about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/builders/special.xml1
-rw-r--r--doc/builders/special/makesetuphook.section.md37
-rw-r--r--lib/customisation.nix9
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md2
-rw-r--r--nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json38
-rw-r--r--nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json9
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-utils.nix6
-rw-r--r--pkgs/applications/misc/genxword/default.nix1
-rw-r--r--pkgs/applications/misc/udiskie/default.nix1
-rw-r--r--pkgs/applications/office/autokey/default.nix1
-rw-r--r--pkgs/applications/terminal-emulators/terminator/default.nix1
-rw-r--r--pkgs/applications/version-management/git/default.nix4
-rw-r--r--pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix10
-rw-r--r--pkgs/build-support/go/module.nix6
-rw-r--r--pkgs/build-support/go/package.nix6
-rw-r--r--pkgs/build-support/node/build-npm-package/hooks/default.nix2
-rw-r--r--pkgs/build-support/rust/hooks/cargo-setup-hook.sh9
-rw-r--r--pkgs/build-support/rust/hooks/default.nix12
-rw-r--r--pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix3
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix27
-rw-r--r--pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix2
-rw-r--r--pkgs/build-support/trivial-builders.nix50
-rw-r--r--pkgs/development/compilers/chez-racket/default.nix25
-rw-r--r--pkgs/development/compilers/chez-racket/shared.nix3
-rw-r--r--pkgs/development/compilers/glslang/default.nix12
-rw-r--r--pkgs/development/compilers/go/1.19.nix4
-rw-r--r--pkgs/development/compilers/openjdk/11.nix8
-rw-r--r--pkgs/development/compilers/openjdk/12.nix2
-rw-r--r--pkgs/development/compilers/openjdk/13.nix2
-rw-r--r--pkgs/development/compilers/openjdk/14.nix2
-rw-r--r--pkgs/development/compilers/openjdk/15.nix2
-rw-r--r--pkgs/development/compilers/openjdk/16.nix2
-rw-r--r--pkgs/development/compilers/openjdk/17.nix8
-rw-r--r--pkgs/development/compilers/openjdk/18.nix2
-rw-r--r--pkgs/development/compilers/openjdk/19.nix12
-rw-r--r--pkgs/development/compilers/openjdk/8.nix4
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/11.nix27
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/15.nix13
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/17.nix19
-rw-r--r--pkgs/development/compilers/openjdk/openjfx/19.nix19
-rw-r--r--pkgs/development/compilers/rust/1_67.nix12
-rw-r--r--pkgs/development/interpreters/lua-5/hooks/default.nix4
-rw-r--r--pkgs/development/interpreters/lua-5/wrap-lua.nix2
-rw-r--r--pkgs/development/interpreters/octave/wrap-octave.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix4
-rw-r--r--pkgs/development/interpreters/python/cpython/default.nix6
-rw-r--r--pkgs/development/interpreters/python/default.nix55
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix30
-rw-r--r--pkgs/development/interpreters/python/python-packages-base.nix21
-rw-r--r--pkgs/development/interpreters/python/tests.nix5
-rw-r--r--pkgs/development/interpreters/python/wrap-python.nix2
-rw-r--r--pkgs/development/interpreters/ruby/default.nix31
-rw-r--r--pkgs/development/interpreters/tcl/generic.nix2
-rw-r--r--pkgs/development/libraries/accountsservice/default.nix2
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix4
-rw-r--r--pkgs/development/libraries/audio/roc-toolkit/default.nix2
-rw-r--r--pkgs/development/libraries/boost/generic.nix4
-rw-r--r--pkgs/development/libraries/cmocka/default.nix67
-rw-r--r--pkgs/development/libraries/gjs/default.nix1
-rw-r--r--pkgs/development/libraries/glib/default.nix18
-rw-r--r--pkgs/development/libraries/gnutls/default.nix15
-rw-r--r--pkgs/development/libraries/gnutls/nix-ssl-cert-file.patch8
-rw-r--r--pkgs/development/libraries/gnutls/no-security-framework.patch126
-rw-r--r--pkgs/development/libraries/gtest/default.nix5
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix13
-rw-r--r--pkgs/development/libraries/hidapi/default.nix4
-rw-r--r--pkgs/development/libraries/iso-codes/default.nix9
-rw-r--r--pkgs/development/libraries/libbsd/default.nix17
-rw-r--r--pkgs/development/libraries/libde265/default.nix14
-rw-r--r--pkgs/development/libraries/libdeflate/default.nix36
-rw-r--r--pkgs/development/libraries/libdrm/default.nix7
-rw-r--r--pkgs/development/libraries/libgudev/default.nix1
-rw-r--r--pkgs/development/libraries/libical/default.nix1
-rw-r--r--pkgs/development/libraries/libimagequant/Cargo.lock322
-rw-r--r--pkgs/development/libraries/libimagequant/default.nix41
-rw-r--r--pkgs/development/libraries/libinput/default.nix8
-rw-r--r--pkgs/development/libraries/libisds/default.nix2
-rw-r--r--pkgs/development/libraries/libmanette/default.nix1
-rw-r--r--pkgs/development/libraries/libmbim/default.nix33
-rw-r--r--pkgs/development/libraries/libnotify/default.nix4
-rw-r--r--pkgs/development/libraries/libptytty/default.nix18
-rw-r--r--pkgs/development/libraries/libqmi/default.nix46
-rw-r--r--pkgs/development/libraries/libqrtr-glib/default.nix1
-rw-r--r--pkgs/development/libraries/librsvg/default.nix2
-rw-r--r--pkgs/development/libraries/libsecret/default.nix3
-rw-r--r--pkgs/development/libraries/libvirt-glib/default.nix2
-rw-r--r--pkgs/development/libraries/libvisual/default.nix35
-rw-r--r--pkgs/development/libraries/libvmaf/default.nix11
-rw-r--r--pkgs/development/libraries/libwacom/default.nix4
-rw-r--r--pkgs/development/libraries/libxml2/default.nix5
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/neon/darwin-fix-configure.patch4
-rw-r--r--pkgs/development/libraries/neon/default.nix4
-rw-r--r--pkgs/development/libraries/nss/esr.nix4
-rw-r--r--pkgs/development/libraries/nss/generic.nix1
-rw-r--r--pkgs/development/libraries/openjpeg/default.nix4
-rw-r--r--pkgs/development/libraries/pango/default.nix18
-rw-r--r--pkgs/development/libraries/pipewire/default.nix26
-rw-r--r--pkgs/development/libraries/pmdk/default.nix42
-rw-r--r--pkgs/development/libraries/polkit/default.nix1
-rw-r--r--pkgs/development/libraries/portaudio/default.nix3
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh2
-rw-r--r--pkgs/development/libraries/qt-6/default.nix4
-rw-r--r--pkgs/development/libraries/re2/default.nix4
-rw-r--r--pkgs/development/libraries/spirv-headers/default.nix4
-rw-r--r--pkgs/development/libraries/umockdev/default.nix1
-rw-r--r--pkgs/development/libraries/vk-bootstrap/default.nix4
-rw-r--r--pkgs/development/libraries/vulkan-headers/default.nix4
-rw-r--r--pkgs/development/libraries/vulkan-loader/default.nix4
-rw-r--r--pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch6
-rw-r--r--pkgs/development/perl-modules/strip-nondeterminism/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix9
-rw-r--r--pkgs/development/python-modules/asgiref/default.nix2
-rw-r--r--pkgs/development/python-modules/cryptography/default.nix6
-rw-r--r--pkgs/development/python-modules/cryptography/vectors.nix2
-rw-r--r--pkgs/development/python-modules/django/3.nix4
-rw-r--r--pkgs/development/python-modules/dnspython/default.nix68
-rw-r--r--pkgs/development/python-modules/ephemeral-port-reserve/default.nix2
-rw-r--r--pkgs/development/python-modules/eventlet/default.nix6
-rw-r--r--pkgs/development/python-modules/flit-scm/default.nix2
-rw-r--r--pkgs/development/python-modules/h5py/default.nix5
-rw-r--r--pkgs/development/python-modules/hidapi/default.nix4
-rw-r--r--pkgs/development/python-modules/patool/default.nix15
-rw-r--r--pkgs/development/python-modules/pillow/default.nix4
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix12
-rw-r--r--pkgs/development/python-modules/pygobject/3.nix3
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix40
-rw-r--r--pkgs/development/python-modules/sphinx-rtd-theme/default.nix31
-rw-r--r--pkgs/development/python-modules/typeguard/default.nix11
-rw-r--r--pkgs/development/python-modules/types-toml/default.nix4
-rw-r--r--pkgs/development/python-modules/ujson/default.nix4
-rw-r--r--pkgs/development/python-modules/watchdog/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix29
-rw-r--r--pkgs/development/tools/build-managers/ninja/default.nix18
-rw-r--r--pkgs/development/tools/documentation/doxygen/default.nix11
-rw-r--r--pkgs/development/tools/documentation/gi-docgen/default.nix6
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix8
-rw-r--r--pkgs/development/tools/rust/bindgen/unwrapped.nix6
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/tools/spirv-tools/default.nix4
-rw-r--r--pkgs/development/tools/vulkan-validation-layers/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix8
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix144
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix80
-rw-r--r--pkgs/os-specific/darwin/moltenvk/default.nix4
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix5
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix18
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix7
-rw-r--r--pkgs/servers/gpsd/default.nix1
-rw-r--r--pkgs/servers/sql/mariadb/default.nix17
-rw-r--r--pkgs/servers/x11/quartz-wm/default.nix1
-rw-r--r--pkgs/servers/x11/xorg/default.nix12
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix44
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list4
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix49
-rw-r--r--pkgs/stdenv/generic/setup.sh79
-rw-r--r--pkgs/test/default.nix2
-rw-r--r--pkgs/test/overriding.nix56
-rw-r--r--pkgs/tools/compression/zstd/default.nix4
-rw-r--r--pkgs/tools/filesystems/ceph/default.nix4
-rw-r--r--pkgs/tools/graphics/spirv-cross/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-extension-layer/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-tools-lunarg/default.nix7
-rw-r--r--pkgs/tools/graphics/vulkan-tools/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch50
-rw-r--r--pkgs/tools/inputmethods/ibus/build-without-dbus-launch.patch21
-rw-r--r--pkgs/tools/inputmethods/ibus/default.nix1
-rw-r--r--pkgs/tools/misc/file/default.nix13
-rw-r--r--pkgs/tools/misc/file/pyzip.patch36
-rw-r--r--pkgs/tools/misc/hdf5/default.nix9
-rw-r--r--pkgs/tools/networking/curl/7.88.0-http2-breakage.patch101
-rw-r--r--pkgs/tools/networking/curl/default.nix5
-rw-r--r--pkgs/tools/networking/modemmanager/default.nix84
-rw-r--r--pkgs/tools/networking/modemmanager/no-dummy-dirs-in-sysconfdir.patch20
-rw-r--r--pkgs/tools/networking/networkmanager/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix43
-rw-r--r--pkgs/top-level/cuda-packages.nix2
-rw-r--r--pkgs/top-level/darwin-packages.nix4
183 files changed, 1834 insertions, 1089 deletions
diff --git a/doc/builders/special.xml b/doc/builders/special.xml
index 525eb71abfe7e..c971134819818 100644
--- a/doc/builders/special.xml
+++ b/doc/builders/special.xml
@@ -6,6 +6,7 @@
   This chapter describes several special builders.
  </para>
  <xi:include href="special/fhs-environments.section.xml" />
+ <xi:include href="special/makesetuphook.section.xml" />
  <xi:include href="special/mkshell.section.xml" />
  <xi:include href="special/darwin-builder.section.xml" />
 </chapter>
diff --git a/doc/builders/special/makesetuphook.section.md b/doc/builders/special/makesetuphook.section.md
new file mode 100644
index 0000000000000..90d75c5491cff
--- /dev/null
+++ b/doc/builders/special/makesetuphook.section.md
@@ -0,0 +1,37 @@
+# pkgs.makeSetupHook {#sec-pkgs.makeSetupHook}
+
+`pkgs.makeSetupHook` is a builder that produces hooks that go in to `nativeBuildInputs`
+
+## Usage {#sec-pkgs.makeSetupHook-usage}
+
+```nix
+pkgs.makeSetupHook {
+  name = "something-hook";
+  propagatedBuildInputs = [ pkgs.commandsomething ];
+  depsTargetTargetPropagated = [ pkgs.libsomething ];
+} ./script.sh
+```
+
+#### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash
+
+```nix
+pkgs.makeSetupHook {
+    name = "run-hello-hook";
+    propagatedBuildInputs = [ pkgs.hello ];
+    substitutions = { shell = "${pkgs.bash}/bin/bash"; };
+    passthru.tests.greeting = callPackage ./test { };
+    meta.platforms = lib.platforms.linux;
+} (writeScript "run-hello-hook.sh" ''
+    #!@shell@
+    hello
+'')
+```
+
+## Attributes
+
+* `name` Set the name of the hook.
+* `propagatedBuildInputs` Runtime dependencies (such as binaries) of the hook.
+* `depsTargetTargetPropagated` Non-binary dependencies.
+* `meta`
+* `passthru`
+* `substitutions` Variables for `substituteAll`
diff --git a/lib/customisation.nix b/lib/customisation.nix
index 42d711cf5fb93..cb3a4b561151f 100644
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -213,7 +213,14 @@ rec {
             outputSpecified = true;
             drvPath = assert condition; drv.${outputName}.drvPath;
             outPath = assert condition; drv.${outputName}.outPath;
-          };
+          } //
+            # TODO: give the derivation control over the outputs.
+            #       `overrideAttrs` may not be the only attribute that needs
+            #       updating when switching outputs.
+            lib.optionalAttrs (passthru?overrideAttrs) {
+              # TODO: also add overrideAttrs when overrideAttrs is not custom, e.g. when not splicing.
+              overrideAttrs = f: (passthru.overrideAttrs f).${outputName};
+            };
         };
 
       outputsList = map outputToAttrListElement outputs;
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index d50438ddb6114..276405199ca49 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -259,6 +259,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.
 
+- `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`.
+
 - [Xastir](https://xastir.org/index.php/Main_Page) can now access AX.25 interfaces via the `libax25` package.
 
 - `tvbrowser-bin` was removed, and now `tvbrowser` is built from source.
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json
new file mode 100644
index 0000000000000..aaffa93ca964c
--- /dev/null
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire-aes67.conf.json
@@ -0,0 +1,38 @@
+{
+  "context.properties": {},
+  "context.modules": [
+    {
+      "name": "libpipewire-module-rt",
+      "args": {
+        "nice.level": -11
+      },
+      "flags": [
+        "ifexists",
+        "nofail"
+      ]
+    },
+    {
+      "name": "libpipewire-module-protocol-native"
+    },
+    {
+      "name": "libpipewire-module-client-node"
+    },
+    {
+      "name": "libpipewire-module-adapter"
+    },
+    {
+      "name": "libpipewire-module-rtp-source",
+      "args": {
+        "sap.ip": "239.255.255.255",
+        "sap.port": 9875,
+        "sess.latency.msec": 10,
+        "local.ifname": "eth0",
+        "stream.props": {
+          "media.class": "Audio/Source",
+          "node.virtual": false,
+          "device.api": "aes67"
+        }
+      }
+    }
+  ]
+}
diff --git a/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json b/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
index 53fc103d22144..a47abe2213d94 100644
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
@@ -3,10 +3,10 @@
     "link.max-buffers": 16,
     "core.daemon": true,
     "core.name": "pipewire-0",
-    "default.clock.min-quantum": 16,
     "vm.overrides": {
       "default.clock.min-quantum": 1024
-    }
+    },
+    "module.x11.bell": true
   },
   "context.spa-libs": {
     "audio.convert.*": "audioconvert/libspa-audioconvert",
@@ -77,6 +77,11 @@
       "flags": [
         "ifexists",
         "nofail"
+      ],
+      "condition": [
+        {
+          "module.x11.bell": true
+        }
       ]
     }
   ],
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 66369c266d604..27a92ac659ba1 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.0609";
+  version = "9.0.1275";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-UBj3pXY6rdekKnCX/V/4o8LLBMZkNs1U4Z4KuvisIYQ=";
+    hash = "sha256-WDnlYi9o2Kv/f3Fh1MHcfTlBTe1fxw4UyKJlKY04fyA=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/vim/plugins/vim-utils.nix b/pkgs/applications/editors/vim/plugins/vim-utils.nix
index 74c811c2eae8e..44ad9295e2849 100644
--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@@ -363,7 +363,7 @@ rec {
   vimGenDocHook = callPackage ({ vim }:
     makeSetupHook {
       name = "vim-gen-doc-hook";
-      deps = [ vim ];
+      propagatedBuildInputs = [ vim ];
       substitutions = {
         vimBinary = "${vim}/bin/vim";
         inherit rtpPath;
@@ -373,7 +373,7 @@ rec {
   vimCommandCheckHook = callPackage ({ neovim-unwrapped }:
     makeSetupHook {
       name = "vim-command-check-hook";
-      deps = [ neovim-unwrapped ];
+      propagatedBuildInputs = [ neovim-unwrapped ];
       substitutions = {
         vimBinary = "${neovim-unwrapped}/bin/nvim";
         inherit rtpPath;
@@ -383,7 +383,7 @@ rec {
   neovimRequireCheckHook = callPackage ({ neovim-unwrapped }:
     makeSetupHook {
       name = "neovim-require-check-hook";
-      deps = [ neovim-unwrapped ];
+      propagatedBuildInputs = [ neovim-unwrapped ];
       substitutions = {
         nvimBinary = "${neovim-unwrapped}/bin/nvim";
         inherit rtpPath;
diff --git a/pkgs/applications/misc/genxword/default.nix b/pkgs/applications/misc/genxword/default.nix
index f443618c685ac..5ba67ecddcdb1 100644
--- a/pkgs/applications/misc/genxword/default.nix
+++ b/pkgs/applications/misc/genxword/default.nix
@@ -26,7 +26,6 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     pango
     gtksourceview3
   ];
diff --git a/pkgs/applications/misc/udiskie/default.nix b/pkgs/applications/misc/udiskie/default.nix
index 91ad479f450e1..e28eb1e2ce358 100644
--- a/pkgs/applications/misc/udiskie/default.nix
+++ b/pkgs/applications/misc/udiskie/default.nix
@@ -43,7 +43,6 @@ python3.pkgs.buildPythonApplication rec {
   dontWrapGApps = true;
 
   buildInputs = [
-    gobject-introspection
     gtk3
     libappindicator-gtk3
     libnotify
diff --git a/pkgs/applications/office/autokey/default.nix b/pkgs/applications/office/autokey/default.nix
index 0a00ac1463b5b..c490be238112a 100644
--- a/pkgs/applications/office/autokey/default.nix
+++ b/pkgs/applications/office/autokey/default.nix
@@ -25,7 +25,6 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
 
   buildInputs = [
-    gobject-introspection
     gtksourceview3
     libappindicator-gtk3
     libnotify
diff --git a/pkgs/applications/terminal-emulators/terminator/default.nix b/pkgs/applications/terminal-emulators/terminator/default.nix
index 7cc1b23a60ac7..54c9f9467636f 100644
--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@@ -33,7 +33,6 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [
     gtk3
-    gobject-introspection # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
     keybinder3
     libnotify
     python3
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 317db2924ab3a..ef1b8db97b03f 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.39.1";
+  version = "2.39.2";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-QKOKCEezDDcbNYc7OvzxI4hd1B6j7Lv1EO+pfzzlwWE=";
+    sha256 = "R1918Tc7LNTkOHBhhRdZZtXBH2jE2x5IwmJXxD3c8tY=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
index bce3d799fbb1a..a72f0291a872b 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
@@ -20,7 +20,7 @@ in
   dotnetConfigureHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-configure-hook";
-      deps = [ dotnet-sdk nuget-source ];
+      propagatedBuildInputs = [ dotnet-sdk nuget-source ];
       substitutions = {
         nugetSource = nuget-source;
         inherit runtimeId;
@@ -30,7 +30,7 @@ in
   dotnetBuildHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-build-hook";
-      deps = [ dotnet-sdk ];
+      propagatedBuildInputs = [ dotnet-sdk ];
       substitutions = {
         inherit buildType runtimeId;
       };
@@ -39,7 +39,7 @@ in
   dotnetCheckHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-check-hook";
-      deps = [ dotnet-test-sdk ];
+      propagatedBuildInputs = [ dotnet-test-sdk ];
       substitutions = {
         inherit buildType libraryPath;
         disabledTests = lib.optionalString (disabledTests != [])
@@ -54,7 +54,7 @@ in
   dotnetInstallHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-install-hook";
-      deps = [ dotnet-sdk ];
+      propagatedBuildInputs = [ dotnet-sdk ];
       substitutions = {
         inherit buildType runtimeId;
       };
@@ -63,7 +63,7 @@ in
   dotnetFixupHook = callPackage ({ }:
     makeSetupHook {
       name = "dotnet-fixup-hook";
-      deps = [ dotnet-runtime ];
+      propagatedBuildInputs = [ dotnet-runtime ];
       substitutions = {
         dotnetRuntime = dotnet-runtime;
         runtimeDeps = libraryPath;
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 284cc1586dad0..aca313264a28c 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -193,6 +193,12 @@ let
       ''}
     '' + ''
 
+      # currently pie is only enabled by default in pkgsMusl
+      # this will respect the `hardening{Disable,Enable}` flags if set
+      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+        export GOFLAGS="-buildmode=pie $GOFLAGS"
+      fi
+
       runHook postConfigure
     '';
 
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index ba1ab37a0c0eb..9106bf9796ebb 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -134,6 +134,12 @@ let
       export GOPATH=$NIX_BUILD_TOP/go:$GOPATH
       export GOCACHE=$TMPDIR/go-cache
 
+      # currently pie is only enabled by default in pkgsMusl
+      # this will respect the `hardening{Disable,Enable}` flags if set
+      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+        export GOFLAGS="-buildmode=pie $GOFLAGS"
+      fi
+
       runHook postConfigure
     '';
 
diff --git a/pkgs/build-support/node/build-npm-package/hooks/default.nix b/pkgs/build-support/node/build-npm-package/hooks/default.nix
index 65ac661cea516..e5c93f1f77842 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/default.nix
+++ b/pkgs/build-support/node/build-npm-package/hooks/default.nix
@@ -26,7 +26,7 @@
   npmInstallHook = makeSetupHook
     {
       name = "npm-install-hook";
-      deps = [ buildPackages.makeWrapper ];
+      propagatedBuildInputs = [ buildPackages.makeWrapper ];
       substitutions = {
         hostNode = "${nodejs}/bin/node";
         jq = "${buildPackages.jq}/bin/jq";
diff --git a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
index 8146573e79dba..90a81d68b5200 100644
--- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@@ -61,14 +61,15 @@ cargoSetupPostPatchHook() {
       fi
 
       echo
-      echo "ERROR: cargoSha256 is out of date"
+      echo "ERROR: cargoHash or cargoSha256 is out of date"
       echo
       echo "Cargo.lock is not the same in $cargoDepsCopy"
       echo
       echo "To fix the issue:"
-      echo '1. Use "0000000000000000000000000000000000000000000000000000" as the cargoSha256 value'
-      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
-      echo "3. Copy the 'got: sha256:' value back into the cargoSha256 field"
+      echo '1. Set cargoHash/cargoSha256 to an empty string: `cargoHash = "";`'
+      echo '2. Build the derivation and wait for it to fail with a hash mismatch'
+      echo '3. Copy the "got: sha256-..." value back into the cargoHash field'
+      echo '   You should have: cargoHash = "sha256-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=";'
       echo
 
       exit 1
diff --git a/pkgs/build-support/rust/hooks/default.nix b/pkgs/build-support/rust/hooks/default.nix
index 9989e582d2e9a..b4034120103ed 100644
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@@ -31,7 +31,7 @@ in {
   cargoBuildHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-build-hook.sh";
-      deps = [ cargo ];
+      propagatedBuildInputs = [ cargo ];
       substitutions = {
         inherit ccForBuild ccForHost cxxForBuild cxxForHost
           rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
@@ -41,7 +41,7 @@ in {
   cargoCheckHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-check-hook.sh";
-      deps = [ cargo ];
+      propagatedBuildInputs = [ cargo ];
       substitutions = {
         inherit rustTargetPlatformSpec;
       };
@@ -50,7 +50,7 @@ in {
   cargoInstallHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-install-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
       substitutions = {
         inherit shortTarget;
       };
@@ -59,7 +59,7 @@ in {
   cargoNextestHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-nextest-hook.sh";
-      deps = [ cargo cargo-nextest ];
+      propagatedBuildInputs = [ cargo cargo-nextest ];
       substitutions = {
         inherit rustTargetPlatformSpec;
       };
@@ -68,7 +68,7 @@ in {
   cargoSetupHook = callPackage ({ }:
     makeSetupHook {
       name = "cargo-setup-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
       substitutions = {
         defaultConfig = ../fetchcargo-default-config.toml;
 
@@ -117,7 +117,7 @@ in {
   maturinBuildHook = callPackage ({ }:
     makeSetupHook {
       name = "maturin-build-hook.sh";
-      deps = [ cargo maturin rustc ];
+      propagatedBuildInputs = [ cargo maturin rustc ];
       substitutions = {
         inherit ccForBuild ccForHost cxxForBuild cxxForHost
           rustBuildPlatform rustTargetPlatform rustTargetPlatformSpec;
diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index c81a253b0de8d..17b97b1082e93 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -11,8 +11,7 @@
 
 makeSetupHook {
   name = "make-binary-wrapper-hook";
-
-  deps = [ dieHook ]
+  propagatedBuildInputs = [ dieHook ]
     # https://github.com/NixOS/nixpkgs/issues/148189
     ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;
 
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
index 5ef6138388562..99633a3c7c9af 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@@ -9,12 +9,15 @@
 , dconf
 , callPackage
 , wrapGAppsHook
-, writeTextFile
+, targetPackages
 }:
 
 makeSetupHook {
   name = "wrap-gapps-hook";
-  deps = lib.optionals (!stdenv.isDarwin) [
+  propagatedBuildInputs = [
+    # We use the wrapProgram function.
+    makeWrapper
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     # It is highly probable that a program will use GSettings,
     # at minimum through GTK file chooser dialogue.
     # Let’s add a GIO module for “dconf” GSettings backend
@@ -23,19 +26,22 @@ makeSetupHook {
     # Unfortunately, it also requires the user to have dconf
     # D-Bus service enabled globally (e.g. through a NixOS module).
     dconf.lib
+
   ] ++ lib.optionals isGraphical [
     # TODO: remove this, packages should depend on GTK explicitly.
     gtk3
 
+    librsvg
+  ];
+
+  # depsTargetTargetPropagated will essentially be buildInputs when wrapGAppsHook is placed into nativeBuildInputs
+  # the librsvg above should be removed but kept to not break anything that implicitly depended on its binaries
+  depsTargetTargetPropagated = assert (lib.assertMsg (!targetPackages ? raw) "wrapGAppsHook must be in nativeBuildInputs"); lib.optionals isGraphical [
     # librsvg provides a module for gdk-pixbuf to allow rendering
     # SVG icons. Most icon themes are SVG-based and so are some
     # graphics in GTK (e.g. cross for closing window in window title bar)
     # so it is pretty much required for applications using GTK.
     librsvg
-  ] ++ [
-
-    # We use the wrapProgram function.
-    makeWrapper
   ];
   passthru = {
     tests = let
@@ -65,6 +71,15 @@ makeSetupHook {
         ''
       );
 
+      basic-contains-gdk-pixbuf = let
+        tested = basic;
+      in testLib.runTest "basic-contains-gdk-pixbuf" (
+        testLib.skip stdenv.isDarwin ''
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GDK_PIXBUF_MODULE_FILE" "${lib.getLib librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"}
+          ${expectSomeLineContainingYInFileXToMentionZ "${tested}/libexec/bar" "GDK_PIXBUF_MODULE_FILE" "${lib.getLib librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"}
+        ''
+      );
+
       # Simple derivation containing a gobject-introspection typelib.
       typelib-Mahjong = stdenv.mkDerivation {
         name = "typelib-Mahjong";
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
index 42866c3419ddf..59fa9de24f9d1 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/tests/lib.nix
@@ -1,7 +1,7 @@
 { lib, runCommand }:
 
 rec {
-  runTest = name: body: runCommand name { } ''
+  runTest = name: body: runCommand name { strictDeps = true; } ''
     set -o errexit
     ${body}
     touch $out
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 7318d13f6babd..413ed65852f50 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -593,45 +593,28 @@ rec {
     in linkFarm name (map mkEntryFromDrv drvs);
 
 
-  /*
-    Make a package that just contains a setup hook with the given contents.
-    This setup hook will be invoked by any package that includes this package
-    as a buildInput. Optionally takes a list of substitutions that should be
-    applied to the resulting script.
-
-    Examples:
-    # setup hook that depends on the hello package and runs ./myscript.sh
-    myhellohook = makeSetupHook { deps = [ hello ]; } ./myscript.sh;
-
-    # writes a Linux-exclusive setup hook where @bash@ myscript.sh is substituted for the
-    # bash interpreter.
-    myhellohookSub = makeSetupHook {
-                   name = "myscript-hook";
-                   deps = [ hello ];
-                   substitutions = { bash = "${pkgs.bash}/bin/bash"; };
-                   meta.platforms = lib.platforms.linux;
-                 } ./myscript.sh;
-
-    # setup hook with a package test
-    myhellohookTested = makeSetupHook {
-                   name = "myscript-hook";
-                   deps = [ hello ];
-                   substitutions = { bash = "${pkgs.bash}/bin/bash"; };
-                   meta.platforms = lib.platforms.linux;
-                   passthru.tests.greeting = callPackage ./test { };
-                 } ./myscript.sh;
-   */
+  # docs in doc/builders/special/makesetuphook.section.md
   makeSetupHook =
     { name ? lib.warn "calling makeSetupHook without passing a name is deprecated." "hook"
-    , deps ? []
-    , substitutions ? {}
-    , meta ? {}
-    , passthru ? {}
+    , deps ? [ ]
+      # hooks go in nativeBuildInput so these will be nativeBuildInput
+    , propagatedBuildInputs ? [ ]
+      # these will be buildInputs
+    , depsTargetTargetPropagated ? [ ]
+    , meta ? { }
+    , passthru ? { }
+    , substitutions ? { }
     }:
     script:
     runCommand name
       (substitutions // {
         inherit meta;
+        inherit depsTargetTargetPropagated;
+        propagatedBuildInputs =
+          # remove list conditionals before 23.11
+          lib.warnIf (!lib.isList deps) "'deps' argument to makeSetupHook must be a list. content of deps: ${toString deps}"
+            (lib.warnIf (deps != [ ]) "'deps' argument to makeSetupHook is deprecated and will be removed in release 23.11., Please use propagatedBuildInputs instead. content of deps: ${toString deps}"
+              propagatedBuildInputs ++ (if lib.isList deps then deps else [ deps ]));
         strictDeps = true;
         # TODO 2023-01, no backport: simplify to inherit passthru;
         passthru = passthru
@@ -642,8 +625,7 @@ rec {
       (''
         mkdir -p $out/nix-support
         cp ${script} $out/nix-support/setup-hook
-      '' + lib.optionalString (deps != []) ''
-        printWords ${toString deps} > $out/nix-support/propagated-build-inputs
+        recordPropagatedDependencies
       '' + lib.optionalString (substitutions != {}) ''
         substituteAll ${script} $out/nix-support/setup-hook
       '');
diff --git a/pkgs/development/compilers/chez-racket/default.nix b/pkgs/development/compilers/chez-racket/default.nix
index fa32934243c6d..158dfa0529334 100644
--- a/pkgs/development/compilers/chez-racket/default.nix
+++ b/pkgs/development/compilers/chez-racket/default.nix
@@ -1,16 +1,23 @@
 { stdenv, buildPackages, callPackage }:
 
 let
-  chezSystemMap = {
-    # See `/workarea` of source code for list of systems
-    "aarch64-darwin" = "tarm64osx";
-    "aarch64-linux" = "tarm64le";
-    "armv7l-linux" = "tarm32le";
-    "x86_64-darwin" = "ta6osx";
-    "x86_64-linux" = "ta6le";
-  };
+  chezArch =
+    /**/ if stdenv.hostPlatform.isAarch then "arm${toString stdenv.hostPlatform.parsed.cpu.bits}"
+    else if stdenv.hostPlatform.isx86_32 then "i3"
+    else if stdenv.hostPlatform.isx86_64 then "a6"
+    else if stdenv.hostPlatform.isPower then "ppc${toString stdenv.hostPlatform.parsed.cpu.bits}"
+    else throw "Add ${stdenv.hostPlatform.parsed.cpu.arch} to chezArch to enable building chez-racket";
+
+  chezOs =
+    /**/ if stdenv.hostPlatform.isDarwin then "osx"
+    else if stdenv.hostPlatform.isFreeBSD then "fb"
+    else if stdenv.hostPlatform.isLinux then "le"
+    else if stdenv.hostPlatform.isNetBSD then "nb"
+    else if stdenv.hostPlatform.isOpenBSD then "ob"
+    else throw "Add ${stdenv.hostPlatform.uname.system} to chezOs to enable building chez-racket";
+
   inherit (stdenv.hostPlatform) system;
-  chezSystem = chezSystemMap.${system} or (throw "Add ${system} to chezSystemMap to enable building chez-racket");
+  chezSystem = "t${chezArch}${chezOs}";
   # Chez Scheme uses an ad-hoc `configure`, hence we don't use the usual
   # stdenv abstractions.
   forBoot = {
diff --git a/pkgs/development/compilers/chez-racket/shared.nix b/pkgs/development/compilers/chez-racket/shared.nix
index f5a9bbc1e5b4b..d09f55e229ee9 100644
--- a/pkgs/development/compilers/chez-racket/shared.nix
+++ b/pkgs/development/compilers/chez-racket/shared.nix
@@ -24,8 +24,7 @@ stdenv.mkDerivation (args // {
   '';
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin (with darwin; [ cctools autoSignDarwinBinariesHook ]);
-  buildInputs = [ ncurses libX11 zlib lz4 ]
-    ++ lib.optional stdenv.isDarwin libiconv;
+  buildInputs = [ libiconv libX11 lz4 ncurses zlib ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index f5f46ff9f4f7f..e0e980483064b 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = "sdk-${version}";
-    hash = "sha256-iVcx1j7OMJEU4cPydNwQSFufTUiqq7GKp69Y6pEt7Wc=";
+    hash = "sha256-P2HG/oJXdB5nvU3zVnj2vSLJGQuDcZiQBfBBvuR66Kk=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
@@ -33,6 +33,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/KhronosGroup/glslang/commit/7627bd89583c5aafb8b38c81c15494019271fabf.patch";
       hash = "sha256-1Dwhn78PG4gAGgEwTXpC+mkZRyvy8sTIsEvihXFeNaQ=";
     })
+    # Upstream tries to detect the Darwin linker by checking for AppleClang, but it’s just Clang in nixpkgs.
+    # Revert the commit to allow the build to work on Darwin with the nixpkg Darwin Clang toolchain.
+    (fetchpatch {
+      name = "Fix-Darwin-linker-error.patch";
+      url = "https://github.com/KhronosGroup/glslang/commit/586baa35a47b3aa6ad3fa829a27f0f4206400668.patch";
+      hash = "sha256-paAl4E8GzogcxDEzn/XuhNH6XObp+i7WfArqAiuH4Mk=";
+      revert = true;
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 829772fa016e3..dda624c19122f 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.19.5";
+  version = "1.19.6";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-jkhujoWigfxc4/C+3FudLb9idtfbCyXT7ANPMT2gN18=";
+    hash = "sha256-1/ABP4Lm1/hizGy1yM20ju9fLiObNbqpfi8adGYEN2c=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 72b25bff777b6..e5980a711a3c0 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -4,15 +4,15 @@
 , libXcursor, libXrandr, fontconfig, openjdk11-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
 let
   major = "11";
   minor = "0";
-  update = "17";
-  build = "8";
+  update = "18";
+  build = "10";
 
   openjdk = stdenv.mkDerivation rec {
     pname = "openjdk" + lib.optionalString headless "-headless";
@@ -22,7 +22,7 @@ let
       owner = "openjdk";
       repo = "jdk${major}u";
       rev = "jdk-${version}";
-      sha256 = "sha256-kvgLYqQZPqyuigVyzbDHc3TMff0clvzM8IdzYLYcxPU=";
+      sha256 = "sha256-QGOpMIrWwOtIcUY/CLbTRDvcVTG2xioZu46v+n+IIQ4=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];
diff --git a/pkgs/development/compilers/openjdk/12.nix b/pkgs/development/compilers/openjdk/12.nix
index bd3defbd6b98c..682bb3263f74c 100644
--- a/pkgs/development/compilers/openjdk/12.nix
+++ b/pkgs/development/compilers/openjdk/12.nix
@@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk11, fetchpatch
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/13.nix b/pkgs/development/compilers/openjdk/13.nix
index 40dc753f7955c..72be3b050dd94 100644
--- a/pkgs/development/compilers/openjdk/13.nix
+++ b/pkgs/development/compilers/openjdk/13.nix
@@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk13-bootstrap, fetchpatch
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/14.nix b/pkgs/development/compilers/openjdk/14.nix
index 047e1a3908191..50e23ca1399c5 100644
--- a/pkgs/development/compilers/openjdk/14.nix
+++ b/pkgs/development/compilers/openjdk/14.nix
@@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk14-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/15.nix b/pkgs/development/compilers/openjdk/15.nix
index c33e937f9f24b..f013cddbae536 100644
--- a/pkgs/development/compilers/openjdk/15.nix
+++ b/pkgs/development/compilers/openjdk/15.nix
@@ -4,7 +4,7 @@
 , libXcursor, libXrandr, fontconfig, openjdk15-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/16.nix b/pkgs/development/compilers/openjdk/16.nix
index 461cd724144ed..eee569a7bfd67 100644
--- a/pkgs/development/compilers/openjdk/16.nix
+++ b/pkgs/development/compilers/openjdk/16.nix
@@ -4,7 +4,7 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk16-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/17.nix b/pkgs/development/compilers/openjdk/17.nix
index 6d8087d7e948d..0d9ffb1f79f46 100644
--- a/pkgs/development/compilers/openjdk/17.nix
+++ b/pkgs/development/compilers/openjdk/17.nix
@@ -4,15 +4,15 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk17-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
 let
   version = {
     feature = "17";
-    interim = ".0.5";
-    build = "8";
+    interim = ".0.6";
+    build = "10";
   };
 
   openjdk = stdenv.mkDerivation {
@@ -23,7 +23,7 @@ let
       owner = "openjdk";
       repo = "jdk${version.feature}u";
       rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      sha256 = "sha256-2k1Mm36ds6MZheZVsLvXkoqQG4zYeIRWzbP1aZ72Vqs=";
+      sha256 = "sha256-zPpINi++3Ct0PCwlwlfhceh/ploMkclw+MgeI9dULdc=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ];
diff --git a/pkgs/development/compilers/openjdk/18.nix b/pkgs/development/compilers/openjdk/18.nix
index 37b51a1ee4ce0..4726e145d152b 100644
--- a/pkgs/development/compilers/openjdk/18.nix
+++ b/pkgs/development/compilers/openjdk/18.nix
@@ -4,7 +4,7 @@
 , libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk18-bootstrap
 , setJavaClassPath
 , headless ? false
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
diff --git a/pkgs/development/compilers/openjdk/19.nix b/pkgs/development/compilers/openjdk/19.nix
index 717bfedcb6354..c79c3d34bd44f 100644
--- a/pkgs/development/compilers/openjdk/19.nix
+++ b/pkgs/development/compilers/openjdk/19.nix
@@ -7,15 +7,15 @@
 # TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
 # which should be fixable, this is a no-rebuild workaround for GHC.
 , headless ? stdenv.targetPlatform.isGhcjs
-, enableJavaFX ? openjfx.meta.available, openjfx
+, enableJavaFX ? false, openjfx
 , enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
 }:
 
 let
   version = {
     feature = "19";
-    interim = ".0.1";
-    build = "10";
+    interim = ".0.2";
+    build = "7";
   };
 
   openjdk = stdenv.mkDerivation {
@@ -26,7 +26,7 @@ let
       owner = "openjdk";
       repo = "jdk${version.feature}u";
       rev = "jdk-${version.feature}${version.interim}+${version.build}";
-      hash = "sha256-IS6ABnVdW1qJ4gu4YSgMVFXBTNdtWFdbNNz+kMaiyk8=";
+      hash = "sha256-pBEHmBtIgG4Czou4C/zpBBYZEDImvXiLoA5CjOzpeyI=";
     };
 
     nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
@@ -57,8 +57,8 @@ let
       # Patch borrowed from Alpine to fix build errors with musl libc and recent gcc.
       # This is applied anywhere to prevent patchrot.
       (fetchpatch {
-        url = "https://git.alpinelinux.org/aports/plain/testing/openjdk19/FixNullPtrCast.patch?id=b93d1fc37fcf106144958d957bb97c7db67bd41f";
-        hash = "sha256-cnpeYcVoRYjuDgrl2x27frv6KUAnu1+1MVPehPZy/Cg=";
+        url = "https://git.alpinelinux.org/aports/plain/testing/openjdk19/FixNullPtrCast.patch?id=93dc07f97ff716b647c5f57c6224901ea06da560";
+        hash = "sha256-H4X3Yip5bCpXMH7MSu9BgXIOYRVUBMZPZW8EvZSWI5k=";
       })
     ] ++ lib.optionals (!headless && enableGnome2) [
       ./swing-use-gtk-jdk13.patch
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index c65a9fcc66b68..e78e45b878efa 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -20,7 +20,7 @@ let
     powerpc64le-linux = "ppc64le";
   }.${stdenv.system} or (throw "Unsupported platform ${stdenv.system}");
 
-  update = "352";
+  update = "362";
   build = "ga";
 
   openjdk8 = stdenv.mkDerivation rec {
@@ -31,7 +31,7 @@ let
       owner = "openjdk";
       repo = "jdk8u";
       rev = "jdk${version}";
-      sha256 = "sha256-xDiiALDjStD9IPhbBr997rm/v2Q/WdS10cILBCmdJIQ=";
+      sha256 = "sha256-C5dQwfIIpIrLeO3JWERyFCQHUSgG8gARuc3qXAeLkJ4=";
     };
     outputs = [ "out" "jre" ];
 
diff --git a/pkgs/development/compilers/openjdk/openjfx/11.nix b/pkgs/development/compilers/openjdk/openjfx/11.nix
index 164677c3b8dcd..276767fa37a82 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -1,26 +1,19 @@
 { stdenv, lib, fetchFromGitHub, writeText, gradle_7, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, icu68
-, openjdk11-bootstrap }:
+, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, icu68
+, openjdk11-bootstrap
+, withMedia ? true
+, withWebKit ? false
+}:
 
 let
   major = "11";
-  update = ".0.17";
+  update = ".0.18";
   build = "1";
   repover = "${major}${update}+${build}";
   gradle_ = (gradle_7.override {
     java = openjdk11-bootstrap;
   });
 
-  NIX_CFLAGS_COMPILE = [
-    # avoids errors about deprecation of GTypeDebugFlags, GTimeVal, etc.
-    "-DGLIB_DISABLE_DEPRECATION_WARNINGS"
-    # glib-2.62 deprecations
-    # -fcommon: gstreamer workaround for -fno-common toolchains:
-    #   ld: gsttypefindelement.o:(.bss._gst_disable_registry_cache+0x0): multiple definition of
-    #     `_gst_disable_registry_cache'; gst.o:(.bss._gst_disable_registry_cache+0x0): first defined here
-    "-fcommon"
-  ];
-
   makePackage = args: stdenv.mkDerivation ({
     version = "${major}${update}-${build}";
 
@@ -28,10 +21,10 @@ let
       owner = "openjdk";
       repo = "jfx${major}u";
       rev = repover;
-      sha256 = "sha256-uKb6k+tIFdwy1BYiHWeGmKNz82X4CZjFlGYqLDpSFY0=";
+      sha256 = "sha256-46DjIzcBHkmp5vnhYnLu78CG72bIBRM4A6mgk2OLOko=";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -81,8 +74,8 @@ in makePackage {
   pname = "openjfx-modular-sdk";
 
   gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
   '';
 
   preBuild = ''
diff --git a/pkgs/development/compilers/openjdk/openjfx/15.nix b/pkgs/development/compilers/openjdk/openjfx/15.nix
index 788baabde848f..6e853efedcbba 100644
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@@ -1,6 +1,9 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk11_headless, gradle_6
-, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4-headless, python3, ruby }:
+, pkg-config, perl, cmake, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib
+, ffmpeg_4-headless, python3, ruby
+, withMedia ? true
+, withWebKit ? false
+}:
 
 let
   major = "15";
@@ -21,7 +24,7 @@ let
       sha256 = "019glq8rhn6amy3n5jc17vi2wpf1pxpmmywvyz1ga8n09w7xscq1";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -76,8 +79,8 @@ in makePackage {
   pname = "openjfx-modular-sdk";
 
   gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
   '';
 
   preBuild = ''
diff --git a/pkgs/development/compilers/openjdk/openjfx/17.nix b/pkgs/development/compilers/openjdk/openjfx/17.nix
index 8d4d47df32e7f..5c1d057a21880 100644
--- a/pkgs/development/compilers/openjdk/openjfx/17.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/17.nix
@@ -1,11 +1,14 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk17_headless, gradle_7
-, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4-headless, python3, ruby, icu68 }:
+, pkg-config, perl, cmake, gperf, gtk3, libXtst, libXxf86vm, glib, alsa-lib
+, ffmpeg_4-headless, python3, ruby, icu68
+, withMedia ? true
+, withWebKit ? false
+}:
 
 let
   major = "17";
-  update = ".0.5";
-  build = "+1";
+  update = ".0.6";
+  build = "+3";
   repover = "${major}${update}${build}";
   gradle_ = (gradle_7.override {
     java = openjdk17_headless;
@@ -18,10 +21,10 @@ let
       owner = "openjdk";
       repo = "jfx${major}u";
       rev = repover;
-      sha256 = "sha256-jzLOlWuhkUS0/4+nXtjd1/IYbAHHnJrusFRTh7aPt8U=";
+      sha256 = "sha256-9VfXk2EfMebMyVKPohPRP2QXRFf8XemUtfY0JtBCHyw=";
     };
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -66,8 +69,8 @@ in makePackage {
   pname = "openjfx-modular-sdk";
 
   gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
   '';
 
   preBuild = ''
diff --git a/pkgs/development/compilers/openjdk/openjfx/19.nix b/pkgs/development/compilers/openjdk/openjfx/19.nix
index 96103734eb0a5..e0c23e4734b17 100644
--- a/pkgs/development/compilers/openjdk/openjfx/19.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/19.nix
@@ -1,11 +1,14 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, writeText, openjdk17_headless
-, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst
-, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68 }:
+, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk3, libXtst
+, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68
+, withMedia ? true
+, withWebKit ? false
+}:
 
 let
   major = "19";
-  update = "";
-  build = "+11";
+  update = ".0.2.1";
+  build = "+1";
   repover = "${major}${update}${build}";
   gradle_ = (gradle_7.override {
     # note: gradle does not yet support running on 19
@@ -19,7 +22,7 @@ let
       owner = "openjdk";
       repo = "jfx";
       rev = repover;
-      hash = "sha256-UXTaXtJ8py83V7IQK9wACIEWDAMRUaYNgH9e/Aeyuzc=";
+      hash = "sha256-A08GhCGpzWlUG1+f6mcjvkJmMNaOReacQKPEmNpUvLs=";
     };
 
     patches = [
@@ -35,7 +38,7 @@ let
       })
     ];
 
-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    buildInputs = [ gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
     nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
 
     dontUseCmakeConfigure = true;
@@ -83,8 +86,8 @@ in makePackage {
   pname = "openjfx-modular-sdk";
 
   gradleProperties = ''
-    COMPILE_MEDIA = true
-    COMPILE_WEBKIT = false
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
   '';
 
   preBuild = ''
diff --git a/pkgs/development/compilers/rust/1_67.nix b/pkgs/development/compilers/rust/1_67.nix
index a0a43f31386db..2d22432798a41 100644
--- a/pkgs/development/compilers/rust/1_67.nix
+++ b/pkgs/development/compilers/rust/1_67.nix
@@ -21,8 +21,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.67.0";
-  rustcSha256 = "sha256-0CnxT85Foux6mmBdKgpAquRznLL9rinun3pukCWn/eQ=";
+  rustcVersion = "1.67.1";
+  rustcSha256 = "sha256-Rkg9Pl3oWjvUb456OuGDdJY5EGfb5xOiXTzwUbPZ/24=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_15.libllvm.override { enableSharedLibraries = true; };
@@ -59,14 +59,6 @@ import ./default.nix {
   selectRustPackage = pkgs: pkgs.rust_1_67;
 
   rustcPatches = [
-    # fix thin archive reading
-    # https://github.com/rust-lang/rust/pull/107360
-    (fetchpatch {
-      name = "revert-back-to-llvmarchivebuilder-on-all-platforms.patch";
-      url = "https://github.com/rust-lang/rust/commit/de363d54c40a378717881240e719f5f7223ba376.patch";
-      hash = "sha256-3Xb803LZUZ1dldxGJ65Iw6gg1V1K827OB/0b32GqilU=";
-    })
-
     # Fixes ICE.
     # https://github.com/rust-lang/rust/pull/107688
     (fetchpatch {
diff --git a/pkgs/development/interpreters/lua-5/hooks/default.nix b/pkgs/development/interpreters/lua-5/hooks/default.nix
index fc92c59bb910c..6c303f770decc 100644
--- a/pkgs/development/interpreters/lua-5/hooks/default.nix
+++ b/pkgs/development/interpreters/lua-5/hooks/default.nix
@@ -27,7 +27,7 @@ in {
   luarocksCheckHook = callPackage ({ luarocks }:
     makeSetupHook {
       name = "luarocks-check-hook";
-      deps = [ luarocks ];
+      propagatedBuildInputs = [ luarocks ];
     } ./luarocks-check-hook.sh) {};
 
   # luarocks installs data in a non-overridable location. Until a proper luarocks patch,
@@ -35,6 +35,6 @@ in {
   luarocksMoveDataFolder = callPackage ({ }:
     makeSetupHook {
       name = "luarocks-move-rock";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
     } ./luarocks-move-data.sh) {};
 }
diff --git a/pkgs/development/interpreters/lua-5/wrap-lua.nix b/pkgs/development/interpreters/lua-5/wrap-lua.nix
index c9ef151bea3c3..43ececd1e794c 100644
--- a/pkgs/development/interpreters/lua-5/wrap-lua.nix
+++ b/pkgs/development/interpreters/lua-5/wrap-lua.nix
@@ -8,7 +8,7 @@
 # imported as wrapLua in lua-packages.nix and passed to build-lua-derivation to be used as buildInput
 makeSetupHook {
   name = "wrap-lua-hook";
-  deps = makeWrapper;
+  propagatedBuildInputs = [ makeWrapper ];
   substitutions.executable = lua.interpreter;
   substitutions.lua = lua;
   substitutions.LuaPathSearchPaths = lib.escapeShellArgs lua.LuaPathSearchPaths;
diff --git a/pkgs/development/interpreters/octave/wrap-octave.nix b/pkgs/development/interpreters/octave/wrap-octave.nix
index 1e4616136a1b9..2317a479f0e20 100644
--- a/pkgs/development/interpreters/octave/wrap-octave.nix
+++ b/pkgs/development/interpreters/octave/wrap-octave.nix
@@ -10,7 +10,7 @@
 # Each of the substitutions is available in the wrap.sh script as @thingSubstituted@
 makeSetupHook {
   name = "${octave.name}-pkgs-setup-hook";
-  deps = makeWrapper;
+  propagatedBuildInputs = [ makeWrapper ];
   substitutions.executable = octave.interpreter;
   substitutions.octave = octave;
 } ./wrap.sh
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 2971981eba1ff..706dd931c7851 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -24,7 +24,7 @@
 , pkgsHostHost
 , pkgsTargetTarget
 , sourceVersion
-, sha256
+, hash
 , passthruFun
 , static ? stdenv.hostPlatform.isStatic
 , stripBytecode ? reproducibleBuild
@@ -87,7 +87,7 @@ let
     owner = "ActiveState";
     repo = "cpython";
     rev = "v${version}";
-    inherit sha256;
+    inherit hash;
   };
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 66566cf5c2772..11b6fcbe8cf17 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -30,7 +30,7 @@
 , pkgsHostHost
 , pkgsTargetTarget
 , sourceVersion
-, sha256
+, hash
 , passthruFun
 , bash
 , stripConfig ? false
@@ -215,7 +215,7 @@ in with passthru; stdenv.mkDerivation {
 
   src = fetchurl {
     url = with sourceVersion; "https://www.python.org/ftp/python/${major}.${minor}.${patch}/Python-${version}.tar.xz";
-    inherit sha256;
+    inherit hash;
   };
 
   prePatch = optionalString stdenv.isDarwin ''
@@ -235,7 +235,7 @@ in with passthru; stdenv.mkDerivation {
       url = "https://github.com/python/cpython/commit/3fae04b10e2655a20a3aadb5e0d63e87206d0c67.diff";
       revert = true;
       excludes = [ "Misc/NEWS.d/*" ];
-      sha256 = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
+      hash = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
     })
   ] ++ [
     # Disable the use of ldconfig in ctypes.util.find_library (since
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 08e2717d41c16..c4b95af92f284 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -117,23 +117,24 @@
   };
 
   sources = {
-    python39 = {
+    python310 = {
       sourceVersion = {
         major = "3";
-        minor = "9";
-        patch = "16";
+        minor = "10";
+        patch = "10";
         suffix = "";
       };
-      sha256 = "sha256-It3cCZJG3SdgZlVh6K23OU6gzEOnJoTGSA+TgPd4ZDk=";
+      hash = "sha256-BBnpCFv1G3pnIAmz9Q2/GFms3xi6cl0OwZqlyFA/DqM=";
     };
-    python310 = {
+
+    python311 = {
       sourceVersion = {
         major = "3";
-        minor = "10";
-        patch = "9";
+        minor = "11";
+        patch = "2";
         suffix = "";
       };
-      sha256 = "sha256-WuA+MIJgFkuro5kh/bTb+ObQPYI1qTnUWCsz8LXkaoM=";
+      hash = "sha256-KeS49fFlhUKowT4t0nc1jJxI8rL3MYZS7xZ15AK50q8=";
     };
   };
 
@@ -147,7 +148,7 @@ in {
       patch = "18";
       suffix = ".6"; # ActiveState's Python 2 extended support
     };
-    sha256 = "sha256-+I0QOBkuTHMIQz71lgNn1X1vjPsjJMtFbgC0xcGTwWY=";
+    hash = "sha256-+I0QOBkuTHMIQz71lgNn1X1vjPsjJMtFbgC0xcGTwWY=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -160,16 +161,23 @@ in {
       patch = "16";
       suffix = "";
     };
-    sha256 = "sha256-2F27N3QTJHPYCB3LFY80oQzK16kLlsflDqS7YfXORWI=";
+    hash = "sha256-2F27N3QTJHPYCB3LFY80oQzK16kLlsflDqS7YfXORWI=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
 
-  python39 = callPackage ./cpython ({
+  python39 = callPackage ./cpython {
     self = __splicedPackages.python39;
+    sourceVersion = {
+      major = "3";
+      minor = "9";
+      patch = "16";
+      suffix = "";
+    };
+    hash = "sha256-It3cCZJG3SdgZlVh6K23OU6gzEOnJoTGSA+TgPd4ZDk=";
     inherit (darwin) configd;
     inherit passthruFun;
-  } // sources.python39);
+  };
 
   python310 = callPackage ./cpython ({
     self = __splicedPackages.python310;
@@ -177,18 +185,11 @@ in {
     inherit passthruFun;
   } // sources.python310);
 
-  python311 = callPackage ./cpython {
+  python311 = callPackage ./cpython ({
     self = __splicedPackages.python311;
-    sourceVersion = {
-      major = "3";
-      minor = "11";
-      patch = "1";
-      suffix = "";
-    };
-    sha256 = "sha256-hYeRkvLP/VbLFsCSkFlJ6/Pl45S392RyNSljeQHftY8=";
     inherit (darwin) configd;
     inherit passthruFun;
-  };
+  } // sources.python311);
 
   python312 = callPackage ./cpython {
     self = __splicedPackages.python312;
@@ -198,7 +199,7 @@ in {
       patch = "0";
       suffix = "a5";
     };
-    sha256 = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
+    hash = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
@@ -241,7 +242,7 @@ in {
       patch = "11";
     };
 
-    sha256 = "sha256-ERevtmgx2k6m852NIIR4enRon9AineC+MB+e2bJVCTw=";
+    hash = "sha256-ERevtmgx2k6m852NIIR4enRon9AineC+MB+e2bJVCTw=";
     pythonVersion = "2.7";
     db = db.override { dbmSupport = !stdenv.isDarwin; };
     python = __splicedPackages.pythonInterpreters.pypy27_prebuilt;
@@ -258,7 +259,7 @@ in {
       patch = "11";
     };
 
-    sha256 = "sha256-sPMWb7Klqt/VzrnbXN1feSmg7MygK0omwNrgSS98qOo=";
+    hash = "sha256-sPMWb7Klqt/VzrnbXN1feSmg7MygK0omwNrgSS98qOo=";
     pythonVersion = "3.9";
     db = db.override { dbmSupport = !stdenv.isDarwin; };
     python = __splicedPackages.pypy27;
@@ -270,7 +271,7 @@ in {
   pypy38 = __splicedPackages.pypy39.override {
     self = __splicedPackages.pythonInterpreters.pypy38;
     pythonVersion = "3.8";
-    sha256 = "sha256-TWdpv8pzc06GZv1wUDt86wam4lkRDmFzMbs4mcpOYFg=";
+    hash = "sha256-TWdpv8pzc06GZv1wUDt86wam4lkRDmFzMbs4mcpOYFg=";
   };
 
   pypy37 = throw "pypy37 has been removed from nixpkgs since it is no longer supported upstream"; # Added 2023-01-04
@@ -284,7 +285,7 @@ in {
       patch = "11";
     };
 
-    sha256 = {
+    hash = {
       aarch64-linux = "sha256-6pJNod7+kyXvdg4oiwT5hGFOQFWA9TIetqXI9Tm9QVo=";
       x86_64-linux = "sha256-uo7ZWKkFwHNaTP/yh1wlCJlU3AIOCH2YKw/6W52jFs0=";
       aarch64-darwin = "sha256-zFaWq0+TzTSBweSZC13t17pgrAYC+hiQ02iImmxb93E=";
@@ -302,7 +303,7 @@ in {
       minor = "3";
       patch = "11";
     };
-    sha256 = {
+    hash = {
       aarch64-linux = "sha256-CRddxlLtiV2Y6a1j0haBK/PufjmNkAqb+espBrqDArk=";
       x86_64-linux = "sha256-1QYXLKEQcSdBdddOnFgcMWZDLQF5sDZHDjuejSDq5YE=";
       aarch64-darwin = "sha256-ka11APGjlTHb76CzRaPc/5J/+ZcWVOjS6e98WuMR9X4=";
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 08dc3ea61ab76..001e477b9185b 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -11,7 +11,7 @@ in {
   condaInstallHook = callPackage ({ makePythonHook, gnutar, lbzip2 }:
     makePythonHook {
       name = "conda-install-hook";
-      deps = [ gnutar lbzip2 ];
+      propagatedBuildInputs = [ gnutar lbzip2 ];
       substitutions = {
         inherit pythonSitePackages;
       };
@@ -20,19 +20,19 @@ in {
   condaUnpackHook = callPackage ({ makePythonHook }:
     makePythonHook {
       name = "conda-unpack-hook";
-      deps = [];
+      propagatedBuildInputs = [];
     } ./conda-unpack-hook.sh) {};
 
   eggBuildHook = callPackage ({ makePythonHook }:
     makePythonHook {
       name = "egg-build-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
     } ./egg-build-hook.sh) {};
 
   eggInstallHook = callPackage ({ makePythonHook, setuptools }:
     makePythonHook {
       name = "egg-install-hook.sh";
-      deps = [ setuptools ];
+      propagatedBuildInputs = [ setuptools ];
       substitutions = {
         inherit pythonInterpreter pythonSitePackages;
       };
@@ -41,13 +41,13 @@ in {
   eggUnpackHook = callPackage ({ makePythonHook, }:
     makePythonHook {
       name = "egg-unpack-hook.sh";
-      deps = [ ];
+      propagatedBuildInputs = [ ];
     } ./egg-unpack-hook.sh) {};
 
   flitBuildHook = callPackage ({ makePythonHook, flit }:
     makePythonHook {
       name = "flit-build-hook";
-      deps = [ flit ];
+      propagatedBuildInputs = [ flit ];
       substitutions = {
         inherit pythonInterpreter;
       };
@@ -56,7 +56,7 @@ in {
   pipBuildHook = callPackage ({ makePythonHook, pip, wheel }:
     makePythonHook {
       name = "pip-build-hook.sh";
-      deps = [ pip wheel ];
+      propagatedBuildInputs = [ pip wheel ];
       substitutions = {
         inherit pythonInterpreter pythonSitePackages;
       };
@@ -65,7 +65,7 @@ in {
   pipInstallHook = callPackage ({ makePythonHook, pip }:
     makePythonHook {
       name = "pip-install-hook";
-      deps = [ pip ];
+      propagatedBuildInputs = [ pip ];
       substitutions = {
         inherit pythonInterpreter pythonSitePackages;
       };
@@ -74,7 +74,7 @@ in {
   pytestCheckHook = callPackage ({ makePythonHook, pytest }:
     makePythonHook {
       name = "pytest-check-hook";
-      deps = [ pytest ];
+      propagatedBuildInputs = [ pytest ];
       substitutions = {
         inherit pythonCheckInterpreter;
       };
@@ -123,7 +123,7 @@ in {
   pythonRelaxDepsHook = callPackage ({ makePythonHook, wheel }:
     makePythonHook {
       name = "python-relax-deps-hook";
-      deps = [ wheel ];
+      propagatedBuildInputs = [ wheel ];
       substitutions = {
         inherit pythonInterpreter;
       };
@@ -145,7 +145,7 @@ in {
   setuptoolsBuildHook = callPackage ({ makePythonHook, setuptools, wheel }:
     makePythonHook {
       name = "setuptools-setup-hook";
-      deps = [ setuptools wheel ];
+      propagatedBuildInputs = [ setuptools wheel ];
       substitutions = {
         inherit pythonInterpreter pythonSitePackages setuppy;
       };
@@ -154,7 +154,7 @@ in {
   setuptoolsCheckHook = callPackage ({ makePythonHook, setuptools }:
     makePythonHook {
       name = "setuptools-check-hook";
-      deps = [ setuptools ];
+      propagatedBuildInputs = [ setuptools ];
       substitutions = {
         inherit pythonCheckInterpreter setuppy;
       };
@@ -171,7 +171,7 @@ in {
   venvShellHook = disabledIf (!isPy3k) (callPackage ({ makePythonHook, ensureNewerSourcesForZipFilesHook }:
     makePythonHook {
       name = "venv-shell-hook";
-      deps = [ ensureNewerSourcesForZipFilesHook ];
+      propagatedBuildInputs = [ ensureNewerSourcesForZipFilesHook ];
       substitutions = {
         inherit pythonInterpreter;
       };
@@ -180,7 +180,7 @@ in {
   wheelUnpackHook = callPackage ({ makePythonHook, wheel }:
     makePythonHook {
       name = "wheel-unpack-hook.sh";
-      deps = [ wheel ];
+      propagatedBuildInputs = [ wheel ];
     } ./wheel-unpack-hook.sh) {};
 
   wrapPython = callPackage ../wrap-python.nix {
@@ -190,6 +190,6 @@ in {
   sphinxHook = callPackage ({ makePythonHook, sphinx, installShellFiles }:
     makePythonHook {
       name = "python${python.pythonVersion}-sphinx-hook";
-      deps = [ sphinx installShellFiles ];
+      propagatedBuildInputs = [ sphinx installShellFiles ];
     } ./sphinx-hook.sh) {};
 }
diff --git a/pkgs/development/interpreters/python/python-packages-base.nix b/pkgs/development/interpreters/python/python-packages-base.nix
index ee94d4aec0310..0899ad18e967c 100644
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@@ -16,17 +16,22 @@ let
   # This function introduces `overridePythonAttrs` and it overrides the call to `buildPythonPackage`.
   makeOverridablePythonPackage = f: origArgs:
     let
-      ff = f origArgs;
-      overrideWith = newArgs: origArgs // (if pkgs.lib.isFunction newArgs then newArgs origArgs else newArgs);
+      args = lib.fix (lib.extends
+        (_: previousAttrs: {
+          passthru = (previousAttrs.passthru or { }) // {
+            overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
+          };
+        })
+        (_: origArgs));
+      result = f args;
+      overrideWith = newArgs: args // (if pkgs.lib.isFunction newArgs then newArgs args else newArgs);
     in
-      if builtins.isAttrs ff then (ff // {
+      if builtins.isAttrs result then result
+      else if builtins.isFunction result then {
         overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
-      })
-      else if builtins.isFunction ff then {
-        overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
-        __functor = self: ff;
+        __functor = self: result;
       }
-      else ff;
+      else result;
 
   buildPythonPackage = makeOverridablePythonPackage (lib.makeOverridable (callPackage ./mk-python-derivation.nix {
     inherit namePrefix;     # We want Python libraries to be named like e.g. "python3.6-${name}"
diff --git a/pkgs/development/interpreters/python/tests.nix b/pkgs/development/interpreters/python/tests.nix
index 037c8f87b8ba7..4ba1b757c3f6a 100644
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@@ -43,7 +43,8 @@ let
       # Use virtualenv from a Nix env.
       nixenv-virtualenv = rec {
         env = runCommand "${python.name}-virtualenv" {} ''
-          ${pythonVirtualEnv.interpreter} -m virtualenv $out
+          ${pythonVirtualEnv.interpreter} -m virtualenv venv
+          mv venv $out
         '';
         interpreter = "${env}/bin/${python.executable}";
         is_venv = "False";
@@ -173,7 +174,7 @@ let
       }
     ) {};
     pythonWithRequests = requests.pythonModule.withPackages (ps: [ requests ]);
-    in
+    in lib.optionalAttrs stdenv.isLinux
     {
       condaExamplePackage = runCommand "import-requests" {} ''
         ${pythonWithRequests.interpreter} -c "import requests" > $out
diff --git a/pkgs/development/interpreters/python/wrap-python.nix b/pkgs/development/interpreters/python/wrap-python.nix
index 83da013bfd2d9..c67a8e0885149 100644
--- a/pkgs/development/interpreters/python/wrap-python.nix
+++ b/pkgs/development/interpreters/python/wrap-python.nix
@@ -5,7 +5,7 @@
 
 makePythonHook {
       name = "wrap-python-hook";
-      deps = makeWrapper;
+      propagatedBuildInputs = [ makeWrapper ];
       substitutions.sitePackages = python.sitePackages;
       substitutions.executable = python.interpreter;
       substitutions.python = python.pythonForBuild;
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 4461bd08365ea..2bab78ecd4197 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -97,6 +97,13 @@ let
           }).${ver.majMinTiny}
           ++ op (lib.versionOlder ver.majMin "3.1") ./do-not-regenerate-revision.h.patch
           ++ op (atLeast30 && useBaseRuby) ./do-not-update-gems-baseruby.patch
+          ++ ops (ver.majMin == "3.0") [
+            # Ruby 3.0 adds `-fdeclspec` to $CC instead of $CFLAGS. Fixed in later versions.
+            (fetchpatch {
+              url = "https://github.com/ruby/ruby/commit/0acc05caf7518cd0d63ab02bfa036455add02346.patch";
+              sha256 = "sha256-43hI9L6bXfeujgmgKFVmiWhg7OXvshPCCtQ4TxqK1zk=";
+            })
+          ]
           ++ ops (!atLeast30 && rubygemsSupport) [
             # We upgrade rubygems to a version that isn't compatible with the
             # ruby 2.7 installer. Backport the upstream fix.
@@ -190,14 +197,7 @@ let
 
           # Allow to override compiler. This is important for cross compiling as
           # we need to set a compiler that is different from the build one.
-          awk -i inplace -F' = ' \
-            ' # operate on the line starting with
-              /^  CONFIG\["CC"\]/ {
-                # replace the right hand side
-                sub($2, "ENV[\"CC\"] || \"1\"")
-              }; { print }' "$rbConfig"
-          # test that the line isn't mangled in case upstream made the above unnecessary
-          grep -qx '  CONFIG\["CC"\] = ENV\["CC"\] || "1"' "$rbConfig"
+          sed -i 's/CONFIG\["CC"\] = "\(.*\)"/CONFIG["CC"] = if ENV["CC"].nil? || ENV["CC"].empty? then "\1" else ENV["CC"] end/'  "$rbConfig"
 
           # Remove unnecessary external intermediate files created by gems
           extMakefiles=$(find $out/${passthru.gemPath} -name Makefile)
@@ -235,6 +235,21 @@ let
             $rbConfig $out/lib/libruby*
         '';
 
+        installCheckPhase = ''
+          overriden_cc=$(CC=foo $out/bin/ruby -rrbconfig -e 'puts RbConfig::CONFIG["CC"]')
+          if [[ "$overriden_cc" != "foo" ]]; then
+             echo "CC cannot be overwritten: $overriden_cc != foo" >&2
+             false
+          fi
+
+          fallback_cc=$(unset CC; $out/bin/ruby -rrbconfig -e 'puts RbConfig::CONFIG["CC"]')
+          if [[ "$fallback_cc" != "$CC" ]]; then
+             echo "CC='$fallback_cc' should be '$CC' by default" >&2
+             false
+          fi
+        '';
+        doInstallCheck = true;
+
         disallowedRequisites = op (!jitSupport) stdenv.cc.cc
           ++ op useBaseRuby baseRuby;
 
diff --git a/pkgs/development/interpreters/tcl/generic.nix b/pkgs/development/interpreters/tcl/generic.nix
index 6351a08c1c071..6ce6e35189bf2 100644
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -53,7 +53,7 @@ let
         libdir = "lib/${libPrefix}";
         tclPackageHook = callPackage ({ buildPackages }: makeSetupHook {
           name = "tcl-package-hook";
-          deps = [ buildPackages.makeWrapper ];
+          propagatedBuildInputs = [ buildPackages.makeWrapper ];
         } ./tcl-package-hook.sh) {};
       };
     };
diff --git a/pkgs/development/libraries/accountsservice/default.nix b/pkgs/development/libraries/accountsservice/default.nix
index 694aab16d1abd..584b328d47001 100644
--- a/pkgs/development/libraries/accountsservice/default.nix
+++ b/pkgs/development/libraries/accountsservice/default.nix
@@ -62,8 +62,8 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     dbus
+    gettext
     glib
     polkit
     systemd
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 8e5793b0bcd12..4eaa95384d310 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.6.6";
+  version = "0.6.8";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "bdueJqQwYglEiReW/vsbuzi9kUj2z8VYgQwNPyaYdsc=";
+    sha256 = "HGGLPf8afLaiT0MXVZIPokN1YmgTj/ox09t8YHwsLWk=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
index f52800e2e70ce..287ce2a700846 100644
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   pname = "roc-toolkit";
   version = "0.2.1";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchFromGitHub {
     owner = "roc-streaming";
     repo = "roc-toolkit";
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 4c6ba700457ff..4268af7ee0bb6 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, icu, expat, zlib, bzip2, python ? null, fixDarwinDylibNames, libiconv, libxcrypt
+{ lib, stdenv, icu, expat, zlib, bzip2, zstd, xz, python ? null, fixDarwinDylibNames, libiconv, libxcrypt
 , boost-build
 , fetchpatch
 , which
@@ -226,6 +226,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ which boost-build ]
     ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [ expat zlib bzip2 libiconv ]
+    ++ lib.optional (lib.versionAtLeast version "1.69") zstd
+    ++ lib.optional (lib.versionAtLeast version "1.65") xz
     ++ lib.optional enableIcu icu
     ++ lib.optionals enablePython [ libxcrypt python ]
     ++ lib.optional enableNumpy python.pkgs.numpy;
diff --git a/pkgs/development/libraries/cmocka/default.nix b/pkgs/development/libraries/cmocka/default.nix
index ed78f4f9ec84a..718377a7ca53d 100644
--- a/pkgs/development/libraries/cmocka/default.nix
+++ b/pkgs/development/libraries/cmocka/default.nix
@@ -1,16 +1,21 @@
 { fetchurl, fetchpatch, lib, stdenv, cmake }:
-
+let
+  # Temporary split to save rebuilds; see PR #217469
+  isUpdated = with stdenv; isDarwin && isAarch64;
+in
 stdenv.mkDerivation rec {
   pname = "cmocka";
   majorVersion = "1.1";
-  version = "${majorVersion}.5";
+  version = "${majorVersion}." + (if isUpdated then "6" else "5");
 
   src = fetchurl {
     url = "https://cmocka.org/files/${majorVersion}/cmocka-${version}.tar.xz";
-    sha256 = "1dm8pdvkyfa8dsbz9bpq7wwgixjij4sii9bbn5sgvqjm5ljdik7h";
+    sha256 = if isUpdated
+      then "0xksffx1w3pzm18ynf28cx8scrhylcbz43s1rgkkdqnyil1q6cjv"
+      else "1dm8pdvkyfa8dsbz9bpq7wwgixjij4sii9bbn5sgvqjm5ljdik7h";
   };
 
-  patches = [
+  patches = lib.optionals (!isUpdated) [
     (fetchpatch {
       name = "musl-uintptr.patch";
       url = "https://git.alpinelinux.org/aports/plain/main/cmocka/musl_uintptr.patch?id=6a15dd0d0ba9cc354a621fb359ca5e315ff2eabd";
@@ -20,38 +25,42 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = lib.optional doCheck "-DUNIT_TESTING=ON"
+    ++ lib.optional stdenv.hostPlatform.isStatic "-DBUILD_SHARED_LIBS=OFF";
+
+  doCheck = true;
+
   meta = with lib; {
     description = "Lightweight library to simplify and generalize unit tests for C";
+    longDescription = ''
+      There are a variety of C unit testing frameworks available however
+      many of them are fairly complex and require the latest compiler
+      technology.  Some development requires the use of old compilers which
+      makes it difficult to use some unit testing frameworks. In addition
+      many unit testing frameworks assume the code being tested is an
+      application or module that is targeted to the same platform that will
+      ultimately execute the test.  Because of this assumption many
+      frameworks require the inclusion of standard C library headers in the
+      code module being tested which may collide with the custom or
+      incomplete implementation of the C library utilized by the code under
+      test.
 
-    longDescription =
-      ''There are a variety of C unit testing frameworks available however
-        many of them are fairly complex and require the latest compiler
-        technology.  Some development requires the use of old compilers which
-        makes it difficult to use some unit testing frameworks. In addition
-        many unit testing frameworks assume the code being tested is an
-        application or module that is targeted to the same platform that will
-        ultimately execute the test.  Because of this assumption many
-        frameworks require the inclusion of standard C library headers in the
-        code module being tested which may collide with the custom or
-        incomplete implementation of the C library utilized by the code under
-        test.
-
-        Cmocka only requires a test application is linked with the standard C
-        library which minimizes conflicts with standard C library headers.
-        Also, CMocka tries to avoid the use of some of the newer features of
-        C compilers.
-
-        This results in CMocka being a relatively small library that can be
-        used to test a variety of exotic code. If a developer wishes to
-        simply test an application with the latest compiler then other unit
-        testing frameworks may be preferable.
-
-        This is the successor of Google's Cmockery.'';
+      Cmocka only requires a test application is linked with the standard C
+      library which minimizes conflicts with standard C library headers.
+      Also, CMocka tries to avoid the use of some of the newer features of
+      C compilers.
 
-    homepage = "https://cmocka.org/";
+      This results in CMocka being a relatively small library that can be
+      used to test a variety of exotic code. If a developer wishes to
+      simply test an application with the latest compiler then other unit
+      testing frameworks may be preferable.
 
+      This is the successor of Google's Cmockery.
+    '';
+    homepage = "https://cmocka.org/";
     license = licenses.asl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ kragniz rasendubi ];
+    broken = stdenv.hostPlatform.isStatic; # See https://github.com/NixOS/nixpkgs/issues/213623
   };
 }
diff --git a/pkgs/development/libraries/gjs/default.nix b/pkgs/development/libraries/gjs/default.nix
index a6824f121d39b..3b39482519642 100644
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@@ -27,7 +27,6 @@
 
 let
   testDeps = [
-    gobject-introspection # for Gio and cairo typelibs
     gtk3 atk pango.out gdk-pixbuf harfbuzz
   ];
 in stdenv.mkDerivation rec {
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 9e932e547f43f..489b3154f0d72 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -56,11 +56,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.74.3";
+  version = "2.74.5";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "6bxB7NlpDZvGqXDMc4ARm4KOW2pLFsOTxjiz3CuHy8s=";
+    sha256 = "zrqDpZmc6zGkxPyZISB8uf//0qsdbsA8Fi0/YIpcFMg=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
@@ -118,20 +118,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Disable flaky test.
     # https://gitlab.gnome.org/GNOME/glib/-/issues/820
     ./skip-timer-test.patch
-
-    # GVariant security fixes
-    # https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126.patch";
-      sha256 = "CNCxouYy8xNHt4eJtPZ2eOi9b0SxzI2DkklNfQMk3d8=";
-    })
-
-    # Menu model security fix
-    # https://discourse.gnome.org/t/fixes-for-gdbusmenumodel-crashes-in-glib/12846
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/4f4d770a1e40f719d5a310cffdac29cbb4e20c11.patch";
-      sha256 = "+S44AnC86HfbMwkRe1ll54IK9pLxaFD3LqiVhPelnXI=";
-    })
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 4ab7360f1f074..2c6e74d0fa1af 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -5,7 +5,7 @@
 , guileBindings ? config.gnutls.guile or false, guile
 , tpmSupport ? false, trousers, which, nettools, libunistring
 , withP11-kit ? !stdenv.hostPlatform.isStatic, p11-kit
-, withSecurity ? true, Security  # darwin Security.framework
+, Security  # darwin Security.framework
 # certificate compression - only zlib now, more possible: zstd, brotli
 
 # for passthru.tests
@@ -35,11 +35,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.7.8";
+  version = "3.8.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "sha256-xYrTmvBnDv5qiu5eOosjMaEgBBi2S3xRl3+zltRhcRQ=";
+    sha256 = "sha256-DqDRGhZgoeY/lg8Vexl6vm0MjLMlW+JOH7OBWTC5vcU=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -47,11 +47,7 @@ stdenv.mkDerivation rec {
   outputInfo = "devdoc";
   outputDoc  = "devdoc";
 
-  patches = [ ./nix-ssl-cert-file.patch ]
-    # Disable native add_system_trust.
-    # FIXME: apparently it's not enough to drop the framework anymore; maybe related to
-    # https://gitlab.com/gnutls/gnutls/-/commit/c19cb93d492e45141bfef9b926dfeba36003261c
-    ++ lib.optional (isDarwin && !withSecurity) ./no-security-framework.patch;
+  patches = [ ./nix-ssl-cert-file.patch ];
 
   # Skip some tests:
   #  - pkg-config: building against the result won't work before installing (3.5.11)
@@ -93,12 +89,11 @@ stdenv.mkDerivation rec {
     ++ lib.optional guileBindings guile;
 
   nativeBuildInputs = [ perl pkg-config ]
-    ++ lib.optionals (isDarwin && !withSecurity) [ autoconf automake ]
     ++ lib.optionals doCheck [ which nettools util-linux ];
 
   propagatedBuildInputs = [ nettle ]
     # Builds dynamically linking against gnutls seem to need the framework now.
-    ++ lib.optional (isDarwin && withSecurity) Security;
+    ++ lib.optional isDarwin Security;
 
   inherit doCheck;
   # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
diff --git a/pkgs/development/libraries/gnutls/nix-ssl-cert-file.patch b/pkgs/development/libraries/gnutls/nix-ssl-cert-file.patch
index 90d1e85ee8c02..c0f27f7b5a45b 100644
--- a/pkgs/development/libraries/gnutls/nix-ssl-cert-file.patch
+++ b/pkgs/development/libraries/gnutls/nix-ssl-cert-file.patch
@@ -1,14 +1,13 @@
 allow overriding system trust store location via $NIX_SSL_CERT_FILE
 
-diff --git a/lib/system/certs.c b/lib/system/certs.c
-index 611c645..6ef6edb 100644
 --- a/lib/system/certs.c
 +++ b/lib/system/certs.c
-@@ -369,6 +369,11 @@ gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
+@@ -404,6 +404,10 @@ gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
  					unsigned int tl_flags,
  					unsigned int tl_vflags)
  {
--	return add_system_trust(list, tl_flags|GNUTLS_TL_NO_DUPLICATES, tl_vflags);
+-	return add_system_trust(list, tl_flags | GNUTLS_TL_NO_DUPLICATES,
+-				tl_vflags);
 +	tl_flags = tl_flags|GNUTLS_TL_NO_DUPLICATES;
 +	const char *file = secure_getenv("NIX_SSL_CERT_FILE");
 +	return file
@@ -16,4 +15,3 @@ index 611c645..6ef6edb 100644
 +			list, file, NULL/*CRL*/, GNUTLS_X509_FMT_PEM, tl_flags, tl_vflags)
 +		: add_system_trust(list, tl_flags, tl_vflags);
  }
- 
diff --git a/pkgs/development/libraries/gnutls/no-security-framework.patch b/pkgs/development/libraries/gnutls/no-security-framework.patch
deleted file mode 100644
index 7f5808e50535e..0000000000000
--- a/pkgs/development/libraries/gnutls/no-security-framework.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-commit 9bcdde1ab9cdff6a4471f9a926dd488ab70c7247
-Author: Daiderd Jordan <daiderd@gmail.com>
-Date:   Mon Apr 22 16:38:27 2019 +0200
-
-    Revert "gnutls_x509_trust_list_add_system_trust: Add macOS keychain support"
-    
-    This reverts commit c0eb46d3463cd21b3f822ac377ff37f067f66b8d.
-
-diff --git a/configure.ac b/configure.ac
-index 8ad597bfd..8d14f26cd 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -781,7 +781,7 @@ dnl auto detect https://lists.gnu.org/archive/html/help-gnutls/2012-05/msg00004.
- AC_ARG_WITH([default-trust-store-file],
-   [AS_HELP_STRING([--with-default-trust-store-file=FILE],
-     [use the given file default trust store])], with_default_trust_store_file="$withval",
--  [if test "$build" = "$host" && test x$with_default_trust_store_pkcs11 = x && test x$with_default_trust_store_dir = x && test x$have_macosx = x;then
-+  [if test "$build" = "$host" && test x$with_default_trust_store_pkcs11 = x && test x$with_default_trust_store_dir = x;then
-   for i in \
-     /etc/ssl/ca-bundle.pem \
-     /etc/ssl/certs/ca-certificates.crt \
-diff --git a/lib/Makefile.am b/lib/Makefile.am
-index fe9cf63a2..745695f7e 100644
---- a/lib/Makefile.am
-+++ b/lib/Makefile.am
-@@ -203,10 +203,6 @@ if WINDOWS
- thirdparty_libadd += -lcrypt32
- endif
- 
--if MACOSX
--libgnutls_la_LDFLAGS += -framework Security -framework CoreFoundation
--endif
--
- libgnutls_la_LIBADD += $(thirdparty_libadd)
- 
- # C++ library
-diff --git a/lib/system/certs.c b/lib/system/certs.c
-index 611c645e0..912b0aa5e 100644
---- a/lib/system/certs.c
-+++ b/lib/system/certs.c
-@@ -44,12 +44,6 @@
- # endif
- #endif
- 
--#ifdef __APPLE__
--# include <CoreFoundation/CoreFoundation.h>
--# include <Security/Security.h>
--# include <Availability.h>
--#endif
--
- /* System specific function wrappers for certificate stores.
-  */
- 
-@@ -276,72 +270,6 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
- 
- 	return r;
- }
--#elif defined(__APPLE__) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
--static
--int osstatus_error(status)
--{
--	CFStringRef err_str = SecCopyErrorMessageString(status, NULL);
--	_gnutls_debug_log("Error loading system root certificates: %s\n",
--			  CFStringGetCStringPtr(err_str, kCFStringEncodingUTF8));
--	CFRelease(err_str);
--	return GNUTLS_E_FILE_ERROR;
--}
--
--static
--int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
--		     unsigned int tl_vflags)
--{
--	int r=0;
--
--	SecTrustSettingsDomain domain[] = { kSecTrustSettingsDomainUser,
--					    kSecTrustSettingsDomainAdmin,
--					    kSecTrustSettingsDomainSystem };
--	for (size_t d=0; d<sizeof(domain)/sizeof(*domain); d++) {
--		CFArrayRef certs = NULL;
--		OSStatus status = SecTrustSettingsCopyCertificates(domain[d],
--								   &certs);
--		if (status == errSecNoTrustSettings)
--			continue;
--		if (status != errSecSuccess)
--			return osstatus_error(status);
--
--		int cert_count = CFArrayGetCount(certs);
--		for (int i=0; i<cert_count; i++) {
--			SecCertificateRef cert =
--				(void*)CFArrayGetValueAtIndex(certs, i);
--			CFDataRef der;
--			status = SecItemExport(cert, kSecFormatX509Cert, 0,
--					       NULL, &der);
--			if (status != errSecSuccess) {
--				CFRelease(der);
--				CFRelease(certs);
--				return osstatus_error(status);
--			}
--
--			if (gnutls_x509_trust_list_add_trust_mem(list,
--								 &(gnutls_datum_t) {
--									.data = (void*)CFDataGetBytePtr(der),
--									.size = CFDataGetLength(der),
--								 },
--								 NULL,
--			                                         GNUTLS_X509_FMT_DER,
--								 tl_flags,
--								 tl_vflags) > 0)
--				r++;
--			CFRelease(der);
--		}
--		CFRelease(certs);
--	}
--
--#ifdef DEFAULT_BLACKLIST_FILE
--	ret = gnutls_x509_trust_list_remove_trust_file(list, DEFAULT_BLACKLIST_FILE, GNUTLS_X509_FMT_PEM);
--	if (ret < 0) {
--		_gnutls_debug_log("Could not load blacklist file '%s'\n", DEFAULT_BLACKLIST_FILE);
--	}
--#endif
--
--	return r;
--}
- #else
- 
- #define add_system_trust(x,y,z) GNUTLS_E_UNIMPLEMENTED_FEATURE
diff --git a/pkgs/development/libraries/gtest/default.nix b/pkgs/development/libraries/gtest/default.nix
index 1dd68b077b206..80013e3613d01 100644
--- a/pkgs/development/libraries/gtest/default.nix
+++ b/pkgs/development/libraries/gtest/default.nix
@@ -27,7 +27,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
-  ] ++ lib.optionals (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0")) [
+  ] ++ lib.optionals (
+    (stdenv.cc.isGNU && (lib.versionOlder stdenv.cc.version "11.0"))
+    || (stdenv.cc.isClang && (lib.versionOlder stdenv.cc.version "16.0"))
+  ) [
     # Enable C++17 support
     # https://github.com/google/googletest/issues/3081
     "-DCMAKE_CXX_STANDARD=17"
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 7a9904f31dab4..e0501bd50cdc4 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -10,6 +10,8 @@
 , meson
 , ninja
 , gobject-introspection
+, buildPackages
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , icu
 , graphite2
 , harfbuzz # The icu variant uses and propagates the non-icu one.
@@ -32,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "6.0.0";
+  version = "7.0.0";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${version}/harfbuzz-${version}.tar.xz";
-    sha256 = "HRAQoXUdB21SkeQzwThQKnlNZ5p0mNEmjuIeLUoUDrQ=";
+    hash = "sha256-e0aFtwZsXGuNxs17AvY8VU+4zBxN3PxEvChO+jwgzyg=";
   };
 
   postPatch = ''
@@ -61,6 +63,7 @@ stdenv.mkDerivation rec {
     (lib.mesonEnable "coretext" withCoreText)
     (lib.mesonEnable "graphite" withGraphite2)
     (lib.mesonEnable "icu" withIcu)
+    (lib.mesonEnable "introspection" withIntrospection)
   ];
 
   depsBuildBuild = [
@@ -70,14 +73,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson
     ninja
-    gobject-introspection
     libintl
     pkg-config
     python3
+    glib
     gtk-doc
     docbook-xsl-nons
     docbook_xml_dtd_43
-  ];
+  ] ++ lib.optional withIntrospection gobject-introspection;
 
   buildInputs = [ glib freetype ]
     ++ lib.optionals withCoreText [ ApplicationServices CoreText ];
@@ -107,6 +110,6 @@ stdenv.mkDerivation rec {
     homepage = "https://harfbuzz.github.io/";
     maintainers = [ maintainers.eelco ];
     license = licenses.mit;
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/hidapi/default.nix b/pkgs/development/libraries/hidapi/default.nix
index e9bfe33e9f482..89cff8ef427c2 100644
--- a/pkgs/development/libraries/hidapi/default.nix
+++ b/pkgs/development/libraries/hidapi/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hidapi";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "hidapi";
     rev = "${finalAttrs.pname}-${finalAttrs.version}";
-    sha256 = "sha256-SMhlcB7LcViC6UFVYACjunxsGkvSOKC3mbLBH4XQSzM=";
+    sha256 = "sha256-CEZP5n8qEAzsqn8dz3u1nG0YoT7J1P+WfN7urkRTuVg=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/iso-codes/default.nix b/pkgs/development/libraries/iso-codes/default.nix
index c38c72ccd04c2..aca509b3b036b 100644
--- a/pkgs/development/libraries/iso-codes/default.nix
+++ b/pkgs/development/libraries/iso-codes/default.nix
@@ -9,15 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-QI95nfQTVGj6fKNetrBcQAS+pEPYHKWLibLkgkAagrs=";
   };
 
-  patchPhase = ''
-    for i in `find . -name \*.py`
-    do
-        sed -i -e "s|#!/usr/bin/env python|#!${python3}/bin/python|" $i
-    done
-  '';
-
   nativeBuildInputs = [ gettext python3 ];
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     homepage = "https://salsa.debian.org/iso-codes-team/iso-codes";
     description = "Various ISO codes packaged as XML files";
diff --git a/pkgs/development/libraries/libbsd/default.nix b/pkgs/development/libraries/libbsd/default.nix
index b8f6aac0b3884..0c8040010e722 100644
--- a/pkgs/development/libraries/libbsd/default.nix
+++ b/pkgs/development/libraries/libbsd/default.nix
@@ -1,12 +1,18 @@
-{ lib, stdenv, fetchurl, autoreconfHook, libmd }:
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, libmd
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "libbsd";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchurl {
     url = "https://libbsd.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-GbOPMXLq9pPm4caHFGNhkMfkiFHkUiTXILO1vASZtd8=";
+    hash = "sha256-m6oYYFnrvyXAYwjp+ZH9ox9xg8DySTGCbYOqar2KAmE=";
   };
 
   outputs = [ "out" "dev" "man" ];
@@ -18,6 +24,11 @@ stdenv.mkDerivation rec {
 
   patches = [ ./darwin.patch ];
 
+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "https://gitlab.freedesktop.org/libbsd/libbsd.git";
+  };
+
   meta = with lib; {
     description = "Common functions found on BSD systems";
     homepage = "https://libbsd.freedesktop.org/";
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 7cbcbe238ea16..c24209e4ab6c3 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , pkg-config
 
@@ -13,25 +12,16 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.10";
+  version = "1.0.11";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "sha256-d2TJKPvOAqLe+ZO1+Rd/yRIn3W1u1q62ZH20/9N2Shw=";
+    sha256 = "sha256-0aRUh5h49fnjBjy42A5fWYHnhnQ4CFoeSIXZilZewW8=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "revert-cmake-change-pkg-config.patch";
-      url = "https://github.com/strukturag/libde265/commit/388b61459c2abe2b949114ab54e83fb4dbfa8ba0.patch";
-      sha256 = "sha256-b6wwSvZpK7lIu0uD1SqK2zGBUjb/25+JW1Pf1fvHc0I=";
-      revert = true;
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libdeflate/default.nix b/pkgs/development/libraries/libdeflate/default.nix
index 39b80238b7191..acbed23326cc1 100644
--- a/pkgs/development/libraries/libdeflate/default.nix
+++ b/pkgs/development/libraries/libdeflate/default.nix
@@ -1,38 +1,28 @@
-{ stdenv, lib, fetchpatch, fetchFromGitHub, fixDarwinDylibNames, pkgsStatic }:
-
+{ lib
+, stdenv
+, fetchFromGitHub
+, fixDarwinDylibNames
+, pkgsStatic
+, cmake
+}:
 stdenv.mkDerivation rec {
   pname = "libdeflate";
-  version = "1.8";
+  version = "1.17";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${version}";
-    sha256 = "sha256-P7YbuhP2/zJCpE9dxZev1yy5oda8WKAHY84ZLTL8gVs=";
+    sha256 = "sha256-tKs8feGbeodOID8FPIUc/1LfBz1p0oN1Jfkv2OnA2qc=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/ebiggers/libdeflate/commit/ee4d18872bfe09a32cfd031c716b9069a04a50a0.diff";
-      sha256 = "0d2lllg60zbbbch0w0qrcqijrgski8xlsy5llg3i684d66ci538a";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace Makefile --replace /usr/local $out
-  '';
-
-  makeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "DISABLE_SHARED=1"];
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "-DLIBDEFLATE_BUILD_SHARED_LIB=OFF" ];
 
-  nativeBuildInputs = lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-
-  configurePhase = ''
-    make programs/config.h
-  '';
-
-  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
   passthru.tests.static = pkgsStatic.libdeflate;
+
   meta = with lib; {
     description = "Fast DEFLATE/zlib/gzip compressor and decompressor";
     license = licenses.mit;
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 83a426a2afa4f..b34282dd37b10 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -20,12 +20,13 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dinstall-test-programs=true"
-    "-Domap=enabled"
     "-Dcairo-tests=disabled"
-    "-Dvalgrind=${if withValgrind then "enabled" else "disabled"}"
+    (lib.mesonEnable "omap" stdenv.hostPlatform.isLinux)
+    (lib.mesonEnable "valgrind" withValgrind)
   ] ++ lib.optionals stdenv.hostPlatform.isAarch [
     "-Dtegra=enabled"
-    "-Detnaviv=enabled"
+  ] ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
+    "-Detnaviv=disabled"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libgudev/default.nix b/pkgs/development/libraries/libgudev/default.nix
index 799e1d0f84517..59df64e63558a 100644
--- a/pkgs/development/libraries/libgudev/default.nix
+++ b/pkgs/development/libraries/libgudev/default.nix
@@ -55,7 +55,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     udev
     glib
   ];
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 230cd3fc9196a..f85181d376a9d 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -59,7 +59,6 @@ stdenv.mkDerivation rec {
     glib
     libxml2
     icu
-    gobject-introspection
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libimagequant/Cargo.lock b/pkgs/development/libraries/libimagequant/Cargo.lock
new file mode 100644
index 0000000000000..6c1e8c61643a7
--- /dev/null
+++ b/pkgs/development/libraries/libimagequant/Cargo.lock
@@ -0,0 +1,322 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "ahash"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+dependencies = [
+ "getrandom",
+ "once_cell",
+ "version_check",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bytemuck"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c041d3eab048880cb0b86b256447da3f18859a163c3b8d8893f4e6368abe6393"
+
+[[package]]
+name = "c_test"
+version = "0.1.0"
+dependencies = [
+ "cc",
+ "imagequant-sys",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2dd04ddaf88237dc3b8d8f9a3c1004b506b54b3313403944054d23c0870c521"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "715e8152b692bba2d374b53d4875445368fdf21a94751410af607a5ac677d1fc"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a9af1f4c2ef74bb8aa1f7e19706bc72d03598c8a570bb5de72243c7a9d9d5a"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "either"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+
+[[package]]
+name = "fallible_collections"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f57ccc32870366ae684be48b32a1a2e196f98a42a9b4361fe77e13fd4a34755"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8a2db397cb1c8772f31494cb8917e48cd1e64f0fa7efac59fbd741a0a8ce841"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "imagequant"
+version = "4.1.0"
+dependencies = [
+ "arrayvec",
+ "lodepng",
+ "noisy_float",
+ "num_cpus",
+ "once_cell",
+ "rayon",
+ "rgb",
+ "thread_local",
+]
+
+[[package]]
+name = "imagequant-sys"
+version = "4.0.1"
+dependencies = [
+ "bitflags",
+ "imagequant",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
+
+[[package]]
+name = "lodepng"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0ad39f75bbaa4b10bb6f2316543632a8046a5bcf9c785488d79720b21f044f8"
+dependencies = [
+ "crc32fast",
+ "fallible_collections",
+ "flate2",
+ "libc",
+ "rgb",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "noisy_float"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978fe6e6ebc0bf53de533cd456ca2d9de13de13856eda1518a285d7705a213af"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+
+[[package]]
+name = "rayon"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db3a213adf02b3bcfd2d3846bb41cb22857d131789e01df434fb7e7bc0759b7"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "356a0625f1954f730c0201cdab48611198dc6ce21f4acff55089b5a78e6e835b"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
+
+[[package]]
+name = "rgb"
+version = "0.8.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3603b7d71ca82644f79b5a06d1220e9a58ede60bd32255f698cb1af8838b8db3"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "thread_local"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5516c27b78311c50bf42c071425c560ac799b11c30b31f87e3081965fe5e0180"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index 5f4d500758956..825c442eb6c91 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -1,21 +1,48 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, rust, rustPlatform, cargo-c, python3 }:
 
-stdenv.mkDerivation rec {
+let
+  rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
+in
+rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "2.17.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZoBCZsoUO66X4sDbMO89g4IX5+jqGMLGR7aC2UwD2tE=";
+    hash = "sha256-W9Q81AbFhWUe6c3csAnm8L5wLqURizrjwqcurWhPISI=";
   };
 
-  preConfigure = ''
-    patchShebangs ./configure
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';
+
+  cargoHash = "sha256-0HOmItooNsGq6iTIb9M5IPXMwYh2nQ03qfjomkg0d00=";
+
+  auditable = true; # TODO: remove when this is the default
+
+  nativeBuildInputs = [ cargo-c ];
+
+  postBuild = ''
+    pushd imagequant-sys
+    cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    popd
   '';
 
-  configureFlags = lib.optionals (!stdenv.hostPlatform.isx86) [ "--disable-sse" ];
+  postInstall = ''
+    pushd imagequant-sys
+    cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
+    popd
+  '';
+
+  passthru.tests = {
+    inherit (python3.pkgs) pillow;
+  };
 
   meta = with lib; {
     homepage = "https://pngquant.org/lib/";
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 83034b8dd6202..268ddd3708104 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -45,7 +45,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.21.0";
+  version = "1.22.1";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     owner = "libinput";
     repo = "libinput";
     rev = version;
-    sha256 = "R94BdrjI4szNbVtQ+ydRNUg9clR8mkRL7+GE9b2FcDs=";
+    sha256 = "RgwEp60Anr+CpJws6srIv/Qzk2r9NoekeNQ0UT3FRZ0=";
   };
 
   patches = [
@@ -113,8 +113,8 @@ stdenv.mkDerivation rec {
       test/check-leftover-udev-rules.sh \
       test/helper-copy-and-exec-from-tmp.sh
 
-    # Don't create an empty /etc directory.
-    sed -i "/install_subdir('libinput', install_dir : dir_etc)/d" meson.build
+    # Don't create an empty directory under /etc.
+    sed -i "/install_emptydir(dir_etc \/ 'libinput')/d" meson.build
   '';
 
   passthru = {
diff --git a/pkgs/development/libraries/libisds/default.nix b/pkgs/development/libraries/libisds/default.nix
index 9d2732c44096f..4c61e3c48868d 100644
--- a/pkgs/development/libraries/libisds/default.nix
+++ b/pkgs/development/libraries/libisds/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ expat gpgme libgcrypt libxml2 libxslt curl docbook_xsl ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
+
   meta = with lib; {
     description = "Client library for accessing SOAP services of Czech government-provided Databox infomation system";
     homepage = "http://xpisar.wz.cz/libisds/";
diff --git a/pkgs/development/libraries/libmanette/default.nix b/pkgs/development/libraries/libmanette/default.nix
index 2320aa78bba7f..7629dd8a6f1ae 100644
--- a/pkgs/development/libraries/libmanette/default.nix
+++ b/pkgs/development/libraries/libmanette/default.nix
@@ -40,7 +40,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     glib
     libgudev
     libevdev
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index eb32fca71641c..f9f15b683946a 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -1,46 +1,63 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, meson
+, ninja
 , pkg-config
 , glib
 , python3
+, help2man
 , systemd
+, bash-completion
 , withIntrospection ? stdenv.hostPlatform == stdenv.buildPlatform
 , gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.26.4";
+  version = "1.28.2";
 
   outputs = [ "out" "dev" "man" ];
 
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libmbim/${pname}-${version}.tar.xz";
-    sha256 = "sha256-9ojOxMRYahdXX14ydEjOYvIADvagfJ5FiYc9SmhWitk=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mobile-broadband";
+    repo = "libmbim";
+    rev = version;
+    hash = "sha256-EtjUaSNBT1e/eeTX4oHzQolGrisbsGKBK8Cfl3rRQTQ=";
   };
 
-  configureFlags = [
-    "--with-udev-base-dir=${placeholder "out"}/lib/udev"
-    (lib.enableFeature withIntrospection "introspection")
+  mesonFlags = [
+    "-Dudevdir=${placeholder "out"}/lib/udev"
+    (lib.mesonBool "introspection" withIntrospection)
   ];
 
   nativeBuildInputs = [
+    meson
+    ninja
     pkg-config
     python3
+    help2man
     gobject-introspection
   ];
 
   buildInputs = [
     glib
     systemd
+    bash-completion
   ];
 
   doCheck = true;
 
+  postPatch = ''
+    patchShebangs \
+      build-aux/mbim-codegen/mbim-codegen
+  '';
+
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/libmbim/";
     description = "Library for talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
+    maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
   };
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index f1034781fb441..e047b34fa85a4 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -44,10 +44,6 @@ stdenv.mkDerivation rec {
     gobject-introspection
   ];
 
-  buildInputs = lib.optionals withIntrospection [
-    gobject-introspection
-  ];
-
   propagatedBuildInputs = [
     gdk-pixbuf
     glib
diff --git a/pkgs/development/libraries/libptytty/default.nix b/pkgs/development/libraries/libptytty/default.nix
index 63f50de287c6e..3ed0cf6a39d0c 100644
--- a/pkgs/development/libraries/libptytty/default.nix
+++ b/pkgs/development/libraries/libptytty/default.nix
@@ -4,6 +4,12 @@
 , cmake
 }:
 
+let
+  isCross = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  isStatic = stdenv.hostPlatform.isStatic;
+  isMusl = stdenv.hostPlatform.isMusl;
+in
+
 stdenv.mkDerivation rec {
   pname = "libptytty";
   version = "2.0";
@@ -15,12 +21,24 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = lib.optional isStatic "-DBUILD_SHARED_LIBS=OFF"
+    ++ lib.optional (isCross || isStatic) "-DTTY_GID_SUPPORT=OFF"
+    # Musl lacks UTMP/WTMP built-in support
+    ++ lib.optionals isMusl [
+      "-DUTMP_SUPPORT=OFF"
+      "-DWTMP_SUPPORT=OFF"
+      "-DLASTLOG_SUPPORT=OFF"
+    ];
+
   meta = with lib; {
     description = "OS independent and secure pty/tty and utmp/wtmp/lastlog";
     homepage = "http://dist.schmorp.de/libptytty";
     maintainers = with maintainers; [ rnhmjoj ];
     platforms = platforms.unix;
     license = licenses.gpl2;
+    # pkgsMusl.pkgsStatic errors as:
+    #   ln: failed to create symbolic link './include': File exists
+    broken = isStatic && isMusl;
   };
 
 }
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index b261967f5cf26..05a44980f83cc 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -1,40 +1,61 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, fetchpatch2
+, meson
+, ninja
 , pkg-config
 , gobject-introspection
 , gtk-doc
 , docbook-xsl-nons
 , docbook_xml_dtd_43
+, help2man
 , glib
 , python3
 , libgudev
+, bash-completion
 , libmbim
 , libqrtr-glib
 }:
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.30.8";
+  version = "1.32.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "sha256-hiSCzp460L1l0mQzTuMRzblLnfKGO1txNjCbQbisGZA=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mobile-broadband";
+    repo = "libqmi";
+    rev = version;
+    hash = "sha256-XIbeWgkPiJL8hN8Rb6KFt5Q5sG3KsiEQr0EnhwmI6h8=";
   };
 
+  patches = [
+    # Fix pkg-config file missing qrtr in Requires.
+    # https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/99
+    (fetchpatch2 {
+      url = "https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/commit/7d08150910974c6bd2c29f887c2c6d4a3526e085.patch";
+      hash = "sha256-LFrlm2ZqLqewLGO2FxL5kFYbZ7HaxdxvVHsFHYSgZ4Y=";
+    })
+  ];
+
   nativeBuildInputs = [
+    meson
+    ninja
     pkg-config
     gobject-introspection
     python3
     gtk-doc
     docbook-xsl-nons
     docbook_xml_dtd_43
+    help2man
   ];
 
   buildInputs = [
     libgudev
+    bash-completion
     libmbim
   ];
 
@@ -43,16 +64,19 @@ stdenv.mkDerivation rec {
     libqrtr-glib
   ];
 
-  configureFlags = [
-    "--with-udev-base-dir=${placeholder "out"}/lib/udev"
-    "--enable-gtk-doc=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "yes" else "no"}"
-    "--enable-introspection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "yes" else "no"}"
+  mesonFlags = [
+    "-Dudevdir=${placeholder "out"}/lib/udev"
+    (lib.mesonBool "gtk_doc" (stdenv.buildPlatform == stdenv.hostPlatform))
+    (lib.mesonBool "introspection" (stdenv.buildPlatform == stdenv.hostPlatform))
   ];
 
-  enableParallelBuilding = true;
-
   doCheck = true;
 
+  postPatch = ''
+    patchShebangs \
+      build-aux/qmi-codegen/qmi-codegen
+  '';
+
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/libqmi/";
     description = "Modem protocol helper library";
diff --git a/pkgs/development/libraries/libqrtr-glib/default.nix b/pkgs/development/libraries/libqrtr-glib/default.nix
index 6e01cda916256..9309c48a8c6a7 100644
--- a/pkgs/development/libraries/libqrtr-glib/default.nix
+++ b/pkgs/development/libraries/libqrtr-glib/default.nix
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     glib
   ];
 
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index a60da602e0709..a78bf86a18c3e 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -71,8 +71,6 @@ stdenv.mkDerivation rec {
     bzip2
     pango
     libintl
-  ] ++ lib.optionals withIntrospection [
-    gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices
     Foundation
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index fd2cadf1602db..4a2ad99af4d9c 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -52,7 +52,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libgcrypt
-    gobject-introspection
   ];
 
   propagatedBuildInputs = [
@@ -88,7 +87,7 @@ stdenv.mkDerivation rec {
 
     dbus-run-session \
       --config-file=${dbus}/share/dbus-1/session.conf \
-      meson test --print-errorlogs
+      meson test --print-errorlogs --timeout-multiplier 0
 
     runHook postCheck
   '';
diff --git a/pkgs/development/libraries/libvirt-glib/default.nix b/pkgs/development/libraries/libvirt-glib/default.nix
index 566a1c1b83fa7..cff3b32cb7b2e 100644
--- a/pkgs/development/libraries/libvirt-glib/default.nix
+++ b/pkgs/development/libraries/libvirt-glib/default.nix
@@ -55,8 +55,6 @@ stdenv.mkDerivation rec {
     libxml2
   ] ++ lib.optionals stdenv.isLinux [
     libcap_ng
-  ] ++ lib.optionals withIntrospection [
-    gobject-introspection
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libvisual/default.nix b/pkgs/development/libraries/libvisual/default.nix
index b58c25401c908..046035a290cb1 100644
--- a/pkgs/development/libraries/libvisual/default.nix
+++ b/pkgs/development/libraries/libvisual/default.nix
@@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , SDL
+, autoreconfHook
 , glib
 , pkg-config
-  # sdl-config is not available when crossing
-, withExamples ? stdenv.buildPlatform == stdenv.hostPlatform
 }:
 
 stdenv.mkDerivation rec {
@@ -17,10 +17,35 @@ stdenv.mkDerivation rec {
     hash = "sha256-qhKHdBf3bTZC2fTHIzAjgNgzF1Y51jpVZB0Bkopd230=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = lib.optional withExamples SDL ++ [ glib ];
+  patches = [
+    # pull upstream fix for SDL1 cross-compilation.
+    #   https://github.com/Libvisual/libvisual/pull/238
+    (fetchpatch {
+      name = "sdl-cross-prereq.patch";
+      url = "https://github.com/Libvisual/libvisual/commit/7902d24aa1a552619a5738339b3823e90dd3b865.patch";
+      hash = "sha256-84u8klHDAw/q4d+9L4ROAr7XsbXItHrhaEKkTEMSPcc=";
+      # remove extra libvisual prefix
+      stripLen = 1;
+      # pull in only useful configure.ac changes.
+      excludes = [ "Makefile.am" ];
+    })
+    (fetchpatch {
+      name = "sdl-cross-pc.patch";
+      url = "https://github.com/Libvisual/libvisual/commit/f79a2e8d21ad1d7fe26e2aa83cea4c9f48f9e392.patch";
+      hash = "sha256-8c7SdLxXC8K9BAwj7DzozsZAcbs5l1xuBqky9LJ1MfM=";
+      # remove extra libvisual prefix
+      stripLen = 1;
+    })
+  ];
 
-  configureFlags = lib.optional (!withExamples) "--disable-examples";
+  strictDeps = true;
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ SDL glib ];
+
+  configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # Remove once "sdl-cross-prereq.patch" patch above is removed.
+    "--disable-lv-tool"
+  ];
 
   meta = {
     description = "An abstraction library for audio visualisations";
diff --git a/pkgs/development/libraries/libvmaf/default.nix b/pkgs/development/libraries/libvmaf/default.nix
index e7add08871a6c..c0fc4d1556f3c 100644
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, nasm }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm }:
 
 stdenv.mkDerivation rec {
   pname = "libvmaf";
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/libvmaf";
 
+  patches = [
+    # Backport fix for non-Linux, non-Darwin platforms.
+    (fetchpatch {
+      url = "https://github.com/Netflix/vmaf/commit/f47640f9ffee9494571bd7c9622e353660c93fc4.patch";
+      stripLen = 1;
+      sha256 = "rsTKuqp8VJG5DBDpixPke3LrdfjKzUO945i+iL0n7CY=";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja nasm ];
 
   mesonFlags = [ "-Denable_avx512=true" ];
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 24092d3286958..dbc5008a1a491 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.4.0";
+  version = "2.6.0";
 
   outputs = [ "out" "dev" ];
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "sha256-9uhnO+MqB7tAnSXjBcJWCzHGiz9izun4nVjFb17G8Gg=";
+    sha256 = "sha256-9zqW6zPrFcxv/yAAtFgdVavKVMXeDBoMP3E/XriUcT0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 6e8936f7ce63d..23123940057dc 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -11,7 +11,10 @@
 , ncurses
 , findXMLCatalogs
 , libiconv
-, pythonSupport ? enableShared
+# Python limits cross-compilation to an allowlist of host OSes.
+# https://github.com/python/cpython/blob/dfad678d7024ab86d265d84ed45999e031a03691/configure.ac#L534-L562
+, pythonSupport ? enableShared &&
+    (stdenv.hostPlatform == stdenv.buildPlatform || stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isWasi)
 , icuSupport ? false
 , icu
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 52633a6d21649..25b2357759747 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -88,7 +88,7 @@
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.3.4";
+  version = "22.3.5";
   branch  = lib.versions.major version;
 
   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
@@ -120,7 +120,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "37a1ddaf03f41919ee3c89c97cff41e87de96e00e9d3247959cc8279d8294593";
+    sha256 = "3eed2ecae2bc674494566faab9fcc9beb21cd804c7ba2b59a1694f3d7236e6a9";
   };
 
   # TODO:
diff --git a/pkgs/development/libraries/neon/darwin-fix-configure.patch b/pkgs/development/libraries/neon/darwin-fix-configure.patch
index 87222a9c0ce09..b8bbd288f7a2b 100644
--- a/pkgs/development/libraries/neon/darwin-fix-configure.patch
+++ b/pkgs/development/libraries/neon/darwin-fix-configure.patch
@@ -2,9 +2,9 @@ diff -Nuar neon-0.29.6/configure neon-0.29.6-darwin-fix-configure/configure
 --- neon-0.29.6/configure	2011-05-03 14:25:31.000000000 +0200
 +++ neon-0.29.6-darwin-fix-configure/configure	2012-06-06 23:32:21.000000000 +0200
 @@ -4184,7 +4184,7 @@
- $as_echo "$ne_cv_os_uname" >&6; }
+ case x"$ne_cv_os_uname" in #(
+   x"Darwin") :
  
- if test "$ne_cv_os_uname" = "Darwin"; then
 -  CPPFLAGS="$CPPFLAGS -no-cpp-precomp"
 +  CPPFLAGS="$CPPFLAGS"
    LDFLAGS="$LDFLAGS -flat_namespace"
diff --git a/pkgs/development/libraries/neon/default.nix b/pkgs/development/libraries/neon/default.nix
index 827d7eb69799f..f26dbf5ace45d 100644
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@@ -15,12 +15,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "0.32.3";
+  version = "0.32.5";
   pname = "neon";
 
   src = fetchurl {
     url = "https://notroj.github.io/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-lMuHXcbb/N7ljwObdjxnSwIyiGzf16Xekb5c36K3WWo=";
+    sha256 = "sha256-SHLhL4Alct7dSwL4cAZYFLLVFB99va9wju2rgmtRpYo=";
   };
 
   patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index c3f04cf6b15b2..d9103f75399af 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.3";
-  hash = "sha256-8fhrlMe832xWYTYVMnZE7MV20W8sMX+5hHDcAcWYSA4=";
+  version = "3.79.4";
+  hash = "sha256-Skcdv6Wzo7fsB4U8b8CijNBmn2mEEp4k9VQeLOFdcdU=";
 }
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index e1b6abc5b253a..63a908140f045 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -96,6 +96,7 @@ stdenv.mkDerivation rec {
         -Dhost_arch=${host} \
         -Duse_system_zlib=1 \
         --enable-libpkix \
+        -j $NIX_BUILD_CORES \
         ${lib.optionalString enableFIPS "--enable-fips"} \
         ${lib.optionalString stdenv.isDarwin "--clang"} \
         ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
diff --git a/pkgs/development/libraries/openjpeg/default.nix b/pkgs/development/libraries/openjpeg/default.nix
index ad4206eedfbb4..5c6d6b8a13467 100644
--- a/pkgs/development/libraries/openjpeg/default.nix
+++ b/pkgs/development/libraries/openjpeg/default.nix
@@ -55,10 +55,10 @@ stdenv.mkDerivation rec {
     ++ lib.optional (jpipLibSupport) jdk;
 
   doCheck = (!stdenv.isAarch64 && !stdenv.hostPlatform.isPower64); # tests fail on aarch64-linux and powerpc64
-
+  nativeCheckInputs = [ jpylyzer ];
   checkPhase = ''
     substituteInPlace ../tools/ctest_scripts/travis-ci.cmake \
-      --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"${jpylyzer}/bin/jpylyzer\" # "
+      --replace "JPYLYZER_EXECUTABLE=" "JPYLYZER_EXECUTABLE=\"$(command -v jpylyzer)\" # "
     OPJ_SOURCE_DIR=.. ctest -S ../tools/ctest_scripts/travis-ci.cmake
   '';
 
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 662437659147c..50e2d5736ff0e 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -16,15 +16,16 @@
 , ninja
 , glib
 , python3
-, gobject-introspection
 , x11Support? !stdenv.isDarwin, libXft
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, buildPackages, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
   pname = "pango";
   version = "1.50.12";
 
-  outputs = [ "bin" "out" "dev" "devdoc" ];
+  outputs = [ "bin" "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
@@ -39,9 +40,10 @@ stdenv.mkDerivation rec {
     meson ninja
     glib # for glib-mkenum
     pkg-config
-    gobject-introspection
-    gi-docgen
     python3
+  ] ++ lib.optionals withIntrospection [
+    gi-docgen
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -64,9 +66,9 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
-  ] ++ lib.optionals (!x11Support) [
-    "-Dxft=disabled" # only works with x11
+    (lib.mesonBool "gtk_doc" withIntrospection)
+    (lib.mesonEnable "introspection" withIntrospection)
+    (lib.mesonEnable "xft" x11Support)
   ];
 
   # Fontconfig error: Cannot load default config file
@@ -116,6 +118,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl2Plus;
 
     maintainers = with maintainers; [ raskin ] ++ teams.gnome.members;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 53d465542b2bd..29db9019b11c9 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -61,6 +61,8 @@
 , x11Support ? true
 , libcanberra
 , xorg
+, mysofaSupport ? true
+, libmysofa
 }:
 
 let
@@ -68,7 +70,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.65";
+    version = "0.3.66";
 
     outputs = [
       "out"
@@ -86,7 +88,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-O5nu58QFlOPTaN4qNi50Wp9acxM6dWNy63BD+AnVl5w=";
+      sha256 = "sha256-qx4mgNRhMdha+8ap+FhVfxpsHE9TcTx29uwQIHLyMHA=";
     };
 
     patches = [
@@ -102,20 +104,6 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
-
-      # backport a fix to actually install the new module
-      # FIXME: remove after 0.3.66
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/fba7083f8ceb210c7c20aceafeb5c9a8767cf705.patch";
-        hash = "sha256-aZQ4OzK0B5YPq+jQNygxPE0coG2qB0ukbYzyI8E24XM=";
-      })
-
-      # backport a fix for rust-cbindgen errors in downstream packages
-      # See https://github.com/NixOS/nixpkgs/pull/211872#issuecomment-1415981135 for details.
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/caf58ecffb4dc8e2bfa7898d0ed910cf0a82d65f.patch";
-        hash = "sha256-kCQNG0j3lwT01WNfGsdUmKvDHg8tvMfS2eunPyXBV1E=";
-      })
     ];
 
     strictDeps = true;
@@ -153,7 +141,8 @@ let
     ++ lib.optional zeroconfSupport avahi
     ++ lib.optional raopSupport openssl
     ++ lib.optional rocSupport roc-toolkit
-    ++ lib.optionals x11Support [ libcanberra xorg.libX11 xorg.libXfixes ];
+    ++ lib.optionals x11Support [ libcanberra xorg.libX11 xorg.libXfixes ]
+    ++ lib.optional mysofaSupport libmysofa;
 
     # Valgrind binary is required for running one optional test.
     nativeCheckInputs = lib.optional withValgrind valgrind;
@@ -188,7 +177,9 @@ let
       "-Dsession-managers="
       "-Dvulkan=enabled"
       "-Dx11=${mesonEnableFeature x11Support}"
+      "-Dlibmysofa=${mesonEnableFeature mysofaSupport}"
       "-Dsdl2=disabled" # required only to build examples, causes dependency loop
+      "-Drlimits-install=false" # installs to /etc, we won't use this anyway
     ];
 
     # Fontconfig error: Cannot load default config file
@@ -239,6 +230,7 @@ let
             "nix-support/jack.conf.json"
             "nix-support/minimal.conf.json"
             "nix-support/pipewire.conf.json"
+            "nix-support/pipewire-aes67.conf.json"
             "nix-support/pipewire-pulse.conf.json"
           ];
           paths-lib = [
diff --git a/pkgs/development/libraries/pmdk/default.nix b/pkgs/development/libraries/pmdk/default.nix
deleted file mode 100644
index 1f02bfa0dab30..0000000000000
--- a/pkgs/development/libraries/pmdk/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, stdenv, fetchFromGitHub
-, autoconf, libndctl, pkg-config, gnum4, pandoc
-}:
-
-stdenv.mkDerivation rec {
-  pname = "pmdk";
-  version = "1.11.1";
-
-  src = fetchFromGitHub {
-    owner  = "pmem";
-    repo   = "pmdk";
-    rev    = "refs/tags/${version}";
-    hash = "sha256-8bnyLtgkKfgIjJkfY/ZS1I9aCYcrz0nrdY7m/TUVWAk=";
-  };
-
-  nativeBuildInputs = [ autoconf pkg-config gnum4 pandoc ];
-  buildInputs = [ libndctl ];
-  enableParallelBuilding = true;
-
-  outputs = [ "out" "lib" "dev" "man" ];
-
-  patchPhase = "patchShebangs utils";
-
-  NIX_CFLAGS_COMPILE = "-Wno-error";
-
-  installPhase = ''
-    make install prefix=$out
-
-    mkdir -p $lib $dev $man/share
-    mv $out/share/man $man/share/man
-    mv $out/include $dev/include
-    mv $out/lib     $lib/lib
-  '';
-
-  meta = with lib; {
-    description = "Persistent Memory Development Kit";
-    homepage    = "https://github.com/pmem/pmdk";
-    license     = licenses.lgpl21;
-    maintainers = with maintainers; [ thoughtpolice ];
-    platforms   = [ "x86_64-linux" ]; # aarch64 is experimental
-  };
-}
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 5c67eb1b65db4..ec05f890f7794 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -90,7 +90,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     expat
     pam
     dbus
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index 22ff1e450c192..d0e9935032ed6 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , alsa-lib
+, libjack2
 , pkg-config
 , which
 , AudioUnit
@@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
   nativeBuildInputs = [ pkg-config which ];
-  buildInputs = lib.optional (!stdenv.isDarwin) alsa-lib;
+  buildInputs = [ libjack2 ] ++ lib.optionals (!stdenv.isDarwin) [ alsa-lib ];
 
   configureFlags = [ "--disable-mac-universal" "--enable-cxx" ];
 
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 7d876d884b374..31de73b25edcf 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -211,7 +211,7 @@ let
 
       qmake = makeSetupHook {
         name = "qmake-hook";
-        deps = [ self.qtbase.dev ];
+        propagatedBuildInputs = [ self.qtbase.dev ];
         substitutions = {
           inherit debug;
           fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
@@ -220,7 +220,7 @@ let
 
       wrapQtAppsHook = makeSetupHook {
         name = "wrap-qt5-apps-hook";
-        deps = [ self.qtbase.dev buildPackages.makeWrapper ]
+        propagatedBuildInputs = [ self.qtbase.dev buildPackages.makeWrapper ]
           ++ lib.optional stdenv.isLinux self.qtwayland.dev;
       } ../hooks/wrap-qt-apps-hook.sh;
     };
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index c085cdaca52ea..2127be5e0a2a0 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -34,7 +34,7 @@ qtHostPathHook() {
         qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
     fi
 }
-addEnvHooks "$hostOffset" qtHostPathHook
+addEnvHooks "$targetOffset" qtHostPathHook
 
 makeQtWrapper() {
     local original="$1"
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index b09521e34e3cc..2577806b5c436 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -141,12 +141,12 @@ let
 
       wrapQtAppsHook = makeSetupHook {
         name = "wrap-qt6-apps-hook";
-          deps = [ buildPackages.makeWrapper ];
+        propagatedBuildInputs = [ buildPackages.makeWrapper ];
         } ./hooks/wrap-qt-apps-hook.sh;
 
       qmake = makeSetupHook {
         name = "qmake6-hook";
-        deps = [ self.qtbase.dev ];
+        propagatedBuildInputs = [ self.qtbase.dev ];
         substitutions = {
           inherit debug;
           fix_qmake_libtool = ./hooks/fix-qmake-libtool.sh;
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index dafc91e6dcfa6..8b6d945d25529 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re2";
-  version = "2022-12-01";
+  version = "2023-02-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = version;
-    hash = "sha256-RmPXfavSKVnnl/RJ5aTjc/GbkPz+EXiFg1n5e4s6wjw=";
+    hash = "sha256-YENgO5Ig6SLNdGEsdhKNb4THhocyAv1MMcg4FVYBB7U=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 78dc373d4ab6e..706d3449286e2 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-eWI1MyIWxcg1JepRsnHBmitehDigDa+dR8kXvIkYejY=";
+    hash = "sha256-bjiWGSmpEbydXtCLP8fRZfPBvdCzBoJxKXTx3BroQbg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index 6b7f58bcd6daa..a6d2a9ea00cd6 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -48,7 +48,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     glib
     systemd
     libgudev
diff --git a/pkgs/development/libraries/vk-bootstrap/default.nix b/pkgs/development/libraries/vk-bootstrap/default.nix
index ef76d6db9dbc7..bc43da3567d8d 100644
--- a/pkgs/development/libraries/vk-bootstrap/default.nix
+++ b/pkgs/development/libraries/vk-bootstrap/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vk-bootstrap";
-  version = "0.6";
+  version = "0.7";
   outputs = [ "out" "dev" ];
 
   src = fetchFromGitHub {
     owner = "charles-lunarg";
     repo = "vk-bootstrap";
     rev = "v${version}";
-    sha256 = "sha256-T24SCJSGta4yuK58NcQnMeiO3sg9P9/O3kaFJFO/eOE=";
+    hash = "sha256-X3ANqfplrCF1R494+H5/plcwMH7rbW6zpLA4MZrYaoE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index 8f1202088e58e..e34cf98d5106e 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-b1q9QugFH4lieS8CTOyZ3uoQ7bd44G8NPEwRtUPD+24=";
+    hash = "sha256-mzxT6s4ZHShB9tGyyf8jDtVWVEclHPYW+9oKy7v0bC4=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 8d38f725a64d6..b45bf4c66be85 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,14 +3,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Loader";
       rev = "sdk-${version}";
-      hash = "sha256-Y6OakowZlb40ZatITQCFBK/qSZqSdgTNew1XUFD/jMo=";
+      hash = "sha256-4oxynsbFLmsrpI5NEs7gI50g0XVcaUWuZRn6JKB/+hA=";
     });
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch b/pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch
index b5c3bf4428ab4..42295a67d4667 100644
--- a/pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch
+++ b/pkgs/development/libraries/vulkan-loader/fix-pkgconfig.patch
@@ -5,10 +5,10 @@ index 153815577..584b15273 100644
 @@ -1,7 +1,5 @@
 -prefix=@CMAKE_INSTALL_PREFIX@
 -exec_prefix=${prefix}
--libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
--includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+-libdir=${exec_prefix}/@CMAKE_INSTALL_REL_LIBDIR_PC@
+-includedir=${prefix}/@CMAKE_INSTALL_REL_INCLUDEDIR_PC@
 +libdir=@CMAKE_INSTALL_LIBDIR@
 +includedir=@CMAKE_INSTALL_INCLUDEDIR@
- 
+
  Name: @CMAKE_PROJECT_NAME@
  Description: Vulkan Loader
diff --git a/pkgs/development/perl-modules/strip-nondeterminism/default.nix b/pkgs/development/perl-modules/strip-nondeterminism/default.nix
index d33362d4a1708..806ad65b737b9 100644
--- a/pkgs/development/perl-modules/strip-nondeterminism/default.nix
+++ b/pkgs/development/perl-modules/strip-nondeterminism/default.nix
@@ -11,7 +11,7 @@
 
 buildPerlPackage rec {
   pname = "strip-nondeterminism";
-  version = "1.13.0";
+  version = "1.13.1";
 
   outputs = [ "out" "dev" ]; # no "devdoc"
 
@@ -20,7 +20,7 @@ buildPerlPackage rec {
     repo = "strip-nondeterminism";
     domain = "salsa.debian.org";
     rev = version;
-    sha256 = "sha256-KZQeoJYBPJzUvz4wlUZbiGODbpCp7/52dsg5OemKDkI=";
+    sha256 = "czx9UhdgTsQSfDNo1mMOXCM/3/nuNe+cPZeyy2xdnKs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 2b912f9622e41..86cc7e308e9c0 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pythonOlder
 # install_requires
 , attrs
@@ -39,6 +40,14 @@ buildPythonPackage rec {
     sha256 = "3828fb41b7203176b82fe5d699e0d845435f2374750a44b480ea6b930f6be269";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/aio-libs/aiohttp/pull/7178
+      url = "https://github.com/aio-libs/aiohttp/commit/5718879cdb6a98bf48810a994b78bc02abaf3e07.patch";
+      hash = "sha256-4UynkTZOzWzusQ2+MPZszhFA8I/PJNLeT/hHF/fASy8=";
+    })
+  ];
+
   postPatch = ''
     sed -i '/--cov/d' setup.cfg
 
diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index 72d9a9707323d..923ee6bd8198e 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -35,6 +35,8 @@ buildPythonPackage rec {
     "test_multiprocessing"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "asgiref" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index b8cf310a06ee9..ba2407923f33a 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -28,20 +28,20 @@ let
 in
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "38.0.4"; # Also update the hash in vectors.nix
+  version = "39.0.1"; # Also update the hash in vectors.nix
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-F1wagYuHyayAu3N39VILfzGz7yoABOJCAxm+re22cpA=";
+    hash = "sha256-0fYZjubZFIQF5JiHgDkH/olioj5sb4PqfZjxwN43VpU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-BN0kOblUwgHj5QBf52RY2Jx0nBn03lwoN1O5PEohbwY=";
+    hash = "sha256-0x+KIqJznDEyIUqVuYfIESKmHBWfzirPeX2R/cWlngc=";
   };
 
   cargoRoot = "src/rust";
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 31ace7c48ffdf..b054f89aa3a6d 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -9,7 +9,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-bsYmlb7F34ECiN3OrpmK5pHNuKFigI1svJYNPeuafbE=";
+    hash = "sha256-DLrrUL2388nXqTsmoEYu9ul8doynjZAoVP4EXDC2gMY=";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index f54562742b15a..de1424bb0ec40 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "3.2.17";
+  version = "3.2.18";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Django";
     inherit version;
-    hash = "sha256-ZEKINB8G6+STjuxoAba9WaZTSnjkrt3ioVMHXREUOJQ=";
+    hash = "sha256-CCCN/okutk//BzynQ7O5UjERBPk55/ba6VT+ctzFM7o=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/dnspython/default.nix b/pkgs/development/python-modules/dnspython/default.nix
index fa77bc0d0cde0..30a220fd6da84 100644
--- a/pkgs/development/python-modules/dnspython/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
@@ -1,27 +1,71 @@
 { lib
 , stdenv
+, aioquic
 , buildPythonPackage
+, cacert
+, cryptography
+, curio
 , fetchPypi
+, h2
+, httpx
+, idna
+, pytestCheckHook
 , pythonOlder
+, requests
+, requests-toolbelt
 , setuptools-scm
-, pytestCheckHook
-, cacert
+, sniffio
+, trio
 }:
 
 buildPythonPackage rec {
   pname = "dnspython";
-  version = "2.2.1";
-  disabled = pythonOlder "3.6";
+  version = "2.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    extension = "tar.gz";
-    sha256 = "0gk00m8zxjghxnzafhars51k5ahd6wfhf123nrc1j5gzlsj6jx8g";
+    hash = "sha256-Ik4ysD60a+cOEu9tZOC+Ejpk5iGrTAgi/21FDVKlQLk=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  passthru.optional-dependencies = {
+    DOH = [
+      httpx
+      h2
+      requests
+      requests-toolbelt
+    ];
+    IDNA = [
+      idna
+    ];
+    DNSSEC = [
+      cryptography
+    ];
+    trio = [
+      trio
+    ];
+    curio = [
+      curio
+      sniffio
+    ];
+    DOQ = [
+      aioquic
+    ];
   };
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ lib.optionals stdenv.isDarwin [
+  ];
+
+  checkInputs = [
+  ] ++ passthru.optional-dependencies.DNSSEC
+  ++ lib.optionals stdenv.isDarwin [
     cacert
   ];
 
@@ -30,9 +74,8 @@ buildPythonPackage rec {
     "test_misc_good_WKS_text"
     # fails if IPv6 isn't available
     "test_resolver_override"
-
-  # Tests that run inconsistently on darwin systems
   ] ++ lib.optionals stdenv.isDarwin [
+    # Tests that run inconsistently on darwin systems
     # 9 tests fail with: BlockingIOError: [Errno 35] Resource temporarily unavailable
     "testQueryUDP"
     # 6 tests fail with: dns.resolver.LifetimeTimeout: The resolution lifetime expired after ...
@@ -40,15 +83,14 @@ buildPythonPackage rec {
     "testResolveTCP"
   ];
 
-  nativeBuildInputs = [
-    setuptools-scm
+  pythonImportsCheck = [
+    "dns"
   ];
 
-  pythonImportsCheck = [ "dns" ];
-
   meta = with lib; {
     description = "A DNS toolkit for Python";
     homepage = "https://www.dnspython.org";
+    changelog = "https://github.com/rthalley/dnspython/blob/v${version}/doc/whatsnew.rst";
     license = with licenses; [ isc ];
     maintainers = with maintainers; [ gador ];
   };
diff --git a/pkgs/development/python-modules/ephemeral-port-reserve/default.nix b/pkgs/development/python-modules/ephemeral-port-reserve/default.nix
index dc3148f362302..76d14e191cac2 100644
--- a/pkgs/development/python-modules/ephemeral-port-reserve/default.nix
+++ b/pkgs/development/python-modules/ephemeral-port-reserve/default.nix
@@ -29,6 +29,8 @@ buildPythonPackage {
     "test_fqdn"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [
     "ephemeral_port_reserve"
   ];
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index e653bda8caac2..2f358ba983254 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "eventlet";
-  version = "0.33.1";
+  version = "0.33.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "eventlet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8tIvvTTCcIG56VaPZMhdzAKnFRsYV3YC9xcf47nh838=";
+    hash = "sha256-iSSEZgPkK7RrZfU11z7hUk+JbFsCPH/SD16e+/f6TFU=";
   };
 
   propagatedBuildInputs = [
@@ -58,7 +58,7 @@ buildPythonPackage rec {
     "test_patcher_existing_locks_locked"
     # broken with pyopenssl 22.0.0
     "test_sendall_timeout"
-  ] ++ lib.optionals stdenv.isAarch64 [
+    # broken on aarch64 and when using march in gcc
     "test_fork_after_monkey_patch"
   ];
 
diff --git a/pkgs/development/python-modules/flit-scm/default.nix b/pkgs/development/python-modules/flit-scm/default.nix
index 2a209f2b7cd85..6b7c57100017c 100644
--- a/pkgs/development/python-modules/flit-scm/default.nix
+++ b/pkgs/development/python-modules/flit-scm/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "WillDaSilva";
     repo = "flit_scm";
     rev = "refs/tags/${version}";
-    hash = "sha256-K5sH+oHgX/ftvhkY+vIg6wUokAP96YxrTWds3tnEtyg=";
+    hash = "sha256-2nx9kWq/2TzauOW+c67g9a3JZ2dhBM4QzKyK/sqWOPo=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/h5py/default.nix b/pkgs/development/python-modules/h5py/default.nix
index 9e38225571d98..4d611cbaf2ab3 100644
--- a/pkgs/development/python-modules/h5py/default.nix
+++ b/pkgs/development/python-modules/h5py/default.nix
@@ -19,7 +19,7 @@ let
   mpi = hdf5.mpi;
   mpiSupport = hdf5.mpiSupport;
 in buildPythonPackage rec {
-  version = "3.7.0";
+  version = "3.8.0";
   pname = "h5py";
   format = "pyproject";
 
@@ -27,7 +27,7 @@ in buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-P883iEODxdpkhGq1EBkHIAJ9ygdo3vNN2Ny2Wdvly/M=";
+    hash = "sha256-b+rYLwxAAM841T+cAweA2Bv6AiAhiu4TuQt3Ack32V8=";
   };
 
   # avoid strict pinning of numpy
@@ -68,6 +68,7 @@ in buildPythonPackage rec {
   pythonImportsCheck = [ "h5py" ];
 
   meta = with lib; {
+    changelog = "https://github.com/h5py/h5py/blob/${version}/docs/whatsnew/${lib.versions.majorMinor version}.rst";
     description = "Pythonic interface to the HDF5 binary data format";
     homepage = "http://www.h5py.org/";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/hidapi/default.nix b/pkgs/development/python-modules/hidapi/default.nix
index 977d94e8a20c9..bbbcdfb5267da 100644
--- a/pkgs/development/python-modules/hidapi/default.nix
+++ b/pkgs/development/python-modules/hidapi/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "hidapi";
-  version = "0.12.0.post2";
+  version = "0.13.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8ebb2117be8b27af5c780936030148e1971b6b7fda06e0581ff0bfb15e94ed76";
+    sha256 = "99b18b28ec414ef9b604ddaed08182e486a400486f31ca56f61d537eed1d17cf";
   };
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [ xcbuild ];
diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index 47ef2faea9623..f23521ea21407 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, fetchurl, pytestCheckHook, p7zip,
+{ lib, buildPythonPackage, fetchFromGitHub, pytestCheckHook, p7zip,
   cabextract, zip, lzip, zpaq, gnutar, gnugrep, diffutils, file,
   gzip, bzip2, xz}:
 
@@ -6,17 +6,6 @@
 # it will still use unrar if present in the path
 
 let
-  # FIXME: backport a patch in `file` that seemingly only affects this package
-  # Revert when fix to main package makes it through staging.
-  file' = file.overrideAttrs(old: {
-    patches = (old.patches or []) ++ [
-      (fetchurl {
-        url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-apps/file/files/file-5.44-decompress-empty.patch?h=dfc57da515a2aaf085bea68267cc727f1bfaa691";
-        hash = "sha256-fUzRQAlLWczBmR5iA1Gk66mHjP40MJcMdgCtm2+u1SQ=";
-      })
-    ];
-  });
-
   compression-utilities = [
     p7zip
     gnutar
@@ -28,7 +17,7 @@ let
     gnugrep
     diffutils
     bzip2
-    file'
+    file
     xz
   ];
 in
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 05fe40802c5d5..6dc894c0a4ca5 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -12,7 +12,7 @@
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "9.3.0";
+  version = "9.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ import ./generic.nix (rec {
   src = fetchPypi {
     pname = "Pillow";
     inherit version;
-    hash = "sha256-yTWiKlV6VgEI14D5oPxCbddFmUDcVPqknYMknI0+dg8=";
+    hash = "sha256-ocLXeARI65P7zDeJvzkWqlcg2ULjeUX0BWaAMX8c0j4=";
   };
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index f2b546cac802d..f07c8062c1086 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , callPackage
 , fetchFromGitHub
-, fetchpatch
 , gmp
 }:
 
@@ -11,23 +10,16 @@ let
 in
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.16.0";
+  version = "3.17.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Legrandin";
     repo = "pycryptodome";
     rev = "v${version}";
-    hash = "sha256-8EAgeAU3HQiPrMKOtoVQQLbgq47cbveU2eQYp15XS/U=";
+    hash = "sha256-xsfd+dbaNOPuD0ulvpLPBPtcFgmJqX1VuunwNMcqh+Q=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/Legrandin/pycryptodome/commit/1c043abb089ddbc2fc43d1c169672688ccc64c64.patch";
-      sha256 = "sha256-QklwOlFpQNAH0CpR06fWSZqx8C97RV8BRsKbp2j8js8=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace lib/Crypto/Math/_IntegerGMP.py \
       --replace 'load_lib("gmp"' 'load_lib("${gmp}/lib/libgmp.so.10"'
diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index 20c45462d9ed9..893fd1e64564a 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -42,8 +42,7 @@ buildPythonPackage rec {
   ];
 
   buildInputs = [
-    # # .so files link to these
-    gobject-introspection
+    # # .so files link to this
     glib
   ] ++ lib.optionals stdenv.isDarwin [
     ncurses
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 048c47184d161..ec6acefeb49de 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -2,32 +2,36 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , openssl
 , cryptography
 , pytestCheckHook
 , pretend
+, sphinxHook
+, sphinx-rtd-theme
 , flaky
 }:
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "22.1.0";
-
-  outputs = [ "out" "dev" ];
+  version = "23.0.0";
+  format = "setuptools";
 
   src = fetchPypi {
     pname = "pyOpenSSL";
     inherit version;
-    sha256 = "sha256-eoO3snLdWVIi1nL1zimqAw8fuDdjDvIp9i5y45XOiWg=";
+    hash = "sha256-wcxfhrys78hNrafTEXXK4bFRjV9g09C7WVpngiqGim8=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-flaky-darwin-handshake-tests.patch";
-      url = "https://github.com/pyca/pyopenssl/commit/8a75898356806784caf742e8277ef03de830ce11.patch";
-      hash = "sha256-UVsZ8Nq1jUTZhOUAilRgdtqMYp4AN7qvWHqc6RleqRI=";
-    })
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  nativeBuildInputs = [
+    openssl
+    sphinxHook
+    sphinx-rtd-theme
   ];
 
   postPatch = ''
@@ -35,10 +39,17 @@ buildPythonPackage rec {
     sed "/cryptography/ s/,<[0-9]*//g" setup.py
   '';
 
-  nativeBuildInputs = [ openssl ];
-  propagatedBuildInputs = [ cryptography ];
+  propagatedBuildInputs = [
+    cryptography
+  ];
+
+  nativeCheckInputs = [
+    flaky
+    pretend
+    pytestCheckHook
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook pretend flaky ];
+  __darwinAllowLocalNetworking = true;
 
   preCheck = ''
     export LANG="en_US.UTF-8"
@@ -82,6 +93,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python wrapper around the OpenSSL library";
     homepage = "https://github.com/pyca/pyopenssl";
+    changelog = "https://github.com/pyca/pyopenssl/blob/${version}/CHANGELOG.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
index 998ee4b8ed774..8d2ff5a8a05a4 100644
--- a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
+++ b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
@@ -4,25 +4,22 @@
 , docutils
 , sphinx
 , readthedocs-sphinx-ext
+, sphinx-jquery
 , pytestCheckHook
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
   pname = "sphinx-rtd-theme";
-  version = "1.1.1";
+  version = "1.2.0";
+  format = "setuptools";
 
   src = fetchPypi {
     pname = "sphinx_rtd_theme";
     inherit version;
-    sha256 = "sha256-YUbIRfHhlHs8PdRDLCiZihaTzMdCtPmtfGMSnwdXwQM=";
+    sha256 = "sha256-oNi9Gi7VLgszjL4ZxLLu88XnoEh2l1PaxqnwWce2Qbg=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "docutils <0.18" "docutils" \
-      --replace "sphinx >=1.6,<6" "sphinx"
-  '';
-
   preBuild = ''
     # Don't use NPM to fetch assets. Assets are included in sdist.
     export CI=1
@@ -31,18 +28,28 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     docutils
     sphinx
+    sphinx-jquery
   ];
 
   nativeCheckInputs = [
-    readthedocs-sphinx-ext
     pytestCheckHook
+    pythonRelaxDepsHook
+    readthedocs-sphinx-ext
+  ];
+
+  pythonRelaxDeps = [
+    "docutils"
+    "sphinxcontrib-jquery"
+  ];
+
+  pythonImportsCheck = [
+    "sphinx_rtd_theme"
   ];
 
   meta = with lib; {
-    description = "ReadTheDocs.org theme for Sphinx";
+    description = "Sphinx theme for readthedocs.org";
     homepage = "https://github.com/readthedocs/sphinx_rtd_theme";
+    changelog = "https://github.com/readthedocs/sphinx_rtd_theme/blob/${version}/docs/changelog.rst";
     license = licenses.mit;
-    platforms = platforms.unix;
   };
-
 }
diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index 7c69463d9b7b2..7ae99a98d2285 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -5,12 +5,16 @@
 , setuptools-scm
 , pytestCheckHook
 , typing-extensions
+, sphinxHook
+, sphinx-autodoc-typehints
+, sphinx-rtd-theme
 , glibcLocales
 }:
 
 buildPythonPackage rec {
   pname = "typeguard";
   version = "2.13.3";
+  outputs = [ "out" "doc" ];
 
   src = fetchPypi {
     inherit pname version;
@@ -18,7 +22,12 @@ buildPythonPackage rec {
   };
 
   buildInputs = [ setuptools-scm ];
-  nativeBuildInputs = [ glibcLocales ];
+  nativeBuildInputs = [
+    glibcLocales
+    sphinxHook
+    sphinx-autodoc-typehints
+    sphinx-rtd-theme
+  ];
 
   LC_ALL="en_US.utf-8";
 
diff --git a/pkgs/development/python-modules/types-toml/default.nix b/pkgs/development/python-modules/types-toml/default.nix
index fff70bd611f76..c3c5a13e9005d 100644
--- a/pkgs/development/python-modules/types-toml/default.nix
+++ b/pkgs/development/python-modules/types-toml/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-toml";
-  version = "0.10.8.1";
+  version = "0.10.8.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-FxvbMWPXmlIFYPJLqRap/Jv/gWWcVEip/qiSQJI3Ir4=";
+    sha256 = "sha256-UdQoZmsw6cwEd5H0QNDxGoIgXnicQN67uG863XRyzz4=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/ujson/default.nix b/pkgs/development/python-modules/ujson/default.nix
index 7f9ca14ebdbef..6755a274d1dde 100644
--- a/pkgs/development/python-modules/ujson/default.nix
+++ b/pkgs/development/python-modules/ujson/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "ujson";
-  version = "5.6.0";
+  version = "5.7.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-+IHi2KAi6Shaouq2uoZ0NY28srV/poYY2I1ik3rD/wQ=";
+    sha256 = "sha256-54jl1dyuj2EYrJtF0LiRoNVfesSA7dy38HJj8rzzeyM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index a242c7ec9c6cb..043b1e8aff666 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "watchdog";
-  version = "2.2.0";
+  version = "2.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-g8+Lxg2cYTtmpMAYBRhz1ic9nkXQQO7QbWqWJBvY7AE=";
+    hash = "sha256-zcwjyVKGAaiik+tDacvRT2tPNPB66HaUISUunCJxi28=";
   };
 
   patches = lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index d0306dd33a492..23e11a324337c 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -59,6 +59,9 @@ python3.pkgs.buildPythonApplication rec {
     # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
     ./boost-Do-not-add-system-paths-on-nix.patch
 
+    # Nixpkgs cctools does not have bitcode support.
+    ./disable-bitcode.patch
+
     # Fix passing multiple --define-variable arguments to pkg-config.
     # https://github.com/mesonbuild/meson/pull/10670
     (fetchpatch {
@@ -75,13 +78,7 @@ python3.pkgs.buildPythonApplication rec {
       url = "https://github.com/mesonbuild/meson/commit/a38ad3039d0680f3ac34a6dc487776c79c48acf3.patch";
       hash = "sha256-9YaXwc+F3Pw4BjuOXqva4MD6DAxX1k5WLbn0xzwuEmw=";
     })
-  ]
-    # Nixpkgs cctools does not have bitcode support.
-    ++ lib.optional stdenv.isDarwin ./disable-bitcode.patch;
-
-  postPatch = if stdenv.isDarwin then ''
-    rm -r 'test cases/osx/7 bitcode'
-  '' else null;
+  ];
 
   setupHook = ./setup-hook.sh;
 
@@ -89,17 +86,23 @@ python3.pkgs.buildPythonApplication rec {
   checkInputs = [ zlib ]
     ++ lib.optionals stdenv.isDarwin [ Foundation OpenGL AppKit Cocoa ];
   checkPhase = ''
-    patchShebangs "test cases"
-    substituteInPlace "test cases/native/8 external program shebang parsing/script.int.in" \
+    runHook preCheck
+
+    patchShebangs 'test cases'
+    substituteInPlace 'test cases/native/8 external program shebang parsing/script.int.in' \
       --replace /usr/bin/env ${coreutils}/bin/env
     # requires git, creating cyclic dependency
-    rm -r "test cases/common/66 vcstag"
+    rm -r 'test cases/common/66 vcstag'
     # requires glib, creating cyclic dependency
-    rm -r "test cases/linuxlike/6 subdir include order"
-    rm -r "test cases/linuxlike/9 compiler checks with dependencies"
+    rm -r 'test cases/linuxlike/6 subdir include order'
+    rm -r 'test cases/linuxlike/9 compiler checks with dependencies'
     # requires static zlib, see #66461
-    rm -r "test cases/linuxlike/14 static dynamic linkage"
+    rm -r 'test cases/linuxlike/14 static dynamic linkage'
+    # Nixpkgs cctools does not have bitcode support.
+    rm -r 'test cases/osx/7 bitcode'
     HOME="$TMPDIR" python ./run_project_tests.py
+
+    runHook postCheck
   '';
 
   postFixup = ''
diff --git a/pkgs/development/tools/build-managers/ninja/default.nix b/pkgs/development/tools/build-managers/ninja/default.nix
index f80f0289dbe8d..84897e43f7862 100644
--- a/pkgs/development/tools/build-managers/ninja/default.nix
+++ b/pkgs/development/tools/build-managers/ninja/default.nix
@@ -9,6 +9,7 @@
 , libxslt
 , python3
 , re2c
+, buildPackages
 , buildDocs ? true
 }:
 
@@ -23,6 +24,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-LvV/Fi2ARXBkfyA1paCRmLUwCh/rTyz+tGMg2/qEepI=";
   };
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   nativeBuildInputs = [
     python3
     re2c
@@ -35,10 +38,25 @@ stdenv.mkDerivation rec {
     libxslt.bin
   ];
 
+  postPatch = ''
+    # write rebuild args to file after bootstrap
+    substituteInPlace configure.py --replace "subprocess.check_call(rebuild_args)" "open('rebuild_args','w').write(rebuild_args[0])"
+  '';
+
   buildPhase = ''
     runHook preBuild
 
+    # for list of env vars
+    # see https://github.com/ninja-build/ninja/blob/v1.11.1/configure.py#L264
+    CXX="$CXX_FOR_BUILD" \
+    AR="$AR_FOR_BUILD" \
+    CFLAGS="$CFLAGS_FOR_BUILD" \
+    CXXFLAGS="$CXXFLAGS_FOR_BUILD" \
+    LDFLAGS="$LDFLAGS_FOR_BUILD" \
     python configure.py --bootstrap
+    python configure.py
+
+    source rebuild_args
   '' + lib.optionalString buildDocs ''
     # "./ninja -vn manual" output copied here to support cross compilation.
     asciidoc -b docbook -d book -o build/manual.xml doc/manual.asciidoc
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index 8cdb533da8e03..6428fe27fe5aa 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "doxygen";
-  version = "1.9.5";
+  version = "1.9.6";
 
   src = fetchFromGitHub {
     owner = "doxygen";
     repo = "doxygen";
     rev = "Release_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-968LGj2b8qLs/YQ1DxC1s/xf5qUwnrd8xu5iKrqNN+Y=";
+    sha256 = "sha256-SqboPBqK7gDVTTjGgCUB9oIGBZR55EA7x65a0wumiKw=";
   };
 
   nativeBuildInputs = [
@@ -18,10 +18,9 @@ stdenv.mkDerivation rec {
     bison
   ];
 
-  buildInputs =
-       lib.optionals (qt5 != null) (with qt5; [ qtbase wrapQtAppsHook ])
-    ++ lib.optional stdenv.isSunOS libiconv
-    ++ lib.optionals stdenv.isDarwin [ CoreServices libiconv ];
+  buildInputs = [ libiconv ]
+    ++ lib.optionals (qt5 != null) (with qt5; [ qtbase wrapQtAppsHook ])
+    ++ lib.optionals stdenv.isDarwin [ CoreServices ];
 
   cmakeFlags =
     [ "-DICONV_INCLUDE_DIR=${libiconv}/include" ] ++
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index 512f7aeb7bd58..05da1f3aa0c10 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2022.2";
+  version = "2023.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
-    sha256 = "JlQ5ENdqedYvZnEihWkqO2KnXzHQfLvupG7sfjTmOlQ=";
+    sha256 = "qaaHwbfEpBOaIUvUUeAcqGExoxYfaKo+BzJbBgArv7Y=";
   };
 
   depsBuildBuild = [
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
     markdown
     markupsafe
     pygments
-    toml
+    toml # remove once python311 is the default
     typogrify
   ];
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
index a503ea594fb41..513d17fbbc2f7 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/hooks/default.nix
@@ -18,7 +18,7 @@ let
         makeSetupHook
           {
             name = "remove-path-dependencies.sh";
-            deps = [ ];
+            propagatedBuildInputs = [ ];
             substitutions = {
               # NOTE: We have to use a non-overlayed Python here because otherwise we run into an infinite recursion
               # because building of tomlkit and its dependencies also use these hooks.
@@ -50,7 +50,7 @@ in
       makeSetupHook
         {
           name = "pip-build-hook.sh";
-          deps = [ pip wheel ];
+          propagatedBuildInputs = [ pip wheel ];
           substitutions = {
             inherit pythonInterpreter pythonSitePackages;
           };
@@ -64,7 +64,7 @@ in
       makeSetupHook
         {
           name = "fixup-hook.sh";
-          deps = [ ];
+          propagatedBuildInputs = [ ];
           substitutions = {
             inherit pythonSitePackages;
             filenames = builtins.concatStringsSep " " [
@@ -84,7 +84,7 @@ in
       makeSetupHook
         {
           name = "wheel-unpack-hook.sh";
-          deps = [ ];
+          propagatedBuildInputs = [ ];
         } ./wheel-unpack-hook.sh
     )
     { };
diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index f9e8038b6b325..7a99c448ba7d1 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -7,15 +7,15 @@ let
   rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.63.0";
+  version = "0.64.0";
 
   src = fetchCrate {
     pname = "bindgen-cli";
     inherit version;
-    sha256 = "sha256-qynsHbcljbJyi4wq9AxEE7KIclnDqNTMFAW366JhBSo=";
+    sha256 = "JfR4NDrU86npU+zJ80YKhCn2+hNirzL+0mzLyDHJQjU=";
   };
 
-  cargoSha256 = "sha256-nOPJo6vWMAcG9VG03uceYyLiJfomFERViDCZ0vFnenY=";
+  cargoSha256 = "e1Dqv3lA8WeVF/bxBedntk2nCWk9pUs6LkgP3svNI0w=";
 
   buildInputs = [ clang.cc.lib ];
 
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 384030c903d96..3c3dd234e2023 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "0.14.5";
+  version = "0.14.13";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-3TEEmraQ9KGx29ok7IUdVzTW0ilaAci1dOZUlKvQYJE=";
+    hash = "sha256-a/i4pe+vjQRB4j0K6wBA5XVAih+a1ijLlDvROBjjxOw=";
   };
 
-  cargoHash = "sha256-/biWBTNIysg6HDozyF8UdKoxlgkHl9tnyean8+333hI=";
+  cargoHash = "sha256-8IsXD6bKAkzxVOM04tA5+z1qQxZiV+enlTZrwiik4Ik=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 6f95ded63e15e..cc8b30ab18ca6 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   src = (assert version == spirv-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "SPIRV-Tools";
       rev = "sdk-${version}";
-      hash = "sha256-BV7V/jS782zdvtuw/wNY5fyAdx8Z2niWSocNaW0Atho=";
+      hash = "sha256-xLYykbCHb6OH5wUSgheAfReXhxZtI3RqBJ+PxDZx58s=";
     }
   );
 
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index efc161095580c..c2477ed02d52d 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -23,7 +23,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   # If we were to use "dev" here instead of headers, the setupHook would be
   # placed in that output instead of "out".
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
       owner = "KhronosGroup";
       repo = "Vulkan-ValidationLayers";
       rev = "sdk-${version}";
-      hash = "sha256-+VbiXtxzYaF5o+wIrJ+09LmgBdaLv/0VJGFDnBkrXms=";
+      hash = "sha256-k/A0TaERQAHSM0Fal2IOaRvTz3FV2Go/17P12FSBG1s=";
     });
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
index 74f1160e43066..aeeb5c06b34c4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
@@ -172,10 +172,10 @@ appleDerivation' stdenv {
     # stream: missing altogether
 
     # usb: complete
-    cp IOUSBFamily-630.4.5/IOUSBFamily/Headers/IOUSBLib.h            $dest/usb
-    cp IOUSBFamily-630.4.5/IOUSBUserClient/Headers/IOUSBUserClient.h $dest/usb
-    cp IOUSBFamily-560.4.2/IOUSBFamily/Headers/USB.h                 $dest/usb # This file is empty in 630.4.5!
-    cp IOUSBFamily-630.4.5/IOUSBFamily/Headers/USBSpec.h             $dest/usb
+    cp IOUSBFamily*-630.4.5/IOUSBFamily/Headers/IOUSBLib.h            $dest/usb
+    cp IOUSBFamily*-630.4.5/IOUSBUserClient/Headers/IOUSBUserClient.h $dest/usb
+    cp IOUSBFamily*-560.4.2/IOUSBFamily/Headers/USB.h                 $dest/usb # This file is empty in 630.4.5!
+    cp IOUSBFamily*-630.4.5/IOUSBFamily/Headers/USBSpec.h             $dest/usb
 
     # video: missing altogether
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
index 2ca2d061591af..910b42b0c9d40 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, appleDerivation, fetchzip, bsdmake, perl, flex, bison
+{ lib, stdenv, buildPackages, appleDerivation, fetchFromGitHub, bsdmake, perl, flex, bison
 }:
 
 # this derivation sucks
@@ -10,9 +10,11 @@
 #
 # the more recent adv_cmds release is used for everything else in this package
 
-let recentAdvCmds = fetchzip {
-  url = "https://opensource.apple.com/tarballs/adv_cmds/adv_cmds-158.tar.gz";
-  sha256 = "0z081kcprzg5jcvqivfnwvvv6wfxzkjg2jc2lagsf8c7j7vgm8nn";
+let recentAdvCmds = fetchFromGitHub {
+  owner = "apple-oss-distributions";
+  repo = "adv_cmds";
+  rev = "adv_cmds-158";
+  hash = "sha256-1qL69pGHIaefooJJ8eT83XGz9+bW7Yg3k+X9fNkMCHw=";
 };
 
 in appleDerivation {
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index df47d53514abd..ba0e5b3b78b9c 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchzip, pkgs }:
+{ lib, stdenv, fetchurl, fetchFromGitHub, pkgs }:
 
 let
   # This attrset can in theory be computed automatically, but for that to work nicely we need
@@ -146,7 +146,7 @@ let
       then stdenv.fetchurlBoot
       else fetchurl;
   in fetch {
-    url = "http://www.opensource.apple.com/tarballs/${pname}/${pname}-${version}.tar.gz";
+    url = "https://github.com/apple-oss-distributions/${pname}/archive/refs/tags/${pname}-${version}.tar.gz";
     inherit sha256;
   };
 
@@ -188,24 +188,24 @@ let
   });
 
   IOKitSpecs = {
-    IOAudioFamily                        = fetchApple "osx-10.10.5" "0ggq7za3iq8g02j16rj67prqhrw828jsw3ah3bxq8a1cvr55aqnq";
-    IOFireWireFamily                     = fetchApple "osx-10.10.5" "059qa1m668kwvchl90cqcx35b31zaqdg61zi11y1imn5s389y2g1";
-    IOFWDVComponents                     = fetchApple "osx-10.10.5" "1brr0yn6mxgapw3bvlhyissfksifzj2mqsvj9vmps6zwcsxjfw7m";
-    IOFireWireAVC                        = fetchApple "osx-10.10.5" "194an37gbqs9s5s891lmw6prvd1m2362602s8lj5m89fp9h8mbal";
-    IOFireWireSBP2                       = fetchApple "osx-10.10.5" "1mym158kp46y1vfiq625b15ihh4jjbpimfm7d56wlw6l2syajqvi";
-    IOFireWireSerialBusProtocolTransport = fetchApple "osx-10.10.5" "09kiq907qpk94zbij1mrcfcnyyc5ncvlxavxjrj4v5braxm78lhi";
-    IOGraphics                           = fetchApple "osx-10.10.5" "1z0x3yrv0p8pfdqnvwf8rvrf9wip593lhm9q6yzbclz3fn53ad0p";
-    IOHIDFamily                          = fetchApple "osx-10.10.5" "0yibagwk74imp3j3skjycm703s5ybdqw0qlsmnml6zwjpbrz5894";
-    IONetworkingFamily                   = fetchApple "osx-10.10.5" "04as1hc8avncijf61mp9dmplz8vb1inhirkd1g74gah08lgrfs9j";
-    IOSerialFamily                       = fetchApple "osx-10.10.5" "0jh12aanxcigqi9w6wqzbwjdin9m48zwrhdj3n4ki0h41sg89y91";
-    IOStorageFamily                      = fetchApple "osx-10.9.5"  "0w5yr8ppl82anwph2zba0ppjji6ipf5x410zhcm1drzwn4bbkxrj";
-    IOBDStorageFamily                    = fetchApple "osx-10.10.5" "1rbvmh311n853j5qb6hfda94vym9wkws5w736w2r7dwbrjyppc1q";
-    IOCDStorageFamily                    = fetchApple "osx-10.10.5" "1905sxwmpxdcnm6yggklc5zimx1558ygm3ycj6b34f9h48xfxzgy";
-    IODVDStorageFamily                   = fetchApple "osx-10.10.5" "1fv82rn199mi998l41c0qpnlp3irhqp2rb7v53pxbx7cra4zx3i6";
+    IOAudioFamily                        = fetchApple "osx-10.10.5" "sha256-frs2pm2OpGUOz68ZXsjktlyHlgn5oXM+ltbmAf//Cio=";
+    IOFireWireFamily                     = fetchApple "osx-10.10.5" "sha256-V9fNeo/Wj9dm1/XM4hkOInnMk01M6c9QSjJs5zJKB60=";
+    IOFWDVComponents                     = fetchApple "osx-10.10.5" "sha256-KenCX9C/Z2ErUK8tpKpm65gEmhn2NsXFxlzK7NKomaI=";
+    IOFireWireAVC                        = fetchApple "osx-10.10.5" "sha256-Gd8+PK/mk+xEXgF8dGAx+3jsXv4NX1GiBFyjyrf6sTo=";
+    IOFireWireSBP2                       = fetchApple "osx-10.10.5" "sha256-Z3nP8pX1YG4Fbt7MrnqO06ihE9aYOex5Eib/rqOpoPk=";
+    IOFireWireSerialBusProtocolTransport = fetchApple "osx-10.10.5" "sha256-zdYE0UCKiVhDRGdWaH8L51ArbYTnsQOmcN/OMmpNdFA=";
+    IOGraphics                           = fetchApple "osx-10.10.5" "sha256-lXoW4sx3pyl5fg5Qde3sQi2i8rTLnpeCdDaTHjbfaMI=";
+    IOHIDFamily                          = fetchApple "osx-10.10.5" "sha256-b+S1p3p5d8olYE18VrBns4euerVINaQSFEp34sko5rM=";
+    IONetworkingFamily                   = fetchApple "osx-10.10.5" "sha256-NOpFOBKS6iwFj9DJxduZYZfZJuhDyBQw2QMKHbu7j40=";
+    IOSerialFamily                       = fetchApple "osx-10.10.5" "sha256-hpYrgXsuTul4CYoYIjQjerfvQRqISM2tCcfVXlnjbZo=";
+    IOStorageFamily                      = fetchApple "osx-10.9.5"  "sha256-CeA4rHUrBKHsDeJU9ssIY9LQwDw09a+vQUyruosaLKA=";
+    IOBDStorageFamily                    = fetchApple "osx-10.10.5" "sha256-gD52RKXGKWGga/QGlutxsgsPNSN6gcRfFQRT8v51N3E=";
+    IOCDStorageFamily                    = fetchApple "osx-10.10.5" "sha256-+nyqH6lMPmIkDLYXNVSeR4vBYS165oyJx+DkCkKOGRg=";
+    IODVDStorageFamily                   = fetchApple "osx-10.10.5" "sha256-Jy3UuRzdd0bBdhJgI/f8vLXh2GdGs1RVN3G2iEs86kQ=";
     # There should be an IOStreamFamily project here, but they haven't released it :(
-    IOUSBFamily                          = fetchApple "osx-10.8.5"  "1znqb6frxgab9mkyv7csa08c26p9p0ip6hqb4wm9c7j85kf71f4j"; # This is from 10.8 :(
-    IOUSBFamily_older                    = fetchApple "osx-10.8.4"  "113lmpz8n6sibd27p42h8bl7a6c3myc6zngwri7gnvf8qlajzyml" "IOUSBFamily"; # This is even older :(
-    IOKitUser                            = fetchApple "osx-10.10.5" "1jzndziv97bhjxmla8nib5fpcswbvsxr04447g251ls81rw313lb";
+    IOUSBFamily                          = fetchApple "osx-10.8.5"  "sha256-FwgGoP97Sj47VGXMxbY0oUugKf7jtxAL1RzL6+315cU="; # This is from 10.8 :(
+    IOUSBFamily_older                    = fetchApple "osx-10.8.4"  "sha256-5apCsqtHK0EC8x1uPTTll43x69eal/nsokfS80qLlxs=" "IOUSBFamily"; # This is even older :(
+    IOKitUser                            = fetchApple "osx-10.10.5" "sha256-3UHM3g91v4RugmONbM+SAPr1SfoUPY3QPcTwTpt+zuY=";
     # There should be an IOVideo here, but they haven't released it :(
   };
 
@@ -234,7 +234,7 @@ let
   in applePackage' namePath version sdkName sha256;
 
   # Only used for bootstrapping. It’s convenient because it was the last version to come with a real makefile.
-  adv_cmds-boot = applePackage "adv_cmds/boot.nix" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
+  adv_cmds-boot = applePackage "adv_cmds/boot.nix" "osx-10.5.8" "sha256-/OJLNpATyS31W5nWfJgSVO5itp8j55TRwG57/QLT5Fg=" {};
 
 in
 
@@ -242,70 +242,72 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     # TODO: shorten this list, we should cut down to a minimum set of bootstrap or necessary packages here.
 
     inherit (adv_cmds-boot) ps locale;
-    architecture    = applePackage "architecture"      "osx-10.11.6"     "1pbpjcd7is69hn8y29i98ci0byik826if8gnp824ha92h90w0fq3" {};
-    bsdmake         = applePackage "bsdmake"           "dev-tools-3.2.6" "11a9kkhz5bfgi1i8kpdkis78lhc6b5vxmhd598fcdgra1jw4iac2" {};
-    CarbonHeaders   = applePackage "CarbonHeaders"     "osx-10.6.2"      "1zam29847cxr6y9rnl76zqmkbac53nx0szmqm9w5p469a6wzjqar" {};
-    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.12.6"     "0sgsqjcxbdm2g2zfpc50mzmk4b4ldyw7xvvkwiayhpczg1fga4ff" {};
-    configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
-      Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    architecture    = applePackage "architecture"      "osx-10.11.6"     "sha256-cUKeMx6mOAxBSRHIdfzsrR65Qv86m7+20XvpKqVfwVI=" {};
+    bsdmake         = applePackage "bsdmake"           "dev-tools-3.2.6" "sha256-CW8zP5QZMhWTGp+rhrm8oHE/vSLsRlv1VRAGe1OUDmI=" {};
+    CarbonHeaders   = applePackage "CarbonHeaders"     "osx-10.6.2"      "sha256-UNaHvxzYzEBnYYuoMLqWUVprZa6Wqn/3XleoSCco050=" {};
+    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.12.6"     "sha256-FLgODBrfv+XsGaAjddncYAm/BIJJYw6LcwX/z7ncKFM=" {};
+    configd         = applePackage "configd"           "osx-10.8.5"      "sha256-6I3FWNjTgds5abEcZrD++s9b+P9a2+qUf8KFAb72DwI=" {
+      Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "sha256-7qr0IamjCXCobIJ6V9KtvbMBkJDfRCy4C5eqpHJlQLI=" {};
     };
-    copyfile        = applePackage "copyfile"          "osx-10.12.6"     "0a70bvzndkava1a946cdq42lnjhg7i7b5alpii3lap6r5fkvas0n" {};
-    Csu             = applePackage "Csu"               "osx-10.11.6"     "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
-    dtrace          = applePackage "dtrace"            "osx-10.12.6"     "0hpd6348av463yqf70n3xkygwmf1i5zza8kps4zys52sviqz3a0l" {};
-    dyld            = applePackage "dyld"              "osx-10.12.6"     "0q4jmk78b5ajn33blh4agyq6v2a63lpb3fln78az0dy12bnp1qqk" {};
-    eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
-    IOKit           = applePackage "IOKit"             "osx-10.11.6"     "0kcbrlyxcyirvg5p95hjd9k8a01k161zg0bsfgfhkb90kh2s8x00" { inherit IOKitSrcs; };
-    launchd         = applePackage "launchd"           "osx-10.9.5"      "0w30hvwqq8j5n90s3qyp0fccxflvrmmjnicjri4i1vd2g196jdgj" {};
-    libauto         = applePackage "libauto"           "osx-10.9.5"      "17z27yq5d7zfkwr49r7f0vn9pxvj95884sd2k6lq6rfaz9gxqhy3" {};
-    Libc            = applePackage "Libc"              "osx-10.12.6"     "183wcy1nlj2wkpfsx3k3lyv917mk8r2p72qw8lb89mbjsw3yw0xx" {
-      Libc_10-9 = fetchzip {
-        url    = "http://www.opensource.apple.com/tarballs/Libc/Libc-997.90.3.tar.gz";
-        sha256 = "1xchgxkxg5288r2b9yfrqji2gsgdap92k4wx2dbjwslixws12pq7";
+    copyfile        = applePackage "copyfile"          "osx-10.12.6"     "sha256-uHqLFOIpXK+n0RHyOZzVsP2DDZcFDivKCnqHBaXvHns=" {};
+    Csu             = applePackage "Csu"               "osx-10.11.6"     "sha256-h6a/sQMEVeFxKNWAPgKBXjWhyL2L2nvX9BQUMaTQ6sY=" {};
+    dtrace          = applePackage "dtrace"            "osx-10.12.6"     "sha256-Icr22ozixHquI0kRB2XZ+LlxD6V46sJHsHy4L/tDXZg=" {};
+    dyld            = applePackage "dyld"              "osx-10.12.6"     "sha256-JmKnOZtBPf96zEx7vhYHLBSTOPyKN71IdYE3R0IeJww=" {};
+    eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "sha256-54P3+YhVhOanoZQoqswDnr/GbR/AdEERse135nyuIQo=" {};
+    IOKit           = applePackage "IOKit"             "osx-10.11.6"     "" { inherit IOKitSrcs; };
+    launchd         = applePackage "launchd"           "osx-10.9.5"      "sha256-dmV0UK7hG9wvTr+F4Z47nCFXcVZCV+cQ46WbE0DBtJs=" {};
+    libauto         = applePackage "libauto"           "osx-10.9.5"      "sha256-GnRcKq8jRbEsI/PSDphwUjWtpEIEcnLlQL9yxYLgSsU=" {};
+    Libc            = applePackage "Libc"              "osx-10.12.6"     "sha256-LSsL7S3KFgGU9qjK4atu/4wBh8ftgfsk6JOvg+ZTZOY=" {
+      Libc_10-9 = fetchFromGitHub {
+        owner  = "apple-oss-distributions";
+        repo   = "Libc";
+        rev    = "Libc-997.90.3";
+        hash   = "sha256-B18RNO+Rai5XE52TKdJV7eknosTZ+bRERkiU12d/kPU=";
       };
-      Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
+      Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "sha256-JvPSY7FzraGpqF/jYLfhU2o/2195NuKrXsryYfVtx3s=" {};
     };
-    libclosure      = applePackage "libclosure"        "osx-10.11.6"     "1zqy1zvra46cmqv6vsf1mcsz3a76r9bky145phfwh4ab6y15vjpq" {};
-    libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "0jsfbzp87lwk9snlby0hd4zvj7j894p5q3cw0wdx9ny1mcp3kdcj" {};
-    libiconv        = applePackage "libiconv"          "osx-10.12.6"     "1gg5h6z8sk851bhv87vyxzs54jmqz6lh57ny8j4s51j7srja0nly" {};
-    Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "0qjgkd4y8sjvwjzv5wwyzkb61pg8wwg95bkp721dgzv119dqhr8x" {};
-    Libm            = applePackage "Libm"              "osx-10.7.4"      "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {};
-    Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "0p5qhvalf6j1w6n8xwywhn6dvbpzv74q5wqrgs8rwfpf74wg6s9z" {};
-    libplatform     = applePackage "libplatform"       "osx-10.12.6"     "0rh1f5ybvwz8s0nwfar8s0fh7jbgwqcy903cv2x8m15iq1x599yn" {};
-    libpthread      = applePackage "libpthread"        "osx-10.12.6"     "1j6541rcgjpas1fc77ip5krjgw4bvz6jq7bq7h9q7axb0jv2ns6c" {};
-    libresolv       = applePackage "libresolv"         "osx-10.12.6"     "077j6ljfh7amqpk2146rr7dsz5vasvr3als830mgv5jzl7l6vz88" {};
-    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "1082ircc1ggaq3wha218vmfa75jqdaqidsy1bmrc4ckfkbr3bwx2" {};
-    libutil         = applePackage "libutil"           "osx-10.12.6"     "0lqdxaj82h8yjbjm856jjz9k2d96k0viimi881akfng08xk1246y" {};
-    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
-    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "02ms1p8zlgmprzn65jzr7yaqxykh3zxjcrw0c06aayim6h0dsqfy" {};
-    objc4           = applePackage "objc4"             "osx-10.12.6"     "1cj1vhbcs9pkmag2ms8wslagicnq9bxi2qjkszmp3ys7z7ccrbwz" {};
-    ppp             = applePackage "ppp"               "osx-10.12.6"     "1kcc2nc4x1kf8sz0a23i6nfpvxg381kipi0qdisrp8x9z2gbkxb8" {};
-    removefile      = applePackage "removefile"        "osx-10.12.6"     "0jzjxbmxgjzhssqd50z7kq9dlwrv5fsdshh57c0f8mdwcs19bsyx" {};
+    libclosure      = applePackage "libclosure"        "osx-10.11.6"     "sha256-L5rQ+UBpf3B+W1U+gZKk7fXulslHsc8lxnCsplV+nr0=" {};
+    libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "sha256-jfAEk0OLrJa9AIZVikIoHomd+l+4rCfc320Xh50qK5M=" {};
+    libiconv        = applePackage "libiconv"          "osx-10.12.6"     "sha256-ZzPFkchK3EU95UQUVVrR0t8iilhi/VnIkjjtP6KT2oI=" {};
+    Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "sha256-6F7wiwerv4nz/xXHtp1qCHSaFzZgzcRN+jbmXA5oWOQ=" {};
+    Libm            = applePackage "Libm"              "osx-10.7.4"      "sha256-KjMETfT4qJm0m0Ux/F6Rq8bI4Q4UVnFx6IKbKxXd+Es=" {};
+    Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "sha256-6wvMBxAUfiYcQtmlfYCj1d3kFmFM/jdboTd7hRvi3e4=" {};
+    libplatform     = applePackage "libplatform"       "osx-10.12.6"     "sha256-6McMTjw55xtnCsFI3AB1osRagnuB5pSTqeMKD3gpGtM=" {};
+    libpthread      = applePackage "libpthread"        "osx-10.12.6"     "sha256-QvJ9PERmrCWBiDmOWrLvQUKZ4JxHuh8gS5nlZKDLqE8=" {};
+    libresolv       = applePackage "libresolv"         "osx-10.12.6"     "sha256-FtvwjJKSFX6j9APYPC8WLXVOjbHLZa1Gcoc8yxLy8qE=" {};
+    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "sha256-zvRdCP//TjKCGAqm/5nJXPppshU1cv2fg/L/yK/olGQ=" {};
+    libutil         = applePackage "libutil"           "osx-10.12.6"     "sha256-4PFuk+CTLwvd/Ll9GLBkiIM0Sh/CVaiKwh5m1noheRs=" {};
+    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "sha256-CC0sndP/mKYe3dZu3v7fjuDASV4V4w7dAcnWMvpoquE=" {};
+    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "sha256-ddZr6tropkpdMJhq/kUlm3OwO8b0yxtkrMpwec8R4FY=" {};
+    objc4           = applePackage "objc4"             "osx-10.12.6"     "sha256-ZsxRpdsfv3Dxs7yBBCkjbKXKR6aXwkEpxc1XYXz7ueM=" {};
+    ppp             = applePackage "ppp"               "osx-10.12.6"     "sha256-M1zoEjjeKIDUEP6ACbpUJk3OXjobw4g/qzUmxGdX1J0=" {};
+    removefile      = applePackage "removefile"        "osx-10.12.6"     "sha256-UpNk27kGXnZss1ZXWVJU9jLz/NW63ZAZEDLhyCYoi9M=" {};
     xnu             = if stdenv.isx86_64 then
-    applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {
+    applePackage "xnu"               "osx-10.12.6"     "sha256-C8TPQlUT3RbzAy8YnZPNtr70hpaVG9Llv0h42s3NENI=" {
       python3 = pkgs.buildPackages.buildPackages.python3; # TODO(@Ericson2314) this shouldn't be needed.
     }
     else macosPackages_11_0_1.xnu;
-    hfs             = applePackage "hfs"               "osx-10.12.6"     "1mj3xvqpq1mgd80b6kl1s04knqnap7hccr0gz8rjphalq14rbl5g" {};
-    Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
-    adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
-    basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
-    developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "1r9c2b6dcl22diqf90x58psvz797d3lxh4r2wppr7lldgbgn24di" {};
-    diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {
+    hfs             = applePackage "hfs"               "osx-10.12.6"     "sha256-eGi18HQFJrU5UHoBOE0LqO5gQ0xOf8+OJuAWQljfKE4=" {};
+    Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "sha256-YHbGws901xONzAbo6sB5zSea4Wp0sgYUJ8YgwVfWxnE=" {};
+    adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"     "sha256-Ztp8ALWcviEpthoiY8ttWzGI8OcsLzsULjlqe8GIzw8=" {};
+    basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "sha256-BYPPTg4/7x6RPs0WwwQlkNiZxxArV+7EVe6bM+a/I6Q=" {};
+    developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "sha256-h0wMVlS6QdRvKOVJ74W9ziHYGApjvnk77AIR6ukYBRo=" {};
+    diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "sha256-VX+hcZ7JhOA8EhwLloPlM3Yx79RXp9OYHV9Mi10uw3Q=" {
       macosPackages_11_0_1 = macosPackages_11_0_1;
     };
     network_cmds    = if stdenv.isx86_64 then
-      applePackage "network_cmds" "osx-10.11.6" "0lhi9wz84qr1r2ab3fb4nvmdg9gxn817n5ldg7zw9gnf3wwn42kw" {}
+      applePackage "network_cmds" "osx-10.11.6" "sha256-I89CLIswGheewOjiNZwQTgWvWbhm0qtB5+KUqzxnQ5M=" {}
     else macosPackages_11_0_1.network_cmds;
-    file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "1zfxbmasps529pnfdjvc13p7ws2cfx8pidkplypkswyff0nff4wp" {};
-    shell_cmds      = applePackage "shell_cmds"        "osx-10.11.6"     "0084k271v66h4jqp7q7rmjvv7w4mvhx3aq860qs8jbd30canm86n" {};
-    system_cmds     = applePackage "system_cmds"       "osx-10.11.6"     "1h46j2c5v02pkv5d9fyv6cpgyg0lczvwicrx6r9s210cl03l77jl" {};
-    text_cmds       = applePackage "text_cmds"         "osx-10.11.6"     "1f93m7dd0ghqb2hwh905mjhzblyfr7dwffw98xhgmv1mfdnigxg0" {};
-    top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
-    PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "1llimhvp0gjffd47322lnjq7cqwinx0c5z7ikli04ad5srpa68mh" {};
+    file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "sha256-JYy6HwmultKeZtLfaysbsyLoWg+OaTh7eJu54JkJC0Q=" {};
+    shell_cmds      = applePackage "shell_cmds"        "osx-10.11.6"     "sha256-kmEOprkiJGMVcl7yHkGX8ymk/5KjE99gWuF8j2hK5hY=" {};
+    system_cmds     = applePackage "system_cmds"       "osx-10.11.6"     "sha256-KBdGlHeXo2PwgRQOOeElJ1RBqCY1Tdhn5KD42CMhdzI=" {};
+    text_cmds       = applePackage "text_cmds"         "osx-10.11.6"     "sha256-KSebU7ZyUsPeqn51nzuGNaNxs9pvmlIQQdkWXIVzDxw=" {};
+    top             = applePackage "top"               "osx-10.11.6"     "sha256-jbz64ODogtpNyLpXGSZj1jCBdFPVXcVcBkL1vc7g5qQ=" {};
+    PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "sha256-bYGtYnBOcE5W03AZzfVTJXPZ6GgryGAMt/LgLPxFkVk=" {};
 
     # `configdHeaders` can’t use an override because `pkgs.darwin.configd` on aarch64-darwin will
     # be replaced by SystemConfiguration.framework from the macOS SDK.
-    configdHeaders  = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
+    configdHeaders  = applePackage "configd"           "osx-10.8.5"      "sha256-6I3FWNjTgds5abEcZrD++s9b+P9a2+qUf8KFAb72DwI=" {
       headersOnly = true;
       Security    = null;
     };
@@ -315,5 +317,5 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
 
     # TODO(matthewbauer):
     # To be removed, once I figure out how to build a newer Security version.
-    Security        = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    Security        = applePackage "Security/boot.nix" "osx-10.9.5"      "sha256-7qr0IamjCXCobIJ6V9KtvbMBkJDfRCy4C5eqpHJlQLI=" {};
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix b/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix
index f57d224615f4b..7eeafec346551 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/developer-tools-11.3.1.nix
@@ -3,6 +3,6 @@
 { applePackage' }:
 
 {
-bootstrap_cmds = applePackage' "bootstrap_cmds" "116" "developer-tools-11.3.1" "148xpqkf5xzpslqxch5l8h6vsz7sys8sdzk4ghbg9mkcivp8qa03" {};
-developer_cmds = applePackage' "developer_cmds" "66" "developer-tools-11.3.1" "0q08m4cxxwph7gxqravmx13l418p1i050bd46zwksn9j9zpw9mlr" {};
+bootstrap_cmds = applePackage' "bootstrap_cmds" "116" "developer-tools-11.3.1" "06nw99ajkd264vdi6n2zv252ppxp3wx3120hqf3jqdh6c1wavy0b" {};
+developer_cmds = applePackage' "developer_cmds" "66" "developer-tools-11.3.1" "0f7vphpscjcypq49gjckbs20xhm7yjalr4nnbphqcqp8v1al56dc" {};
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix b/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
index 517f53e9435da..1637ed7838956 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/macos-11.0.1.nix
@@ -3,44 +3,44 @@
 { applePackage' }:
 
 {
-adv_cmds = applePackage' "adv_cmds" "176" "macos-11.0.1" "0x8c25rh6fnzndbc26vcb65vcxilvqyfvm2klfyci1wr4bh3ixgk" {};
-architecture = applePackage' "architecture" "279" "macos-11.0.1" "1cgp33ywa30max6cyp69kvii299hx2vgwvmy3ms8n4gaq2mkpaky" {};
-basic_cmds = applePackage' "basic_cmds" "55" "macos-11.0.1" "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
-bootstrap_cmds = applePackage' "bootstrap_cmds" "121" "macos-11.0.1" "09bwclws6adxb1ky9q35f4ikddk4mbalmgds0cmqaf7j23qxl3fv" {};
-CommonCrypto = applePackage' "CommonCrypto" "60178.40.2" "macos-11.0.1" "0r3b1mlfmbdzpwn6pbsbfaga3k63gpwcwbhkbi4r09aq82skl02v" {};
-configd = applePackage' "configd" "1109.40.9" "macos-11.0.1" "173i55wfzli9pg2x2rw437hs68h6l4ngss5jfgf18g26zjkjzv5v" {};
-copyfile = applePackage' "copyfile" "173.40.2" "macos-11.0.1" "0qyp15qj3fdb7yx033n57l7s61d70mv17f43yiwcbhx09mmlrp07" {};
-Csu = applePackage' "Csu" "88" "macos-11.0.1" "029lgcyj0i16036h2lcx6fd6r1yf1bkj5dnvz905rh6ncl8skgdr" {};
-diskdev_cmds = applePackage' "diskdev_cmds" "667.40.1" "macos-11.0.1" "1bqwkwkwd556rba5000ap77xrhaf4xnmy83mszd7a0yvl2xlma7j" {};
-dtrace = applePackage' "dtrace" "370.40.1" "macos-11.0.1" "1941yczmn94ng5zlnhf0i5mjw2f4g7znisgvhkhn5f86gxmd98wl" {};
-dyld = applePackage' "dyld" "832.7.1" "macos-11.0.1" "1s77ca6jg20z91qlph59da8j61m97y23vrw48xs4rywdzh4915n0" {};
-eap8021x = applePackage' "eap8021x" "304.40.1" "macos-11.0.1" "1ph3kcpf527s0jqsi60j2sgg3m8h128spf292d8kyc08siz9mf9c" {};
-file_cmds = applePackage' "file_cmds" "321.40.3" "macos-11.0.1" "04789vn1wghclfr3ma3ncg716xdsxfj66hrcxi5h3h1ryag2ycfz" {};
-hfs = applePackage' "hfs" "556.41.1" "macos-11.0.1" "1rhkmn2yj5p4wmi4aajy5hj2h0gxk63s8j4qz4ziy4g4bjpdgwmy" {};
-ICU = applePackage' "ICU" "66108" "macos-11.0.1" "1d76cyyqpwkzjlxfajm4nsglxmfrcafbnjwnjxc3j5w3nw67pqhx" {};
-Libc = applePackage' "Libc" "1439.40.11" "macos-11.0.1" "0d5xlnks4lc9391wg31c9126vflb40lc5ffkgxmf2kpyglac1280" {};
-libclosure = applePackage' "libclosure" "78" "macos-11.0.1" "089i2bl4agpnfplrg23xbzma1674g0w05988nxdps6ghxl4kz66f" {};
-libdispatch = applePackage' "libdispatch" "1271.40.12" "macos-11.0.1" "0z7r42zfb8y48f0nrw0qw7fanfvimycimgnrg3jig101kjvjar98" {};
-libiconv = applePackage' "libiconv" "59" "macos-11.0.1" "0hqbsqggjrr0sv6h70lcr3gabgk9inyc8aq1b30wibgjm6crjwpp" {};
-Libinfo = applePackage' "Libinfo" "542.40.3" "macos-11.0.1" "0y5x6wxd3mwn6my1jdp8qrak3y7x7sgjdmwyw9cvvbn3kg9v6z1p" {};
-Libnotify = applePackage' "Libnotify" "279.40.4" "macos-11.0.1" "0aswflxki877izp6sacv35sydn6a3639cflv3zhs3i7vkfbsvbf5" {};
-libplatform = applePackage' "libplatform" "254.40.4" "macos-11.0.1" "1mhi8n66864y98dr3n0pkqad3aqim800kn9bxzp6h5jf2jni3aql" {};
-libpthread = applePackage' "libpthread" "454.40.3" "macos-11.0.1" "18rb4dqjdf3krzi4hdj5i310gy49ipf01klbkp9g51i02a55gphq" {};
-libresolv = applePackage' "libresolv" "68" "macos-11.0.1" "1ysvg6d28xyaky9sn7giglnsflhjsbj17h3h3i6knlzxnzznpkql" {};
-Librpcsvc = applePackage' "Librpcsvc" "26" "macos-11.0.1" "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
-Libsystem = applePackage' "Libsystem" "1292.50.1" "macos-11.0.1" "0w16zaigq18jfsnw15pfyz2mkfqdkn0cc16q617kmgw2khld8j7j" {};
-libunwind = applePackage' "libunwind" "200.10" "macos-11.0.1" "1pmymcqpfk7lfxh6zqch429vfpvmd2m1dlg898170pkx5zhxisl2" {};
-libutil = applePackage' "libutil" "58.40.2" "macos-11.0.1" "1hhgashfj9g4vjv02070c5pn818a5n0bh5l81l2pflmvb2rrqs3f" {};
-mDNSResponder = applePackage' "mDNSResponder" "1310.40.42" "macos-11.0.1" "0d0b9wwah9rg7rwrr29dxd6iy0y4rlmss3wcz2wcqmnd2qb9x8my" {};
-network_cmds = applePackage' "network_cmds" "606.40.2" "macos-11.0.1" "1dlslk67npvmxx5m50385kmn3ysxih2iv220hhzkin11f8abdjv7" {};
-objc4 = applePackage' "objc4" "818.2" "macos-11.0.1" "177gmh9m9ajy6mvcd2sf7gqydgljy44n3iih0yqsn1b13j784azx" {};
-PowerManagement = applePackage' "PowerManagement" "1132.50.3" "macos-11.0.1" "1n5yn6sc8w67g8iism6ilkyl33j46gcnlqcaq6k16zkngx6lprba" {};
-ppp = applePackage' "ppp" "877.40.2" "macos-11.0.1" "1z506z8ndvb1lfr4pypfy2bnig6qimhmq3yhjvqwfnliv91965iq" {};
-removefile = applePackage' "removefile" "49.40.3" "macos-11.0.1" "1fhp47awi15f02385r25qgw1ag5z0kr1v3kvgqm3r8i8yysfqvwp" {};
-Security = applePackage' "Security" "59754.41.1" "macos-11.0.1" "00kqgg7k80ba70ar2c02f0q9yrdgqcb56nb9z5g0bxwkvi40ryph" {};
-shell_cmds = applePackage' "shell_cmds" "216.40.4" "macos-11.0.1" "1mvp1fp34kkm4mi85fdn3i0l0gig4c0w09zg2mvkpxcf68cq2f69" {};
-system_cmds = applePackage' "system_cmds" "880.40.5" "macos-11.0.1" "1kys4vwfz4559sspdsfhmxc238nd8qgylqypza3zdzaqhfh7lx2x" {};
-text_cmds = applePackage' "text_cmds" "106" "macos-11.0.1" "0cpnfpllwpx20hbxzg5i5488gcjyi9adnbac1sd5hpv3bq6z1hs5" {};
-top = applePackage' "top" "129" "macos-11.0.1" "1nyz5mvq7js3zhsi3dwxl5fslg6m7nhlgc6p2hr889xgyl5prw8f" {};
-xnu = applePackage' "xnu" "7195.50.7.100.1" "macos-11.0.1" "14wqkqp3lcxgpm1sjnsysybrc4ppzkghwv3mb5nr5v8ml37prkib" {};
+CommonCrypto = applePackage' "CommonCrypto" "60178.40.2" "macos-11.0.1" "129gsxhhcxqycg0zjrdrz2ay4dv2ih1ckafqh33qrc499z8dam2p" {};
+Csu = applePackage' "Csu" "88" "macos-11.0.1" "1lzp9x8iv60c2h12q2s89nf49b5hvpqq4a9li44zr2fxszn8lqxh" {};
+ICU = applePackage' "ICU" "66108" "macos-11.0.1" "0mclizp99daihghqy2sgzjkid8i93dsn5pi8q9p7b3156chrhw57" {};
+Libc = applePackage' "Libc" "1439.40.11" "macos-11.0.1" "12k5sbz2k1pl839w2lk9iw414zzl50zdjzgq2x6bm20yjbfj69qm" {};
+Libinfo = applePackage' "Libinfo" "542.40.3" "macos-11.0.1" "18jvl7cdg64x6clhsfv5pbzxis2aldddpca5r81xqakrmi9mck80" {};
+Libnotify = applePackage' "Libnotify" "279.40.4" "macos-11.0.1" "1vr11s0c42ssjs29shy1m8rj008np7aswdzjpimsfzyav47jb6y7" {};
+Librpcsvc = applePackage' "Librpcsvc" "26" "macos-11.0.1" "0wf6srbw28664wa0dckldbhrl9ydg70fms06rj6i7mvlrz1ccxk0" {};
+Libsystem = applePackage' "Libsystem" "1292.50.1" "macos-11.0.1" "0d3flh1p4kskic8ypi8wia4kinfbprx9fvyfqc3mcq0710i0gy77" {};
+PowerManagement = applePackage' "PowerManagement" "1132.50.3" "macos-11.0.1" "1sb2nz92vdf6v3h17ry0vgw0z9zsva82lhdrhsf3k60jhfw1fi2v" {};
+Security = applePackage' "Security" "59754.41.1" "macos-11.0.1" "0jq70mnwkvrrhws64ipx0i68pi3n0sk95jlhacxxikdj9f4hpbsw" {};
+adv_cmds = applePackage' "adv_cmds" "176" "macos-11.0.1" "0sskwl3jc7llbrlyd1i7qlb03yhm1xkbxd1k9xhh7f9wqhlzq31j" {};
+architecture = applePackage' "architecture" "279" "macos-11.0.1" "19s93rqr9r98qh0rlndf7kv3v4n1ifh9i539mbpsx6kbixcx8vvp" {};
+basic_cmds = applePackage' "basic_cmds" "55" "macos-11.0.1" "1913pzk376zfap2fwmrb233rkn4h4l2c65nd7s8ixvrz1r7cz0q5" {};
+bootstrap_cmds = applePackage' "bootstrap_cmds" "121" "macos-11.0.1" "0qgbgwijv7xqmm9gn74jibyw2dh516xpj7h1grj2j1i80m3b16bl" {};
+configd = applePackage' "configd" "1109.40.9" "macos-11.0.1" "024ny63lpwzgnm8g28hh8dldvmmislmrl298n721rm0blqjhahz5" {};
+copyfile = applePackage' "copyfile" "173.40.2" "macos-11.0.1" "1j20909inn2iw8n51b8vk551wznfi3bhfziy8nbv08qj5lk50m04" {};
+diskdev_cmds = applePackage' "diskdev_cmds" "667.40.1" "macos-11.0.1" "0wr60vyvgkbc4wyldnsqas0xss2k1fgmbdk3vnhj6v6jqa98l1ny" {};
+dtrace = applePackage' "dtrace" "370.40.1" "macos-11.0.1" "1qj74mix1x3drffr1qpafm57aby42bc61kynba5q0ppbcf0lrbp1" {};
+dyld = applePackage' "dyld" "832.7.1" "macos-11.0.1" "01q7fsibr6xp94l3w22sh8qfjgwzzf1v82mhgq39ivkxwwc4jdy0" {};
+eap8021x = applePackage' "eap8021x" "304.40.1" "macos-11.0.1" "1aihyklri64w380d1mvi830n5cnzs9gd38z8i9ccd37n48gmz88p" {};
+file_cmds = applePackage' "file_cmds" "321.40.3" "macos-11.0.1" "0p077lnbcy8266m03a0fssj4214bjxh88y3qkspnzcvi0g84k43q" {};
+hfs = applePackage' "hfs" "556.41.1" "macos-11.0.1" "0a0s6b12b0q07wslfifna0bj51dml9v098i4crr2m1vivnx4xj75" {};
+libclosure = applePackage' "libclosure" "78" "macos-11.0.1" "0vf9n0k3m8dbprv1bf45zqg0g43bidy2i5z1v9a826bsf8lv7am7" {};
+libdispatch = applePackage' "libdispatch" "1271.40.12" "macos-11.0.1" "1ck5srcjapg18vqb8wl08gacs7ndc6xr067qjn3ngx39q1jdcywz" {};
+libiconv = applePackage' "libiconv" "59" "macos-11.0.1" "0lwa4brdwm4lvrdnxylzsn1yph4m7csgri2zkc4xb4xiisz32pwp" {};
+libplatform = applePackage' "libplatform" "254.40.4" "macos-11.0.1" "1qf3ri0yd8b1xjln1j1gyx7ks6k3a2jhd63blyvfby75y9s7flky" {};
+libpthread = applePackage' "libpthread" "454.40.3" "macos-11.0.1" "0zljbw8mpb80n1if65hhi9lkgwbgjr8vc9wvf7q1nl3mzyl35f8p" {};
+libresolv = applePackage' "libresolv" "68" "macos-11.0.1" "045ahh8nvaam9whryc2f5g5xagwp7d187r80kcff82snp5p66aq1" {};
+libunwind = applePackage' "libunwind" "200.10" "macos-11.0.1" "0wa4ssr7skn5j0ncm1rigd56qmbs982zvwr3qpjn28krwp8wvigd" {};
+libutil = applePackage' "libutil" "58.40.2" "macos-11.0.1" "11s0vizk7bg0k0yjx21j8vaji4j4vk57131qbp07i9lpksb3bcy4" {};
+mDNSResponder = applePackage' "mDNSResponder" "1310.40.42" "macos-11.0.1" "0xxrqqbqsf0pagfs1yzwfbwf7lhr0sns97k18y7kh4ri0p09h44c" {};
+network_cmds = applePackage' "network_cmds" "606.40.2" "macos-11.0.1" "1jsy13nraarafq6wmgh3wyir8wrwfra148xsjns7cw7q5xn40a1w" {};
+objc4 = applePackage' "objc4" "818.2" "macos-11.0.1" "0m8mk1qd18wqjfn2jsq2lx6fxvllhmadmvz11jzg8vjw8pq91nw2" {};
+ppp = applePackage' "ppp" "877.40.2" "macos-11.0.1" "06xznc77j45zzi12m4cmr3jj853qlc8dbmynbg1z6m9qf5phdbgk" {};
+removefile = applePackage' "removefile" "49.40.3" "macos-11.0.1" "0870ihxpmvj8ggaycwlismbgbw9768lz7w6mc9vxf8l6nlc43z4f" {};
+shell_cmds = applePackage' "shell_cmds" "216.40.4" "macos-11.0.1" "0wbysc9lwf1xgl686r3yn95rndcmqlp17zc1ig9gsl5fxyy5bghh" {};
+system_cmds = applePackage' "system_cmds" "880.40.5" "macos-11.0.1" "064yqf84ny0cjpqmzmnhz05faay6axb2r4i6knnyc8n21yiip5dc" {};
+text_cmds = applePackage' "text_cmds" "106" "macos-11.0.1" "17fn35m6i866zjrf8da6cq6crydp6vp4zq0aaab243rv1fx303yy" {};
+top = applePackage' "top" "129" "macos-11.0.1" "0d9pqmv3mwkfcv7c05hfvnvnn4rbsl92plr5hsazp854pshzqw2k" {};
+xnu = applePackage' "xnu" "7195.50.7.100.1" "macos-11.0.1" "11zjmpw11rcc6a0xlbwramra1rsr65s4ypnxwpajgbr2c657lipl" {};
 }
diff --git a/pkgs/os-specific/darwin/moltenvk/default.nix b/pkgs/os-specific/darwin/moltenvk/default.nix
index 07645c5e61c65..3d48f3d86cac1 100644
--- a/pkgs/os-specific/darwin/moltenvk/default.nix
+++ b/pkgs/os-specific/darwin/moltenvk/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.2.1";
+  version = "1.2.2";
 
   buildInputs = [
     AppKit
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JqHPKLSFq+8hyOjVZbjh4AsHM8zSF7ZVxlEePmnEC2w=";
+    hash = "sha256-XowMXhGqPcxJ0DS3G41tpBO68va94a7SZHOOgguCxy0=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index d7a13faf4a0b3..d9ae091f8f0fe 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.366";
+  version = "0.367";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-Qn5fx4EiE4bGmPaMcB3ne0wS5ZRRgZC+cYEH5HCRQ7g=";
+    sha256 = "sha256-cFusLjRH7E3TCEREQH4Y9fZLjB6b5IJV/NThdS7c19A=";
   };
 
   postPatch = ''
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/vcrhonek/hwdata";
     description = "Hardware Database, including Monitors, pci.ids, usb.ids, and video cards";
     license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ pedrohlc ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index b03f3c3c16c65..73d2b06cac1f5 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -3,6 +3,7 @@
 { stdenv
 , lib
 , nixosTests
+, pkgsCross
 , fetchFromGitHub
 , fetchpatch
 , fetchzip
@@ -63,6 +64,7 @@
 , withKexectools ? lib.meta.availableOn stdenv.hostPlatform kexec-tools
 , kexec-tools
 , bashInteractive
+, bash
 , libmicrohttpd
 , libfido2
 , p11-kit
@@ -139,7 +141,7 @@ let
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
   releaseTimestamp = "1667246393";
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
@@ -339,7 +341,7 @@ stdenv.mkDerivation {
   # when cross-compiling.
   + ''
     shopt -s extglob
-    patchShebangs tools test src/!(rpm)
+    patchShebangs tools test src/!(rpm|kernel-install) src/kernel-install/test-kernel-install.sh
   '';
 
   outputs = [ "out" "man" "dev" ];
@@ -362,6 +364,7 @@ stdenv.mkDerivation {
       docbook_xsl
       docbook_xml_dtd_42
       docbook_xml_dtd_45
+      bash
       (buildPackages.python3Packages.python.withPackages (ps: with ps; [ lxml jinja2 ]))
     ]
     ++ lib.optionals withLibBPF [
@@ -382,9 +385,10 @@ stdenv.mkDerivation {
       libuuid
       linuxHeaders
       pam
+      bashInteractive # for patch shebangs
     ]
 
-    ++ lib.optional wantGcrypt libgcrypt
+    ++ lib.optionals wantGcrypt [ libgcrypt libgpg-error ]
     ++ lib.optional withTests glib
     ++ lib.optional withApparmor libapparmor
     ++ lib.optional wantCurl (lib.getDev curl)
@@ -396,7 +400,6 @@ stdenv.mkDerivation {
     ++ lib.optional withLibseccomp libseccomp
     ++ lib.optional withNetworkd iptables
     ++ lib.optional withPCRE2 pcre2
-    ++ lib.optional withResolved libgpg-error
     ++ lib.optional withSelinux libselinux
     ++ lib.optional withRemote libmicrohttpd
     ++ lib.optionals withHomed [ p11-kit ]
@@ -695,6 +698,10 @@ stdenv.mkDerivation {
     mv $out/dont-strip-me $out/lib/systemd/boot/efi
   '';
 
+  disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
+    # 'or p' is for manually specified buildPackages as they dont have __spliced
+    (builtins.map (p: p.__spliced.buildHost or p) finalAttrs.nativeBuildInputs);
+
   passthru = {
     # The interface version prevents NixOS from switching to an
     # incompatible systemd at runtime.  (Switching across reboots is
@@ -708,6 +715,7 @@ stdenv.mkDerivation {
 
     tests = {
       inherit (nixosTests) switchTest;
+      cross = pkgsCross.aarch64-multiplatform.systemd;
     };
   };
 
@@ -722,4 +730,4 @@ stdenv.mkDerivation {
     priority = 10;
     maintainers = with maintainers; [ flokli kloenk mic92 ];
   };
-}
+})
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index eeecc655aef92..3c8b7f6663f18 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -11,6 +11,7 @@
 , nlsSupport ? true
 , translateManpages ? true
 , po4a
+, installShellFiles
 }:
 
 stdenv.mkDerivation rec {
@@ -66,7 +67,7 @@ stdenv.mkDerivation rec {
     "usrsbin_execdir=${placeholder "bin"}/sbin"
   ];
 
-  nativeBuildInputs = [ pkg-config ]
+  nativeBuildInputs = [ pkg-config installShellFiles ]
     ++ lib.optionals translateManpages [ po4a ];
 
   buildInputs = [ zlib libxcrypt ]
@@ -79,6 +80,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  postInstall = ''
+    installShellCompletion --bash bash-completion/*
+  '';
+
   meta = with lib; {
     homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
     description = "A set of system utilities for Linux";
diff --git a/pkgs/servers/gpsd/default.nix b/pkgs/servers/gpsd/default.nix
index d1b11dfd3d55b..e8bc31abed836 100644
--- a/pkgs/servers/gpsd/default.nix
+++ b/pkgs/servers/gpsd/default.nix
@@ -59,7 +59,6 @@ stdenv.mkDerivation rec {
     atk
     dbus-glib
     gdk-pixbuf
-    gobject-introspection
     libX11
     libXaw
     libXext
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 4f3a19db7fea5..60a6c88c4dd67 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -13,13 +13,17 @@ let
     # Server components
     , bzip2, lz4, lzo, snappy, xz, zlib, zstd
     , cracklib, judy, libevent, libxml2
-    , linux-pam, numactl, pmdk
+    , linux-pam, numactl
     , fmt_8
     , withStorageMroonga ? true, kytea, libsodium, msgpack, zeromq
     , withStorageRocks ? true
     , withEmbedded ? false
+    , withNuma ? false
     }:
+
   let
+    isCross = stdenv.buildPlatform != stdenv.hostPlatform;
+
     libExt = stdenv.hostPlatform.extensions.sharedLibrary;
 
     mytopEnv = buildPackages.perl.withPackages (p: with p; [ DBDmysql DBI TermReadKey ]);
@@ -99,7 +103,7 @@ let
       ] ++ lib.optionals (stdenv.hostPlatform.isDarwin && lib.versionAtLeast version "10.6") [
         # workaround for https://jira.mariadb.org/browse/MDEV-29925
         "-Dhave_C__Wl___as_needed="
-      ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+      ] ++ lib.optionals isCross [
         # revisit this if nixpkgs supports any architecture whose stack grows upwards
         "-DSTACK_DIRECTION=-1"
         "-DCMAKE_CROSSCOMPILING_EMULATOR=${stdenv.hostPlatform.emulator buildPackages}"
@@ -169,16 +173,13 @@ let
       buildInputs = common.buildInputs ++ [
         bzip2 lz4 lzo snappy xz zstd
         cracklib judy libevent libxml2
-      ] ++ lib.optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) numactl
+      ] ++ lib.optional withNuma numactl
         ++ lib.optionals stdenv.hostPlatform.isLinux [ linux-pam ]
-        ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) pmdk.dev
         ++ lib.optional (!stdenv.hostPlatform.isDarwin) mytopEnv
         ++ lib.optionals withStorageMroonga [ kytea libsodium msgpack zeromq ]
         ++ lib.optionals (lib.versionAtLeast common.version "10.7") [ fmt_8 ];
 
-      propagatedBuildInputs = lib.optionals withEmbedded
-        (lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) pmdk.lib
-         ++ lib.optional (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) numactl);
+      propagatedBuildInputs = lib.optional withNuma numactl;
 
       postPatch = ''
         substituteInPlace scripts/galera_new_cluster.sh \
@@ -197,7 +198,7 @@ let
         "-DWITHOUT_EXAMPLE=1"
         "-DWITHOUT_FEDERATED=1"
         "-DWITHOUT_TOKUDB=1"
-      ] ++ lib.optionals (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32) [
+      ] ++ lib.optionals withNuma [
         "-DWITH_NUMA=ON"
       ] ++ lib.optionals (!withStorageMroonga) [
         "-DWITHOUT_MROONGA=1"
diff --git a/pkgs/servers/x11/quartz-wm/default.nix b/pkgs/servers/x11/quartz-wm/default.nix
index 2d132b389be68..3cf65e990795a 100644
--- a/pkgs/servers/x11/quartz-wm/default.nix
+++ b/pkgs/servers/x11/quartz-wm/default.nix
@@ -12,6 +12,7 @@ in stdenv.mkDerivation {
     ./no_title_crash.patch
     ./extern-patch.patch
   ];
+  configureFlags = [ "--enable-xplugin-dock-support" ];
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     xorg.libXinerama
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index e46d8e750a030..41bc0609c91aa 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -696,11 +696,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontutil = callPackage ({ stdenv, pkg-config, fetchurl }: stdenv.mkDerivation {
     pname = "font-util";
-    version = "1.3.1";
+    version = "1.3.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/font/font-util-1.3.1.tar.bz2";
-      sha256 = "08drjb6cf84pf5ysghjpb4i7xkd2p86k3wl2a0jxs1jif6qbszma";
+      url = "mirror://xorg/individual/font/font-util-1.3.3.tar.xz";
+      sha256 = "1lpb5qd2drilql4wl644m682hvmv67hdbbisnrm0ah4wfy8ci4g7";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -892,11 +892,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpthreadstubs, libxcb, xtrans }: stdenv.mkDerivation {
     pname = "libX11";
-    version = "1.8.3";
+    version = "1.8.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.8.3.tar.xz";
-      sha256 = "1gc5cnfys48m1y9y1cidph89fww5c209qff93phbidh68346a5g3";
+      url = "mirror://xorg/individual/lib/libX11-1.8.4.tar.xz";
+      sha256 = "sha256-yaKHpa76mATOPPr89Rb+lu0/fo5FwOLuWehMhnV99Rg=";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index d0a2ec881219c..1b4b5e000b78d 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -26,7 +26,7 @@ self: super:
 {
   wrapWithXFileSearchPathHook = callPackage ({ makeBinaryWrapper, makeSetupHook, writeScript }: makeSetupHook {
       name = "wrapWithXFileSearchPathHook";
-      deps = [ makeBinaryWrapper ];
+      propagatedBuildInputs = [ makeBinaryWrapper ];
     } (writeScript "wrapWithXFileSearchPathHook.sh" ''
       wrapWithXFileSearchPath() {
         paths=(
@@ -741,35 +741,24 @@ self: super:
       attrs =
         if (abiCompat == null || lib.hasPrefix abiCompat version) then
           attrs_passed // {
-            buildInputs = attrs_passed.buildInputs ++ [ libdrm.dev ]; postPatch = ''
-            for i in dri3/*.c
-            do
-              sed -i -e "s|#include <drm_fourcc.h>|#include <libdrm/drm_fourcc.h>|" $i
-            done
-          '';}
-        else if (abiCompat == "1.18") then {
-            name = "xorg-server-1.18.4";
-            builder = ./builder.sh;
-            src = fetchurl {
-              url = "mirror://xorg/individual/xserver/xorg-server-1.18.4.tar.bz2";
-              sha256 = "1j1i3n5xy1wawhk95kxqdc54h34kg7xp4nnramba2q8xqfr5k117";
-            };
-            nativeBuildInputs = [ pkg-config ];
-            buildInputs = [ xorgproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ];
-            postPatch = lib.optionalString stdenv.isLinux "sed '1i#include <malloc.h>' -i include/os.h";
-            meta.platforms = lib.platforms.unix;
-            meta.broken = stdenv.isDarwin;
-        } else throw "unsupported xorg abiCompat ${abiCompat} for ${attrs_passed.name}";
+            buildInputs = attrs_passed.buildInputs ++
+              lib.optional (libdrm != null) libdrm.dev;
+            postPatch = ''
+              for i in dri3/*.c
+              do
+                sed -i -e "s|#include <drm_fourcc.h>|#include <libdrm/drm_fourcc.h>|" $i
+              done
+            '';
+          }
+        else throw "unsupported xorg abiCompat ${abiCompat} for ${attrs_passed.name}";
 
     in attrs //
     (let
       version = lib.getVersion attrs;
       commonBuildInputs = attrs.buildInputs ++ [ xtrans ];
       commonPropagatedBuildInputs = [
-        zlib libGL libGLU dbus
-        xorgproto
-        libXext pixman libXfont libxshmfence libunwind
-        libXfont2
+        dbus libGL libGLU libXext libXfont libXfont2 libepoxy libunwind
+        libxshmfence pixman xorgproto zlib
       ];
       # XQuartz requires two compilations: the first to get X / XQuartz,
       # and the second to get Xvfb, Xnest, etc.
@@ -870,7 +859,7 @@ self: super:
           })
         ];
         buildInputs = commonBuildInputs ++ [ libdrm mesa ];
-        propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess libepoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
+        propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
           udev
         ];
         depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -909,7 +898,7 @@ self: super:
         '';
         passthru.version = version; # needed by virtualbox guest additions
       } else {
-        nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook xorg.utilmacros xorg.fontutil ];
+        nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook bootstrap_cmds xorg.utilmacros xorg.fontutil ];
         buildInputs = commonBuildInputs ++ [
           bootstrap_cmds automake autoconf
           Xplugin Carbon Cocoa
@@ -945,6 +934,7 @@ self: super:
         configureFlags = [
           # note: --enable-xquartz is auto
           "CPPFLAGS=-I${./darwin/dri}"
+          "--disable-glamor"
           "--with-default-font-path="
           "--with-apple-application-name=XQuartz"
           "--with-apple-applications-dir=\${out}/Applications"
@@ -1005,7 +995,7 @@ self: super:
   xinit = (super.xinit.override {
     stdenv = if isDarwin then clangStdenv else stdenv;
   }).overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ lib.optional isDarwin bootstrap_cmds;
+    nativeBuildInputs = attrs.nativeBuildInputs ++ lib.optional isDarwin bootstrap_cmds;
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     configureFlags = [
       "--with-xserver=${xorg.xorgserver.out}/bin/X"
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index dd09fbba34f52..f5d004fd0f651 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -163,7 +163,7 @@ mirror://xorg/individual/font/font-schumacher-misc-1.1.2.tar.bz2
 mirror://xorg/individual/font/font-screen-cyrillic-1.0.4.tar.bz2
 mirror://xorg/individual/font/font-sony-misc-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-sun-misc-1.0.3.tar.bz2
-mirror://xorg/individual/font/font-util-1.3.1.tar.bz2
+mirror://xorg/individual/font/font-util-1.3.3.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.3.tar.bz2
 mirror://xorg/individual/font/font-xfree86-type1-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libAppleWM-1.4.1.tar.bz2
@@ -174,7 +174,7 @@ mirror://xorg/individual/lib/libICE-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libpciaccess-0.16.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.3.tar.bz2
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.8.3.tar.xz
+mirror://xorg/individual/lib/libX11-1.8.4.tar.xz
 mirror://xorg/individual/lib/libXau-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXaw-1.0.14.tar.bz2
 mirror://xorg/individual/lib/libxcb-1.14.tar.xz
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 3d60934557c6a..6bf319d07308a 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -18,33 +18,34 @@ let
       # separate lines, because Nix would only show the last line of the comment.
 
       # An infinite recursion here can be caused by having the attribute names of expression `e` in `.overrideAttrs(finalAttrs: previousAttrs: e)` depend on `finalAttrs`. Only the attribute values of `e` can depend on `finalAttrs`.
-      args = rattrs (args // { inherit finalPackage; });
+      args = rattrs (args // { inherit finalPackage overrideAttrs; });
       #              ^^^^
 
-      finalPackage =
-        mkDerivationSimple
-          (f0:
-            let
-              f = self: super:
-                # Convert f0 to an overlay. Legacy is:
-                #   overrideAttrs (super: {})
-                # We want to introduce self. We follow the convention of overlays:
-                #   overrideAttrs (self: super: {})
-                # Which means the first parameter can be either self or super.
-                # This is surprising, but far better than the confusion that would
-                # arise from flipping an overlay's parameters in some cases.
-                let x = f0 super;
-                in
-                  if builtins.isFunction x
-                  then
-                    # Can't reuse `x`, because `self` comes first.
-                    # Looks inefficient, but `f0 super` was a cheap thunk.
-                    f0 self super
-                  else x;
+      overrideAttrs = f0:
+        let
+          f = self: super:
+            # Convert f0 to an overlay. Legacy is:
+            #   overrideAttrs (super: {})
+            # We want to introduce self. We follow the convention of overlays:
+            #   overrideAttrs (self: super: {})
+            # Which means the first parameter can be either self or super.
+            # This is surprising, but far better than the confusion that would
+            # arise from flipping an overlay's parameters in some cases.
+            let x = f0 super;
             in
-              makeDerivationExtensible
-                (self: let super = rattrs self; in super // f self super))
-          args;
+              if builtins.isFunction x
+              then
+                # Can't reuse `x`, because `self` comes first.
+                # Looks inefficient, but `f0 super` was a cheap thunk.
+                f0 self super
+              else x;
+        in
+          makeDerivationExtensible
+            (self: let super = rattrs self; in super // f self super);
+
+      finalPackage =
+        mkDerivationSimple overrideAttrs args;
+
     in finalPackage;
 
   # makeDerivationExtensibleConst == makeDerivationExtensible (_: attrs),
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index cbf2a2ceb8dee..1a637bf13fdd2 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -28,10 +28,16 @@ if [ -n "$__structuredAttrs" ]; then
         # ex: out=/nix/store/...
         export "$outputName=${outputs[$outputName]}"
     done
-    # $NIX_ATTRS_JSON_FILE points to the wrong location in sandbox
-    # https://github.com/NixOS/nix/issues/6736
-    export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
-    export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
+
+    # $NIX_ATTRS_JSON_FILE pointed to the wrong location in sandbox
+    # https://github.com/NixOS/nix/issues/6736; please keep around until the
+    # fix reaches *every patch version* that's >= lib/minver.nix
+    if ! [[ -e "$NIX_ATTRS_JSON_FILE" ]]; then
+        export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
+    fi
+    if ! [[ -e "$NIX_ATTRS_SH_FILE" ]]; then
+        export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
+    fi
 else
     : "${outputs:=out}"
 fi
@@ -989,6 +995,39 @@ stripHash() {
 }
 
 
+recordPropagatedDependencies() {
+    # Propagate dependencies into the development output.
+    declare -ra flatVars=(
+        # Build
+        depsBuildBuildPropagated
+        propagatedNativeBuildInputs
+        depsBuildTargetPropagated
+        # Host
+        depsHostHostPropagated
+        propagatedBuildInputs
+        # Target
+        depsTargetTargetPropagated
+    )
+    declare -ra flatFiles=(
+        "${propagatedBuildDepFiles[@]}"
+        "${propagatedHostDepFiles[@]}"
+        "${propagatedTargetDepFiles[@]}"
+    )
+
+    local propagatedInputsIndex
+    for propagatedInputsIndex in "${!flatVars[@]}"; do
+        local propagatedInputsSlice="${flatVars[$propagatedInputsIndex]}[@]"
+        local propagatedInputsFile="${flatFiles[$propagatedInputsIndex]}"
+
+        [[ "${!propagatedInputsSlice}" ]] || continue
+
+        mkdir -p "${!outputDev}/nix-support"
+        # shellcheck disable=SC2086
+        printWords ${!propagatedInputsSlice} > "${!outputDev}/nix-support/$propagatedInputsFile"
+    done
+}
+
+
 unpackCmdHooks+=(_defaultUnpack)
 _defaultUnpack() {
     local fn="$1"
@@ -1373,36 +1412,8 @@ fixupPhase() {
     done
 
 
-    # Propagate dependencies & setup hook into the development output.
-    declare -ra flatVars=(
-        # Build
-        depsBuildBuildPropagated
-        propagatedNativeBuildInputs
-        depsBuildTargetPropagated
-        # Host
-        depsHostHostPropagated
-        propagatedBuildInputs
-        # Target
-        depsTargetTargetPropagated
-    )
-    declare -ra flatFiles=(
-        "${propagatedBuildDepFiles[@]}"
-        "${propagatedHostDepFiles[@]}"
-        "${propagatedTargetDepFiles[@]}"
-    )
-
-    local propagatedInputsIndex
-    for propagatedInputsIndex in "${!flatVars[@]}"; do
-        local propagatedInputsSlice="${flatVars[$propagatedInputsIndex]}[@]"
-        local propagatedInputsFile="${flatFiles[$propagatedInputsIndex]}"
-
-        [[ "${!propagatedInputsSlice}" ]] || continue
-
-        mkdir -p "${!outputDev}/nix-support"
-        # shellcheck disable=SC2086
-        printWords ${!propagatedInputsSlice} > "${!outputDev}/nix-support/$propagatedInputsFile"
-    done
-
+    # record propagated dependencies & setup hook into the development output.
+    recordPropagatedDependencies
 
     if [ -n "${setupHook:-}" ]; then
         mkdir -p "${!outputDev}/nix-support"
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 39039c5950e46..71d065179d172 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -61,6 +61,8 @@ with pkgs;
 
   nixos-functions = callPackage ./nixos-functions {};
 
+  overriding = callPackage ./overriding.nix { };
+
   patch-shebangs = callPackage ./patch-shebangs {};
 
   texlive = callPackage ./texlive {};
diff --git a/pkgs/test/overriding.nix b/pkgs/test/overriding.nix
new file mode 100644
index 0000000000000..edc1b27cf4f1d
--- /dev/null
+++ b/pkgs/test/overriding.nix
@@ -0,0 +1,56 @@
+{ lib, pkgs, stdenvNoCC }:
+
+let
+  tests =
+    let
+      p = pkgs.python3Packages.xpybutil.overridePythonAttrs (_: { dontWrapPythonPrograms = true; });
+    in
+    [
+      ({
+        name = "overridePythonAttrs";
+        expr = !lib.hasInfix "wrapPythonPrograms" p.postFixup;
+        expected = true;
+      })
+      ({
+        name = "repeatedOverrides-pname";
+        expr = repeatedOverrides.pname == "a-better-hello-with-blackjack";
+        expected = true;
+      })
+      ({
+        name = "repeatedOverrides-entangled-pname";
+        expr = repeatedOverrides.entangled.pname == "a-better-figlet-with-blackjack";
+        expected = true;
+      })
+    ];
+
+  addEntangled = origOverrideAttrs: f:
+    origOverrideAttrs (
+      lib.composeExtensions f (self: super: {
+        passthru = super.passthru // {
+          entangled = super.passthru.entangled.overrideAttrs f;
+          overrideAttrs = addEntangled self.overrideAttrs;
+        };
+      })
+    );
+
+  entangle = pkg1: pkg2: pkg1.overrideAttrs (self: super: {
+    passthru = super.passthru // {
+      entangled = pkg2;
+      overrideAttrs = addEntangled self.overrideAttrs;
+    };
+  });
+
+  example = entangle pkgs.hello pkgs.figlet;
+
+  overrides1 = example.overrideAttrs (_: super: { pname = "a-better-${super.pname}"; });
+
+  repeatedOverrides = overrides1.overrideAttrs (_: super: { pname = "${super.pname}-with-blackjack"; });
+in
+
+stdenvNoCC.mkDerivation {
+  name = "test-overriding";
+  passthru = { inherit tests; };
+  buildCommand = ''
+    touch $out
+  '' + lib.concatMapStringsSep "\n" (t: "([[ ${lib.boolToString t.expr} == ${lib.boolToString t.expected} ]] && echo '${t.name} success') || (echo '${t.name} fail' && exit 1)") tests;
+}
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 40df92b4d538c..ca04ead396b72 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zstd";
-  version = "1.5.2";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "zstd";
     rev = "v${version}";
-    sha256 = "sha256-yJvhcysxcbUGuDOqe/TQ3Y5xyM2AUw6r1THSHOqmUy0=";
+    sha256 = "sha256-2blY4hY4eEcxY8K9bIhYPbfb//rt/+J2TmvxABPG78A=";
   };
 
   nativeBuildInputs = [ cmake ]
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index e2677957e9cdf..a42d7cce67d42 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -2,7 +2,7 @@
 , ensureNewerSourcesHook
 , cmake, pkg-config
 , which, git
-, boost175
+, boost175, xz
 , libxml2, zlib, lz4
 , openldap, lttng-ust
 , babeltrace, gperf
@@ -182,7 +182,7 @@ in rec {
     ];
 
     buildInputs = cryptoLibsMap.${cryptoStr} ++ [
-      boost ceph-python-env libxml2 optYasm optLibatomic_ops optLibs3
+      boost xz ceph-python-env libxml2 optYasm optLibatomic_ops optLibs3
       malloc zlib openldap lttng-ust babeltrace gperf gtest cunit
       snappy lz4 oath-toolkit leveldb libnl libcap_ng rdkafka
       cryptsetup sqlite lua icu bzip2
diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index 4a75e28deb8ac..b66c2d0a7590f 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "sdk-${finalAttrs.version}";
-    hash = "sha256-zx/fjDKgteWizC3O1bL4WSwwPNw2/2m0xCnCiOttgAo=";
+    hash = "sha256-Awtsz4iMuS3JuvaYHRxjo56EnnZPjo9YGfeYAi7lmJY=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index bf60e8ed85f32..63d763a893daf 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-ExtensionLayer";
       rev = "sdk-${version}";
-      hash = "sha256-NlBS7UuV2AZPY5VyoqTnTf63M7fHIPQDZRtMZ4XwMzA=";
+      hash = "sha256-0t9HGyiYk3twYQLFCcWsrPiXY1dqjdCadjP4yMLoFwA=";
     });
 
   nativeBuildInputs = [ cmake jq ];
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 11cef8eeb886b..ec1862df9cd77 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -10,6 +10,7 @@
 , libXrandr
 , libffi
 , libxcb
+, pkg-config
 , wayland
 , which
 , xcbutilkeysyms
@@ -24,18 +25,18 @@
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
   # The version must match that in vulkan-headers
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "LunarG";
       repo = "VulkanTools";
       rev = "sdk-${version}";
-      hash = "sha256-0dGD3InmEd9hO8+uVGMqBHXXfyX8tswyuOaZCftudz0=";
+      hash = "sha256-zgkuTy9ccg8D/riA1CM/PnbXW1R0jWEINtcEVilETwk=";
       fetchSubmodules = true;
     });
 
-  nativeBuildInputs = [ cmake python3 jq which ];
+  nativeBuildInputs = [ cmake python3 jq which pkg-config ];
 
   buildInputs = [
     expat
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 8e94997db6c8e..da84038fd0fdb 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.236.0";
+  version = "1.3.239.0";
 
   # It's not strictly necessary to have matching versions here, however
   # since we're using the SDK version we may as well be consistent with
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
       owner = "KhronosGroup";
       repo = "Vulkan-Tools";
       rev = "sdk-${version}";
-      hash = "sha256-PmNTpdAkXJkARLohRtUOuKTZPoKgeVF4DAo1wsAq5xE=";
+      hash = "sha256-DQGwxTZzS0eATKodMpeJaQdXADvomiqPOspDYoPFZjI=";
     });
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch b/pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch
index 5cbcec6a8a145..5d09bff9c958c 100644
--- a/pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch
+++ b/pkgs/tools/graphics/vulkan-tools/use-nix-moltenvk.patch
@@ -1,8 +1,8 @@
 diff --git a/cube/CMakeLists.txt b/cube/CMakeLists.txt
-index 616fbc96..d2811c8d 100644
+index a2f026e7..327f5dba 100644
 --- a/cube/CMakeLists.txt
 +++ b/cube/CMakeLists.txt
-@@ -262,14 +262,7 @@ else()
+@@ -257,14 +257,7 @@ else()
  endif()
  
  if(APPLE)
@@ -18,7 +18,7 @@ index 616fbc96..d2811c8d 100644
  else()
      install(TARGETS vkcube RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
  endif()
-@@ -309,14 +302,7 @@ else()
+@@ -302,14 +295,7 @@ else()
  endif()
  
  if(APPLE)
@@ -35,10 +35,10 @@ index 616fbc96..d2811c8d 100644
      install(TARGETS vkcubepp RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
  endif()
 diff --git a/cube/macOS/cube/cube.cmake b/cube/macOS/cube/cube.cmake
-index 9b823f95..238c3e67 100644
+index 9b823f95..0c43a2c9 100644
 --- a/cube/macOS/cube/cube.cmake
 +++ b/cube/macOS/cube/cube.cmake
-@@ -72,12 +69,14 @@ set_source_files_properties("${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json"
+@@ -72,12 +72,14 @@ set_source_files_properties("${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json"
  # Copy the MoltenVK lib into the bundle.
  if(${CMAKE_GENERATOR} MATCHES "^Xcode.*")
      add_custom_command(TARGET vkcube POST_BUILD
@@ -56,10 +56,10 @@ index 9b823f95..238c3e67 100644
                         DEPENDS vulkan)
  endif()
 diff --git a/cube/macOS/cubepp/cubepp.cmake b/cube/macOS/cubepp/cubepp.cmake
-index eae4de3c..0acd18f9 100644
+index eae4de3c..e528ae26 100644
 --- a/cube/macOS/cubepp/cubepp.cmake
 +++ b/cube/macOS/cubepp/cubepp.cmake
-@@ -74,12 +71,14 @@ set_source_files_properties("${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json"
+@@ -74,12 +74,14 @@ set_source_files_properties("${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json"
  # Copy the MoltenVK lib into the bundle.
  if(${CMAKE_GENERATOR} MATCHES "^Xcode.*")
      add_custom_command(TARGET vkcubepp POST_BUILD
@@ -107,10 +107,10 @@ index bad3c414..b498906d 100644
  
  find_library(COCOA NAMES Cocoa)
 diff --git a/vulkaninfo/CMakeLists.txt b/vulkaninfo/CMakeLists.txt
-index fb236a5b..3c8270d4 100644
+index d23dcf89..32aa0ebb 100644
 --- a/vulkaninfo/CMakeLists.txt
 +++ b/vulkaninfo/CMakeLists.txt
-@@ -139,9 +139,4 @@ elseif(APPLE)
+@@ -136,9 +136,5 @@ elseif(APPLE)
      add_definitions(-DVK_USE_PLATFORM_MACOS_MVK -DVK_USE_PLATFORM_METAL_EXT)
  endif()
  
@@ -119,37 +119,5 @@ index fb236a5b..3c8270d4 100644
 -else()
 -    install(TARGETS vulkaninfo RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 -endif()
--
 +install(TARGETS vulkaninfo RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
-diff --git a/vulkaninfo/macOS/vulkaninfo.cmake b/vulkaninfo/macOS/vulkaninfo.cmake
-index 9614530e..56af3b89 100644
---- a/vulkaninfo/macOS/vulkaninfo.cmake
-+++ b/vulkaninfo/macOS/vulkaninfo.cmake
-@@ -48,26 +48,4 @@ set_source_files_properties(${CMAKE_BINARY_DIR}/staging-json/MoltenVK_icd.json
-                             MACOSX_PACKAGE_LOCATION
-                             "Resources/vulkan/icd.d")
  
--# Xcode projects need some extra help with what would be install steps.
--if(${CMAKE_GENERATOR} MATCHES "^Xcode.*")
--    add_custom_command(TARGET vulkaninfo-bundle POST_BUILD
--                       COMMAND ${CMAKE_COMMAND} -E copy "${MOLTENVK_DIR}/MoltenVK/dylib/macOS/libMoltenVK.dylib"
--                               ${CMAKE_CURRENT_BINARY_DIR}/$<CONFIG>/vulkaninfo.app/Contents/Frameworks/libMoltenVK.dylib
--                       DEPENDS vulkan)
--else()
--    add_custom_command(TARGET vulkaninfo-bundle POST_BUILD
--                       COMMAND ${CMAKE_COMMAND} -E copy "${MOLTENVK_DIR}/MoltenVK/dylib/macOS/libMoltenVK.dylib"
--                               ${CMAKE_CURRENT_BINARY_DIR}/vulkaninfo.app/Contents/Frameworks/libMoltenVK.dylib
--                       DEPENDS vulkan)
--endif()
--
--# Keep RPATH so fixup_bundle can use it to find libraries
--set_target_properties(vulkaninfo-bundle PROPERTIES INSTALL_RPATH_USE_LINK_PATH TRUE)
--install(TARGETS vulkaninfo-bundle BUNDLE DESTINATION "vulkaninfo")
--# Fix up the library search path in the executable to find (loader) libraries in the bundle. When fixup_bundle() is passed a bundle
--# in the first argument, it looks at the Info.plist file to determine the BundleExecutable. In this case, the executable is a
--# script, which can't be fixed up. Instead pass it the explicit name of the executable.
--install(CODE "
--    include(BundleUtilities)
--    fixup_bundle(\${CMAKE_INSTALL_PREFIX}/vulkaninfo/vulkaninfo.app/Contents/MacOS/vulkaninfo \"\" \"${Vulkan_LIBRARY_DIR}\")
--    ")
-+install(TARGETS vulkaninfo-bundle BUNDLE DESTINATION "Applications")
diff --git a/pkgs/tools/inputmethods/ibus/build-without-dbus-launch.patch b/pkgs/tools/inputmethods/ibus/build-without-dbus-launch.patch
new file mode 100644
index 0000000000000..cb587ccf47d8b
--- /dev/null
+++ b/pkgs/tools/inputmethods/ibus/build-without-dbus-launch.patch
@@ -0,0 +1,21 @@
+diff --git a/data/dconf/make-dconf-override-db.sh b/data/dconf/make-dconf-override-db.sh
+index 601c1c3f..fcb7305d 100755
+--- a/data/dconf/make-dconf-override-db.sh
++++ b/data/dconf/make-dconf-override-db.sh
+@@ -12,10 +12,6 @@ export XDG_CACHE_HOME="$TMPDIR/cache"
+ export GSETTINGS_SCHEMA_DIR="$TMPDIR/schemas"
+ mkdir -p $XDG_CONFIG_HOME $XDG_CACHE_HOME $GSETTINGS_SCHEMA_DIR
+ 
+-eval `dbus-launch --sh-syntax`
+-
+-trap 'rm -rf $TMPDIR; kill $DBUS_SESSION_BUS_PID' ERR
+-
+ # in case that schema is not installed on the system
+ glib-compile-schemas --targetdir "$GSETTINGS_SCHEMA_DIR" "$PWD"
+ 
+@@ -52,5 +48,3 @@ if [ -d $TMPDIR/cache/gvfs ] ; then
+     umount $TMPDIR/cache/gvfs
+ fi
+ rm -rf $TMPDIR
+-
+-kill $DBUS_SESSION_BUS_PID
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index e3403e334b8b4..e3b4acf7f28dd 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -71,6 +71,7 @@ stdenv.mkDerivation rec {
       pythonInterpreter = python3Runtime.interpreter;
       pythonSitePackages = python3.sitePackages;
     })
+    ./build-without-dbus-launch.patch
   ];
 
   outputs = [ "out" "dev" "installedTests" ];
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 806d1bc24bdc1..35ea4e992d887 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -17,6 +17,19 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-N1HH+6jbyDHLjXzIr/IQNUWbjOUVXviwiAon0ChHXzs=";
   };
 
+  patches = [
+    # Backport fix to identification for pyzip files.
+    # Needed for strip-nondeterminism.
+    # https://salsa.debian.org/reproducible-builds/strip-nondeterminism/-/issues/20
+    ./pyzip.patch
+
+    # Backport fix for --uncompress always detecting contents as "empty"
+    (fetchurl {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-apps/file/files/file-5.44-decompress-empty.patch?h=dfc57da515a2aaf085bea68267cc727f1bfaa691";
+      hash = "sha256-fUzRQAlLWczBmR5iA1Gk66mHjP40MJcMdgCtm2+u1SQ=";
+    })
+  ];
+
   strictDeps = true;
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/misc/file/pyzip.patch b/pkgs/tools/misc/file/pyzip.patch
new file mode 100644
index 0000000000000..57f9e7ef8b64e
--- /dev/null
+++ b/pkgs/tools/misc/file/pyzip.patch
@@ -0,0 +1,36 @@
+From dc71304b3b1fd2ed5f7098d59fb7f6ef10cfdc85 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Sat, 31 Dec 2022 20:24:08 +0000
+Subject: [PATCH] pyzip improvements (FC Stegerman)
+
+---
+ magic/Magdir/archive | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/magic/Magdir/archive b/magic/Magdir/archive
+index a706556d5..d58201e69 100644
+--- a/magic/Magdir/archive
++++ b/magic/Magdir/archive
+@@ -1,5 +1,5 @@
+ #------------------------------------------------------------------------------
+-# $File: archive,v 1.179 2022/12/21 15:50:59 christos Exp $
++# $File: archive,v 1.180 2022/12/31 20:24:08 christos Exp $
+ # archive:  file(1) magic for archive formats (see also "msdos" for self-
+ #           extracting compressed archives)
+ #
+@@ -1876,9 +1876,14 @@
+ # https://en.wikipedia.org/wiki/ZIP_(file_format)#End_of_central_directory_record_(EOCD)
+ # by Michal Gorny <mgorny@gentoo.org>
+ -2	uleshort	0
+->&-22	string	PK\005\006	Zip archive, with extra data prepended
++>&-22	string	PK\005\006
++# without #!
++>>0	string	!#!	Zip archive, with extra data prepended
+ !:mime	application/zip
+ !:ext zip/cbz
++# with #!
++>>0	string/w	#!\ 	a
++>>>&-1	string/T	x	%s script executable (Zip archive)
+ 
+ # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
+ # by Stefan `Sec` Zehl <sec@42.org>
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index 76efc76678116..f32fba46d5500 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -16,6 +16,7 @@
 , jdk
 , usev110Api ? false
 , threadsafe ? false
+, python3
 }:
 
 # cpp and mpi options are mutually exclusive
@@ -25,7 +26,7 @@ assert !cppSupport || !mpiSupport;
 let inherit (lib) optional optionals; in
 
 stdenv.mkDerivation rec {
-  version = "1.12.2";
+  version = "1.14.0";
   pname = "hdf5"
     + lib.optionalString cppSupport "-cpp"
     + lib.optionalString fortranSupport "-fortran"
@@ -34,7 +35,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-${lib.versions.majorMinor version}/hdf5-${version}/src/hdf5-${version}.tar.bz2";
-    sha256 = "sha256-Goi742ITos6gyDlyAaRZZD5xVcnckeBiZ1s/sH7jiv4=";
+    sha256 = "sha256-5OeUM0UO2uKGWkxjKBiLtFORsp10+MU47mmfCxFsK6A=";
   };
 
   passthru = {
@@ -90,6 +91,10 @@ stdenv.mkDerivation rec {
     moveToOutput 'bin/h5pcc' "''${!outputDev}"
   '';
 
+  passthru.tests = {
+    inherit (python3.pkgs) h5py;
+  };
+
   meta = {
     description = "Data model, library, and file format for storing and managing data";
     longDescription = ''
diff --git a/pkgs/tools/networking/curl/7.88.0-http2-breakage.patch b/pkgs/tools/networking/curl/7.88.0-http2-breakage.patch
new file mode 100644
index 0000000000000..fd22299a7627a
--- /dev/null
+++ b/pkgs/tools/networking/curl/7.88.0-http2-breakage.patch
@@ -0,0 +1,101 @@
+From 3103de2053ca8cacf9cdbe78764ba6814481709f Mon Sep 17 00:00:00 2001
+Date: Wed, 15 Feb 2023 22:11:13 +0100
+Subject: [PATCH] http2: buffer/pausedata and output flush fix.
+
+ * do not process pending input data when copying pausedata to the
+   caller
+ * return CURLE_AGAIN if the output buffer could not be completely
+   written out.
+
+Ref: #10525
+Closes #10529
+---
+ lib/http2.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+diff --git a/lib/http2.c b/lib/http2.c
+index 46fc746457726..1ef5d3949218f 100644
+--- a/lib/http2.c
++++ b/lib/http2.c
+@@ -467,6 +467,7 @@ static CURLcode flush_output(struct Curl_cfilter *cf,
+   }
+   if((size_t)written < buflen) {
+     Curl_dyn_tail(&ctx->outbuf, buflen - (size_t)written);
++    return CURLE_AGAIN;
+   }
+   else {
+     Curl_dyn_reset(&ctx->outbuf);
+@@ -1790,6 +1791,7 @@ static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+ 
+     stream->pausedata += nread;
+     stream->pauselen -= nread;
++    drain_this(cf, data);
+ 
+     if(stream->pauselen == 0) {
+       DEBUGF(LOG_CF(data, cf, "[h2sid=%u] Unpaused", stream->stream_id));
+@@ -1798,18 +1800,6 @@ static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+ 
+       stream->pausedata = NULL;
+       stream->pauselen = 0;
+-
+-      /* When NGHTTP2_ERR_PAUSE is returned from
+-         data_source_read_callback, we might not process DATA frame
+-         fully.  Calling nghttp2_session_mem_recv() again will
+-         continue to process DATA frame, but if there is no incoming
+-         frames, then we have to call it again with 0-length data.
+-         Without this, on_stream_close callback will not be called,
+-         and stream could be hanged. */
+-      if(h2_process_pending_input(cf, data, err) != 0) {
+-        nread = -1;
+-        goto out;
+-      }
+     }
+     DEBUGF(LOG_CF(data, cf, "[h2sid=%u] recv: returns unpaused %zd bytes",
+                   stream->stream_id, nread));
+@@ -1933,6 +1923,7 @@ static ssize_t cf_h2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+       drained_transfer(cf, data);
+     }
+ 
++    *err = CURLE_OK;
+     nread = retlen;
+     DEBUGF(LOG_CF(data, cf, "[h2sid=%u] cf_h2_recv -> %zd",
+                   stream->stream_id, nread));
+
+
+From 87ed650d04dc1a6f7944a5d952f7d5b0934a19ac Mon Sep 17 00:00:00 2001
+From: Harry Sintonen <sintonen@iki.fi>
+Date: Thu, 16 Feb 2023 06:26:26 +0200
+Subject: [PATCH] http2: set drain on stream end
+
+Ensure that on_frame_recv() stream end will trigger a read if there is
+pending data. Without this it could happen that the pending data is
+never consumed.
+
+This combined with https://github.com/curl/curl/pull/10529 should fix
+https://github.com/curl/curl/issues/10525
+
+Ref: https://github.com/curl/curl/issues/10525
+Closes #10530
+---
+ lib/http2.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/lib/http2.c b/lib/http2.c
+index 1ef5d3949218f..bdb5e7378e9cb 100644
+--- a/lib/http2.c
++++ b/lib/http2.c
+@@ -868,6 +868,14 @@ static int on_frame_recv(nghttp2_session *session, const nghttp2_frame *frame,
+         return NGHTTP2_ERR_CALLBACK_FAILURE;
+       }
+     }
++    if(frame->hd.flags & NGHTTP2_FLAG_END_STREAM) {
++      /* Stream has ended. If there is pending data, ensure that read
++         will occur to consume it. */
++      if(!data->state.drain && stream->memlen) {
++        drain_this(cf, data_s);
++        Curl_expire(data, 0, EXPIRE_RUN_NOW);
++      }
++    }
+     break;
+   case NGHTTP2_HEADERS:
+     DEBUGF(LOG_CF(data_s, cf, "[h2sid=%u] recv frame HEADERS", stream_id));
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index b91e7733ab238..21173d4d070b7 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -48,18 +48,19 @@ assert !(opensslSupport && wolfsslSupport);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "7.87.0";
+  version = "7.88.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.bz2"
     ];
-    hash = "sha256-XW4Sh2G3EQlG0Sdq/28PJm8rcm9eYZ9+CgV6R0FV8wc=";
+    hash = "sha256-yB9DntAkQvapuVg237OpjgxHdhDKey9NWqH8MpVD0z8=";
   };
 
   patches = [
     ./7.79.1-darwin-no-systemconfiguration.patch
+    ./7.88.0-http2-breakage.patch
   ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index 01c70f3bf3f58..752cd74d77ab7 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -1,38 +1,84 @@
-{ lib, stdenv, fetchurl
-, glib, udev, libgudev, polkit, ppp, gettext, pkg-config, python3
-, libmbim, libqmi, systemd, vala, gobject-introspection, dbus
+{ lib
+, stdenv
+, fetchFromGitLab
+, glib
+, udev
+, libgudev
+, polkit
+, ppp
+, gettext
+, pkg-config
+, libxslt
+, python3
+, libmbim
+, libqmi
+, systemd
+, bash-completion
+, meson
+, ninja
+, vala
+, gobject-introspection
+, dbus
 }:
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.18.12";
+  version = "1.20.4";
 
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/ModemManager/ModemManager-${version}.tar.xz";
-    sha256 = "sha256-tGTkkl2VWmyobdCGFudjsmrkbX/Tfb4oFnjjQGWx5DA=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mobile-broadband";
+    repo = "ModemManager";
+    rev = version;
+    hash = "sha256-OWP23EQ7a8rghhV7AC9yinCxRI0xwcntB5dl9XtgK6M=";
   };
 
-  nativeBuildInputs = [ vala gobject-introspection gettext pkg-config ];
+  patches = [
+    # Since /etc is the domain of NixOS, not Nix, we cannot install files there.
+    # But these are just placeholders so we do not need to install them at all.
+    ./no-dummy-dirs-in-sysconfdir.patch
+  ];
 
-  buildInputs = [ glib udev libgudev polkit ppp libmbim libqmi systemd ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    vala
+    gobject-introspection
+    gettext
+    pkg-config
+    libxslt
+  ];
+
+  buildInputs = [
+    glib
+    udev
+    libgudev
+    polkit
+    ppp
+    libmbim
+    libqmi
+    systemd
+    bash-completion
+    dbus
+  ];
 
   nativeInstallCheckInputs = [
-    python3 python3.pkgs.dbus-python python3.pkgs.pygobject3
+    python3
+    python3.pkgs.dbus-python
+    python3.pkgs.pygobject3
   ];
 
-  configureFlags = [
-    "--with-polkit"
-    "--with-udev-base-dir=${placeholder "out"}/lib/udev"
-    "--with-dbus-sys-dir=${placeholder "out"}/share/dbus-1/system.d"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+  mesonFlags = [
+    "-Dudevdir=${placeholder "out"}/lib/udev"
+    "-Ddbus_policy_dir=${placeholder "out"}/share/dbus-1/system.d"
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-systemd-suspend-resume"
-    "--with-systemd-journal"
+    "-Dvapi=true"
   ];
 
   postPatch = ''
-    patchShebangs tools/test-modemmanager-service.py
+    patchShebangs \
+      tools/test-modemmanager-service.py
   '';
 
   # In Nixpkgs g-ir-scanner is patched to produce absolute paths, and
@@ -47,8 +93,6 @@ stdenv.mkDerivation rec {
   '';
   installCheckTarget = "check";
 
-  enableParallelBuilding = true;
-
   meta = with lib; {
     description = "WWAN modem manager, part of NetworkManager";
     homepage = "https://www.freedesktop.org/wiki/Software/ModemManager/";
diff --git a/pkgs/tools/networking/modemmanager/no-dummy-dirs-in-sysconfdir.patch b/pkgs/tools/networking/modemmanager/no-dummy-dirs-in-sysconfdir.patch
new file mode 100644
index 0000000000000..d293efa7b2456
--- /dev/null
+++ b/pkgs/tools/networking/modemmanager/no-dummy-dirs-in-sysconfdir.patch
@@ -0,0 +1,20 @@
+diff --git a/data/dispatcher-connection/meson.build b/data/dispatcher-connection/meson.build
+index 2e7ef8b4..e0f4aa66 100644
+--- a/data/dispatcher-connection/meson.build
++++ b/data/dispatcher-connection/meson.build
+@@ -21,5 +21,4 @@ install_data(
+ )
+ 
+ mkdir_cmd = 'mkdir -p ${DESTDIR}@0@'
+-meson.add_install_script('sh', '-c', mkdir_cmd.format(mm_prefix / mm_connectiondiruser))
+ meson.add_install_script('sh', '-c', mkdir_cmd.format(mm_prefix / mm_connectiondirpackage))
+diff --git a/data/dispatcher-fcc-unlock/meson.build b/data/dispatcher-fcc-unlock/meson.build
+index 5dc3b6a0..25a948a1 100644
+--- a/data/dispatcher-fcc-unlock/meson.build
++++ b/data/dispatcher-fcc-unlock/meson.build
+@@ -39,5 +39,4 @@ foreach output, input: vidpids
+ endforeach
+ 
+ mkdir_cmd = 'mkdir -p ${DESTDIR}@0@'
+-meson.add_install_script('sh', '-c', mkdir_cmd.format(mm_prefix / mm_fccunlockdiruser))
+ meson.add_install_script('sh', '-c', mkdir_cmd.format(mm_prefix / mm_fccunlockdirpackage))
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 03c205f2d647e..5cd15525da72e 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -58,11 +58,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.40.6";
+  version = "1.40.12";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-LwJbLVr33lk7v0fBfk2YorlgjqkKgmD7CAgL6XQ5U04=";
+    sha256 = "sha256-wCJ+BKttAylmLfoKftxGbgQGJek2odjo4CoFM6cRca8=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5a4d2fbb189c5..0d1ac81827928 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1225,6 +1225,7 @@ mapAliases ({
   pleroma-otp = pleroma; # Added 2021-07-10
   plexpy = throw "'plexpy' has been renamed to/replaced by 'tautulli'"; # Converted to throw 2022-02-22
   pltScheme = racket; # just to be sure
+  pmdk = throw "'pmdk' is discontinued, no further support or maintenance is planned by upstream"; # Added 2023-02-06
   pmtools = throw "'pmtools' has been renamed to/replaced by 'acpica-tools'"; # Converted to throw 2022-02-22
   pocketsphinx = throw "pocketsphinx has been removed: unmaintained"; # Added 2022-04-24
   polarssl = throw "'polarssl' has been renamed to/replaced by 'mbedtls'"; # Converted to throw 2022-02-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d968a4a6e4bc7..8b2eaee926398 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -160,14 +160,14 @@ with pkgs;
   ### BUILD SUPPORT
 
   auditBlasHook = makeSetupHook
-    { name = "auto-blas-hook"; deps = [ blas lapack ]; }
+    { name = "auto-blas-hook"; propagatedBuildInputs = [ blas lapack ]; }
     ../build-support/setup-hooks/audit-blas.sh;
 
   autoreconfHook = callPackage (
     { makeSetupHook, autoconf, automake, gettext, libtool }:
     makeSetupHook {
       name = "autoreconf-hook";
-      deps = [ autoconf automake gettext libtool ];
+      propagatedBuildInputs = [ autoconf automake gettext libtool ];
     } ../build-support/setup-hooks/autoreconf.sh
   ) { };
 
@@ -184,7 +184,7 @@ with pkgs;
 
   autoPatchelfHook = makeSetupHook {
     name = "auto-patchelf-hook";
-    deps = [ bintools ];
+    propagatedBuildInputs = [ bintools ];
     substitutions = {
       pythonInterpreter = "${python3.withPackages (ps: [ ps.pyelftools ])}/bin/python";
       autoPatchelfScript = ../build-support/setup-hooks/auto-patchelf.py;
@@ -360,7 +360,7 @@ with pkgs;
 
   gogUnpackHook = makeSetupHook {
     name = "gog-unpack-hook";
-    deps = [ innoextract file-rename ]; }
+    propagatedBuildInputs = [ innoextract file-rename ]; }
     ../build-support/setup-hooks/gog-unpack.sh;
 
   buildEnv = callPackage ../build-support/buildenv { }; # not actually a package
@@ -1022,7 +1022,7 @@ with pkgs;
 
   makeShellWrapper = makeSetupHook {
     name = "make-shell-wrapper-hook";
-    deps = [ dieHook ];
+    propagatedBuildInputs = [ dieHook ];
     substitutions = {
       # targetPackages.runtimeShell only exists when pkgs == targetPackages (when targetPackages is not  __raw)
       shell = if targetPackages ? runtimeShell then targetPackages.runtimeShell else throw "makeWrapper/makeShellWrapper must be in nativeBuildInputs";
@@ -1075,7 +1075,7 @@ with pkgs;
 
   shortenPerlShebang = makeSetupHook {
     name = "shorten-perl-shebang-hook";
-    deps = [ dieHook ];
+    propagatedBuildInputs = [ dieHook ];
   } ../build-support/setup-hooks/shorten-perl-shebang.sh;
 
   singularity-tools = callPackage ../build-support/singularity-tools { };
@@ -1127,7 +1127,7 @@ with pkgs;
 
   desktopToDarwinBundle = makeSetupHook {
     name = "desktop-to-darwin-bundle-hook";
-    deps = [ writeDarwinBundle librsvg imagemagick python3Packages.icnsutil ];
+    propagatedBuildInputs = [ writeDarwinBundle librsvg imagemagick python3Packages.icnsutil ];
   } ../build-support/setup-hooks/desktop-to-darwin-bundle.sh;
 
   keepBuildTree = makeSetupHook {
@@ -1140,7 +1140,7 @@ with pkgs;
 
   makeGCOVReport = makeSetupHook {
     name = "make-gcov-report-hook";
-    deps = [ lcov enableGCOVInstrumentation ];
+    propagatedBuildInputs = [ lcov enableGCOVInstrumentation ];
   } ../build-support/setup-hooks/make-coverage-analysis-report.sh;
 
   makeHardcodeGsettingsPatch = callPackage ../build-support/make-hardcode-gsettings-patch { };
@@ -1175,7 +1175,7 @@ with pkgs;
   iconConvTools = callPackage ../build-support/icon-conv-tools {};
 
   validatePkgConfig = makeSetupHook
-    { name = "validate-pkg-config"; deps = [ findutils pkg-config ]; }
+    { name = "validate-pkg-config"; propagatedBuildInputs = [ findutils pkg-config ]; }
     ../build-support/setup-hooks/validate-pkg-config.sh;
 
   patchPpdFilesHook = callPackage ../build-support/setup-hooks/patch-ppd-files {};
@@ -2953,7 +2953,9 @@ with pkgs;
 
   bcachefs-tools = callPackage ../tools/filesystems/bcachefs-tools { };
 
-  bisq-desktop = callPackage ../applications/blockchains/bisq-desktop { };
+  bisq-desktop = callPackage ../applications/blockchains/bisq-desktop {
+    openjdk11 = openjdk11.override { enableJavaFX = true; };
+  };
 
   bic = callPackage ../development/interpreters/bic { };
 
@@ -15031,7 +15033,7 @@ with pkgs;
 
   hugs = callPackage ../development/interpreters/hugs { };
 
-  inherit (javaPackages) openjfx11 openjfx15 openjfx17;
+  inherit (javaPackages) openjfx11 openjfx15 openjfx17 openjfx19;
   openjfx = openjfx17;
 
   openjdk8-bootstrap = javaPackages.compiler.openjdk8-bootstrap;
@@ -17862,8 +17864,6 @@ with pkgs;
     openjdk = openjdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
 
-  pmdk = callPackage ../development/libraries/pmdk { };
-
   jdepend = callPackage ../development/tools/analysis/jdepend {
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
   };
@@ -18886,13 +18886,13 @@ with pkgs;
   xcbuild = xcodebuild;
   xcbuildHook = makeSetupHook {
     name = "xcbuild-hook";
-    deps = [ xcbuild ];
+    propagatedBuildInputs = [ xcbuild ];
   } ../development/tools/xcbuild/setup-hook.sh  ;
 
   # xcbuild with llvm 6
   xcbuild6Hook = makeSetupHook {
     name = "xcbuild6-hook";
-    deps = [ xcodebuild6 ];
+    propagatedBuildInputs = [ xcodebuild6 ];
   } ../development/tools/xcbuild/setup-hook.sh  ;
 
   xcpretty = callPackage ../development/tools/xcpretty { };
@@ -20963,7 +20963,7 @@ with pkgs;
 
   libde265 = callPackage ../development/libraries/libde265 {};
 
-  libdeflate = callPackage ../development/libraries/libdeflate { };
+  libdeflate = darwin.apple_sdk_11_0.callPackage ../development/libraries/libdeflate { };
 
   libdeltachat = callPackage ../development/libraries/libdeltachat {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
@@ -22187,7 +22187,7 @@ with pkgs;
   memorymapping = callPackage ../development/libraries/memorymapping { };
   memorymappingHook = makeSetupHook {
     name = "memorymapping-hook";
-    deps = [ memorymapping ];
+    propagatedBuildInputs = [ memorymapping ];
   } ../development/libraries/memorymapping/setup-hook.sh;
 
   memray = callPackage ../development/tools/memray { };
@@ -22195,7 +22195,7 @@ with pkgs;
   memstream = callPackage ../development/libraries/memstream { };
   memstreamHook = makeSetupHook {
     name = "memstream-hook";
-    deps = [ memstream ];
+    propagatedBuildInputs = [ memstream ];
   } ../development/libraries/memstream/setup-hook.sh;
 
   menu-cache = callPackage ../development/libraries/menu-cache { };
@@ -25541,8 +25541,7 @@ with pkgs;
       inherit (buildPackages.darwin) bootstrap_cmds;
       udev = if stdenv.isLinux then udev else null;
       libdrm = if stdenv.isLinux then libdrm else null;
-      abiCompat = config.xorg.abiCompat # `config` because we have no `xorg.override`
-        or (if stdenv.isDarwin then "1.18" else null); # 1.19 needs fixing on Darwin
+      abiCompat = config.xorg.abiCompat or null; # `config` because we have no `xorg.override`
     };
 
     generatedPackages = lib.callPackageWith __splicedPackages ../servers/x11/xorg/default.nix {};
@@ -31927,7 +31926,9 @@ with pkgs;
 
   pdfdiff = callPackage ../applications/misc/pdfdiff { };
 
-  pdfsam-basic = callPackage ../applications/misc/pdfsam-basic { };
+  pdfsam-basic = callPackage ../applications/misc/pdfsam-basic {
+    jdk19 = openjdk19.override { enableJavaFX = true; };
+  };
 
   mupdf = callPackage ../applications/misc/mupdf { };
   mupdf_1_17 = callPackage ../applications/misc/mupdf/1.17.nix { };
diff --git a/pkgs/top-level/cuda-packages.nix b/pkgs/top-level/cuda-packages.nix
index c57e486406e1f..2044d74cab79d 100644
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -50,7 +50,7 @@ let
     autoAddOpenGLRunpathHook = final.callPackage ( { makeSetupHook, addOpenGLRunpath }:
       makeSetupHook {
         name = "auto-add-opengl-runpath-hook";
-        deps = [
+        propagatedBuildInputs = [
           addOpenGLRunpath
         ];
       } ../development/compilers/cudatoolkit/auto-add-opengl-runpath-hook.sh
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index cf9bb6e593456..68b50fa9ab08f 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -121,7 +121,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   checkReexportsHook = pkgs.makeSetupHook {
     name = "darwin-check-reexports-hook";
-    deps = [ pkgs.darwin.print-reexports ];
+    propagatedBuildInputs = [ pkgs.darwin.print-reexports ];
   } ../os-specific/darwin/print-reexports/setup-hook.sh;
 
   sigtool = callPackage ../os-specific/darwin/sigtool { };
@@ -142,7 +142,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   autoSignDarwinBinariesHook = pkgs.makeSetupHook {
     name = "auto-sign-darwin-binaries-hook";
-    deps = [ self.signingUtils ];
+    propagatedBuildInputs = [ self.signingUtils ];
   } ../os-specific/darwin/signing-utils/auto-sign-hook.sh;
 
   maloader = callPackage ../os-specific/darwin/maloader {