrfs = callPackage ../development/python-modules/btrfs { };
 
-  btrfsutil = toPythonModule (pkgs.btrfs-progs.override { python3 = self.python; });
+  btrfsutil = callPackage ../development/python-modules/btrfsutil { };
 
   btsocket = callPackage ../development/python-modules/btsocket { };
 
@@ -3736,18 +3736,19 @@ self: super: with self; {
 
   git-filter-repo = callPackage ../development/python-modules/git-filter-repo { };
 
-  gitdb = callPackage ../development/python-modules/gitdb { };
+  git-revise = callPackage ../development/python-modules/git-revise { };
 
-  github3_py = callPackage ../development/python-modules/github3_py { };
+  git-sweep = callPackage ../development/python-modules/git-sweep { };
+
+  gitdb = callPackage ../development/python-modules/gitdb { };
 
   github-to-sqlite = callPackage ../development/python-modules/github-to-sqlite { };
 
   github-webhook = callPackage ../development/python-modules/github-webhook { };
-  GitPython = callPackage ../development/python-modules/GitPython { };
 
-  git-revise = callPackage ../development/python-modules/git-revise { };
+  github3_py = callPackage ../development/python-modules/github3_py { };
 
-  git-sweep = callPackage ../development/python-modules/git-sweep { };
+  gitpython = callPackage ../development/python-modules/gitpython { };
 
   glad =  callPackage ../development/python-modules/glad { };
 
@@ -7819,8 +7820,6 @@ self: super: with self; {
 
   pyexcel-xls = callPackage ../development/python-modules/pyexcel-xls { };
 
-  pyext = callPackage ../development/python-modules/pyext { };
-
   pyezviz = callPackage ../development/python-modules/pyezviz { };
 
   pyface = callPackage ../development/python-modules/pyface { };
@@ -8979,6 +8978,8 @@ self: super: with self; {
 
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
+  python-arango = callPackage ../development/python-modules/python-arango { };
+
   python-awair = callPackage ../development/python-modules/python-awair { };
 
   python3-saml = callPackage ../development/python-modules/python3-saml { };
@@ -12045,7 +12046,7 @@ self: super: with self; {
 
   wxPython_4_0 = callPackage ../development/python-modules/wxPython/4.0.nix {
     inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox Carbon Cocoa CoreFoundation IOKit OpenGL;
-    wxGTK = pkgs.wxGTK30-gtk3.override {
+    wxGTK = pkgs.wxGTK30.override {
       withWebKit = true;
     };
   };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index bb25b2df7a08d..d702c04dac156 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -1166,6 +1166,16 @@
     };
     version = "2.14.3";
   };
+  htmlbeautifier = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1y55dx25l3wwc025mwl6jsbcsqrm30gs2d2pxnaxg07yh22ckq4x";
+      type = "gem";
+    };
+    version = "1.4.2";
+  };
   http-accept = {
     groups = ["default"];
     platforms = [];
@@ -1197,6 +1207,17 @@
     };
     version = "0.8.0";
   };
+  httparty = {
+    dependencies = ["multi_xml"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1q42553gp8brkkrn97m7ah4yr6bqs7fsn8lg84yzx6dr6y02bj5i";
+      type = "gem";
+    };
+    version = "0.15.7";
+  };
   httpclient = {
     groups = ["default"];
     platforms = [];
@@ -1238,6 +1259,16 @@
     };
     version = "0.1.4";
   };
+  ipaddr = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13qd34nzpgp3fxfjbvaqg3dcnfr0cgl5vjvcqy0hfllbvfcklnbq";
+      type = "gem";
+    };
+    version = "1.2.4";
+  };
   jaro_winkler = {
     groups = ["default"];
     platforms = [];
@@ -1664,6 +1695,17 @@
     };
     version = "2.2.1";
   };
+  jekyll-webmention_io = {
+    dependencies = ["htmlbeautifier" "jekyll" "json" "openssl" "string_inflection" "uglifier" "webmention"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "141bj7v068s6sdz3syhzrka47w3r6r9r69a6mhfxrzfyrkwqq8a1";
+      type = "gem";
+    };
+    version = "3.3.6";
+  };
   jemoji = {
     dependencies = ["gemoji" "html-pipeline" "jekyll"];
     groups = ["default"];
@@ -1768,6 +1810,16 @@
     };
     version = "3.2.4";
   };
+  link_header = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yamrdq4rywmnpdhbygnkkl9fdy249fg5r851nrkkxr97gj5rihm";
+      type = "gem";
+    };
+    version = "0.0.8";
+  };
   liquid = {
     groups = ["default"];
     platforms = [];
@@ -1954,6 +2006,16 @@
     };
     version = "1.15.0";
   };
+  multi_xml = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lmd4f401mvravi1i1yq7b2qjjli0yq7dfc4p1nj5nwajp7r6hyj";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
   mustermann = {
     dependencies = ["ruby2_keywords"];
     groups = ["default"];
@@ -2078,6 +2140,17 @@
     };
     version = "4.25.1";
   };
+  openssl = {
+    dependencies = ["ipaddr"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xx01in25q31rpxmq2qlimi44zarsp4px7046xnc6in0pa127xsk";
+      type = "gem";
+    };
+    version = "2.2.2";
+  };
   optimist = {
     groups = ["default"];
     platforms = [];
@@ -3015,6 +3088,16 @@
     };
     version = "1.5.3";
   };
+  string_inflection = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0v57afc7rdr58xd6mayf9giifqgav3hqjr54kagi7iki3hn6vjag";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
   syntax_tree = {
     dependencies = ["prettier_print"];
     groups = ["default"];
@@ -3193,6 +3276,17 @@
     };
     version = "1.2.10";
   };
+  uglifier = {
+    dependencies = ["execjs"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wgh7bzy68vhv9v68061519dd8samcy8sazzz0w3k8kqpy3g4s5f";
+      type = "gem";
+    };
+    version = "4.2.0";
+  };
   unf = {
     dependencies = ["unf_ext"];
     groups = ["default"];
@@ -3234,6 +3328,17 @@
     };
     version = "0.2.0";
   };
+  webmention = {
+    dependencies = ["httparty" "json" "link_header" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1s3p572rp1aifk7xxhnwvnpxwvn9sx8hx5zm0mz0ff4lgb2y4yq4";
+      type = "gem";
+    };
+    version = "0.1.6";
+  };
   webrick = {
     groups = ["default"];
     platforms = [];