about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/labeler.yml1
-rw-r--r--pkgs/build-support/writers/scripts.nix498
-rw-r--r--pkgs/build-support/writers/test.nix88
-rw-r--r--pkgs/by-name/on/onevpl-intel-gpu/package.nix38
-rw-r--r--pkgs/development/libraries/edencommon/default.nix4
-rw-r--r--pkgs/development/libraries/expat/2.6.0-fix-tests-flakiness.patch252
-rw-r--r--pkgs/development/libraries/expat/default.nix9
-rw-r--r--pkgs/development/libraries/fb303/default.nix4
-rw-r--r--pkgs/development/libraries/fbthrift/default.nix8
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix7
-rw-r--r--pkgs/development/libraries/fizz/default.nix4
-rw-r--r--pkgs/development/libraries/folly/default.nix7
-rw-r--r--pkgs/development/libraries/glib-networking/default.nix10
-rw-r--r--pkgs/development/libraries/glib-networking/disable-pkcs11-tests.patch13
-rw-r--r--pkgs/development/libraries/libhandy/default.nix4
-rw-r--r--pkgs/development/libraries/librsvg/default.nix6
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/mvfst/default.nix4
-rw-r--r--pkgs/development/libraries/pango/default.nix4
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/wangle/default.nix4
-rw-r--r--pkgs/development/python-modules/django/4.nix5
-rw-r--r--pkgs/development/python-modules/pymysql/default.nix5
-rw-r--r--pkgs/development/python-modules/pyqrcode/default.nix5
-rw-r--r--pkgs/development/python-modules/pyqt/5.x.nix5
-rw-r--r--pkgs/development/python-modules/sqlalchemy-i18n/default.nix5
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix2
-rw-r--r--pkgs/development/tools/misc/luarocks/default.nix4
-rw-r--r--pkgs/development/tools/watchman/default.nix4
31 files changed, 559 insertions, 457 deletions
diff --git a/.github/labeler.yml b/.github/labeler.yml
index 35d1d140d94e7..37a162f10fa35 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -80,6 +80,7 @@
   - lib/**
 
 "6.topic: lua":
+  - pkgs/development/tools/misc/luarocks/*
   - pkgs/development/interpreters/lua-5/**/*
   - pkgs/development/interpreters/luajit/**/*
   - pkgs/development/lua-modules/**/*
diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index 1dd25c500719b..06d763ca9d6af 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -1,4 +1,14 @@
-{ pkgs, buildPackages, lib, stdenv, libiconv, mkNugetDeps, mkNugetSource, gixy }:
+{
+  buildPackages,
+  gixy,
+  lib,
+  libiconv,
+  makeBinaryWrapper,
+  mkNugetDeps,
+  mkNugetSource,
+  pkgs,
+  stdenv,
+}:
 let
   inherit (lib)
     concatMapStringsSep
@@ -6,7 +16,6 @@ let
     escapeShellArg
     last
     optionalString
-    stringLength
     strings
     types
     ;
@@ -18,137 +27,285 @@ rec {
   # Examples:
   #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
   #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
-  makeScriptWriter = { interpreter, check ? "" }: nameOrPath: content:
+  makeScriptWriter = { interpreter, check ? "", makeWrapperArgs ? [], }: nameOrPath: content:
     assert (types.path.check nameOrPath) || (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
     assert (types.path.check content) || (types.str.check content);
     let
+      nameIsPath = types.path.check nameOrPath;
       name = last (builtins.split "/" nameOrPath);
-    in
+      path = if nameIsPath then nameOrPath else "/bin/${name}";
+      # The inner derivation which creates the executable under $out/bin (never at $out directly)
+      # This is required in order to support wrapping, as wrapped programs consist of at least two files: the executable and the wrapper.
+      inner =
+        pkgs.runCommandLocal name (
+          {
+            inherit makeWrapperArgs;
+            nativeBuildInputs = [
+              makeBinaryWrapper
+            ];
+            meta.mainProgram = name;
+          }
+          // (
+            if (types.str.check content) then {
+              inherit content interpreter;
+              passAsFile = [ "content" ];
+            } else {
+              inherit interpreter;
+              contentPath = content;
+            }
+          )
+        )
+        ''
+          # On darwin a script cannot be used as an interpreter in a shebang but
+          # there doesn't seem to be a limit to the size of shebang and multiple
+          # arguments to the interpreter are allowed.
+          if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
+          then
+            wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
+            # Get first word from the line (note: xargs echo remove leading spaces)
+            wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
+
+            if isScript $wrapperInterpreter
+            then
+              echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
+              exit 1
+            fi
+
+            # This should work as long as wrapperInterpreter is a shell, which is
+            # the case for programs wrapped with makeWrapper, like
+            # python3.withPackages etc.
+            interpreterLine="$wrapperInterpreterLine $interpreter"
+          else
+            interpreterLine=$interpreter
+          fi
+
+          echo "#! $interpreterLine" > $out
+          cat "$contentPath" >> $out
+          ${optionalString (check != "") ''
+            ${check} $out
+          ''}
+          chmod +x $out
+
+          # Relocate executable
+          # Wrap it if makeWrapperArgs are specified
+          mv $out tmp
+            mkdir -p $out/$(dirname "${path}")
+            mv tmp $out/${path}
+          if [ -n "''${makeWrapperArgs+''${makeWrapperArgs[@]}}" ]; then
+              wrapProgram $out/${path} ''${makeWrapperArgs[@]}
+          fi
+        '';
+      in
+        if nameIsPath
+        then inner
+        # In case nameOrPath is a name, the user intends the executable to be located at $out.
+        # This is achieved by creating a separate derivation containing a symlink at $out linking to ${inner}/bin/${name}.
+        # This breaks the override pattern.
+        # In case this turns out to be a problem, we can still add more magic
+        else pkgs.runCommandLocal name {} ''
+          ln -s ${inner}/bin/${name} $out
+        '';
 
-    pkgs.runCommandLocal name (
-      lib.optionalAttrs (nameOrPath == "/bin/${name}") {
-        meta.mainProgram = name;
-      }
-      // (
-        if (types.str.check content) then {
-          inherit content interpreter;
-          passAsFile = [ "content" ];
-        } else {
-          inherit interpreter;
-          contentPath = content;
-        }
-      )
-    )
-    ''
-      # On darwin a script cannot be used as an interpreter in a shebang but
-      # there doesn't seem to be a limit to the size of shebang and multiple
-      # arguments to the interpreter are allowed.
-      if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
-      then
-        wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
-        # Get first word from the line (note: xargs echo remove leading spaces)
-        wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
-
-        if isScript $wrapperInterpreter
-        then
-          echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
-          exit 1
-        fi
-
-        # This should work as long as wrapperInterpreter is a shell, which is
-        # the case for programs wrapped with makeWrapper, like
-        # python3.withPackages etc.
-        interpreterLine="$wrapperInterpreterLine $interpreter"
-      else
-        interpreterLine=$interpreter
-      fi
-
-      echo "#! $interpreterLine" > $out
-      cat "$contentPath" >> $out
-      ${optionalString (check != "") ''
-        ${check} $out
-      ''}
-      chmod +x $out
-      ${optionalString (types.path.check nameOrPath) ''
-        mv $out tmp
-        mkdir -p $out/$(dirname "${nameOrPath}")
-        mv tmp $out/${nameOrPath}
-      ''}
-    '';
 
   # Base implementation for compiled executables.
   # Takes a compile script, which in turn takes the name as an argument.
   #
   # Examples:
   #   writeSimpleC = makeBinWriter { compileScript = name: "gcc -o $out $contentPath"; }
-  makeBinWriter = { compileScript, strip ? true }: nameOrPath: content:
+  makeBinWriter = { compileScript, strip ? true, makeWrapperArgs ? [] }: nameOrPath: content:
     assert (types.path.check nameOrPath) || (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
     assert (types.path.check content) || (types.str.check content);
     let
+      nameIsPath = types.path.check nameOrPath;
       name = last (builtins.split "/" nameOrPath);
+      path = if nameIsPath then nameOrPath else "/bin/${name}";
+      # The inner derivation which creates the executable under $out/bin (never at $out directly)
+      # This is required in order to support wrapping, as wrapped programs consist of at least two files: the executable and the wrapper.
+      inner =
+        pkgs.runCommandLocal name (
+          {
+            inherit makeWrapperArgs;
+            nativeBuildInputs = [
+              makeBinaryWrapper
+            ];
+            meta.mainProgram = name;
+          }
+          // (
+            if (types.str.check content) then {
+            inherit content;
+            passAsFile = [ "content" ];
+          } else {
+            contentPath = content;
+                  }
+          )
+        )
+        ''
+          ${compileScript}
+          ${lib.optionalString strip
+              "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
+          # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
+          # mach-o executables from the get-go, but need to be corrected somehow
+          # which is done by fixupPhase.
+          ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
+          mv $out tmp
+          mkdir -p $out/$(dirname "${path}")
+          mv tmp $out/${path}
+          if [ -n "''${makeWrapperArgs+''${makeWrapperArgs[@]}}" ]; then
+            wrapProgram $out/${path} ''${makeWrapperArgs[@]}
+          fi
+        '';
     in
-    pkgs.runCommand name ((if (types.str.check content) then {
-      inherit content;
-      passAsFile = [ "content" ];
-    } else {
-      contentPath = content;
-    }) // lib.optionalAttrs (nameOrPath == "/bin/${name}") {
-      meta.mainProgram = name;
-    }) ''
-      ${compileScript}
-      ${lib.optionalString strip
-          "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
-      # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
-      # mach-o executables from the get-go, but need to be corrected somehow
-      # which is done by fixupPhase.
-      ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
-      ${optionalString (types.path.check nameOrPath) ''
-        mv $out tmp
-        mkdir -p $out/$(dirname "${nameOrPath}")
-        mv tmp $out/${nameOrPath}
-      ''}
-    '';
+      if nameIsPath
+      then inner
+      # In case nameOrPath is a name, the user intends the executable to be located at $out.
+      # This is achieved by creating a separate derivation containing a symlink at $out linking to ${inner}/bin/${name}.
+      # This breaks the override pattern.
+      # In case this turns out to be a problem, we can still add more magic
+      else pkgs.runCommandLocal name {} ''
+        ln -s ${inner}/bin/${name} $out
+      '';
 
   # Like writeScript but the first line is a shebang to bash
   #
-  # Example:
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
   #   writeBash "example" ''
   #     echo hello world
   #   ''
-  writeBash = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.bash}";
-  };
+  #
+  # Example with arguments:
+  #   writeBash "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix" "PATH" ":" "${pkgs.hello}/bin"
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
+  writeBash = name: argsOrScript:
+    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
+    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.bash}"; }) name
+    else makeScriptWriter { interpreter = "${lib.getExe pkgs.bash}"; } name argsOrScript;
 
   # Like writeScriptBin but the first line is a shebang to bash
+  #
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
+  #   writeBashBin "example" ''
+  #     echo hello world
+  #   ''
+  #
+  # Example with arguments:
+  #  writeBashBin "example"
+  #    {
+  #      makeWrapperArgs = [
+  #        "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #      ];
+  #    }
+  #    ''
+  #      hello
+  #    ''
   writeBashBin = name:
     writeBash "/bin/${name}";
 
   # Like writeScript but the first line is a shebang to dash
   #
-  # Example:
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
   #   writeDash "example" ''
   #     echo hello world
   #   ''
-  writeDash = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.dash}";
-  };
+  #
+  # Example with arguments:
+  #   writeDash "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
+  writeDash = name: argsOrScript:
+    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
+    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.dash}"; }) name
+    else makeScriptWriter { interpreter = "${lib.getExe pkgs.dash}"; } name argsOrScript;
 
   # Like writeScriptBin but the first line is a shebang to dash
+  #
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
+  #   writeDashBin "example" ''
+  #     echo hello world
+  #   ''
+  #
+  # Example with arguments:
+  #  writeDashBin "example"
+  #    {
+  #      makeWrapperArgs = [
+  #        "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #      ];
+  #    }
+  #    ''
+  #      hello
+  #    ''
   writeDashBin = name:
     writeDash "/bin/${name}";
 
   # Like writeScript but the first line is a shebang to fish
   #
-  # Example:
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
   #   writeFish "example" ''
   #     echo hello world
   #   ''
-  writeFish = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.fish} --no-config";
-    check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
-  };
+  #
+  # Example with arguments:
+  #   writeFish "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
+  writeFish = name: argsOrScript:
+    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
+    then makeScriptWriter (argsOrScript // {
+      interpreter = "${lib.getExe pkgs.fish} --no-config";
+      check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
+    }) name
+    else makeScriptWriter {
+      interpreter = "${lib.getExe pkgs.fish} --no-config";
+      check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
+    } name argsOrScript;
 
   # Like writeScriptBin but the first line is a shebang to fish
+  #
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
+  #   writeFishBin "example" ''
+  #     echo hello world
+  #   ''
+  #
+  # Example with arguments:
+  #   writeFishBin "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
   writeFishBin = name:
     writeFish "/bin/${name}";
 
@@ -162,11 +319,12 @@ rec {
   #     main = launchMissiles
   #   '';
   writeHaskell = name: {
-    libraries ? [],
     ghc ? pkgs.ghc,
     ghcArgs ? [],
+    libraries ? [],
+    makeWrapperArgs ? [],
+    strip ? true,
     threadedRuntime ? true,
-    strip ? true
   }:
     let
       appendIfNotSet = el: list: if elem el list then list else list ++ [ el ];
@@ -178,7 +336,7 @@ rec {
         ${(ghc.withPackages (_: libraries ))}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
         mv tmp $out
       '';
-      inherit strip;
+      inherit makeWrapperArgs strip;
     } name;
 
   # writeHaskellBin takes the same arguments as writeHaskell but outputs a directory (like writeScriptBin)
@@ -187,36 +345,72 @@ rec {
 
   # Like writeScript but the first line is a shebang to nu
   #
-  # Example:
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
   #   writeNu "example" ''
   #     echo hello world
   #   ''
-  writeNu = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.nushell} --no-config-file";
-  };
+  #
+  # Example with arguments:
+  #   writeNu "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
+  writeNu = name: argsOrScript:
+    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
+    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; }) name
+    else makeScriptWriter { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; } name argsOrScript;
+
 
   # Like writeScriptBin but the first line is a shebang to nu
+  #
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
+  #   writeNuBin "example" ''
+  #     echo hello world
+  #   ''
+  #
+  # Example with arguments:
+  #   writeNuBin "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #    ''
+  #      hello
+  #    ''
   writeNuBin = name:
     writeNu "/bin/${name}";
 
   # makeRubyWriter takes ruby and compatible rubyPackages and produces ruby script writer,
   # If any libraries are specified, ruby.withPackages is used as interpreter, otherwise the "bare" ruby is used.
-  makeRubyWriter = ruby: rubyPackages: buildRubyPackages: name: { libraries ? [], }:
-  makeScriptWriter {
-    interpreter =
-      if libraries == []
-      then "${ruby}/bin/ruby"
-      else "${(ruby.withPackages (ps: libraries))}/bin/ruby";
-    # Rubocop doesnt seem to like running in this fashion.
-    #check = (writeDash "rubocop.sh" ''
-    #  exec ${lib.getExe buildRubyPackages.rubocop} "$1"
-    #'');
-  } name;
+  makeRubyWriter = ruby: rubyPackages: buildRubyPackages: name: { libraries ? [], ... } @ args:
+  makeScriptWriter (
+    (builtins.removeAttrs args ["libraries"])
+    // {
+      interpreter =
+        if libraries == []
+        then "${ruby}/bin/ruby"
+        else "${(ruby.withPackages (ps: libraries))}/bin/ruby";
+      # Rubocop doesn't seem to like running in this fashion.
+      #check = (writeDash "rubocop.sh" ''
+      #  exec ${lib.getExe buildRubyPackages.rubocop} "$1"
+      #'');
+    }
+  ) name;
 
   # Like writeScript but the first line is a shebang to ruby
   #
   # Example:
-  #   writeRuby "example" ''
+  #   writeRuby "example" { libraries = [ pkgs.rubyPackages.git ]; } ''
   #    puts "hello world"
   #   ''
   writeRuby = makeRubyWriter pkgs.ruby pkgs.rubyPackages buildPackages.rubyPackages;
@@ -227,17 +421,20 @@ rec {
   # makeLuaWriter takes lua and compatible luaPackages and produces lua script writer,
   # which validates the script with luacheck at build time. If any libraries are specified,
   # lua.withPackages is used as interpreter, otherwise the "bare" lua is used.
-  makeLuaWriter = lua: luaPackages: buildLuaPackages: name: { libraries ? [], }:
-  makeScriptWriter {
-    interpreter = lua.interpreter;
-      # if libraries == []
-      # then lua.interpreter
-      # else (lua.withPackages (ps: libraries)).interpreter
-      # This should support packages! I just cant figure out why some dependency collision happens whenever I try to run this.
-    check = (writeDash "luacheck.sh" ''
-      exec ${buildLuaPackages.luacheck}/bin/luacheck "$1"
-    '');
-  } name;
+  makeLuaWriter = lua: luaPackages: buildLuaPackages: name: { libraries ? [], ... } @ args:
+  makeScriptWriter (
+    (builtins.removeAttrs args ["libraries"])
+    // {
+      interpreter = lua.interpreter;
+        # if libraries == []
+        # then lua.interpreter
+        # else (lua.withPackages (ps: libraries)).interpreter
+        # This should support packages! I just cant figure out why some dependency collision happens whenever I try to run this.
+      check = (writeDash "luacheck.sh" ''
+        exec ${buildLuaPackages.luacheck}/bin/luacheck "$1"
+      '');
+    }
+   ) name;
 
   # writeLua takes a name an attributeset with libraries and some lua source code and
   # returns an executable (should also work with luajit)
@@ -265,9 +462,10 @@ rec {
     writeLua "/bin/${name}";
 
   writeRust = name: {
-      rustc ? pkgs.rustc,
-      rustcArgs ? [],
-      strip ? true
+    makeWrapperArgs ? [],
+    rustc ? pkgs.rustc,
+    rustcArgs ? [],
+    strip ? true,
   }:
   let
     darwinArgs = lib.optionals stdenv.isDarwin [ "-L${lib.getLib libiconv}/lib" ];
@@ -277,7 +475,7 @@ rec {
         cp "$contentPath" tmp.rs
         PATH=${lib.makeBinPath [pkgs.gcc]} ${rustc}/bin/rustc ${lib.escapeShellArgs rustcArgs} ${lib.escapeShellArgs darwinArgs} -o "$out" tmp.rs
       '';
-      inherit strip;
+      inherit makeWrapperArgs strip;
     } name;
 
   writeRustBin = name:
@@ -337,10 +535,13 @@ rec {
   #     use boolean;
   #     print "Howdy!\n" if true;
   #   ''
-  writePerl = name: { libraries ? [] }:
-    makeScriptWriter {
-      interpreter = "${lib.getExe (pkgs.perl.withPackages (p: libraries))}";
-    } name;
+  writePerl = name: { libraries ? [], ... } @ args:
+    makeScriptWriter (
+      (builtins.removeAttrs args ["libraries"])
+      // {
+        interpreter = "${lib.getExe (pkgs.perl.withPackages (p: libraries))}";
+      }
+    ) name;
 
   # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
   writePerlBin = name:
@@ -349,22 +550,27 @@ rec {
   # makePythonWriter takes python and compatible pythonPackages and produces python script writer,
   # which validates the script with flake8 at build time. If any libraries are specified,
   # python.withPackages is used as interpreter, otherwise the "bare" python is used.
-  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [] }:
+  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [], ... } @ args:
   let
     ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
   in
-  makeScriptWriter {
-    interpreter =
-      if pythonPackages != pkgs.pypy2Packages || pythonPackages != pkgs.pypy3Packages then
-        if libraries == []
-        then python.interpreter
-        else (python.withPackages (ps: libraries)).interpreter
-      else python.interpreter
-    ;
-    check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
-      exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
-    '');
-  } name;
+  makeScriptWriter
+    (
+      (builtins.removeAttrs args ["libraries" "flakeIgnore"])
+      // {
+        interpreter =
+          if pythonPackages != pkgs.pypy2Packages || pythonPackages != pkgs.pypy3Packages then
+            if libraries == []
+            then python.interpreter
+            else (python.withPackages (ps: libraries)).interpreter
+          else python.interpreter
+        ;
+        check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
+          exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+        '');
+      }
+    )
+    name;
 
   # writePyPy2 takes a name an attributeset with libraries and some pypy2 sourcecode and
   # returns an executable
@@ -421,7 +627,7 @@ rec {
     writePyPy3 "/bin/${name}";
 
 
-  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [] }: nameOrPath:
+  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [], ... } @ args: nameOrPath:
   let
     fname = last (builtins.split "/" nameOrPath);
     path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
@@ -442,9 +648,12 @@ rec {
       ${lib.getExe dotnet-sdk} fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
     '';
 
-  in content: makeScriptWriter {
-    interpreter = fsi;
-  } path
+  in content: makeScriptWriter (
+    (builtins.removeAttrs args ["dotnet-sdk" "fsi-flags" "libraries"])
+    // {
+      interpreter = fsi;
+    }
+  ) path
   ''
     #i "nuget: ${nuget-source}/lib"
     ${ content }
@@ -456,5 +665,4 @@ rec {
 
   writeFSharpBin = name:
     writeFSharp "/bin/${name}";
-
 }
diff --git a/pkgs/build-support/writers/test.nix b/pkgs/build-support/writers/test.nix
index 982c550d28e08..df0eb340d9ae4 100644
--- a/pkgs/build-support/writers/test.nix
+++ b/pkgs/build-support/writers/test.nix
@@ -1,13 +1,8 @@
-{ glib
-, haskellPackages
+{ haskellPackages
 , lib
 , nodePackages
 , perlPackages
-, pypy2Packages
 , python3Packages
-, pypy3Packages
-, luaPackages
-, rubyPackages
 , runCommand
 , testers
 , writers
@@ -310,4 +305,85 @@ lib.recurseIntoAttrs {
       expected = "hello: world\n";
     };
   };
+
+  wrapping = lib.recurseIntoAttrs {
+    bash-bin = expectSuccessBin (
+      writeBashBin "test-writers-wrapping-bash-bin"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          if [[ "$ThaigerSprint" == "Thailand" ]]; then
+            echo "success"
+          fi
+        ''
+    );
+
+    bash = expectSuccess (
+      writeBash "test-writers-wrapping-bash"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          if [[ "$ThaigerSprint" == "Thailand" ]]; then
+            echo "success"
+          fi
+        ''
+    );
+
+    python = expectSuccess (
+      writePython3 "test-writers-wrapping-python"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          import os
+
+          if os.environ.get("ThaigerSprint") == "Thailand":
+              print("success")
+        ''
+    );
+
+    rust = expectSuccess (
+      writeRust "test-writers-wrapping-rust"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          fn main(){
+            if std::env::var("ThaigerSprint").unwrap() == "Thailand" {
+              println!("success")
+            }
+          }
+        ''
+    );
+
+    no-empty-wrapper = let
+      bin = writeBashBin "bin" { makeWrapperArgs = []; } ''true'';
+    in runCommand "run-test-writers-wrapping-no-empty-wrapper" {} ''
+      ls -A ${bin}/bin
+      if [ $(ls -A ${bin}/bin | wc -l) -eq 1 ]; then
+        touch $out
+      else
+        echo "Error: Empty wrapper was created" >&2
+        exit 1
+      fi
+    '';
+  };
 }
diff --git a/pkgs/by-name/on/onevpl-intel-gpu/package.nix b/pkgs/by-name/on/onevpl-intel-gpu/package.nix
new file mode 100644
index 0000000000000..64e6f9d262f2d
--- /dev/null
+++ b/pkgs/by-name/on/onevpl-intel-gpu/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, libdrm
+, libva
+}:
+
+stdenv.mkDerivation rec {
+  pname = "onevpl-intel-gpu";
+  version = "23.4.3";
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "oneapi-src";
+    repo = "oneVPL-intel-gpu";
+    rev = "intel-onevpl-${version}";
+    sha256 = "sha256-oDwDMUq6JpRJH5nbANb7TJLW7HRYA9y0xZxEsoepx/U=";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  buildInputs = [ libdrm libva ];
+
+  meta = {
+    description = "oneAPI Video Processing Library Intel GPU implementation";
+    homepage = "https://github.com/oneapi-src/oneVPL-intel-gpu";
+    changelog = "https://github.com/oneapi-src/oneVPL-intel-gpu/releases/tag/${src.rev}";
+    license = [ lib.licenses.mit ];
+    platforms = lib.platforms.linux;
+    # CMake adds x86 specific compiler flags in <source>/builder/FindGlobals.cmake
+    # NOTE: https://github.com/oneapi-src/oneVPL-intel-gpu/issues/303
+    broken = !stdenv.hostPlatform.isx86;
+    maintainers = [ lib.maintainers.evanrichter ];
+  };
+}
diff --git a/pkgs/development/libraries/edencommon/default.nix b/pkgs/development/libraries/edencommon/default.nix
index 68d6e55291570..0690f0f12ebdf 100644
--- a/pkgs/development/libraries/edencommon/default.nix
+++ b/pkgs/development/libraries/edencommon/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "edencommon";
-  version = "2024.01.22.00";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebookexperimental";
     repo = "edencommon";
     rev = "v${version}";
-    sha256 = "sha256-KY0vXptzOEJLDjHvGd3T5oiCCvggND2bPBzvll+YBo4=";
+    sha256 = "sha256-1z4QicS98juv4bUEbHBkCjVJHEhnoJyLYp4zMHmDbMg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/expat/2.6.0-fix-tests-flakiness.patch b/pkgs/development/libraries/expat/2.6.0-fix-tests-flakiness.patch
deleted file mode 100644
index 9817b1833627f..0000000000000
--- a/pkgs/development/libraries/expat/2.6.0-fix-tests-flakiness.patch
+++ /dev/null
@@ -1,252 +0,0 @@
-diff --git a/lib/internal.h b/lib/internal.h
-index cce71e4c..a217b3f9 100644
---- a/lib/internal.h
-+++ b/lib/internal.h
-@@ -31,7 +31,7 @@
-    Copyright (c) 2016-2023 Sebastian Pipping <sebastian@pipping.org>
-    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
-    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
--   Copyright (c) 2023      Sony Corporation / Snild Dolkow <snild@sony.com>
-+   Copyright (c) 2023-2024 Sony Corporation / Snild Dolkow <snild@sony.com>
-    Licensed under the MIT license:
- 
-    Permission is  hereby granted,  free of charge,  to any  person obtaining
-@@ -162,7 +162,7 @@ const char *unsignedCharToPrintable(unsigned char c);
- #endif
- 
- extern XML_Bool g_reparseDeferralEnabledDefault; // written ONLY in runtests.c
--extern unsigned int g_parseAttempts;             // used for testing only
-+extern unsigned int g_bytesScanned;              // used for testing only
- 
- #ifdef __cplusplus
- }
-diff --git a/lib/xmlparse.c b/lib/xmlparse.c
-index aaf0fa9c..6de99d99 100644
---- a/lib/xmlparse.c
-+++ b/lib/xmlparse.c
-@@ -38,7 +38,7 @@
-    Copyright (c) 2022      Jann Horn <jannh@google.com>
-    Copyright (c) 2022      Sean McBride <sean@rogue-research.com>
-    Copyright (c) 2023      Owain Davies <owaind@bath.edu>
--   Copyright (c) 2023      Sony Corporation / Snild Dolkow <snild@sony.com>
-+   Copyright (c) 2023-2024 Sony Corporation / Snild Dolkow <snild@sony.com>
-    Licensed under the MIT license:
- 
-    Permission is  hereby granted,  free of charge,  to any  person obtaining
-@@ -630,7 +630,7 @@ static unsigned long getDebugLevel(const char *variableName,
-        : ((*((pool)->ptr)++ = c), 1))
- 
- XML_Bool g_reparseDeferralEnabledDefault = XML_TRUE; // write ONLY in runtests.c
--unsigned int g_parseAttempts = 0;                    // used for testing only
-+unsigned int g_bytesScanned = 0;                     // used for testing only
- 
- struct XML_ParserStruct {
-   /* The first member must be m_userData so that the XML_GetUserData
-@@ -1017,7 +1017,7 @@ callProcessor(XML_Parser parser, const char *start, const char *end,
-       return XML_ERROR_NONE;
-     }
-   }
--  g_parseAttempts += 1;
-+  g_bytesScanned += (unsigned)have_now;
-   const enum XML_Error ret = parser->m_processor(parser, start, end, endPtr);
-   if (ret == XML_ERROR_NONE) {
-     // if we consumed nothing, remember what we had on this parse attempt.
-diff --git a/tests/basic_tests.c b/tests/basic_tests.c
-index 7112a440..a9cc3861 100644
---- a/tests/basic_tests.c
-+++ b/tests/basic_tests.c
-@@ -5202,13 +5202,7 @@ START_TEST(test_nested_entity_suspend) {
- END_TEST
- 
- /* Regression test for quadratic parsing on large tokens */
--START_TEST(test_big_tokens_take_linear_time) {
--  const char *const too_slow_failure_message
--      = "Compared to the baseline runtime of the first test, this test has a "
--        "slowdown of more than <max_slowdown>. "
--        "Please keep increasing the value by 1 until it reliably passes the "
--        "test on your hardware and open a bug sharing that number with us. "
--        "Thanks in advance!";
-+START_TEST(test_big_tokens_scale_linearly) {
-   const struct {
-     const char *pre;
-     const char *post;
-@@ -5220,65 +5214,57 @@ START_TEST(test_big_tokens_take_linear_time) {
-       {"<e><", "/></e>"},                   // big elem name, used to be O(N²)
-   };
-   const int num_cases = sizeof(text) / sizeof(text[0]);
--  // For the test we need a <max_slowdown> value that is:
--  // (1) big enough that the test passes reliably (avoiding flaky tests), and
--  // (2) small enough that the test actually catches regressions.
--  const int max_slowdown = 15;
-   char aaaaaa[4096];
-   const int fillsize = (int)sizeof(aaaaaa);
-   const int fillcount = 100;
-+  const unsigned approx_bytes = fillsize * fillcount; // ignore pre/post.
-+  const unsigned max_factor = 4;
-+  const unsigned max_scanned = max_factor * approx_bytes;
- 
-   memset(aaaaaa, 'a', fillsize);
- 
-   if (! g_reparseDeferralEnabledDefault) {
-     return; // heuristic is disabled; we would get O(n^2) and fail.
-   }
--#if ! defined(__linux__)
--  if (CLOCKS_PER_SEC < 100000) {
--    // Skip this test if clock() doesn't have reasonably good resolution.
--    // This workaround is primarily targeting Windows and FreeBSD, since
--    // XSI requires the value to be 1.000.000 (10x the condition here), and
--    // we want to be very sure that at least one platform in CI can catch
--    // regressions (through a failing test).
--    return;
--  }
--#endif
- 
--  clock_t baseline = 0;
-   for (int i = 0; i < num_cases; ++i) {
-     XML_Parser parser = XML_ParserCreate(NULL);
-     assert_true(parser != NULL);
-     enum XML_Status status;
--    set_subtest("max_slowdown=%d text=\"%saaaaaa%s\"", max_slowdown,
--                text[i].pre, text[i].post);
--    const clock_t start = clock();
-+    set_subtest("text=\"%saaaaaa%s\"", text[i].pre, text[i].post);
- 
-     // parse the start text
-+    g_bytesScanned = 0;
-     status = _XML_Parse_SINGLE_BYTES(parser, text[i].pre,
-                                      (int)strlen(text[i].pre), XML_FALSE);
-     if (status != XML_STATUS_OK) {
-       xml_failure(parser);
-     }
-+
-     // parse lots of 'a', failing the test early if it takes too long
-+    unsigned past_max_count = 0;
-     for (int f = 0; f < fillcount; ++f) {
-       status = _XML_Parse_SINGLE_BYTES(parser, aaaaaa, fillsize, XML_FALSE);
-       if (status != XML_STATUS_OK) {
-         xml_failure(parser);
-       }
--      // i == 0 means we're still calculating the baseline value
--      if (i > 0) {
--        const clock_t now = clock();
--        const clock_t clocks_so_far = now - start;
--        const int slowdown = clocks_so_far / baseline;
--        if (slowdown >= max_slowdown) {
--          fprintf(
--              stderr,
--              "fill#%d: clocks_so_far=%d baseline=%d slowdown=%d max_slowdown=%d\n",
--              f, (int)clocks_so_far, (int)baseline, slowdown, max_slowdown);
--          fail(too_slow_failure_message);
--        }
-+      if (g_bytesScanned > max_scanned) {
-+        // We're not done, and have already passed the limit -- the test will
-+        // definitely fail. This block allows us to save time by failing early.
-+        const unsigned pushed
-+            = (unsigned)strlen(text[i].pre) + (f + 1) * fillsize;
-+        fprintf(
-+            stderr,
-+            "after %d/%d loops: pushed=%u scanned=%u (factor ~%.2f) max_scanned: %u (factor ~%u)\n",
-+            f + 1, fillcount, pushed, g_bytesScanned,
-+            g_bytesScanned / (double)pushed, max_scanned, max_factor);
-+        past_max_count++;
-+        // We are failing, but allow a few log prints first. If we don't reach
-+        // a count of five, the test will fail after the loop instead.
-+        assert_true(past_max_count < 5);
-       }
-     }
-+
-     // parse the end text
-     status = _XML_Parse_SINGLE_BYTES(parser, text[i].post,
-                                      (int)strlen(text[i].post), XML_TRUE);
-@@ -5286,18 +5272,14 @@ START_TEST(test_big_tokens_take_linear_time) {
-       xml_failure(parser);
-     }
- 
--    // how long did it take in total?
--    const clock_t end = clock();
--    const clock_t taken = end - start;
--    if (i == 0) {
--      assert_true(taken > 0); // just to make sure we don't div-by-0 later
--      baseline = taken;
--    }
--    const int slowdown = taken / baseline;
--    if (slowdown >= max_slowdown) {
--      fprintf(stderr, "taken=%d baseline=%d slowdown=%d max_slowdown=%d\n",
--              (int)taken, (int)baseline, slowdown, max_slowdown);
--      fail(too_slow_failure_message);
-+    assert_true(g_bytesScanned > approx_bytes); // or the counter isn't working
-+    if (g_bytesScanned > max_scanned) {
-+      fprintf(
-+          stderr,
-+          "after all input: scanned=%u (factor ~%.2f) max_scanned: %u (factor ~%u)\n",
-+          g_bytesScanned, g_bytesScanned / (double)approx_bytes, max_scanned,
-+          max_factor);
-+      fail("scanned too many bytes");
-     }
- 
-     XML_ParserFree(parser);
-@@ -5774,19 +5756,17 @@ START_TEST(test_varying_buffer_fills) {
-                 fillsize[2], fillsize[3]);
-     XML_Parser parser = XML_ParserCreate(NULL);
-     assert_true(parser != NULL);
--    g_parseAttempts = 0;
- 
-     CharData storage;
-     CharData_Init(&storage);
-     XML_SetUserData(parser, &storage);
-     XML_SetStartElementHandler(parser, start_element_event_handler);
- 
-+    g_bytesScanned = 0;
-     int worstcase_bytes = 0; // sum of (buffered bytes at each XML_Parse call)
--    int scanned_bytes = 0;   // sum of (buffered bytes at each actual parse)
-     int offset = 0;
-     while (*fillsize >= 0) {
-       assert_true(offset + *fillsize <= document_length); // or test is invalid
--      const unsigned attempts_before = g_parseAttempts;
-       const enum XML_Status status
-           = XML_Parse(parser, &document[offset], *fillsize, XML_FALSE);
-       if (status != XML_STATUS_OK) {
-@@ -5796,28 +5776,20 @@ START_TEST(test_varying_buffer_fills) {
-       fillsize++;
-       assert_true(offset <= INT_MAX - worstcase_bytes); // avoid overflow
-       worstcase_bytes += offset; // we might've tried to parse all pending bytes
--      if (g_parseAttempts != attempts_before) {
--        assert_true(g_parseAttempts == attempts_before + 1); // max 1/XML_Parse
--        assert_true(offset <= INT_MAX - scanned_bytes);      // avoid overflow
--        scanned_bytes += offset; // we *did* try to parse all pending bytes
--      }
-     }
-     assert_true(storage.count == 1); // the big token should've been parsed
--    assert_true(scanned_bytes > 0);  // test-the-test: does our counter work?
-+    assert_true(g_bytesScanned > 0); // test-the-test: does our counter work?
-     if (g_reparseDeferralEnabledDefault) {
-       // heuristic is enabled; some XML_Parse calls may have deferred reparsing
--      const int max_bytes_scanned = -*fillsize;
--      if (scanned_bytes > max_bytes_scanned) {
-+      const unsigned max_bytes_scanned = -*fillsize;
-+      if (g_bytesScanned > max_bytes_scanned) {
-         fprintf(stderr,
--                "bytes scanned in parse attempts: actual=%d limit=%d \n",
--                scanned_bytes, max_bytes_scanned);
-+                "bytes scanned in parse attempts: actual=%u limit=%u \n",
-+                g_bytesScanned, max_bytes_scanned);
-         fail("too many bytes scanned in parse attempts");
-       }
--      assert_true(scanned_bytes <= worstcase_bytes);
--    } else {
--      // heuristic is disabled; every XML_Parse() will have reparsed
--      assert_true(scanned_bytes == worstcase_bytes);
-     }
-+    assert_true(g_bytesScanned <= (unsigned)worstcase_bytes);
- 
-     XML_ParserFree(parser);
-   }
-@@ -6065,7 +6037,7 @@ make_basic_test_case(Suite *s) {
-   tcase_add_test__ifdef_xml_dtd(tc_basic,
-                                 test_pool_integrity_with_unfinished_attr);
-   tcase_add_test__if_xml_ge(tc_basic, test_nested_entity_suspend);
--  tcase_add_test(tc_basic, test_big_tokens_take_linear_time);
-+  tcase_add_test(tc_basic, test_big_tokens_scale_linearly);
-   tcase_add_test(tc_basic, test_set_reparse_deferral);
-   tcase_add_test(tc_basic, test_reparse_deferral_is_inherited);
-   tcase_add_test(tc_basic, test_set_reparse_deferral_on_null_parser);
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 27cbd38c02868..ee17f3c9b86e4 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -16,7 +16,7 @@
 # files.
 
 let
-  version = "2.6.0";
+  version = "2.6.2";
   tag = "R_${lib.replaceStrings ["."] ["_"] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -25,14 +25,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = with finalAttrs; "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-y19ajqIR4cq9Wb4KkzpS48Aswyboak04fY0hjn7kej4=";
+    hash = "sha256-7hS0xdiQixvsN62TdgfqsYPU2YBqCK3uRyw8MSHSc2Q=";
   };
 
-  patches = [
-    # Fix tests flakiness on some platforms (like aarch64-darwin), should be released in 2.6.1
-    ./2.6.0-fix-tests-flakiness.patch
-  ];
-
   strictDeps = true;
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
diff --git a/pkgs/development/libraries/fb303/default.nix b/pkgs/development/libraries/fb303/default.nix
index d1de187ec2c4f..6c50819ef1468 100644
--- a/pkgs/development/libraries/fb303/default.nix
+++ b/pkgs/development/libraries/fb303/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fb303";
-  version = "2024.01.22.00";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "fb303";
     rev = "v${version}";
-    sha256 = "sha256-EQpe0REGWUpYg+llsCo4x6vJ7UPdWXk3uPM3b8b9Uf0=";
+    sha256 = "sha256-Jtztb8CTqvRdRjUa3jaouP5PFAwoM4rKLIfgvOyXUIg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/fbthrift/default.nix b/pkgs/development/libraries/fbthrift/default.nix
index a483fb1644a2c..216387cf0ae18 100644
--- a/pkgs/development/libraries/fbthrift/default.nix
+++ b/pkgs/development/libraries/fbthrift/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fbthrift";
-  version = "2024.01.22.00";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "fbthrift";
     rev = "v${version}";
-    sha256 = "sha256-vIYXX4NOs2JdhrAJKmIhf4+hQEXHue2Ok7e4cw6yups=";
+    sha256 = "sha256-iCiiKNDlfKm1Y4SGzcSP6o/OdiRRrj9UEawW6qpBpSY=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,9 @@ stdenv.mkDerivation rec {
     flex
   ];
 
-  cmakeFlags = lib.optionals stdenv.isDarwin [
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if stdenv.isDarwin then "OFF" else "ON"}"
+  ] ++ lib.optionals stdenv.isDarwin [
     "-DCMAKE_OSX_DEPLOYMENT_TARGET=10.14" # For aligned allocation
   ];
 
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 09e1a62393a38..7e761e244e1d2 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -93,6 +93,7 @@
 , withVmaf ? withFullDeps && !stdenv.isAarch64 && lib.versionAtLeast version "5" # Netflix's VMAF (Video Multi-Method Assessment Fusion)
 , withVoAmrwbenc ? withFullDeps && withVersion3 # AMR-WB encoder
 , withVorbis ? withHeadlessDeps # Vorbis de/encoding, native encoder exists
+, withVpl ? false # Hardware acceleration via intel libvpl
 , withVpx ? withHeadlessDeps && stdenv.buildPlatform == stdenv.hostPlatform # VP8 & VP9 de/encoding
 , withVulkan ? withSmallDeps && !stdenv.isDarwin
 , withWebp ? withFullDeps # WebP encoder
@@ -238,6 +239,7 @@
 , libvdpau
 , libvmaf
 , libvorbis
+, libvpl
 , libvpx
 , libwebp
 , libX11
@@ -320,6 +322,7 @@ assert withGPLv3 -> withGPL && withVersion3;
  *  Build dependencies
  */
 assert withPixelutils -> buildAvutil;
+assert !(withMfx && withVpl); # incompatible features
 /*
  *  Program dependencies
  */
@@ -533,6 +536,9 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withV4l2M2m "v4l2-m2m")
     (enableFeature withVaapi "vaapi")
     (enableFeature withVdpau "vdpau")
+  ] ++ optionals (versionAtLeast version "6.0")  [
+    (enableFeature withVpl "libvpl")
+  ] ++ [
     (enableFeature withVidStab "libvidstab") # Actual min. version 2.0
     (enableFeature withVmaf "libvmaf")
     (enableFeature withVoAmrwbenc "libvo-amrwbenc")
@@ -648,6 +654,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withVmaf [ libvmaf ]
   ++ optionals withVoAmrwbenc [ vo-amrwbenc ]
   ++ optionals withVorbis [ libvorbis ]
+  ++ optionals withVpl [ libvpl ]
   ++ optionals withVpx [ libvpx ]
   ++ optionals withVulkan [ vulkan-headers vulkan-loader ]
   ++ optionals withWebp [ libwebp ]
diff --git a/pkgs/development/libraries/fizz/default.nix b/pkgs/development/libraries/fizz/default.nix
index 282400948769a..5415dde6ca856 100644
--- a/pkgs/development/libraries/fizz/default.nix
+++ b/pkgs/development/libraries/fizz/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fizz";
-  version = "2024.01.22.00";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "fizz";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-17EELvRrWhUprxvm1Ur0FYNimvY1qgK0YH8ehxtLpxM=";
+    hash = "sha256-IHWotiVUjGOvebXy4rwsh8U8UMxTrF1VaqXzZMjojiM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/folly/default.nix b/pkgs/development/libraries/folly/default.nix
index eb0372a40aff2..9dd6bbeaa55e4 100644
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, overrideSDK
 , fetchFromGitHub
 , boost
 , cmake
@@ -26,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "folly";
-  version = "2024.01.22.00";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "folly";
     rev = "v${version}";
-    sha256 = "sha256-+z1wuEOgr7CMHFnOn5gLm9mtVH7mVURLstOoDqzxKbk=";
+    sha256 = "sha256-INvWTw27fmVbKQIT9ebdRGMCOIzpc/NepRN2EnKLJx0=";
   };
 
   nativeBuildInputs = [
@@ -72,6 +73,8 @@ stdenv.mkDerivation rec {
     # see https://github.com/NixOS/nixpkgs/issues/144170
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
     "-DCMAKE_INSTALL_LIBDIR=lib"
+  ] ++ lib.optional (stdenv.isDarwin && stdenv.isx86_64) [
+    "-DCMAKE_OSX_DEPLOYMENT_TARGET=10.13"
   ];
 
   # split outputs to reduce downstream closure sizes
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index d646830c771fb..39e17a894cb7d 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glib-networking";
-  version = "2.78.0";
+  version = "2.78.1";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Uv5M6T99xRM0sQKJRZmFjSPIplrEoRELMJIFZdaNOro=";
+    sha256 = "5I8t27BJgyy7CSMFKcXkXayp8N8O2jJfgy9zeYWb8J8=";
   };
 
   patches = [
@@ -35,6 +35,12 @@ stdenv.mkDerivation rec {
     })
 
     ./installed-tests-path.patch
+
+    # pkcs11 tests provide a relative path that gnutls of course isn't able to
+    # load, resulting in test failures
+    # https://gitlab.gnome.org/GNOME/glib-networking/-/blob/2.78.1/tls/tests/certificate.c#L926
+    # https://gitlab.gnome.org/GNOME/glib-networking/-/blob/2.78.1/tls/tests/connection.c#L3380
+    ./disable-pkcs11-tests.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/glib-networking/disable-pkcs11-tests.patch b/pkgs/development/libraries/glib-networking/disable-pkcs11-tests.patch
new file mode 100644
index 0000000000000..43a37878b56c9
--- /dev/null
+++ b/pkgs/development/libraries/glib-networking/disable-pkcs11-tests.patch
@@ -0,0 +1,13 @@
+diff --git a/meson.build b/meson.build
+index 0b3b8c0..7f6ce09 100644
+--- a/meson.build
++++ b/meson.build
+@@ -86,7 +86,7 @@ if gnutls_dep.found()
+   backends += ['gnutls']
+   # test-specific, maybe move to tls/tests
+   if cc.has_function('gnutls_pkcs11_init', prefix: '#include <gnutls/pkcs11.h>', dependencies: gnutls_dep)
+-    config_h.set10('HAVE_GNUTLS_PKCS11', true)
++    config_h.set10('HAVE_GNUTLS_PKCS11', false)
+   endif
+ endif
+ 
diff --git a/pkgs/development/libraries/libhandy/default.nix b/pkgs/development/libraries/libhandy/default.nix
index 7507f40b604f0..ea0b125e39f99 100644
--- a/pkgs/development/libraries/libhandy/default.nix
+++ b/pkgs/development/libraries/libhandy/default.nix
@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libhandy";
-  version = "1.8.2";
+  version = "1.8.3";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-0RqizT5XCsbQ79ukbRcxR8EfRYJkV+kkwFmQuy4N+a0=";
+    sha256 = "sha256-BbSXIpBz/1V/ELMm4HTFBm+HQ6MC1IIKuXvLXNLasIc=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 415f097f3318d..f82cc8b4c1081 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.57.1";
+  version = "2.57.92";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -50,13 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-B0Zxo+1vvNZ8ripA5TkQf08JfKikqxqJTAXiUk/zQO8=";
+    hash = "sha256-Kiwwvqvzz91ApKbb7T+zPmd8ruXY8wR4gkm3Mee+OFI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-zICI7sps5KYe8/yWXbCJv529KxGLjoyDOmpCgVAIsTs=";
+    hash = "sha256-yJf3V2dPwI+RcDH6Lh/AhUgaisdbTnzdAFt+SeNw9NY=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index f3d58613b25dc..e9faec42cd318 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.20.0";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = finalAttrs.version;
-    sha256 = "sha256-ENAsytjqvS8xHZyZLPih3bzBgQ1f/j+s3dWZs1GTWHs=";
+    sha256 = "sha256-X9H5nxbYFSMfxZMxs3iWwCgdrJ2FTVWW7tlgQek3WIg=";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/mvfst/default.nix b/pkgs/development/libraries/mvfst/default.nix
index 6b6e2d9c9e579..45b432a2dc9e6 100644
--- a/pkgs/development/libraries/mvfst/default.nix
+++ b/pkgs/development/libraries/mvfst/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mvfst";
-  version = "2024.01.22.00";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "mvfst";
     rev = "v${version}";
-    sha256 = "sha256-vhLwxA91v+vt5PQejhPOaj9YSkulg86hTD9GkpQKB24=";
+    sha256 = "sha256-KjNTDgpiR9EG42Agl2JFJoPo5+8GlS27oPMWpdLq2v8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index fc722257a9c17..34288773705a6 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pango";
-  version = "1.51.0";
+  version = "1.51.2";
 
   outputs = [ "bin" "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = with finalAttrs; "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "dO/BCa5vkDu+avd+qirGCUuO4kWi4j8TKnqPCGLRqfU=";
+    sha256 = "sha256-PbpAfytfwRfhkvMCXwocyO3B/ZuTSxxXiyuXNCE5QVo=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index a8c8a22ff1bbe..4b45b1e1f5b61 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-x4/AkmkmuTKxzlk8AxbydA4GctpShsKiFTTJ8m7B4TY=";
+    hash = "sha256-xaw6aU4Sdu5aOEtt1QeA/jzIe0/Re2Z6PUSIAHj2aSM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 5152f5d0e33c8..d172d75e011bb 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.45.1";
+  version = "3.45.2";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2024/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-zZwnhBt6WTLJiXZR4guGxwHddAVWmJsByllvz6PUmgo=";
+    hash = "sha256-vJBnRC7t8905mJtcXPv/83rmbMnJknTgwwUtxNSo9q4=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 695d2207da7d9..94ac07df9d402 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.45.1";
+    version = "3.45.2";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2024/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-f3sUpo7bzUpX3zqMTb1W0tNUam583VDeQM6wOvM9NLo=";
+      hash = "sha256-SkWjV3zIr2g8S9TG6Bp8eCxbfV2qBhdeosuXHKcWkbE=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/wangle/default.nix b/pkgs/development/libraries/wangle/default.nix
index d30389d972593..080bfb4d018c6 100644
--- a/pkgs/development/libraries/wangle/default.nix
+++ b/pkgs/development/libraries/wangle/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wangle";
-  version = "2024.01.22.00";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "wangle";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-pXcJszncYWvtwT4guEl69rOAIXZzgF7I6qh8PqLbxdA=";
+    sha256 = "sha256-fDtJ+9bZj+siKlMglYMkLO/+jldUmsS5V3Umk1gNdlo=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index e6b2b8991f390..b315581446887 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -41,14 +41,15 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Django";
+  pname = "django";
   version = "4.2.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Django";
+    inherit version;
     hash = "sha256-bm/z2y2N0MmGtO7IVUyOT5GbXB/2KltDkMF6/y7W5cQ=";
   };
 
diff --git a/pkgs/development/python-modules/pymysql/default.nix b/pkgs/development/python-modules/pymysql/default.nix
index 888b5b9d309c3..e7711f5902b94 100644
--- a/pkgs/development/python-modules/pymysql/default.nix
+++ b/pkgs/development/python-modules/pymysql/default.nix
@@ -5,11 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyMySQL";
+  pname = "pymysql";
   version = "1.0.2";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyMySQL";
+    inherit version;
     sha256 = "816927a350f38d56072aeca5dfb10221fe1dc653745853d30a216637f5d7ad36";
   };
 
diff --git a/pkgs/development/python-modules/pyqrcode/default.nix b/pkgs/development/python-modules/pyqrcode/default.nix
index 7cb0a94eb74a1..2b0ce5193555f 100644
--- a/pkgs/development/python-modules/pyqrcode/default.nix
+++ b/pkgs/development/python-modules/pyqrcode/default.nix
@@ -1,11 +1,12 @@
 { lib, buildPythonPackage, fetchPypi }:
 
 buildPythonPackage rec {
-  pname = "PyQRCode";
+  pname = "pyqrcode";
   version = "1.2.1";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyQRCode";
+    inherit version;
     sha256 = "fdbf7634733e56b72e27f9bce46e4550b75a3a2c420414035cae9d9d26b234d5";
   };
 
diff --git a/pkgs/development/python-modules/pyqt/5.x.nix b/pkgs/development/python-modules/pyqt/5.x.nix
index 0b2b1c8ad6b18..0af19e2c174ef 100644
--- a/pkgs/development/python-modules/pyqt/5.x.nix
+++ b/pkgs/development/python-modules/pyqt/5.x.nix
@@ -26,14 +26,15 @@
 }:
 
 buildPythonPackage rec {
-  pname = "PyQt5";
+  pname = "pyqt5";
   version = "5.15.9";
   format = "pyproject";
 
   disabled = isPy27;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyQt5";
+    inherit version;
     hash = "sha256-3EHoQBqQ3D4raStBG9VJKrVZrieidCTu1L05FVZOxMA=";
   };
 
diff --git a/pkgs/development/python-modules/sqlalchemy-i18n/default.nix b/pkgs/development/python-modules/sqlalchemy-i18n/default.nix
index a17e7ada45226..a33a9783319ff 100644
--- a/pkgs/development/python-modules/sqlalchemy-i18n/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-i18n/default.nix
@@ -7,11 +7,12 @@
 }:
 
 buildPythonPackage rec {
-  pname = "SQLAlchemy-i18n";
+  pname = "sqlalchemy-i18n";
   version = "1.1.0";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "SQLAlchemy-i18n";
+    inherit version;
     sha256 = "de33376483a581ca14218d8f57a114466c5f72b674a95839b6c4564a6e67796f";
   };
 
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 0d3ac845f6086..a98b5b7847cad 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -39,7 +39,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "SQLAlchemy";
+  pname = "sqlalchemy";
   version = "2.0.28";
   format = "pyproject";
 
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 8622ca5acd38b..49d3eb280a071 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luarocks";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "luarocks";
     repo = "luarocks";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lM0jbKbV1fNz6AgJX6Pu6rlAzos/wEzn8wTvCBrOOe4=";
+    hash = "sha256-mSwwBuLWoMT38iYaV/BTdDmmBz4heTRJzxBHC0Vrvc4=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/watchman/default.nix b/pkgs/development/tools/watchman/default.nix
index dc5d1f87fdb36..213aa3f8798e0 100644
--- a/pkgs/development/tools/watchman/default.nix
+++ b/pkgs/development/tools/watchman/default.nix
@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation rec {
   pname = "watchman";
-  version = "2024.01.22.00";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "watchman";
     rev = "v${version}";
-    hash = "sha256-+qlcdekBcRwmgrtQ8HcLHphURf0c4oRCs6nbjAzT26c=";
+    hash = "sha256-cD8mIYCc+8Z2p3rwKVRFcW9sOBbpb5KHU5VpbXHMpeg=";
   };
 
   cmakeFlags = [